Risk

Analysis:
Fundamental
Principles
Expert group members:
Terje Aven (leader)
Henning Boje Andersen
Tony Cox
Enrique López Droguett
Michael Greenberg
Seth Guikema
Wolfgang Kröger
Katherine McComas
Ortwin Renn
Kimberly M. Thompson
Enrico Zio

Updated August 2018

RISK ANALYSIS: FUNDAMENTAL PRINCIPLES
The Society for Risk Analysis (SRA) Specialty Group on An illustrating example is categorizations of scientific areas,
foundational issues in risk analysis has established a group as used for instance in research funding schemes, where
of risk analysis experts with the mandate to develop a list of risk analysis is not included. Globally we also find rather
key principles that expresses high quality and trustworthy few educational programs (such as master’s programs) and
risk analysis. professorships in risk analysis.

Expert group members: To solve risk problems, the risk analysis approaches and
Terje Aven (leader) methods are combined with knowledge from statistics,
Henning Boje Andersen psychology, social sciences, engineering, medicine and
Tony Cox many other disciplines and fields. The problems require
Enrique López Droguett multidisciplinary and interdisciplinary activities. The focus
Michael Greenberg is on climate change, business, medicine, etc., with risk
Seth Guikema analysis supporting the work. However, research is also
Wolfgang Kröger conducted on risk analysis concepts, principles and
Katherine McComas methods as such, for example related to how to best
Ortwin Renn conceptualize and describe risk, and how to understand
Kimberly M. Thompson and use the precautionary principle. Thus risk analysis is not
Enrico Zio only a science supporting the knowledge generation of risk
related to various activities (e.g., operation of engineering
The term risk analysis is here used in line with the systems, natural phenomena, medical treatments), but
established tradition of SRA to include: risk assessment, risk also a science producing knowledge related to concepts,
characterization, risk perception, risk communication, risk theories, principles, models and methods regarding how to
management, risk governance, and policy relating to risk, understand, assess, characterise, communicate, manage
in the context of risks of concern to individuals, to public- and govern risk.
and private-sector organizations, and to society at a local,
regional, national, or global level. Risk analysis addresses In a recent document from the Society for Risk Analysis
both negative (undesirable) and positive (desirable) ([Link]/resources) a list of core subjects of risk
consequences, but the main focus of the present work is analysis was developed. It captures five main categories
on the negative part. of subjects: Fundamentals (I) (science, knowledge,
uncertainties, risk - and other basic concepts); Risk
assessment (II); Risk perception and communication (III); Risk
OBJECTIVES management and governance (IV), and Solving real risk
The objectives behind the preparation of this document, problems and issues (V).
including the list of key principles, are:
This document defines some core subjects/topics of risk
1. To initiate and foster a discussion on what high analysis, but it does not take a stand on which are the
quality and trustworthy risk analysis and key key ones and how to interpret them. It just lists them. The
principles of risk analysis are present document goes one step forward and provides
2. To provide an authoritative guidance on the guidance on what fundamental principles to adopt in order
fundamental principles to be adopted when to ensure high quality and trustworthy risk analysis. This
conducting risk analysis. is considered important as the risk field still suffers from a
lack of clarity and consensus on what are the key scientific
pillars of the field. The situation is chaotic and leads to poor
SCOPE, RATIONALE AND PROCESS communication. It also hampers effective risk management
Approaches and methods for risk analysis are now applied and the development of the risk field, as many of the
all over the world and in most societal sectors, and many definitions and perspectives adopted lack proper scientific
advances have been made on different topics of risk support and justification.
analysis over the years. However, risk analysis is not
broadly recognized as a separate/distinct science.

Society for Risk Analysis • Core Subjects of Risk Analysis 2

RISK ANALYSIS: FUNDAMENTAL PRINCIPLES

The history shows that it is difficult to obtain consensus b. Generic knowledge on concepts, theories,
on this type of issues. However, the development of the frameworks, approaches, principles, methods
SRA Glossary and the Core Subjects document ([Link]. and models to understand, assess, characterize,
org/resources) has shown that broad consensus can be communicate and (in a broad sense) manage risk.
achieved if the work is properly structured and some level
of flexibility is allowed for, within given frames. Concrete activities to collect data and establish databases
are to be considered of type A, whereas methods for how
The fundamental principles are necessary to ensure that to do these activities are covered by B.
risk analysis applications and training can progress from
a scientifically solid platform. It is always a challenge to Contributions to risk analysis mean adding knowledge to A
balance the need for authoritative guidance and solutions or B, or both. For each of the coming four themes, we can
on the one hand, and the need for continuous debate, relate the knowledge generation to A and B as indicated in
research and improvement on the other. The present the Core Subjects document.
document acknowledges the importance of this balance,
and is focused on rather high level principles. The 3. In risk analysis we make clear distinctions between
document is built on the risk analysis literature providing variation/variability, uncertainty and imprecision,
analytic arguments on how to conduct risk analysis, also and different methods are used to represent and/
reflecting the authors’ insights on these issues obtained or express these, like frequentist probabilities
from both practical experience and theoretical work. (and related probability models), probability and
imprecise probability, respectively. Clear and
The target audience for the document is all individuals meaningful interpretations are required for these
who have an interest in risk analysis, SRA members or not, concepts, such as:
ranging from risk analysis professionals and practitioners,
to researchers, students, decision makers, bureaucrats, Frequentist probability of an event A: the limiting
regulators, journalists and curious lay people who would fraction of times A occurs if the situation considered
like to get an overview of what the fundamental principles were repeated (hypothetically) an infinite number of
are to ensure prudent risk analysis. times.

