Dependencies defeat simple aggregation

Aggregation changes the question from a particular risk mechanism to the institution's combined exposure. That change requires a loss-incidence definition before it requires a sophisticated dependence estimate. The first question is whether the entries describe distinct additive claims. If the same lost contribution appears under equipment interruption, dispatch interruption and customer-service failure, summing their monetary consequences can count the same harm repeatedly. Naming the entries differently does not make their loss objects distinct. A register can therefore pass input validation while remaining unsuitable for an aggregate-loss interpretation.

Expected values of distinct additive losses can be summed without assuming the losses are independent. This follows from the linearity of expectation, not from a claim about their joint event behaviour. Dependence becomes important for the distribution of their sum, the chance of simultaneous impairment and the institution's capacity to absorb a combined consequence. The distinction prevents two opposite errors. An analyst should not claim a joint-tail result merely because expectations were added. Nor should the analyst invent a correlation adjustment to the mean solely because the events can occur together.

The distinct-loss fixture stipulates separate dispatch and telemetry contribution claims. The engine calculates each expected loss and adds them. That arithmetic is valid within the declared additive-incidence assumption. It does not prove that a real operator could distinguish those claims or that the losses do not overlap. The publication explicitly labels the assumption, and the evidence record retains an incidence-review requirement for any actual application. The controlled case shows what the app does when the input claims are intended to be distinct; it is not a measurement of a real enterprise portfolio.

The duplicate-claim fixture deliberately violates the interpretation needed for a useful aggregate forecast. It uses different risk names for the same underlying contribution claim. The engine accepts those distinct names and calculates their supplied losses correctly. Its total is therefore an exact result for the entered claims but an invalid interpretation of one real loss counted twice. The governance disposition holds the aggregate forecast and requires a reconciled incidence ledger. The engine cannot detect semantic duplication from labels and numbers alone. A mechanical pass should not be mistaken for that semantic review.

The distinct-loss fixture yields residual annual expectation of USD 232.00 thousand. The duplicate fixture yields USD 184.00 thousand for its entered claims. These totals are not compared as alternative interventions on the same valid incidence basis. They demonstrate different semantic constructions. The lower displayed aggregate in the duplicate case does not rescue its interpretation, and the larger distinct-claim total does not prove a more dangerous joint tail. The record keeps the meaning of the sum separate from its magnitude.

The completed adverse response is to stop publication of the duplicate case as a forecast until the claim ledger assigns the underlying consequence once and preserves the alternative causal routes. The fictional analyst can retain the negative fixture as a transparent teaching and verification object. An actual risk report should identify which entries overlap and who owns the reconciliation. The Chair's acceptance of an aggregate should refer to that reviewed incidence basis; a generic confirmation that the calculation ran successfully would not answer the challenged proposition.

This is a specific limit of input validation. Required fields, finite values, valid percentage bounds and distinct names protect the calculation from malformed inputs. They do not establish that an event exists, that its consequence is measured appropriately or that another entry does not contain the same consequence. A reviewer should preserve both kinds of quality evidence. A technically clean fixture can remain epistemically unsupported, and a valid real-world mechanism can still be entered incorrectly. Repairing the right problem requires identifying which layer failed.

An incidence ledger should identify the objective, claimant, loss type, time boundary and relationship to other entries. A dispatch contribution loss can be distinct from repair expenditure if the scope and accounting treatment support that distinction. A lost-sales estimate may contain the contribution loss and should not be added without reconciliation. A contractual indemnity may transfer part of a loss rather than create another independent economic harm. The model uses supplied monetary scalars; the ledger provides the semantic mapping that makes their aggregation useful. That mapping deserves evidence and authority because it can materially alter a board's exposure picture.

Dependencies should then be mapped at the capability level. A single support failure can make several controls unavailable. A common supplier can impair different service routes. A shared information source can cause apparently diverse decisions to fail together. The demonstrator's within-risk common support state does not supply a cross-risk joint state distribution. A reviewer should not infer that the app's similar availability fields are either independent or perfectly shared across risks. If the acceptance question depends on simultaneous failure, the institution must define the cross-risk mechanism and obtain an appropriate basis for its states.

Aggregation can conceal bottlenecks. The institution may be able to absorb each loss separately but lack the repair resources or alternative service capacity to respond to several events together. The additive annual expectation does not reveal that resource conflict. An operational scenario can identify it without estimating a full probability distribution, while a probabilistic capacity question may require a more detailed model. The appropriate response follows the capacity condition. Adding a generic concentration score to the financial mean does not establish how the bottleneck arises or which intervention removes it.

A risk system should preserve the difference between ownership and loss incidence. Several managers may legitimately own different causal paths to the same service loss. Their responsibilities need not be merged merely to avoid duplicate monetary claims. The aggregate ledger can retain the causal paths while assigning the loss once under an explicit incidence rule. This is often more useful than deleting register entries. It permits investigation of each mechanism while protecting the board's total from double counting. The responsibility map and the economic consequence map serve different purposes.

Diversification claims also require a decision context. Separate suppliers or sites can reduce a shared failure exposure when they have sufficiently distinct dependencies. They can also increase operational complexity or create new coordination paths. The number of names in the procurement register is not evidence of independence. The model does not price the diversification benefit or cost. An analyst should identify the shared adverse state that the proposed diversification is meant to address, then assess whether the new arrangement removes it. A general statement that more suppliers reduce risk is not enough to authorise a specific exposure.

A useful aggregate report should retain drill-down to the claims that produce the total. The canonical risk outputs are sorted by residual loss, which helps identify the largest supplied expected-loss entries. That order is not a priority ranking over safety, continuity, legal conditions or evidence quality. A lower-mean entry can dominate a decision because its consequence is noncompensable or its response deadline is binding. The report should therefore avoid using the app's numerical order as an unstated universal escalation rule. The aggregate is a comparison object with a scope, not a complete governance hierarchy.

The fictional incidence review produces two different dispositions. The distinct-claim fixture is arithmetically usable under its explicit additive assumption, while the aggregate forecast for the duplicate-claim fixture is held. Both models reproduce exactly. Neither result supplies a joint loss distribution or implementation authority. This contrast demonstrates the contribution of a semantic gate: it prevents a clean calculation from becoming a misleading enterprise total, while allowing a valid expected-value comparison to remain useful. The gate should test incidence rather than require arbitrary conservative inflation of every sum.