What is Monte Carlo risk analysis?
Monte Carlo risk analysis is a quantitative method that runs thousands of simulated scenarios to estimate the range of financial loss a risk could cause in a given period. Instead of rating a risk as amber on a heat map, it tells you, for example, how likely a loss above a set amount is over the next year.
How it works
You describe each risk with two estimates: how often the loss event is likely to happen in a year, and how much it would cost when it does. Each estimate is a range rather than a single figure, such as a minimum, a most likely value and a maximum.
The model then draws a random value from each range and calculates the loss for that simulated year. It repeats this thousands of times. The results form a distribution, which is usually shown as a loss exceedance curve: the chance that annual losses exceed each amount.
- Frequency. How many times a year the event is expected, as a range.
- Magnitude. The cost of one event, including response, downtime, fines and lost business, as a range.
- Simulation. Thousands of random draws combining the two.
- Result. Percentiles and an exceedance curve that can be compared with risk appetite.
Why teams use it
Heat maps are quick but hard to compare. Two risks in the same red cell can differ in cost by orders of magnitude, and a board cannot weigh a colour against a budget. A loss range in money can be set against the cost of a control, which makes treatment decisions easier to justify.
The most common structured approach in information security is FAIR (Factor Analysis of Information Risk), published as the Open FAIR standard by The Open Group. Monte Carlo simulation is also one of the techniques described in IEC 31010, the guide to risk assessment techniques that supports ISO 31000.
Limits to keep in mind
The ranges you feed in set the quality of the output. Estimates from people who have not been calibrated, or loss figures with no basis in incident data, insurance claims or industry reports, produce precise-looking numbers that mean little. Record where each estimate came from.
ISO 27001 does not require quantitative analysis. It requires a defined, repeatable risk assessment method, and a qualitative method is acceptable. Many organisations keep a qualitative risk register for the full list and run Monte Carlo analysis on the handful of risks where a spending decision depends on the answer.
Questions
Monte Carlo risk analysis, answered
Do auditors require Monte Carlo analysis?
No. ISO 27001 and SOC 2 accept qualitative risk assessment, provided the method is defined and applied consistently. Quantitative analysis is a choice, usually made to support budget and insurance decisions.
How many simulations are enough?
Enough that the results stop changing noticeably when you run the model again. Tools commonly run ten thousand or more iterations, which takes seconds on an ordinary computer.
Can it replace a risk register?
No, it works alongside one. The register is still the list of risks with owners, treatments and review dates. Monte Carlo analysis adds a financial estimate to the risks that need one.
Working through this for an audit?
Talk it through with someone who has run the audit before, or look up another term.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them