Impact and Likelihood: Sizing Consequence, Estimating Chance

Impact is the size of the consequence if the event happens, and it means nothing until the unit of measurement is stated: money, service to a customer, a statutory obligation, or standing. Likelihood is the chance of it happening inside a stated period. A certainty that costs nothing and a catastrophe that never arrives both need the pair. Neither number works alone.

Impact and likelihood are the two axes of every rating scale in use, and almost nobody stops to ask what is actually being measured along either one. The same thirteen events can be ranked into two completely different orders, both correct, purely by a choice made before any judgement was applied.

Every worked figure below comes from Vindhya Commercial Bank Limited, an invented mid-sized Indian commercial bank. Its thirteen recorded incidents of the year, numbered I1 to I13, its ten grade internal rating scale, the chances attached to each grade and the loss assumption it applies are all the bank's own estimates from its own history. None of them is a market figure, an agency scale or a requirement, and a different bank could hold entirely different numbers and be equally sound.

Credit, market, liquidity and operational risk are each a full subject taught later and at length. The incidents and the grades matter now only as things that have a size and a chance. The language is built before any specific exposure is named.

What is impact, and what exactly is being sized?

ImpactThe size of the consequence if the event happens, which has no meaning until a unit is stated. is the size of the consequence if the event happens. Size is not a property a consequence has on its own. The definition is therefore complete and almost useless as it stands. Size is a property a consequence has once somebody names a unit of impactThe thing the consequence is measured in, which may be money, service, a statutory obligation or standing. to measure it in. An impact figure with no unit attached is not a small statement, it is not a statement at all.

The same question at home answers itself three ways. A washing machine floods the kitchen. How big was that? The answer can be given in money, meaning what the repair and the ruined floor cost. A second answer is time, meaning the four days without a machine and the two evenings spent on the phone. A third answer is obligation, meaning the leak reached the flat below and the neighbour now has a claim. Three honest answers, three different sizes, one event. Nobody at home finds that confusing. Institutions find it confusing constantly. A form takes one of the three, and the other two go nowhere.

So start with the purpose of the sizing. An institution sizes a consequence so that it can compare one exposure against another and decide where its attention goes. The comparison only works if everything on the list is measured the same way. The moment the list carries a mixture, the ranking is arithmetic performed on things that are not the same kind of thing, and it will look perfectly convincing.

Vindhya Commercial Bank Limited recorded thirteen incidents in its year and numbered them I1 to I13. Sized in money after recoveries, they run from Rs 0.6 crore to Rs 15.4 crore and sum to Rs 43.8 crore for the year. The shape of a set of consequences matters at least as much as its total. Look at how those thirteen sit.

Look at what that picture does to the ordinary summary sentence. The average net loss for the year was Rs 3.37 crore. The average is a true figure and it describes not one of the thirteen events. Take I13 out of the set and the remaining twelve average Rs 2.37 crore, almost exactly the median of the whole set. One event is doing nearly all the work in that average, and the summary sentence hides it perfectly. I13 alone is Rs 15.4 crore of the year's Rs 43.8 crore, which is 35.2 per cent of the value from 1 event of 13, being 7.7 per cent by count.

Two numbers there deserve a warning before they appear again elsewhere in this bank's records. Rs 15.4 crore is the net loss of incident I13 and nothing else. The bank also carries a market risk measure of Rs 15.6 crore, a different object entirely and one that belongs to a later subject. Either figure, written down, needs what it is a measure of beside it rather than the bare number.

Impact on what: money, service, obligation or standing?

There are four units a consequence is commonly measured in, and an institution that records only the first has not made an error in the first. The institution has quietly decided that the other three are worth nothing.

Money adds up and the other three do not. Money is therefore the unit everybody reaches for. Adding up is the entire attraction, and it is a real one. Rupees total across thirteen unrelated events, the total runs against a cap, and one figure goes in front of a board. Four hours of unavailable service will not total with 1,840 customers who did not get a disclosure. So money wins by default, not by argument.

Service is the second unit: who could not be served, for how long, and how many of them. When the bank's core system was unavailable for 4 hours and 20 minutes on a working day, incident I3, the rupee figure was Rs 3.2 crore. The service figure was every customer who walked into a branch that afternoon. When the payment gateway failed for 9 hours, incident I9, 48,000 transactions failed. Neither of those two counts appears in a rupee column anywhere.

Obligation is the third: what a rule, a procedure or a contract required, and did not get. Incident I4 reached 1,840 customers who were sold a product without the disclosure the bank's own procedure required. The money was refunded and the money is recorded. The fact that a required step did not happen 1,840 times is a different size of thing, and it is not in the rupee column either.

