A Step towards “Oprisk Metrics”

An eXposure, Occurrence, Impact (XOI) scenario is defined as a range of possible adverse events. As such, it differs from a usual scenario, as it is not viewed as a particular storyline. This chapter deals with the example of the cyber attack scenario. One can qualify the main source of the data to be assessed using some simple criteria: external, expert‐based, business data, and loss data. However, loss events are used in the early stages of the definition of the scenario to assess the loss generation mechanism. They are also used to help assessing the probability of a scenario. The use of Exposure Units Tables is possible for all scenarios, provided one distinguishes the scenarios for which the exposure units are individually named, from those for which only clusters of exposure units can be defined, as they are too many to be listed individually, or transient and cannot be used from one year to another.