## A challenge for risk management experts

The intent of this post is to present a more complex risk evaluation scenario for risk management experts to comment on. That advice should be valuable for all of us.

**First, some background**

In a simple situation, an event or situation may be assessed as having a defined likelihood and potential impact. People like to show this on a heat map.

But, events and situations are not always that simple. Any possible event or situation can have a range of likelihoods and impacts. Consider the potential for an earthquake to strike a town in California where your business operates. There is a range of likelihood (of an earthquake in that location) and impact (on the business):

- 1% $10 million
- 2% $5 million
- 3% $1 million
- 4% $100,000
- 4% $50,000
- 5% negligible

All told, there is a likelihood of an earthquake of 23%, but the range of impacts is wide.

For those who measure the risk based on likelihood multiplied by the potential impact, the range translates to:

- 1% $10 million $100,000
- 2% $5 million $100,000
- 3% $1 million $30,000
- 4% $100,000 $4,000
- 4% $50,000 $2,000
- 5% negligible negligible

An argument can be made that each of these is a risk situation that should be evaluated. Some would therefore focus only on the larger scenarios. I am fine with that in this case.

But what if the situation is different? Let’s say we are considering a decision on whether or not to expand into Ethiopia. There are multiple risks, extending from (for example) damage to corporate reputation if employees engage in bribery, the loss of facilities if they are damaged in periods of civil unrest, to the risk that employees will be harmed or even be killed. The aggregated range of likelihood and impact is:

- 1% $200 million
- 2% $100 million
- 3% $50 million
- 3% $10 million
- 4% $5 million
- 5% less than $1 million

Ours is a company with annual revenue of $2 billion and profits of $250 million, so these risks are significant. Why is management considering the initiative? The Marketing people estimate the potential upside (the reward or opportunity) as substantial as well:

- 10% $100 million additional profit
- 20% $80 million additional profit
- 25% $50 million additional profit
- 20% $10 million additional profit
- 5% $5 million additional profit
- 5% break even
- 5% $5 million loss
- 5% $10 million loss
- 5% $15 million loss

**The challenge**

- How would you evaluate the situation and advise management?
- Would your evaluation change if the potential upside estimate from Marketing changed:
- If the upside increased from 10% of $100 million profit to 15%?
- If the highest possible operating loss was limited to $5 million?

Please share your approach so all of us can benefit – and discuss.

This is a classic from Management Decision Analysis. Oil drilling projects face these kind of decision support questions all the time.

First, I need a map of contingent risks vs simple risks. Bear in mind what I mean by simple risk would be a average of your risk exposures and a computation and a standard deviation estimate in that average of risk/reward events. Contingent risk means that a new option of risk or reward opens up only if a path through a fault tree is taken.

Only in the case of taking a 15 MM risk am I enabled to get a 25 MM reward, but not if I take the 10 MM risk. This is what I mean by a contingent risk.

A nice analysis tool in this area is called “Decision Tree” see their @RISK site. I get no financial reward for the referral.

Once we build out our Decision Tree with Contingent Odds or Reward/Loss, we can look at levels of uncertainty where we can endure before we would make much of a different decision. Monte Carlo variation of input values in a Decision Tree can completely map out your critical decision support factors and acceptable uncertainty levels.

Finally, if we want to go for gold, we might look at the utility function. Do we want to decide that an outcome is a net good if and only if its Net Prevent Value computation is net profitable or bad if it is a net loss. Are there other important factors, such as avoiding the monetizing of human life. We can recompute, choose and optimum path and determine if some factors are not truly critical in certain contingencies. Then, map out the time sequence of critical decision points. When to abandon a well drilling effort for example, and than God we got out of there before it leads to twice as much loss.

I can spend the time to build out that model for your case, but I though that giving you the tools to fish might be a more effective response.

First problem in your data that I see. Your marketing outcome table does have have a probability table adding up to 100%. But your Risk Impact table does not.

Thus, I need clarification on Risk Impact able.

Does Risk Exposure represent a subtraction to your marketing data? if the subtraction already considered in your marketing data?

When we adjust the “upside” does that only apply to positive outcomes in your Marketing Table or as a factor for every impact entry?

Should your risk exposure be a normed probability table? What is the impact for odds outside your 1% to 5% range?

Don, the risk impact does not add up to 100% because there is a 82% likelihood that there will be no adverse event or situation.

There is no relationship between the two tables. It is possible to have high profits at the same time as a serious safety issue.

Does that help?

Norman

Would your average odds of an impact be similar to the following?

Sum (risk * Impact) / Sum(Impact) = Average Odds?