Standing is the fourth and the hardest to size honestly. Institutions usually skip it for exactly that reason. Incident I13 was discovered when a beneficiary bank claimed against letters of credit issued on forged shipping documents. The cost in the willingness of other institutions to take this bank's paper is real, is slow, and has no cell in any system.

Why does the same event have two different impacts depending on how it is measured?

Because an event has two honest costs, separated by one word: recoveries. Gross lossWhat the event cost before anything was recovered from anybody. is what the event cost before anybody got anything back. Net lossWhat the event cost after recoveries, which is what the year actually paid. is what it cost after. A recoveryMoney returned by an insurer, a vendor, a counterparty or a reversal, which changes the net figure and not the gross one. can come from an insurer, a vendor, a counterparty, or simply from a payment being reversed before it was gone for good.

The year at Vindhya Commercial Bank Limited was Rs 97.7 crore gross, Rs 53.9 crore recovered and Rs 43.8 crore net. Recoveries were 55.2 per cent of gross across the whole year. Two lists built either side of that figure are going to look very different. Ranked on gross the year begins with I2 at Rs 42.0 crore, and ranked on net the same event is joint twelfth of thirteen at Rs 0.6 crore, tied with I8.

Why did that happen? A settlement instruction was sent twice, and Rs 42 crore left the bank twice. Rs 41.4 crore of it was recovered, a recovery rate of 98.6 per cent. So the failure was enormous and the cost was small, and both of those sentences are true at once. Notice that the recovery says nothing at all about whether the failure was likely to be caught. The duplicate was caught this time. A second duplicate instruction in the same month, for Rs 68 crore, was stopped before release by the four eyes check, and that Rs 68 crore is in no loss total anywhere because it never left.

One more thing in that picture recurs later and is worth naming now. Incident I3 is joint fourth by net loss, tied with I9, and seventh by gross. Nothing dramatic happened to incident I3. The events around it moved, and its rank moved with them. A rank is a statement about a list, not about the thing being ranked, and it changes when the basis changes even if the item itself does not. The basis belongs beside every position quoted.

A complete impact statement has three parts, and a rupee figure on its own is only the middle one. The unit it is measured in. The size in that unit. And the basis, meaning whether it is before or after anything anybody recovered. Without the third part, the number moves eleven places depending on a fact that was never stated.

Does the year rank the same way by count as it does by value?

The year does not, and the same lesson arrives from a third direction. The bank files each incident into one of seven published event categories. The seven categories are the Basel Committee's, published at bis.org, and how an operational loss is categorised belongs to a later subject entirely. The thirteen incidents fall into seven groups, and each group can be sized in two ways: how many times it happened, and what it cost.

The total row does something most tables quietly refuse to do. Read it carefully. The rupee column ties exactly to Rs 43.8 crore, and the seven printed shares add to 99.9 rather than 100.0. The exact shares do sum to 100.0. The gap is a one decimal rounding residual of a tenth of a point. Seven figures were each rounded to one place and the roundings did not cancel. The residual is not an error and nothing has been lost. Nudging one share up by a tenth would make the column look tidy, and the printed figure would then no longer be the share it claims to be. The residual is stated and the numbers are left alone.

The figure Rs 4.4 crore in that table wears two hats in this bank's records, and they sit close together. Rs 4.4 crore is the entire net loss of category 7 for the year, across three incidents, and it is also the gross loss of the single incident I9. Two different objects that happen to carry the same number, and each use of the figure needs to say which one is meant.

How is something sized that has never happened?

The question stops people, and the honest answer is that the number is built rather than remembered. There is no history to look up, so anything that looks like a recalled figure is fiction. The number can be constructed from things that are known, with every step written down so that somebody else can argue with each of them separately.

Three moves cover most of the ground. Count the population exposed, size what is at stake for one member of it, and find the nearest thing the institution has actually lived through as a check on the answer. Suppose this bank wanted to size an event that had never occurred: a disclosure failure across a much larger product run. The bank knows what 1,840 customers cost in incident I4, at Rs 5.2 crore, or roughly Rs 28,261 for each customer reached. Rs 28,261 multiplied by a bigger population gives a number with a stated basis. The answer is still uncertain. The difference is that every part of it is visible and can be challenged.

Frank Knight drew that boundary in Risk, Uncertainty and Profit, 1921, between a risk that can be measured and an uncertainty that cannot. The useful part of his separation for a working assessment is not the philosophy but the discipline of saying which of the two applies. With a base of events, the work is measurement. With none, it is construction, and a constructed number that shows its construction is worth far more than a confident one that does not.

