A major bank's stress testing lead outlines a bold new vision for quantifying non-financial risk using AI, data unification, and structured scenarios.
display-middle-ads-here
At this year’s CeFPro-hosted Risk Americas conference event,
a quietly seismic session rewrote the playbook on how financial institutions
must tackle non-financial threats.
No hype, no theatrics – just a clear-eyed blueprint for
ditching outdated, qualitative risk frameworks in favour of dynamic,
data-driven intelligence.
The message was simple but urgent: if you're not building
systems that think ahead, you're already behind the curve.
Yasin Benzawi, Global Head of Scenario Analysis & and US Head
of Stress Testing, and Capital, Framework in the Operational Risk division at a
major UK-based bank, and his US-based deputy, Anthony Muhammad, began by noting
that non-financial risks like cyberattacks and tech failures are no longer rare
disruptions, but instead mainstream threats.
Referencing ORX data and real-world events, his presentation
pointed to a rising frequency and severity of events previously considered tail
risks.
The implication was clear: frameworks that are still
dominated by qualitative inputs and backward-looking reviews are no longer fit
for purpose.
According to Benzawi, while traditional tools like RCSAs and
KRIs serve their function, they live in a different universe from the
quantitative stress testing frameworks driven by regulators.
This division, the pair argued, weakens our ability to see
around corners. Rather than scrap the old tools, the challenge is to evolve
them – to blend qualitative nuance with structured, testable data.
Central to this vision is the unification of day-to-day risk
operations and stress testing infrastructure.
And Benzawi and Muhammad don’t just mean integration – they
mean building a single data ecosystem that supports everything from live
dashboards to AI augmentation.
The session showcased a Monte Carlo–based Bayesian model
known internally as the XOI approach, which simulates exposure, occurrence, and
impact. What used to be a subjective scenario is now a probabilistic
distribution.
When tested against events like DDoS attacks or trading
errors, it proved that non-financial risk can be quantified – and even
predicted – with useful granularity.
The session also touched on the challenges in horizon-scanning.
Structured scenarios may be the foundation, but AI is what could redefine the
next phase of risk management.
