--- language: - en license: cc-by-4.0 tags: - ai-governance - risk-management - quantitative-risk - monte-carlo - operational-risk - compound-poisson - lognormal-distribution - value-at-risk - cvar - tail-risk - iso-42001 - nist-ai-rmf - eu-ai-act - grc - financial-risk - risk-quantification - actuarial - loss-distribution - stress-testing - capital-adequacy - probabilistic-modeling - frequency-severity - risk-engine - responsible-ai - compliance - audit - internal-controls - model-risk - cfo-tools - board-risk task_categories: - tabular-regression - tabular-classification - text-classification size_categories: - 100K Compound Poisson–Lognormal Monte Carlo Risk Model: AI and Operational Risk Quantification with ISO 42001 and NIST AI RMF Mapping dataset_info: description: > A fully reproducible compound frequency–severity Monte Carlo simulation engine for quantifying operational and AI risk exposure. The model convolves Poisson-distributed event frequency with lognormal-distributed loss severity across 100,000+ simulations to produce empirical loss distributions, Value at Risk (VaR), Conditional VaR (CVaR), exceedance curves, and capital reserve estimates. Outputs are mapped to ISO/IEC 42001 control themes, NIST AI RMF functions, EU AI Act risk tiers, and Basel III / Solvency II regulatory capital frameworks. Created by Prof. Hernan Huwyler, CIAO MBA CPA, Academic Director at IE Law School Center for Risk and Compliance and Senior Manager at the Capgemini Applied AI Lab. features: - name: simulation_id dtype: int64 - name: frequency_poisson dtype: int64 - name: total_annual_loss dtype: float64 - name: avg_severity_per_event dtype: float64 - name: scenario_label dtype: string - name: exceedance_probability dtype: float64 - name: above_var95 dtype: int8 - name: above_reserve_p75 dtype: int8 - name: lognormal_mu dtype: float64 - name: lognormal_sigma dtype: float64 - name: poisson_lambda dtype: float64 - name: confidence_level dtype: float64 - name: severity_lower_bound dtype: float64 - name: severity_upper_bound dtype: float64 - name: var_95 dtype: float64 - name: cvar_95 dtype: float64 - name: reserve_percentile dtype: float64 - name: loss_at_reserve dtype: float64 - name: random_seed dtype: int64 splits: - name: train num_examples: 100000 - name: test num_examples: 288 citation: > @misc{huwyler2025montecarlo, author = {Huwyler, Hernan}, title = {Compound Poisson–Lognormal Monte Carlo Risk Model: AI and Operational Risk Quantification}, year = {2025}, publisher = {Hugging Face}, url = {https://huggingface.co/datasets/hwyler/compound-poisson-lognormal-risk-model} } configs: - config_name: default data_files: - split: train path: data/train.csv - split: test path: data/test.csv - config_name: percentiles data_files: - split: train path: data/percentile_table.csv --- # Compound Poisson–Lognormal Monte Carlo Risk Model **Author:** Prof. Hernan Huwyler, CIAO MBA CPA **Affiliation:** IE Law School Center for Risk and Compliance | Capgemini Applied AI Lab **License:** CC BY 4.0 **Version:** 1.0.0 **Last Updated:** 2025 --- ## Model Overview This dataset and accompanying Python model implement a **compound frequency–severity Monte Carlo simulation engine** for operational and AI risk quantification. The model answers the core question facing Chief Risk Officers, CFOs, and AI Governance practitioners: > *Given uncertainty in how often loss events occur and how severe each event is, > what is the probability distribution of total annual loss — and what capital reserve > does that distribution require?