Session 6

The measurement of risk

1
Overview of session

 Discuss different methods of measuring risk

 Examine the concept of risk mapping
 Consider the risk response

2
 Measuring risks

 Involves the quantification of certain risk

exposures for the purpose of comparison to
company-defined risk tolerances
 A critical component of an organisation’s broad
risk management programme
 Without a good measure of risk it is very
difficult to determine whether the company is
taking too much of (or not enough of!) some
types of risks

3
 Methods of estimating risk

 Once risks have been identified, various

methods may be used to assess the severity of
each, including (but not an exhaustive list):
 Failure mode and effects analysis
 Fault tree analysis and event tree analysis
 Hazard and operability studies
 Cost-benefit and risk-benefit analysis
 Sensitivity analysis
 Simulations and Monte Carlo

4
 Failure mode and effects analysis (FMEA)

 Systematic brainstorming aimed at finding out

what could go wrong with a system or process by
breaking it down into its component parts
 Two stages:
1. The effect of failure of each component is identified
2. Then the consequential failure on the rest of the
system is identified
 From this the likelihood and consequence of
failure can be estimated
 Commonly used in complex manufacturing, such
as the automotive industry
 http://asq.org/learn-about-quality/process-analysis-tools/overview/fmea.html
5
 Fault tree analysis (FTA) and event tree analysis

 Systematic methods to encourage better

understanding of how a particular condition
could arise
 Allows causes and outcomes of events to be identified
 A graphical technique that uses logic diagrams to
identify:
 causes (the fault tree) and
 consequences (the event tree) of potential failures
 Also commonly used in complex manufacturing,
such as the automotive industry
 http://www.weibull.com/basics/fault-tree/

6
 Hazard and operability studies (HAZOP)

 A brainstorming technique commonly used in oil

and chemical industries
 Uses terms such as ‘none’, ‘more than’, ‘less than’
etc. to identify problems in systems design
 http://www.graphicproducts.com/articles/what-is-hazop.php
 http://www.pqri.org/pdfs/mtc/hazop_training_guide.pdf

7
 Cost-benefit (CBA)

 CBA compares advantages and disadvantages

which would result from particular choices
 Each advantage and disadvantage is given a
monetary value
 takes probability into account
 often utilising DCF techniques
 http://www.hse.gov.uk/risk/theory/alarpcheck.htm

8
 Risk-benefit analysis (RBA)

 RBA balances the expected benefits that would

arise from a particular choice with the expected
risks
 May be either monetary or expressed in terms
of injuries
 reportedly used by Railtrack to determine whether
investments in train braking systems should be made
 http://cbabuilder.co.uk/CBA6.html

9
 Sensitivity analysis

 Asks ‘what if?’ questions to test the robustness

of a plan
 Altering variables one at a time identifies the
impact of that variable
 http://www.iplanner.net/business-financial/online/how-to-
articles.aspx?article_id=what-if-analysis

10
 Simulations and Monte Carlo

 Computer simulations of scenarios enable a

consideration of actions against different
events
 The Monte Carlo technique uses probability
distributions of different variables to simulate a
wide range of events
 http://www.palisade.com/risk/monte_carlo_simulation.asp

11
 Critique of methods

 Many of the quantitative methods are

reductionist in nature (e.g. FMEA, FTA/ETA,
HAZOP)
 although they provide a formal structure for
estimating risk they assume linear cause-effect
relationships rather than holistic or whole system
relationships
 However, many methods are subjective – relying
on individual perceptions of risk (e.g.
Brainstorming, CBA/RBA)

12
 Critique of methods

 Some methods are a mixture of the two – with

subjective judgements reflected in probabilities
(e.g. Sensitivity analysis and Monte Carlo
Simulations)
 The most common risk assessment technique is
through a matrix of likelihood and consequences

13
Student activity

 We have looked at some of the theoretical debate

surrounding risk identification but we should
recognise that risk identification is essentially a
very practical activity. One of the most popular
techniques used by organisations is the ‘brain-
storming’ session - bringing people together to
collect ideas in ‘workshop’ or peer group situation.
In your small groups discuss the following
question:
 What other sources of information do you think
are available to assist your organisation with its
risk identification? What are the advantages and
disadvantages of these methods?

