APS1090 Risk Engineering

A. H. Hay ([Link]@[Link])
8 Sep to 1 Dec 2025, Mondays 9 am to 12 pm
• “I wish to acknowledge this land on which the
University of Toronto operates. For thousands of
years it has been the traditional land of the
Huron-Wendat, the Seneca, and the
Mississaugas of the Credit. Today, this meeting
place is still the home to many Indigenous
people from across Turtle Island and we are
grateful to have the opportunity to work on this
land.”
Theory, concepts, discussion tutorials & project tutorials
Three assignments, each 10% of total marks

One project, 50% of total marks

(Real task, real client, real time)

Final exam, 20% of total marks

(Two essay questions from five possible in 1 ½ hours)
Risk & Risk Treatment
Language of risk is common to all professions,
so use it correctly.

Probability & Likelihood

 Effect of uncertainty on objectives
ISO31000:2018
The possibility that an event will occur and
adversely affect the achievement of
objectives
COSO ERM:2004
 Hazard Strategic
Speculative
Pure Risk
Internal External
Risk
Arises from property,
liability or personnel Arises from trends in
loss exposures the economy or society

Arises from the effect of Arises from people,

market forces on processes, systems or
Speculative
financial assets or
External controlsPure Risk
Internal
Risk
liabilities

Financial Operational
 Risk Criteria: reference standards,
measures or expectations used in judging
the significance of a given risk in context
with strategic goals
Correlation: a relationship between
variables

Risk Criteria
Exposure: Any condition that presents a
possibility of gain or loss whether or not an
actual loss occurs

Risk Criteria, Correlation

Risk Horizon: the period of exposure

Risk Criteria, Correlation, Exposure

Risk Profile: A set of characteristics
common to all risks in a portfolio

Risk Criteria, Correlation, Exposure,

Risk Horizon
 Law of Large Numbers: a
mathematical principle stating that as the
number of similar but independent exposure
units increases, so does the relative
accuracy of predictions about future
outcomes
Risk Criteria, Correlation, Exposure,
Risk Horizon, Risk Profile
 Decision-making criteria
Reliability and sufficiency of evidence
Defining the issues
 Value at Risk (VaR): A threshold value
such that the probability of loss on the
portfolio over the given time horizon
exceeds this value, assuming normal
conditions.
Risk Criteria, Correlation, Exposure,
Risk Horizon, Risk Profile, Law of Large Numbers
 VaR Threshold
50
40
Likelihood %
30
20
10
0

-40M -30M -20M -10M 0 10M 20M 30M 40M

Asset Value $
5% VaR of $30M over 2021Q3

... There is a 5% likelihood of losing

$30M or more over the third quarter of
2021
 Organisations covering the risk
must provide ‘economic capital’ for
credit rating

AA standard : 99.95% threshold

0.05% chance of losing more than funds held
Three conditions for loss:

Asset Exposed to Loss

Cause of Loss
Financial Consequence
Four types of loss exposure:
Property Loss Exposure
Liability Loss Exposure
Personnel Loss Exposure
Net Income Loss Exposure
ISO31000:2018 ERM Principles
• Creates and protects value
• Be an integral part of organisational processes
• Be part of decision making
• Explicitly address uncertainty
• Be systematic, structured and timely
• Based on best available information
• Be tailored
• Take into account human and cultural factors
• Be transparent and inclusive
• Be dynamic, iterative and responsive to change
• Facilitate the continual improvement of organisations
Integrate with existing
processes
 Risk Treatment
Avoid the risk
Modify the likelihood/impact of the risk
Transfer the risk
Retain the risk
Exploit the risk
 Optimum risk

Residual Inherent

Impact

Optimum

Likelihood
 Whole Cost of Risk

Cost of the residual risk

(usually the whole cost of loss)
plus the cost of all risk treatments
 Risk Evaluation
Study the organization, operation and context.
1. Define your risk horizons
Then …
2. Location risks (Hazard)
3. Operational Risks
4. Strategic & Financial Risks
… and how you might treat them
 Hazard

Reserves
1. …
Internal

Project
2. …
3. …

Residual Risks
Operational

Treatments
1. …
2. …

Strategic

Contingency
External

Strategic
1. …
2. …
Financial
1. …
2. …
3. …
 Assessing Risk
in Complex Operations
 What makes an
operation complex?
 Changing risk context
Rapid changes in process (updates)
Technological changes
System of systems networks and value chains
… engineering
 We used to use engineers to
evaluate risk
Then we codified practice for the steady
state, the future will resemble the past
 Four Approaches:

Property Prescriptive practice

Loss Incentivized risk reduction

Advisories and guidance Business

Loss
Integrated risk management
 Business
Interruption
$

Property Loss
~$10M

t
Prescriptive Practice

Clear and unambiguous

instructions on what to do and
how to do it in order to be
insurable

The challenge is that codification

is based on assumptions and
past experience; it’s not adaptive
to a dynamic risk context
Incentivized Risk Reduction

[Link]
Advice & Guidance
 Integrated Risk Management

Risk culture
Risk understanding
Objective evidenced risk picture
Risk-based planning and decision-making
This is the basis of
Risk-Based Assessment
(RBA)
Risk Control & Transfer
Key Risk Indicator - KRI

Provides warning that an identified

hazard may be realised
Thank you