* ### Mathematical Foundation **Frequency model:** N ~ Poisson(λ) Each simulation period draws the number of loss events from a Poisson distribution with rate parameter λ (expected events per year). The Poisson distribution is the standard actuarial and operational risk choice for independent, random event counts. **Severity model:** Lᵢ ~ Lognormal(μ, σ) Each individual loss is drawn from a lognormal distribution, which is standard for financial loss severity because it enforces non-negativity, captures heavy right tails, and is consistent with regulatory frameworks including Basel III operational risk, Solvency II internal models, and NIST SP 800-30 risk quantification guidance. **Calibration method:** μ and σ are calibrated analytically from business-facing inputs: a confidence interval [lower, upper] that the practitioner believes contains the central mass of individual loss severity at a specified probability level. This eliminates the need to estimate lognormal parameters directly from sparse loss data. **Aggregate loss:** S = Σᵢ₌₁ᴺ Lᵢ The total annual loss is the sum of all individual losses in the period. When N = 0, S = 0. **Simulation:** 100,000 independent trials by default, vectorized using NumPy for performance. The law of large numbers ensures stable tail estimates at this sample size. --- ## Risk Metrics Produced | Metric | Formula | Regulatory Reference | |---|---|---| | Mean Loss | E[S] | Baseline planning | | Median Loss | P50(S) | Central tendency | | Standard Deviation | Std(S) | Volatility measure | | Value at Risk 95% | P95(S) | Basel III, Solvency II | | Conditional VaR 95% | E[S \| S > VaR95] | Expected Shortfall | | Reserve Percentile | Pₖ(S) user-defined | ICAAP capital buffer | | Exceedance Curve | P(S ≥ x) | Catastrophe modeling | | Return Period | 1 / P(S ≥ x) | Infrastructure risk | --- ## Regulatory and Framework Mapping ### ISO/IEC 42001 — AI Management System | Percentile Range | ISO 42001 Control Theme | |---|---| | ≥ 95th | OC-8: Incident Response and Recovery | | 75th–94th | OC-4: Risk Treatment and Controls | | < 75th | OC-2: Risk Assessment and Identification | ### NIST AI Risk Management Framework (AI RMF) | Loss Range | NIST AI RMF Function | |---|---| | Extreme tail (≥ 99th) | RESPOND + RECOVER | | High risk (75th–98th) | DETECT + RESPOND | | Baseline (< 75th) | GOVERN + MAP | ### EU AI Act Risk Tiers - **Unacceptable risk:** Scenarios with CVaR exceeding regulatory capital thresholds - **High risk:** Loss scenarios at or above VaR(95%) with systemic or rights-impacting AI - **Limited risk:** Base-case scenarios with adequate reserve coverage - **Minimal risk:** Best-case scenarios below reserve threshold ### Basel III and Solvency II - **P99:** Standard for Basel III Advanced Measurement Approach operational risk capital - **P99.5:** Solvency II Solvency Capital Requirement standard - **P99.9:** ICAAP extreme stress scenario buffer --- ## Dataset Contents ### `data/train.csv` — 100,000 simulation trials Primary dataset. One row per Monte Carlo trial. Contains aggregate loss outcome, event frequency, average severity, scenario classification, exceedance probability, VaR and CVaR flags, and all calibration parameters for full reproducibility. ### `data/test.csv` — 288 stress scenarios Validation dataset. One row per stress scenario combining six lambda values, four severity ranges, four confidence levels, and three random seeds. Contains full percentile distribution per scenario for sensitivity analysis. ### `data/percentile_table.csv` — Percentile distribution table Structured percentile summary with regulatory mapping. One row per percentile point from P1 to P99.9. Directly usable in risk reports, board presentations, and regulatory submissions. --- ## Python Model — Key Features ```python from compound_risk_model import RiskModel, RiskModelConfig cfg = RiskModelConfig( simulations = 100_000, lower = 1_000.0, # Lower severity bound (monetary units) upper = 2_000.0, # Upper severity bound (monetary units) confidence_level = 0.80, # Probability mass in [lower, upper] events = 4.0, # Expected loss events per year (Poisson λ) reserve = 0.75, # Reserve percentile for capital planning seed = 123 # Reproducibility seed ) model = RiskModel.from_interval(cfg) model.summary() model.plot_loss_exceedance_curve() model.plot_loss_distribution() model.plot_scatter() model.plot_heatmap()