Monte Carlo simulation takes your low and high estimates for how often a loss happens and how much it costs, picks random values within those ranges many times, and tallies the results. You get a spread of possible annual losses with probabilities, not one number.
Why it is used with FAIR
The FAIR Institute treats Monte Carlo simulation as integral to the final stage of a FAIR analysis. It repeatedly samples the ranges for frequency and magnitude, producing thousands of possible loss outcomes, each with a relative probability. Because the inputs are ranges, the output shows a spread of likely losses rather than a single precise figure.
A tiny example by hand
Suppose a scenario has these estimates:
- Events per year: between 0 and 3.
- Cost per event: between 20 thousand and 300 thousand.
Run one trial: draw a number of events, say 2, then draw a cost for each, say 80 thousand and 150 thousand. The year's loss is 230 thousand. Run another trial: 0 events, loss of zero. Another: 1 event at 40 thousand.
Repeat this ten thousand times on a computer. Sort the results. You can now read statements such as "in half of simulated years the loss is below X" and "in one year out of ten it exceeds Y". Those are better inputs to a budget talk than "medium".
What you need to run one
- A clear scenario with defined start and end.
- A range for each input, written before you look at the output.
- A distribution shape. Many practitioners pick shapes that put more weight near a most likely value, but the choice should be documented.
- A tool: a spreadsheet with random number functions is enough for a first run, and dedicated tools are available.
What it cannot fix
The method does not improve poor inputs. One industry article puts it as output only as good as the data fed in. If every range is a guess, the result is a guess in the shape of a chart. Simulation also assumes you have identified the right scenarios and have treated related events correctly.
NIST SP 800-30 gives a matching caution: the rigor of quantification lessens when subjective determinations are buried inside quantitative assessments or when uncertainty around values is significant.
Good habits
- Record who made each estimate and the evidence.
- Run a sensitivity check: change one input at a time and see which one moves the answer most. That tells you where better data pays off.
- Compare the output with gut feel. A big gap means either a surprise worth studying or an error.
- Re-run when conditions change, and compare to the earlier run.
When it is worth it
Reserve it for decisions where money is large and options differ, such as buying a major control or choosing an insurance limit. For long lists of small risks, a quick qualitative pass is the better use of time.
Quick check
Do I need a statistician?
Not for a basic run. You do need someone comfortable with ranges and with questioning inputs.
Does a simulation predict the future?
No. It shows the consequences of your assumptions. If the assumptions are wrong, the output is too.
Sources
Last reviewed: 19 October 2026.
