The FAIR model
How CRQ Pro structures risk with the Open FAIR taxonomy, and the distributions you can use at each leaf.
CRQ Pro quantifies risk with the Open FAIR approach:
Risk = Loss Event Frequency (LEF) x Loss Magnitude (LM)
Every scenario has these two factors. Each factor can be estimated directly as a distribution, or decomposed into its FAIR sub-factors when you have better data one level down. You choose the depth per factor, per scenario.
The taxonomy
Loss Event Frequency (LEF)
Threat Event Frequency x Vulnerability
Threat Event Frequency (TEF)
Contact Frequency x Probability of Action
Vulnerability
Derived from Threat Capability vs Resistance Strength
Loss Magnitude (LM)
Primary Loss + Secondary Risk
Secondary Risk
Secondary Loss Event Frequency x Secondary Loss Magnitude
LEF: how many times per year the loss event occurs.
TEF: how many times per year a threat agent acts against the asset. Multiplied by Vulnerability (the probability a threat event becomes a loss event) to get LEF.
Vulnerability: set it as a probability directly, or derive it from Threat Capability vs Resistance Strength, both on the FAIR 0-100 scale. Vulnerability is then the probability that the threat's capability exceeds your resistance.
Loss Magnitude: the cost of one loss event. Primary Loss is the direct cost; Secondary Risk covers follow-on losses (for example regulatory action or customer churn) that only happen some of the time.
Forms of loss: any loss amount can be split across the six FAIR forms: productivity, response, replacement, fines, competitive advantage, and reputation. The simulation sums them per event.
Distributions
Every leaf estimate is a distribution, not a point value (though a Point option exists when you truly have a fixed number). Available distributions depend on what you are estimating:
PERT
You can give min, most likely, and max. The default choice for expert estimates.
Poisson
You know the average annual rate.
Gamma
You want a skewed rate with a long right tail.
PERT
Min, most likely, max cost per event.
Lognormal (p10/p90)
You can bound the cost: "90% chance it is between X and Y." A natural fit for loss data.
Triangle
Like PERT but with more weight on the extremes.
Modified PERT
PERT with a confidence parameter (gamma) to sharpen or flatten the peak.
Uniform
Any value in the range is equally likely.
Point
A fixed cost.
Generalized Pareto (GPD)
Heavy-tailed losses where extreme outcomes matter.
PERT
Min, most likely, max probability.
Point
A fixed probability.
Beta
You want to express uncertainty from observed successes and failures.
PERT
Min, most likely, max on the 0-100 scale.
Triangle
Same inputs, heavier extremes.
Uniform
Any value in the range is equally likely.
How deep should you decompose? Only as deep as your data supports. A well-reasoned direct LEF estimate beats a four-level decomposition built on guesses. Decompose when the sub-factors are genuinely easier to estimate, for example when you have log data for contact frequency or control assessments for resistance strength.
How the simulation uses your model
For each simulated year, CRQ Pro samples an annual event rate from your LEF model, draws the number of loss events from a Poisson distribution with that rate, samples a Loss Magnitude for each event, and sums them into an annual loss. Repeated tens of thousands of times, this produces the full annual loss distribution you see in the Results dock.
Last updated