Summing independent risks
is wrong when risks share causes.

Why Aggregation Fails

Standard risk aggregation treats the portfolio as a collection of independent risks and sums their expected losses. This produces an accurate expected loss under normal conditions — when individual risks are small and the correlations between them are low. It catastrophically underestimates tail risk when risks share common causes.

The supply chain case illustrates this precisely: three suppliers in three jurisdictions, scored as independent. The register’s aggregated exposure treated the three risks as additive. The causal model found that all three resolved to a single fabricator under a forced-disruption query — the three independent risks were actually one concentrated risk with three labels. The aggregate exposure figure was $23M. The correct figure was $23M.

The Causal Structure

Risks that share a common cause are confounded. Under normal variation, the common cause produces moderate, partly correlated losses — which look like independent risks with mild correlation. Under tail conditions — when the common cause takes an extreme value — the correlation jumps toward 1. Precisely when diversification is most needed, it disappears.

This is not a statistical artifact. It is a structural consequence of the causal graph. Risks that have a common parent node will always exhibit tail dependence — their joint distribution is not well-characterized by their marginal distributions and a linear correlation coefficient. The only correct way to compute the joint tail distribution is to propagate through the causal structure.

Computing Correctly

A causal model computes joint risk distributions by propagating the common cause through all its downstream effects simultaneously. The tail exposure is read directly from the joint posterior over all consequence nodes given the common cause taking an adverse value. This is structurally different from summing marginal risks — it accounts for the correlation structure that emerges from the shared causal ancestry.

The practical implication: every risk aggregation exercise should begin by asking which risks share causes. The answer is the dependency structure. The dependency structure determines whether aggregated exposure is accurate or dangerously understated.