UsingRiskMapstovisually model&communicaterisk

MartinNeil
AgenaLtd& RiskAssessmentandDecisionAnalysisResearchGroup, DepartmentofComputerScience,QueenMary,UniversityofLondon London,UK
Web:www.agenarisk.com Email:martin@agena.co.uk

Contents
Problemswithcurrentapproaches RiskMapsasSolution RiskMapToolkit RiskMappingforEnterpriseRisk RiskMapApplications FinalRemarks
AllExamplesshownusingAgenaRisksoftware
2

Problemswithcurrent approaches

RiskRegister
Therearetightbudgetconstraints Theprojectoverrunsitsschedule Thecompanysreputationisdamaged externallybypublicityaboutpoorfinalsystem Thecustomerrefusestopay Thedeliveredsystemhasmanyfaults Therequirementsareespeciallycomplex Thedevelopmentstaffareincompetent Keystaffleavetheproject Thestaffarepoorlymotivated Generallycannotrecruitgoodstaffbecause oflocation Thereisamajorterroristattack

RiskHeatMapsandProfiles

Risk=LikelihoodxImpact
5

Spreadsheets

ExpertJudgementIAssume
Ontheonehand.
Obviousriskofbeingwrong Dangerousifunverified,checkedoragreed Political

Ontheotherhand.
Absolutelynecessary Unavoidable Weemploypeopleforareason!

ModelRisk:Ifyouwanttoanalyserisk youaregoingtohavetotakethem.

Howgoodarepeople atestimatingrisk?
Evidencefrompsychologyisworrying!
Availabilityofmorerecentcases Emphasisoneasiertorememberdramaticevents Largesingleconsequenceoftenoutweighs multiplesmallconsequences

FramingProblem:Answeryougetdependshow youaskthequestion! Whatisthechanceofdisease? Vs Givenpositivetestresultwhatisthechanceofdisease? Vs Chanceofdiseasegiventestpositive?

8

Ifyoucannottrustpeople canyoutrustthedata?
Statisticalvalidityrestrictedtocontrolled experiments Datasetsmustrepresenthomogeneous samplesandcorrelationsclear
HighcorrelationbetweenshoesizeandIQ!

Doyouevenhavethedata?
Newbusinessventures? Rareevents?

Thelureofobjectiveirrationality
9

CombiningSubjectiveand Objectiveinformation
Casino1HonestJoes.
Youvisitareputablecasinoatmidnightinagoodneighbourhood inacityyouknowwell.Whenthereyouseevariouscivic dignitaries(judgesetc.).Youdecidetoplayadicegamewhere youwinifthediecomesupsix. Whatistheprobabilityofasix?

Casino2ShadySams.
MorethanafewdrinkslatertheCasinoclosesforcingyouto gambleelsewhere.YouknowtheonlyplaceopenisShady Samsbutyouhaveneverbeen.Thedoormengiveyouahard time,thereareprostitutesatthebarandhustlersallaround.Yet youdecidetoplaythesamedicegame. Whatistheprobabilityofasix?
10

RiskMapsasaSolution

AssessingRiskofRoadFatalities: NaveApproach
Season Coldermonths

Numberof Fatalities

Fewerfatalities

12

AssessingRiskofRoad Fatalities:Causalmodel
Season

Road Conditions

Weather Number ofjourneys

Average speed Danger level

Numberof Fatalities
13

RevThomasBayes

14

BayesTheorem
A:Personhascancer p(A)=0.1(priors) B:Personissmoker p(B)=0.5 Whatisp(A|B)?(posterior) p(B|A)=0.8(likelihood)
Posteriorprobability Likelihood Priorprobability

p(B | A)p( A ) p( A | B )= p(B )

Sop(A|B)=0.16
15

Decomposing(Exposing)Risk Measure
StandardDefinition:

Risk=ImpactxProbability
Isthisdecompositionenough? Exposetheassumptions! Whatisthecontextdrivingthenumbers? Whosriskisit? Isitarisktome? Isitreallyarisk? Anindicatorofarisk? Amitigant..?
16