Something at home works exactly the same way. A household that has never had a fire still knows what the flat contains, roughly what replacing it would cost, and what the neighbour paid after the leak two years ago. The household has a sized consequence built from three known things, and that is why insurance can be discussed at all. Nobody at the kitchen table has the data. Everybody at it can build the number.

What is likelihood, and what is being estimated?

LikelihoodThe chance of the event happening in a stated period, where the period is half the statement. is the chance of the event happening in a stated period. Read that sentence twice. Almost everybody drops the last four words. A probability with no period attached is not an estimate, it is a decoration. Two per cent in a month and two per cent in a decade are completely different claims about the world, and the figure 2 per cent alone cannot say which of the two has been handed over.

Outside work this is already done correctly. When a mechanic says there is a good chance the clutch will go, the very next question is when, and the estimate is not accepted until that answer comes. Nobody hears a chance without hearing a window. Only when the chance gets written into a form with a box marked likelihood does the window quietly disappear.

Vindhya Commercial Bank Limited states the period every time. The bank grades its borrowers from 1 to 10 and attaches its own one year chance of default to each grade, estimated from its own default history: 0.03 per cent at grade 1, then 0.08, 0.20, 0.45, 0.90, 1.80, 3.60, 7.20 and 15.00 per cent at grade 9. Grade 10 is default itself, so it carries no probability at all. Every one of those figures belongs to this bank. None of them is an agency scale, a market estimate or a requirement.

How is a chance stated without inventing precision?

By using an ordered scale with a stated basis rather than a decimal produced from nowhere. An ordered scale with a stated basis is the whole trick, and this bank's ten grades are a working example of it. The grades are ordered, each carries a figure, and the figure came from the bank's own default history over its own period. Nobody is pretending to know that a particular borrower will default 3.60 per cent of the time. The claim is narrower and much more defensible: borrowers the bank puts in grade 7 have historically defaulted at about that rate over a year.

Printing ten grades in a neat column hides the shape of the scale completely. Now look at the shape. From grade 1 at 0.03 per cent to grade 9 at 15.00 per cent is a span of 500 times across eight steps, and grades 4 to 8 double exactly, four consecutive exact doublings. The step multiples run 2.667, 2.500, 2.250, 2.000, 2.000, 2.000, 2.000 and 2.083. The scale is a ladder of multiples wearing the costume of a ladder of steps.

Two consequences follow, and both matter for how any scale like this is read. First, two decimal places at the two ends of the scale mean utterly different amounts of money. The 0.05 percentage point gap between grade 1 and grade 2, applied to grade 1's Rs 2,940 crore of advances at the bank's assumed loss rate, is Rs 0.588 crore. The gap between grade 8 and grade 9 is 7.80 percentage points, 156 times as wide in probability. Same number of decimals, nothing like the same precision.

Second, an ordinal axisAn axis whose points are ordered but not evenly spaced, so arithmetic on them is not what it looks like. is exactly what most likelihood scales are. Grade 8 is not twice grade 4 in any defensible sense, even though the labels are 4 apart and the chances happen to be 16 times apart. How a chance is actually estimated, from what evidence, over what window, and what happens to an estimate built on a handful of events, is covered separately, and it is a bigger subject than it looks.

Why are impact and likelihood always assessed as a pair?

Because each one alone produces a list that looks entirely sensible and is wrong in a predictable direction, and the direction can be named in advance.

Rank by size alone and an institution sorts its problems by how frightening they sound. The catastrophes go to the top, including the ones that have never happened anywhere and probably will not. Attention flows to the dramatic. The failures that actually occur, month after month, sit below the fold because individually they are modest, and nobody looks at the bottom of a list.

Ranking by chance alone gives the mirror image. The frequent nuisances happen constantly and go to the top. The rare large failure happens rarely and sits at the bottom. A chance ranking is exactly the list that puts a category with three small incidents above a category with two very expensive ones. On this bank's year, category 7 leads on count with three incidents and holds 10.0 per cent of the value. Category 1 has two incidents and holds 41.3 per cent of the value.

Each list is defensible on its own terms. Each becomes obviously incomplete the moment the other is laid beside it. The pair is the unit, and not because two numbers are nicer than one. Either number alone will silently reorder the institution's attention.

The same thing shows at household scale. Ranked by size, the top of the list is a serious illness, about which little can be done beyond cover. Ranked by chance, the top is the phone screen, and a screen goes twice a year and costs almost nothing. Neither list is how a household actually runs its money. The household holds both numbers at once, without writing anything down.

