Risk Leadership Network

Introducing
Quantitative Risk Assessment
into decision making
Dr Marcos Tabacow
 Risk management: What does ‘good’ look like?

Some signs of good

• Contributing to real-time decisions before they are made
• Offering insights that no one else can (let’s be honest, it doesn’t take much to plot dots on a heat map…)
• Getting offered a seat at the table to add value rather than tick a box

How ‘good’ we need to be as risk professionals

• Understand the entire breadth of a risk, rather than just the ‘average’ or ‘worst case’ scenarios
• Use mathematically defensible methods to measure risks, even when based on subjective inputs
• Being able to truly aggregate and compare risks across an enterprise, division, investment, etc.
• Propose cost-effective solutions for risk mitigation
• Prove risk program ROI to executives and the board
 Beware limitations of popular qualitative methods

Issues with risk matrices:

• Compresses ranges
R
• Creates illusion of communication
R
• Neglects correlations
R
• Collapses uncertainty
R
• Mathematically impossible to use (add,
multiply, aggregate, etc.) R R

•…
“…they can be ‘worse than useless’”
For a summary of issues, see Krisper, M. (2021). Problems
Anthony (Tony) Cox, L., Jr (2008), What's
with risk matrices using ordinal scales. arXiv preprint
arXiv:2103.05440. Wrong with Risk Matrices?. Risk Analysis,
28: 497-512.
 Case Study: Simple development project

A typical (deterministic) schedule

Start with the project schedule … then add risks to the schedule

1 Consequence
Task Months Likelihood / Risk
Risk (months
2 Frequency exposure
1. Feasibility study 3 delayed)
2. Design 2 Risk 1: Change in
3 10% 4 0.4
3. Contract negotiation 1 government
4 Risk 2: Change orders 3 1 3
4. Development approval 4
5. Pre construction 2 Risk 3 : Workforce shortage 30% 2 0.6
5
6. Construction 9 Risk contingency (months) 4
6
7. Completion 3
Risk-adjusted schedule = 28 months
7 Expected duration 24
… is this the best we can do?
 Case Study: Simple development project

Let’s bring back uncertainty

Task range (months) Impact on schedule

Freq /
Task Most Risk Most
Min Max Prob Min Max
likely likely
1. Feasibility study 1 3 5
2. Design 1 2 4
3. Contract negotiation 0.5 1 2
4. Development approval 2 4 8 Risk 1: Change in government 10% 2 4 6
5. Pre construction 1 2 3 Risk 2: Change orders 3 0.5 1 2
6. Construction 6 9 15 Risk 3: Workforce shortage 30% 1 2 5
7. Completion 2 3 6

Keep original estimate Allocate risks to tasks

Add ranges to each task
and repeat the process
How a Monte Carlo simulation works
Risk Freq Min Most likely Max
Risk 2: Change orders 3 0.5 1 2

Average frequency = 3 Best case Worst case

Most likely
case
X

Shows the chances of different

levels of severity
(i.e., months delayed)
Seeing the effects of uncertainty…

Started with no uncertainty (the original 24 months)

Added uncertainty of task durations

Added uncertainty of the effects of risk

This is the risk we need to communicate!

 How far off were our initial estimates?
• Initial estimate of risk impact: 4 months delay
• Actual risk impact: between 15 and 26 months
delay with 90% confidence
• Initial schedule estimate: 100% chance of delivering in 24
months (before risk contingency)
• Schedule with uncertainty: Actually, there’s only a 29%
chance of delivering in 24 months (before considering risks)
Informing real-time decisions
• Virtually no chance of
meeting original ‘risk
adjusted’ schedule of
28 months (0.02%)

• 46 month average
completion time

• 90% chance of
completing between
38 and 54 months

• Board escalation if
delayed more than 52
months (P90)?

• Bonus if delivered
under 39 months (P10)?
Risk appetite: should this project even go ahead?
Risk mitigation: What to prioritise?

• Prioritise the greatest

sources of uncertainty
(top bar downwards)

• Enables focus on the

overall uncertainty of
task duration given the
risks, rather than
isolated risks

• For example,
Construction should be
prioritised first, even
though it only had the
second highest risk
(Risk 3: Workforce
shortage)
Some discussion points

• What use cases have you encountered for applying quantitative risk analysis?

• What were the results after applying QRA?

• What are the key challenges?

• How have you secured by-in for QRA?

• What competencies does the risk team need to develop to embed QRA in organisations?

Thanks!
Marcos Tabacow