# Scenario Based Assessment

> Creating scenarios like "cybersecurity incident" or "economic downturn"—too vague to drive specific responses.

- Skill: `lev-os/scenario-based-assessment` (Agent Skill)
- Install (CLI): `npx skillmds@latest add lev-os/scenario-based-assessment`
- Raw SKILL.md: https://api.skillmd.com/api/skills/lev-os/scenario-based-assessment/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: lev-os (https://skillmd.com/u/lev-os)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/lev-os/scenario-based-assessment

---


# Scenario-Based Assessment

**Canonical Source**: Risk Management / Strategic Planning
**Domain**: Risk Management, Crisis Planning, Strategic Foresight
**Related**: Shell Scenario Planning, ISO 31000 Risk Management

## One-Line Summary

Structured evaluation of how specific, plausible future scenarios (threat events, market conditions, strategic shifts) affect organizational objectives, enabling proactive risk mitigation and contingency planning.

## Core Concept

Scenario-Based Assessment answers: "What if THIS specific thing happens?" It moves beyond generic risk checklists to evaluate tailored threats, opportunities, and disruptions relevant to a specific organization or project.

**The Core Technique**: Define discrete scenarios → assess likelihood and impact for each → prioritize by risk score → develop response strategies for high-priority scenarios.

**The Innovation**: Replaces one-size-fits-all risk templates with context-specific scenario narratives. Instead of "cybersecurity risk" (vague), test "ransomware attack encrypts production database during peak season" (concrete).

## When to Use

**Ideal Scenarios**:
- Disaster recovery and business continuity planning
- Project risk analysis with known threat vectors
- Strategic planning under uncertainty (market disruptions, regulatory changes)
- Crisis management preparation (operational failures, reputational events)
- Security assessments (physical, cyber, supply chain)
- Evaluating resilience of business models to shocks

**Not Suitable For**:
- Routine operational risks with stable probabilities (use checklists instead)
- Exploring distant future possibilities (use Shell-style scenario planning)
- When probability data is robust enough for quantitative models (VaR, Monte Carlo)
- Low-stakes decisions where scenario development overhead isn't justified

## Execution Steps

### 1. Identify Threat/Opportunity Scenarios
- Brainstorm specific events or conditions that could occur
- Draw from: historical incidents, industry trends, expert warnings, weak signals
- Make scenarios CONCRETE: "Hurricane disrupts primary supplier for 3 weeks" not "supply chain risk"
- Aim for 5-15 distinct scenarios (too few = incomplete, too many = paralysis)

*Output*: List of named scenarios with brief descriptions

### 2. Define Scenario Parameters
- For each scenario, specify:
  - **Trigger**: What causes this scenario to unfold?
  - **Scope**: What parts of the organization are affected?
  - **Duration**: How long does the scenario persist?
  - **Cascade effects**: What secondary impacts follow?
- Add narrative detail to make it vivid and testable

*Output*: Scenario profiles (1 paragraph each)

### 3. Assess Likelihood
- Estimate probability: Rare (1-5%), Unlikely (5-25%), Possible (25-50%), Likely (50-75%), Almost Certain (75%+)
- Ground in data where possible (historical frequency, industry benchmarks)
- Use expert judgment for novel scenarios
- Document reasoning and uncertainty

*Output*: Likelihood rating per scenario

### 4. Assess Impact
- Evaluate consequences if scenario occurs:
  - **Financial**: Revenue loss, cost increase, fines, asset damage
  - **Operational**: Downtime, productivity loss, quality degradation
  - **Strategic**: Competitive position, market share, growth trajectory
  - **Reputational**: Brand damage, customer trust, regulatory scrutiny
- Use consistent impact scale: Negligible, Minor, Moderate, Major, Catastrophic

*Output*: Impact rating per scenario

### 5. Calculate Risk Priority
- Combine likelihood × impact to create risk score
- Standard matrix: 5×5 grid (5 levels each for likelihood/impact)
- Prioritize: High-likelihood + High-impact = top priority
- Flag scenarios that are low-likelihood but catastrophic (black swans)

*Output*: Risk matrix with scenarios plotted, priority ranking

### 6. Develop Response Strategies
- For HIGH-PRIORITY scenarios, define:
  - **Prevent**: Actions to reduce likelihood (controls, redundancy)
  - **Mitigate**: Actions to reduce impact if scenario occurs (backup systems, insurance)
  - **Prepare**: Contingency plans and playbooks (what to do when it happens)
  - **Monitor**: Early warning indicators (trigger points for action)
- Assign owners, timelines, and budgets

*Output*: Risk response plan per high-priority scenario

### 7. Test and Refine
- Run tabletop exercises or simulations testing scenario responses
- Identify gaps: "We didn't consider X" or "Our plan assumes Y, which is unrealistic"
- Update scenarios as environment changes (new threats, new controls)
- Review quarterly or after near-misses

*Output*: Validated response plans, updated scenario library

## Common Pitfalls

**"Generic Risk Speak" Syndrome**
Creating scenarios like "cybersecurity incident" or "economic downturn"—too vague to drive specific responses.

**Solution**: Add specificity. "Phishing attack compromises CFO email, attacker redirects $2M wire transfer" is actionable.

