An insurer runs a scenario workshop for a data breach affecting 20 lakh customer records. Build the 1-in-25-year and 1-in-100-year loss estimates and say what the workshop should challenge.

The 1-in-25-year loss is about Rs 40 crore and the 1-in-100-year loss about Rs 65 crore. Notification and remediation cost Rs 30 crore, compensation to 2 lakh claimants Rs 10 crore, and the severe case adds a Rs 25 crore penalty. Push back on the severe case: it keeps the same records and claim rate, and leaves litigation and lost customers out.

If a friend asks how much a wedding will cost, you do not guess a total. You list the hall, the food per guest, the clothes and the travel, and multiply each by a number you can defend. An operational risk scenario is the same: a costed story in which every block carries one stated assumption that someone in the room can challenge. The two severities, 1 in 25 and 1 in 100 years, are about 4% and 1% chances a year. They are the scenario analysisStructured expert estimates of rare but plausible operational losses, used where the firm has too little loss history of its own. inputs that sit beside the firm's own loss data.

Notification and remediation: 20 lakh records times Rs 150 is Rs 30 crore. Compensation: 10% of 20 lakh is 2 lakh claimants, times Rs 500, Rs 10 crore. The 1-in-25-year case is Rs 40 crore; the 1-in-100-year case adds the Rs 25 crore penalty for Rs 65 crore. The penalty is what makes the severe case severe here: it arrives when the regulator finds that controls failed, not merely that a breach happened.

Three things. The severe case changes only one block, and a 1-in-100-year breach is unlikely to be the 1-in-25-year breach plus a fine. In a worse year more records are taken, health data raises the claim rate, and a class action or consumer forum claims can follow. Ask the room what the severe case looks like, not what extra line to add. Second, the missing blocks: customers who lapse their policies, higher reinsurance or cyber cover premiums, and the cost of rebuilding the vendor access controls.

Third, the evidence. Each assumption needs a source the committee can check: the Rs 150 per record from vendor quotes or industry studies, the 10% claim rate from past incidents, the penalty from legal's reading of the current rules. Close with the control view: the scenario starts with a compromised vendor account, so the actions that shrink it are vendor access reviews and data minimisation, and the workshop's output should name those owners.