What happens when impact is multiplied by likelihood?

One number comes out, and with it goes the only information that would have shown what the position actually is. The product is everywhere, and the loss of information inside it is almost never mentioned.

The bank computes an expected lossSize multiplied by chance, which is a useful average and a poor description of any single case. for each grade: the exposure at that grade, multiplied by the one year chance of default, multiplied by the share it assumes it would not get back. The share it would not get back is the loss given default, or LGD, and this bank puts it at 40.0 per cent for every non-defaulted grade.

Now run it on two grades of this bank. Grade 7 holds Rs 4,704 crore at 3.60 per cent and produces Rs 67.74 crore. Grade 8 holds Rs 2,352 crore at 7.20 per cent and produces Rs 67.74 crore. The exposure halved, the chance doubled, and the product is identical to the paisa. Both come to Rs 67,73,76,000 exactly.

So what did the multiplication throw away? The shape. One of those two positions is twice as much money at half the chance. The other is half as much money at twice the chance. A single product cannot distinguish them, and the responses to them are not the same: one is a concentration that might be reduced, the other is a quality of borrower that might be repriced. The product is a useful summary and a terrible description. The rating grid carries the same lesson in coloured cells with no rupees. The two grades carry it with rupees behind it.

One more thing the multiplication hides, and it is a good one. The largest book does not produce the largest expected loss. Grade 5 holds Rs 14,112 crore, far the biggest of the nine, and produces Rs 50.80 crore. Grade 9 holds Rs 1,176 crore, the smallest, and produces Rs 70.56 crore. Across all nine grades the model asks for Rs 343.6 crore.

Commit to an answer before touching the control below. Being wrong first makes the right answer stick.

What does a rating on either axis leave out?

Quite a lot, and the omissions are worth listing because each of them gets read into a rating by somebody every week.

Neither axis carries timing. This is the big one. A one in five chance inside a year says nothing whatever about where in that year the event falls. The event does not become more likely in December because it has not happened yet, and a rating is not a schedule. Reading a likelihood as a due date is probably the most common misreading of a risk rating there is.

Neither axis shows whether the number moved because the world changed or because the method did. If a rating goes from moderate to high, that could be a genuine deterioration, or a new assessor, a revised definition, or a corrected error in last year's figure. The rating does not carry its own history and somebody has to go and look.

An impact rating does not say who bears the consequence. Rs 5.2 crore refunded to 1,840 customers and Rs 5.2 crore paid to a vendor are the same size and are not the same event, and only one of them has a person on the other end of it.

And a rating says nothing about what would stop the event. Stopping the event is the whole of the next stage of the work, and it sits on neither axis. Sizing and rating come first; deciding what to do about the position is a separate act with a separate record.

Who actually uses these two numbers, and what do they do with them?

Four readers, and each of them does something different with the pair.

A lender uses the pair to price, not to decide. Faced with two positions carrying the same expected loss, the credit officer does not shrug and treat them alike. Twice the money at half the chance is a concentration question: what happens if that one large name goes. Half the money at twice the chance is a quality question: whether the margin covers the frequency. The identical Rs 67.74 crore is the starting point of that conversation and never the end of it.

An analyst reading a published loss disclosure asks two questions before reading a single figure. Gross or net, and over what period. Without those, a total is uncomparable against last year's total and against anybody else's. A loss figure that fell by half might be a better year or a bigger recovery, and the two mean opposite things about how the place is run.

Somebody examining an institution from outside looks for the unit that is missing. If every impact in the record is a rupee figure, then service, obligation and standing were assessed at nothing, and the examiner will go looking for the event where that mattered. In this bank they would find I10 immediately: twelfth of thirteen on money and the single material weakness of the year.

And a household does exactly the same arithmetic with no forms at all. A boiler serves as the example. The consequence sized in money is the replacement. Sized in service, it is the days without hot water. Sized in obligation, it is the tenancy agreement if the place is let out. Then a chance goes beside it: not a feeling, but a window, as in the chance of it going in the next two years given it is nine years old. Two numbers and one window settle whether to set money aside or to replace it early. The household version is the whole method, and the bank version differs from it only in the size of the figures.

Where do the rules behind any of this actually come from?

The mechanism set out here is jurisdiction free. A consequence, a unit, a chance and a period would work the same way in any country and in an institution that is not a bank at all. What an institution must actually measure, provide against and report is not jurisdiction free, and the answer sits with the source rather than in any general treatment.