CausalFrameworkforRisk
Replaceoversimplisticmeasureofrisk withacausalapproach Characteriseriskbyeventchaininvolving:
Theriskitself(atleast) Oneconsequenceevent Oneormoretriggerevents Oneormoremitigantevents

Contexttellsastoryanddependson perspective
17

TownFloodExample
Trigger Control

Mitigant

RiskEvent

Consequence

18

CalculationofTownFloodRisk

19

FloodExampleHomeowners Perspective Trigger Control

Mitigant

RiskEvent

Consequence

20

CalculationofHomeFloodRisk

21

4Stepstodefineariskmap
1. Considersetofeventsfromgiven perspective 2. Foreacheventidentifytriggersand controls 3. Foreacheventidentifyconsquencesand mitigants 4. Defineprobabilitiesforrisknodes

22

ConnectingRiskMapsusing BuildingBlocks
Connectriskmaps viainput/outputrisk nodes Createcomplextime basedorcomplex structuralmodels

23

Benefits
Apicturetellsathousandwords Explicitlyquantifiesuncertainty Connectingmodelsconnects perspectives Dynamiccalculationofriskvalues Greatforwhatifanalysis

24

RiskMapToolkit

SophisticationSpectrum
Mind Mapping Dynamic Modelling Simulation
Expertled And Difficult

Accessible And Simple

Expert Systems Causal modelling

Statistical Learning fromdata

26

RiskMap
Nodesrepresent
variables events quantities

Linksrepresent relationships
relevance causality

Easytosupport andunderstand

27

MeasuringScales
RiskNodeTypes
Boolean(Yes/No,True/False) Labelled(Red,Blue,Green) Numeric(Integer,Continuous,Discrete) Ranked(High,Medium,Low)

28

DiscreteProbabilities
Priorprobabilities ConditionalProbabilities

Resultviewedasmarginalprobabilitydistribution

29

ContinuousProbabilitiesbySimulation
ModelStatisticalDistributionsE.g.Normal

p( X )=

s 2p

- ( x- m )2 /(2s 2)

30

SimulationModel

31

BackwardsReasoning
Estimatecauses fromeffects! Usefulwayto modeluncertain indicators

32

StatisticalLearning

33

RiskMappingfor EnterpriseRisk

KeyRCSA*Questions
Whatriskscanoccur? Cantheyoccurinmyprocess? Howrarearethey? Howreliableareourcontrols? Howgoodisourinternalandexternaldata? Whatislikelyleveloflosses? Whatisworstcasescenario? Howcanweimprove? Whatshouldweimprove?
*RCSA=RiskControlSelfAssessment
AgenaLtd2005

35

AssessingEnterpriseRisk
Blendqualitativeinformationwithquantitativelossdata COSO/CRSAstyleriskandbusinessassessment Selfassessmentdatatopredictprocessreliabilityin quantitativeterms Measureandcombine:
Process,Taskreliability Riskstoreliability Actionplans Issues

UsedtoforecastVaR,ROI,capitalcharge,insurance levels.

36
AgenaLtd2005

RiskMapforRCSA

37

RiskMapApplications

RiskyApplications
AircraftMidair collision Softwaredefects Systemsreliability Warrantyreturnrates ofelectronicparts Operationalriskin financialinstitutions

39

AircraftMidAirCollisionPrediction

40

FinalRemarks
StructuredMethod
Basedon300yearoldprovenBayestheorem Enabledbymoderncomputerpower&technology Beyondcurrentstatistical&MonteCarlotechniques Combinessubjectivejudgementswithdata

RiskMapsenableVisualCommunication
Managingriskthroughpictures Useablebyrisknovicesaswellasexperts Makescomplexriskproblemseasilycommunicable

AgenaRiskisIndustrialStrength
Enablesscalable,reusable&auditableriskmodels IntegrateseasilywithDBMS&Excel Enablesprofessionaldeveloperstobuildenduserapplications

41

NextSteps
TobuildariskmapdownloadandenjoyaFREE EvaluationcopyofAgenaRiskvisit:

www.agenarisk.com

42