Does the average impact in your table computed as follows?

sum(risk * Impact) = Average because all other impacts are zero

or sum(Risk*Impact)/Sum(Risk) because your probability table needs to be normed, sum(risk) should be 100%

Don, one of the first questions is whether you look at average (adverse) impact, the more likely, or the greater.

I will let you add assumptions as needed for your calculation.

So, This model is then roughly a simple risk computation..

Gain = Sum(Odds * Outcome) – Sum(Risk * Impact) +/- factors relating to change in impact like a 10% improvement in odds.

Is this a fair average computation; not I am not dealing with variations yet.

Don, I could build several tables with the same average. Would that affect your calculation? When you decide how fast to drive, do you consider the average likelihood of a accident or only the likelihood of an accident that has fatal consequences?

In short, your table is normed and I can take all the other odds and outcomes as zero.

If so, your risk model is

-6.0 MM +/- 25.4 M<

Your sales gain model is

+39.25 MM +/- 37.46 MM

On an average basis then

your net gain(+) or loss(-) is

39.25 MM – 6.0 MM = +33.25 MM (a gain.)

Taking the case that your sigma is independent, a not completely save view…

Independent Sigma = sqrt(25.5^2 + 37.46^2) = 45.2

Subtractive Sigma = 37.46 – 25.4 = 12.1

Additive Sigma = 37.46 + 25.4 = 62.8

So, the average and independent sigma answer is

33.25 MM +/- 45.23 MM

Noise Factor, C = Sigma/Average = 45.23MM / 33.25 = 1.152

This is not a very comforting decision point. At random +/- 1 sigma variation could wipe out your gain in a heart beat. From a Six Sigma View, the Voice of the Process says bad things about the quality of this deal. While it could win, variation would destroy its worth and so process improvement in this deal to control variation would make or break this decision.

You might want to call in your Six Sigma Blackbelt. Or at a minimum do a Monte Carlo Analysis on this deal.

A poor mans version would make a test matrix for each option and multiply out the odds of each case.

Then you can compute the percentage of business changes that made a profit vs the percentage of changes that did not make a profit. Based on fast spreadsheet, less than 50% of the business cases will be profitable. This is a high risk investment decision.

Thanks, Don.

All: do you agree with this approach and analysis? Please share.

Computation method used:

Average = sumproduct(odds * Impact) Impact (-), Gain(+)

Sigma = sqrt(sumproduct(Impact, Impact, Odds) – Ave^2)

Deal_Ave = Ave_Gain – Ave_Risk

Deal_Sigma = sqrt(Sigma_Gain^2 + Sigma_risk^2)

Noise Factor C = Deal_Sigma/Deal_Ave

…

in a quick designed experiment

(Loss + Gain) * Odds_Loss * Odds_Gain = Metric

45 combinations.

Ave_Metric = 0.00416

Sigma_Metric = .24988

Cases with a positive net: 11

Cases with a negative net: 34

Thus the odds of breach even or gain is less than 11/45 = 24.4%

This is a terrible business deal.

Second computation with Metric = (Odds_loss * Loss – Odds_gain * Gain)

45 combinations

Ave_Metric = 3.22 MM

Sigma_Metric = 6.26 MM

Count metric > 0 = 20

Count metric <= 0 25

Odds of a net win in business: 20/45 = 44.4%

If you win:

Cases that make money only:

Ave_win_Metric = 9 MM

Sigma_win_Metric = 5.2 MM

If you lose:

Ave_Lose = -1.4 MM

Sigma_Lose = 0.9 MM

Fortunes Formula for portfolio management

Portfolio = Odds_Win – Odds_Loss * Loss/Win = 35.7%

Never bet more than 35.7% of your investment capital on this risk, ever.

A comment has been made about understanding the basis for the assessments of likelihood and impact, and whether there is bias, etc. I agree that understanding how the assessments are made is critical to an intelligence decision.

For the sake of argument, to keep this relatively simple, please assume the numbers are reasonable.

Also note, as I said in a comment, that there is no relationship between the profit table and the table with potential adverse effects.

Should the most important point is that the original numbers are unreliable: with the best will in the world, they CANNOT be anything other than a guess of what might happen (adding a range of made-up odds to a range of made-up results does NOT change the underlying lack of reality).

What is the point of building such sophisticated castles on foundations of sand? Doesn’t it lead to just the sort of false assurance that results in big problems? Rather than spending too much time on the planning, shouldn’t one concentrate more on making sure that your processes are agile enough to be able to adapt fast to what ACTUALLY happens?