Skip to main content
Policy Authority
Category: Risk Analysis and Quantification

Risk Correlation

Also known as: Correlation Risk, Risk Correlation Network
Simply put

Risk correlation refers to the statistical relationship between two or more risks that causes them to move together, so that when one risk increases others tend to increase as well. Because correlated risks do not behave independently, they can combine or spread in ways that make an organization's overall exposure larger than it would appear if each risk were considered on its own. In some settings the term is also used to describe the risk of loss arising specifically from adverse changes in the correlation between variables.

Formal definition

Risk correlation is the statistical dependence among risk variables such that their movements are related rather than independent, meaning an increase in one variable is commonly associated with movements in correlated variables. In risk modeling, ignoring correlation may understate aggregate risk, since positively correlated exposures can move adversely together; correlation is therefore commonly represented explicitly in analytical or simulation-based models (for example, Monte Carlo approaches) and in project or portfolio models. A distinct but related sense, sometimes termed 'correlation risk,' is the risk of financial loss due to adverse movements in the correlation between two or more variables, and it may also relate to concentration effects within a portfolio. In network-based analyses, risk correlations can be mapped as a network in which risk may propagate rapidly across connected nodes. This entry describes the concept qualitatively and does not cover specific modeling techniques, parameter estimation methods, or tooling.

Why it matters

Risk correlation matters because organizations that assess risks in isolation may materially understate their aggregate exposure. When risks are positively correlated, they tend to move adversely together, so several exposures can deteriorate at the same time rather than offsetting one another. An organization that appears well diversified on the surface may in fact carry concentrated exposure once the dependence between its risks is taken into account, and this hidden concentration can turn manageable individual risks into a larger combined loss.

Correlation is also dynamic rather than static, which is why a distinct sense of the term, sometimes called correlation risk, refers specifically to the risk of loss arising from adverse changes in the correlation between variables. Relationships that appear weak in normal conditions can strengthen sharply under stress, so risks that seemed independent may begin to move together precisely when it is most damaging. In network-based analyses, correlations can be represented as connections between nodes, and shorter paths through such a network can allow risk to propagate rapidly across it; analyses of equity markets during the COVID-19 period have illustrated how a shock can spread quickly through a densely connected risk correlation network.

For risk managers, the practical consequence is that correlation must be considered explicitly when aggregating exposures, sizing capital or contingency buffers, and interpreting the results of scenario and stress analysis. Treating correlation qualitatively as an afterthought, or assuming independence for convenience, can leave an organization exposed to combined outcomes it did not anticipate.

Who it's relevant to

Risk managers and quantitative analysts
Those responsible for aggregating and modeling risk need to represent correlation explicitly, since assuming independence can understate combined exposure. This includes reflecting dependence in analytical or simulation-based models such as Monte Carlo approaches and interpreting how correlated exposures behave together, particularly under stress.
Portfolio and investment professionals
For those managing portfolios, correlation and concentration effects can determine whether apparent diversification is real. Correlation risk, understood as the risk of financial loss from adverse changes in the correlation between variables, is a relevant consideration when evaluating how exposures may move together.
Project risk practitioners
In project settings, correlation between variables can affect the aggregate risk profile represented in a project model. Practitioners incorporating correlation may obtain a more realistic view of combined outcomes than models that treat individual risks as independent.
Enterprise risk and governance functions
Those overseeing enterprise-level risk benefit from understanding how correlations can allow risk to propagate across connected exposures. This supports more informed judgments about aggregate exposure, concentration, and the potential for correlated risks to deteriorate together during periods of stress.

Inside Risk Correlation

Dependency Between Risks
The core notion that the occurrence or severity of one risk is statistically or causally associated with the occurrence or severity of another, rather than the risks behaving independently. Correlation describes the strength and direction of this association but does not by itself establish causation.
Direction and Sign of Correlation
Whether risks move together (positive correlation) or in opposite directions (negative correlation). Positive correlation between risks can amplify aggregate exposure, while negative correlation may provide a degree of natural offset or diversification, though the extent varies by context.
Common Drivers and Shared Causes
Underlying factors, such as a shared economic condition, counterparty, geography, technology, or process, that can cause multiple risks to materialize together. Identifying common drivers helps explain why correlations exist and where concentrations may build up.
Aggregation and Portfolio View
The role of correlation in combining individual risks into an aggregate or enterprise-level exposure. Treating risks as independent when they are correlated may understate total exposure, which is why correlation assumptions feed into enterprise risk management (ERM) aggregation rather than being handled solely at the single-risk level.
Tail and Stress Behavior
The observation that correlations may change under stressed conditions, with some risks becoming more strongly associated during periods of stress than during normal conditions. This distinction between normal-condition and stressed-condition behavior is commonly examined through scenario analysis and stress testing.
Measurement and Assumptions
The inputs, data, and modeling choices used to estimate correlation, which may be quantitative (for example, statistical estimates from historical data) or qualitative (for example, expert judgment about linkages). Estimates depend on data quality, the period observed, and stated assumptions, all of which introduce uncertainty.