**Probability Anchoring**
Dismissing low-probability scenarios ("won't happen to us") even when consequences are catastrophic.

**Solution**: Separate likelihood assessment from response planning. Even 1% risks deserve contingency plans if impact is existential.

**Analysis Without Action**
Building beautiful risk matrices and scenario documents, then filing them away without implementing mitigation.

**Solution**: Tie scenarios to action plans with owners, budgets, and deadlines. No scenario assessment without a "Now what?" section.

**Static Scenarios**
Developing scenarios once and never updating as the world changes (new technologies, new competitors, new regulations).

**Solution**: Treat scenario library as living document. Add/retire scenarios quarterly based on horizon scanning.

## Key Insights

**Scenario ≠ Forecast**: Scenario-based assessment doesn't predict what WILL happen. It prepares for what COULD happen. The goal is readiness, not accuracy.

**The 1% Doctrine**: In high-stakes domains (national security, nuclear safety, pandemic response), even 1% probability scenarios get full response planning if consequences are catastrophic.

**Narrative Beats Numbers**: Humans respond better to stories than statistics. "Tornado destroys warehouse" drives urgency more than "2% annual probability of facility damage."

**Pre-Mortems**: Scenario assessment works well with pre-mortem technique: "Assume this project failed spectacularly. What scenario caused it?" Reverse-engineers risk identification.

## Real-World Application

**Pandemic Response**: Hospital system runs scenario: "ICU capacity exceeded by 200% for 6 weeks due to respiratory virus outbreak." Assessment reveals insufficient ventilators and staff burnout risk. Response: stockpile equipment, cross-train nurses, establish surge protocols. COVID-19 hits—hospitals with scenario prep fared better.

**Cybersecurity**: Fintech company assesses: "Ransomware encrypts customer database, attackers demand $5M Bitcoin ransom within 48 hours." Impact: Catastrophic (regulatory breach, loss of trust). Likelihood: Possible (industry trend). Response: Implement air-gapped backups, incident response retainer with forensics firm, customer communication playbook. Attack occurs 18 months later—company restores from backup, avoids ransom.

**Supply Chain**: Manufacturer assesses: "Primary chip supplier factory fire halts production for 6 months." Impact: Major ($50M revenue loss, customer contracts at risk). Likelihood: Rare (but precedent exists). Response: Qualify secondary supplier, maintain 3-month safety stock of critical chips, negotiate contract force majeure clauses. When fire actually happens (2023 chip shortage), company maintains production while competitors halt.

## Related Frameworks

- **Shell Scenario Planning**: Exploratory future scenarios (decades out) vs. near-term threat scenarios
- **Risk Matrices**: Visual tool for plotting likelihood × impact
- **PESTLE Analysis**: Identifies macro scenarios (Political, Economic, Social, Tech, Legal, Environmental)
- **Pre-Mortem**: Assumes failure occurred, reverse-engineers scenarios that caused it
- **Stress Testing**: Quantitative version (push financial models to extreme scenario parameters)
- **Business Continuity Planning (BCP)**: Operationalizes scenario-based assessment into recovery plans
- **Horizon Scanning**: Systematic monitoring for weak signals of emerging scenarios

## Anti-Patterns

**"Checklist Risk Management"**
Using generic risk templates ("supply chain disruption," "talent shortage") without tailoring to specific organizational context.

**Consensus Dilution**
Watering down scenario severity to avoid uncomfortable conversations. "Let's call it Moderate instead of Catastrophic so leadership doesn't panic."

**Scenario Fatigue**
Assessing 50 scenarios, overwhelming the team and ensuring none get adequate response planning.

**"That Won't Happen Here" Bias**
Dismissing scenarios because they haven't happened historically, ignoring that novel risks (COVID, 9/11, 2008 crisis) by definition have no precedent.

## Score Justification

**Framework Assessment**: 40/50 (Tier 1 - Canonical)

- **Practitioner Weight (8/10)**: Widely used in enterprise risk management, disaster recovery, military planning, and crisis management. Standard practice for ISO 31000 compliance. Deduction: Often performed superficially (box-checking exercise) rather than deeply.
- **Clarity & Executability (8/10)**: Clear process (define scenarios → assess likelihood/impact → plan responses). However, quality depends heavily on scenario specificity and assessor expertise. Vague scenarios produce vague plans.
- **Proven ROI (8/10)**: Organizations with robust scenario-based assessment demonstrably outperform during crises (COVID showed stark differences). However, ROI is hard to quantify (you don't know which disasters you avoided).
- **Novelty (6/10)**: Straightforward application of structured risk thinking. Not mathematically novel. The value is in systematic application and specificity, not conceptual innovation.
- **Cross-Domain Applicability (10/10)**: Universal. Used in finance (stress tests), public health (pandemic planning), IT (disaster recovery), defense (war games), corporate strategy (market disruption), climate adaptation, infrastructure resilience.

**Notable**: Post-9/11, scenario-based assessment became mandatory for critical infrastructure sectors. The 2008 financial crisis led to regulatory stress testing requirements (Dodd-Frank). COVID-19 proved the difference between organizations that had pandemic scenarios pre-planned vs. those scrambling reactively.