medium · FRM Part 2 Operational Risk

Which diagnosis best reflects an expert's understanding of why predictive KRI models systematically miss the tail for cyber operational risk?

1. The model is overfit to common-cause incidents; because tail cyber losses are driven by novel, adversarial, low-frequency mechanisms absent from the historical KRI–loss mapping, the conditional relationship is non-stationary and the trained associations do not extend to the events that matter for capital.
2. The logistic link function is fundamentally misspecified here; replacing it with a probit link would supposedly better capture the two extreme observations, since probit is commonly (though incorrectly) believed to have heavier response tails fitting rare events more accurately than logit.
3. The failure is purely a matter of class imbalance in the training sample; oversampling the two large realized losses until positive and negative classes are numerically balanced would supposedly make the model correctly predict future tail breach events once it is retrained on the rebalanced dataset.
4. The KRIs used here are inherently lagging rather than leading indicators of breach risk, so simply reordering them as time-series leads with an artificial one-quarter forward shift would supposedly mechanically restore the model's lost predictive power for genuinely rare tail-level breach events going forward.

Sign up free to see the explanation and track your rank →