UsingRiskMapstovisually model&communicaterisk
MartinNeil
AgenaLtd& RiskAssessmentandDecisionAnalysisResearchGroup, DepartmentofComputerScience,QueenMary,UniversityofLondon London,UK
Web:[Link] Email:martin@[Link]
Contents
Problemswithcurrentapproaches RiskMapsasSolution RiskMapToolkit RiskMappingforEnterpriseRisk RiskMapApplications FinalRemarks
AllExamplesshownusingAgenaRisksoftware
2
Problemswithcurrent approaches
RiskRegister
Therearetightbudgetconstraints Theprojectoverrunsitsschedule Thecompanysreputationisdamaged externallybypublicityaboutpoorfinalsystem Thecustomerrefusestopay Thedeliveredsystemhasmanyfaults Therequirementsareespeciallycomplex Thedevelopmentstaffareincompetent Keystaffleavetheproject Thestaffarepoorlymotivated Generallycannotrecruitgoodstaffbecause oflocation Thereisamajorterroristattack
RiskHeatMapsandProfiles
Risk=LikelihoodxImpact
5
Spreadsheets
ExpertJudgementIAssume
Ontheonehand.
Obviousriskofbeingwrong Dangerousifunverified,checkedoragreed Political
Ontheotherhand.
Absolutelynecessary Unavoidable Weemploypeopleforareason!
ModelRisk:Ifyouwanttoanalyserisk youaregoingtohavetotakethem.
Howgoodarepeople atestimatingrisk?
Evidencefrompsychologyisworrying!
Availabilityofmorerecentcases Emphasisoneasiertorememberdramaticevents Largesingleconsequenceoftenoutweighs multiplesmallconsequences
FramingProblem:Answeryougetdependshow youaskthequestion! Whatisthechanceofdisease? Vs Givenpositivetestresultwhatisthechanceofdisease? Vs Chanceofdiseasegiventestpositive?
8
Ifyoucannottrustpeople canyoutrustthedata?
Statisticalvalidityrestrictedtocontrolled experiments Datasetsmustrepresenthomogeneous samplesandcorrelationsclear
HighcorrelationbetweenshoesizeandIQ!
Doyouevenhavethedata?
Newbusinessventures? Rareevents?
Thelureofobjectiveirrationality
9
CombiningSubjectiveand Objectiveinformation
Casino1HonestJoes.
Youvisitareputablecasinoatmidnightinagoodneighbourhood [Link] dignitaries(judgesetc.).Youdecidetoplayadicegamewhere youwinifthediecomesupsix. Whatistheprobabilityofasix?
Casino2ShadySams.
MorethanafewdrinkslatertheCasinoclosesforcingyouto [Link] [Link] time,[Link] youdecidetoplaythesamedicegame. Whatistheprobabilityofasix?
10
RiskMapsasaSolution
AssessingRiskofRoadFatalities: NaveApproach
Season Coldermonths
Numberof Fatalities
Fewerfatalities
12
AssessingRiskofRoad Fatalities:Causalmodel
Season
Road Conditions
Weather Number ofjourneys
Average speed Danger level
Numberof Fatalities
13
RevThomasBayes
14
BayesTheorem
A:Personhascancer p(A)=0.1(priors) B:Personissmoker p(B)=0.5 Whatisp(A|B)?(posterior) p(B|A)=0.8(likelihood)
Posteriorprobability Likelihood Priorprobability
p(B | A)p( A ) p( A | B )= p(B )
Sop(A|B)=0.16
15
Decomposing(Exposing)Risk Measure
StandardDefinition:
Risk=ImpactxProbability
Isthisdecompositionenough? Exposetheassumptions! Whatisthecontextdrivingthenumbers? Whosriskisit? Isitarisktome? Isitreallyarisk? Anindicatorofarisk? Amitigant..?