14
 Risk mapping: the likelihood/consequences matrix

 The likelihood (or probability) of occurrence may

be high, medium or low
 The impact (or consequences) in terms of
downside risk (threats) or upside risk
(opportunities) may also be high, medium or low
 Some organisations use a 3x3 matrix, others
might use a 5x5 or even 7x7
 Either way, by considering the consequence and
probability of each of its risks it should be
possible for organisations to prioritise key risks

15
 Measures of likelihood and consequence – likelihood probability

 Almost certain  Expected to occur

 Likely  Will probably occur
 Moderate  Could occur at some time – may be
difficult to control
 Unlikely  Not expected to occur
 Remote  May occur only in exceptional
circumstances

16
 Measures of likelihood and consequence – consequence impact

 Extreme  Would threaten the survival or viability of

the business unit
 Very high  Would have significant impact on achieving
business objectives
 Medium  Would lead to significant review and
change to the business unit
 Low  Would threaten efficiency or
effectiveness of some aspects of business
 Negligible  Consequences are dealt with by routine
operations

17
 Risk matrix

Consequence/impact of risk
Low Medium High

Low

Likelihood
Medium
of risk

High

18
 Risk matrix – an hypothetical example

Low likelihood Medium likelihood High likelihood

High impact Failure of information Subcontractors fail to Government

systems meet commitments intervention in
Serious accident Failure of project markets
planning system Entry of new
competitor
Medium impact Loss of Insufficient capacity Management overload
licences/certificates causes delays Poor employee morale
Poor succession Excess capacity leads leads to resignations
planning to losses
Low impact Supplier failure Profit shortfall Inadequate R&D
Cost overruns Legal claims

19
Student activity

 In your small groups:

 For the organisation which you have been
allocated, Using the risk matrix approach, try to
rank some of the risks it faces

20
 Risk evaluation

 When risk analysis (identification, description

and estimation) is complete, the risks faced by
the organisation need to be compared against:
 its risk profile – the array of opportunities and
exposures, and
 its preferences towards taking or avoiding risks
 Risk evaluation is used to make decisions about
the significance of risks to the organisation
 helps determine whether each risk should be accepted
or treated

21
 Risk treatment (response)

 The process of selecting and implementing measures to

modify the risk; it involves:
 Setting a policy defining the organisation’s attitude to a
particular risk and the objectives of the response
 Individual accountability for the management of the risk –
person should have expertise/authority
 The management processes currently used to manage risk
 Recommended business processes to reduce the residual risk
to an acceptable level
 Key performance measures to enable management to assess
and monitor risk
 Independent expertise to assess the adequacy of the risk
response
 Contingency plans to manage/mitigate a major loss following
occurrence of an event
22
Risk response

 Avoidance  Sharing
 Action is taken to  Action is taken to

exit from risky transfer part of

activities the risk

 Reduction  Acceptance
 Action is taken to  No action is taken

reduce likelihood or
impact

23
 The retention decision

 A firm’s retention decision is the part of the

risk management process that determines what
risks (and how much) the firm should bear as a
part of its normal business and what risks the
firm should transfer to one or more market
participants
 The impact of a risk on the firm can be analyzed
in one of three dimensions:
1. Net asset value or capital
2. Cash flows
3. Accounting earnings

24
 The retention decision

A risk can be:

 Retained - shareholders bear the full weight of
any realized losses resulting from the risk
 Neutralized - shareholders do not bear the
impact of any realized losses because the firm
has offset one risk with another
 Balance sheet hedging
 Structured or contingent liabilities
 Transferred - shareholders do not bear the
impact of any realized losses because the firm
has transferred the risk to one or more other
firms
25
 Portfolio

 Management will recognise the diversity of

responses and the effect on the entity’s risk
tolerances
 Basic portfolio theory tells us that it is less
risky to have diverse sources of income through
a portfolio of assets or investments
 Spreading investments reduces risk
 May be achieved by a combination of market
expansion or diversification

26
 Types of market expansion

 Extension to market segments not currently

served
 Development of new uses for existing products
 Geographic expansion – nationally or
internationally

27
 Types of diversification

 Backward – activities concerned with inputs to

business processes – e.g. raw materials
 Forward - activities concerned with outputs
from business processes – e.g. distribution
 Horizontal - activities that are competitive with,
or complimentary to present activities – e.g. an
airline providing car rental services
 Unrelated – opportunities beyond the current
product/service or customer base of the
organisation

28
Student activity

 In your small groups:

 For the organisation which you have been
allocated, can you think of any examples of market
expansion and diversification opportunities?
 Obviously there is no standard answer to this – it
is a discussion exercise based on different
organisations

29