An Exploratory Study of Risk Quantification Loss Event Frequency (LEF) Approaches Using the Factor Analysis of Information Risk (FAIR) Model in Non-Financial Risk Areas

Abstract

This study explored the limited use of non-financial banking quantitative risk assessment methodologies. Quantitative assessments have been avoided due to a lack of historical data or the need for complicated, expensive quantitative techniques. The purpose of this exploratory, quantitative, quasi-experimental study aims to develop a practical risk management model framework to help bank practitioners conduct quantitative risk assessments utilizing limited data through a novel Factor Analysis of Information Risk (FAIR) ontology framework. The research questions for the study are: What key factors in banking incidents, if any, influence vulnerability risk assessments derived from historical public incident data? Is there a difference between traditional quantitative assessments using an industry framework and quantitative assessments using an industry framework with a Bayesian approach? The study examined the banking industry's limited public data breach incidents to identify non-financial risk tendencies. The independent variables for this study are (1) the various types of data breach incidents and (2) their effects on the two dependent variables: loss event frequency (LEF) and loss magnitude (LM) risk calculation scores. The study found no association between the top data breach incident types. However, the study found statistically significant differences between the LEF methodologies even when utilizing the same framework. The findings show that various LEF quantitative approaches using the FAIR framework can use limited historical threat data (open source or internal) to analyze non-financial operational risk. The techniques from the study can provide banking risk practitioners with a practical quantitative model to supplement qualitative techniques for enhanced holistic banking risk forecasting.