Common questions

Answers to the questions practitioners most commonly ask about Risk Correlation.

Does a strong correlation between two risks mean that one risk causes the other?
No. Correlation describes the degree to which two risks tend to move together, not a causal relationship between them. Two risks may be correlated because they share a common underlying driver, because of coincidental co-movement in a given period, or because of a genuine causal link, but correlation alone cannot distinguish these. Treating correlation as evidence of causation is a common misuse. Establishing causation typically requires additional analysis and reasoning beyond the correlation measure itself.
If two risks show little or no historical correlation, is it safe to assume they are independent?
Not necessarily. A low observed correlation does not confirm independence. Correlation measures, particularly linear ones, may fail to capture non-linear relationships or dependencies that emerge only under stressed conditions. Risks that appear unrelated in normal periods can become strongly linked during stress events. For this reason, relying solely on historical correlation to assume independence can understate aggregate exposure, and many practitioners supplement correlation analysis with scenario and stress considerations.
How can risk correlation be incorporated into aggregating risks across an enterprise?
Risk correlation is commonly used to inform how individual risks are combined into an aggregate view rather than simply summed. Where risks are assumed to be less than perfectly correlated, aggregation may reflect diversification effects; where risks are highly correlated, aggregate exposure may be closer to the sum of the individual risks. The assumptions applied should be documented and understood, since aggregation outcomes can be sensitive to the correlation inputs chosen. The appropriate method varies by framework, sector, and the nature of the risks involved.
What data challenges commonly arise when estimating risk correlation?
Estimating correlation typically depends on the availability, quality, and comparability of data across the risks being compared. Limited history, changes in the operating environment over time, and differing measurement bases can all affect the reliability of estimates. Correlation estimates derived from short or non-representative periods may not hold under different conditions. Practitioners commonly document data sources and limitations, and treat estimates as approximations subject to review rather than fixed values.
How should correlation assumptions be governed and reviewed within a risk management process?
Correlation assumptions are typically treated as inputs that warrant documentation, periodic review, and appropriate oversight, given their influence on aggregated risk views. Many organizations record the rationale for chosen assumptions, subject material assumptions to challenge, and revisit them as conditions change. Depending on the organization's structure, second line functions may review the approach while independent assurance may assess its adequacy. Specific governance arrangements vary by organization size, sector, and applicable framework.
How can correlation analysis be complemented when assessing risks under stressed conditions?
Because relationships between risks can change under stress, correlation analysis is often complemented by scenario analysis and stress testing that consider how risks might behave together in adverse conditions. This can help identify concentrations or dependencies that historical correlation measures may not reveal. The combination of approaches, and the weight given to each, depends on the framework applied and the context of the risks being assessed; this entry does not prescribe specific methods or tooling.

Common misconceptions

Correlation between risks means one risk causes the other.
Correlation describes an observed association in movement or occurrence; it does not establish that one risk causes another. Two risks may be correlated because they share a common driver or by coincidence in the data. Causal analysis is a separate exercise from measuring correlation.
Correlations are stable and can be assumed constant over time.
Correlation estimates are conditional on the data and period observed and may shift as conditions change. In particular, associations observed under normal conditions may differ from those under stressed conditions, so relying on a fixed correlation assumption can understate exposure during periods of stress.
Aggregating correlated risks is simply a matter of adding individual exposures.
Correlation affects how individual risks combine at the aggregate level. Summing exposures as if risks were independent may overstate diversification benefits or understate concentrations, depending on the direction of the correlation. The aggregation approach and its assumptions should be made explicit.

Best practices

Document the assumed correlations between material risks, including the data or expert judgment used, the observation period, and the rationale, so that assumptions are transparent and can be challenged.
Identify common drivers and shared causes across risks to explain why correlations exist and to surface concentrations that a single-risk view may miss.
Test how correlation assumptions behave under stressed conditions using scenario analysis or stress testing, rather than relying only on associations observed under normal conditions.
Distinguish correlation from causation in analysis and reporting, and avoid inferring causal treatment priorities from statistical association alone.
Periodically review and recalibrate correlation estimates as new data becomes available or as the operating environment changes, recognizing that estimates carry uncertainty.
Ensure that aggregation methods used in enterprise risk management make correlation assumptions explicit and communicate the resulting uncertainty to decision-makers rather than presenting aggregated figures as precise.
Application Security Isn’t Optional Anymore.