16
CausalFrameworkforRisk
Replaceoversimplisticmeasureofrisk withacausalapproach Characteriseriskbyeventchaininvolving:
Theriskitself(atleast) Oneconsequenceevent Oneormoretriggerevents Oneormoremitigantevents
Contexttellsastoryanddependson perspective
17
TownFloodExample
Trigger Control
Mitigant
RiskEvent
Consequence
18
CalculationofTownFloodRisk
19
FloodExampleHomeowners Perspective Trigger Control
Mitigant
RiskEvent
Consequence
20
CalculationofHomeFloodRisk
21
4Stepstodefineariskmap
1. Considersetofeventsfromgiven perspective 2. Foreacheventidentifytriggersand controls 3. Foreacheventidentifyconsquencesand mitigants 4. Defineprobabilitiesforrisknodes
22
ConnectingRiskMapsusing BuildingBlocks
Connectriskmaps viainput/outputrisk nodes Createcomplextime basedorcomplex structuralmodels
23
Benefits
Apicturetellsathousandwords Explicitlyquantifiesuncertainty Connectingmodelsconnects perspectives Dynamiccalculationofriskvalues Greatforwhatifanalysis
24
RiskMapToolkit
SophisticationSpectrum
Mind Mapping Dynamic Modelling Simulation
Expertled And Difficult
Accessible And Simple
Expert Systems Causal modelling
Statistical Learning fromdata
26
RiskMap
Nodesrepresent
variables events quantities
Linksrepresent relationships
relevance causality
Easytosupport andunderstand
27
MeasuringScales
RiskNodeTypes
Boolean(Yes/No,True/False) Labelled(Red,Blue,Green) Numeric(Integer,Continuous,Discrete) Ranked(High,Medium,Low)
28
DiscreteProbabilities
Priorprobabilities ConditionalProbabilities
Resultviewedasmarginalprobabilitydistribution
29
ContinuousProbabilitiesbySimulation
[Link]
p( X )=
s 2p
- ( x- m )2 /(2s 2)
30
SimulationModel
31
BackwardsReasoning
Estimatecauses fromeffects! Usefulwayto modeluncertain indicators
32
StatisticalLearning
33
RiskMappingfor EnterpriseRisk
KeyRCSA*Questions
Whatriskscanoccur? Cantheyoccurinmyprocess? Howrarearethey? Howreliableareourcontrols? Howgoodisourinternalandexternaldata? Whatislikelyleveloflosses? Whatisworstcasescenario? Howcanweimprove? Whatshouldweimprove?
*RCSA=RiskControlSelfAssessment
AgenaLtd2005
35
AssessingEnterpriseRisk
Blendqualitativeinformationwithquantitativelossdata COSO/CRSAstyleriskandbusinessassessment Selfassessmentdatatopredictprocessreliabilityin quantitativeterms Measureandcombine:
Process,Taskreliability Riskstoreliability Actionplans Issues
UsedtoforecastVaR,ROI,capitalcharge,insurance levels.
36
AgenaLtd2005
RiskMapforRCSA
37
RiskMapApplications
RiskyApplications
AircraftMidair collision Softwaredefects Systemsreliability Warrantyreturnrates ofelectronicparts Operationalriskin financialinstitutions
39
AircraftMidAirCollisionPrediction
40
FinalRemarks
StructuredMethod
Basedon300yearoldprovenBayestheorem Enabledbymoderncomputerpower&technology Beyondcurrentstatistical&MonteCarlotechniques Combinessubjectivejudgementswithdata
RiskMapsenableVisualCommunication
Managingriskthroughpictures Useablebyrisknovicesaswellasexperts Makescomplexriskproblemseasilycommunicable
AgenaRiskisIndustrialStrength
Enablesscalable,reusable&auditableriskmodels IntegrateseasilywithDBMS&Excel Enablesprofessionaldeveloperstobuildenduserapplications
41
NextSteps
TobuildariskmapdownloadandenjoyaFREE EvaluationcopyofAgenaRiskvisit:
[Link]
42