If you have any comments on the document, please email Probability of an event A: the number such that
[Link]@[Link]. the uncertainty about (degree of belief in) the
occurrence of A is considered equivalent by the
person assigning the probability, to the uncertainty
FUNDAMENTAL PRINCIPLES about (degree of belief in) some standard event,
We have structured the principles according to the five for example drawing at random a red ball from an
themes of the Core Subjects of Risk Analysis document, urn that contains P(A) x 100% red balls. Hence a
mentioned above. probability of 0.1 means that the assigner considers
the uncertainty (degree of belief) for the event to
1. FUNDAMENTALS occur to be the same as randomly drawing one
1. Terminology in line with the SRA Glossary ([Link]. particular ball out of an urn comprising 10 balls. The
org/resources) probability is conditional on the knowledge K of the
assessor. We write P(A|K).
2. Risk analysis covers two main types of knowledge
generation: Imprecise probability of an event A: A probability
a. Risk knowledge related to specific activities interval [a,b] expressing that the assigner is not willing
(interpreted in a broad sense covering also to be more precise than the interval specified given
natural phenomena) in the real world, for example his/her knowledge K. If for example an interval [0.1,
the use of a medical drug, the design of a 0.2] is specified, it means that the assigner’s degree
process plant, or the climate. of belief for A to occur is higher than or equal to the
degree of belief of randomly drawing one particular
ball out of an urn comprising 10 balls and less than
or equal to the degree of belief of randomly drawing

Society for Risk Analysis • Core Subjects of Risk Analysis 3

RISK ANALYSIS: FUNDAMENTAL PRINCIPLES

one particular ball out of an urn comprising five balls. knowledge and lack of knowledge have
Given the knowledge K, he/she is not willing or able been properly addressed.
to be more precise.
ii. The decision maker (and other stakeholders)
has confidence in the assessment with its
2. RISK ASSESSMENT results and findings. This confidence will
• Risk assessment is the systematic process to identify depend on many factors, including the
risk sources, threats, hazards and opportunities; analysts’ and scientists’ own evaluations of
understanding how these can materialize/occur, the quality of their assessments, and how the
trigger events/event sequences, and what their decision maker judges the competence of the
consequences can be; representing and expressing analysts and scientists.
uncertainties and risk; and determining the • Peer review is a useful tool for checking
significance of the risk using relevant criteria. and improving the quality of scientific risk
• Risk assessment uses the best available data, assessments
information and knowledge, within the constraints and
frames of the assessment. 3. RISK PERCEPTION AND COMMUNICATION
• Probability theory and other frameworks for • Risk perception refers to a person’s subjective
representing, modeling and treating variation and judgement or appraisal of risk, which can involve
uncertainties, as well as traditional statistical and social, cultural and psychological factors.
Bayesian analyses, provide basic tools of risk
• Risk perceptions need to be carefully considered
assessment.
and incorporated into risk management, as they
• Quantitative measures of uncertainty (typically, will influence how people respond to the risks and
probability and imprecise probabilities) should subsequent management efforts.
be supplemented with characterizations of the
• Risk perception studies are important for (i) identifying
knowledge that these measures are based on. Such
concerns but not necessarily for measuring their
characterisations may cover lists of assumptions and
potential impacts and (ii) for providing value
judgments of the strength of the knowledge.
judgement with respect to unavoidable trade-offs in
• A high quality scientific risk assessment meets the the case of conflicting values or objectives.
following criteria:
• Risk communication can be broadly understood as an
i. It meets some basic scientific requirements iterative exchange or sharing of information related to
• It is solid (complying with all rules, the characterization, assessment and management of
assumptions, constraints, etc; the basis risk between and among different groups, including
for all choices, judgments etc., are clear; regulators, stakeholders, consumers, media and
principles, methods, etc are subjected to general public. It is multi-directional and includes
order and system so that critique can be both formal and informal messages and purposeful
raised; etc. and unintentional ones. In today’s super-mediated
• It is relevant and useful (contributing to environment, risk professionals must also recognize
solving a problem, meeting stakeholders’ that any risk message they seek to communicate is
expectations, etc.) likely competing with multiple, conflicting messages
• It is reliable and valid. While reliability is from unofficial sources.
concerned with the consistency of the • Successful risk communication requires an
‘measuring instrument’ (analysts, experts, understanding of the target audience, including the
methods, procedures), validity is concerned best means for reaching the audience: a credible or
with the success at “measuring” what one trusted source; and a message that has ideally been
sets out to “measure” in the analysis. A pre-tested to ensure its effectiveness. Those seeking
key aspect to be considered in relation to develop and test risk messages employ a host of
to validity is the degree to which the methods, including surveys, focus groups, interviews

Society for Risk Analysis • Core Subjects of Risk Analysis 4

RISK ANALYSIS: FUNDAMENTAL PRINCIPLES

and experiments. There is also a vast theoretical cases, the appropriate strategy would be a mixture
literature to inform the practice of risk communication. of these three types of strategies. The higher stakes
• A prerequisite for successful risk communication in involved and larger uncertainties, the more weight on
many situations is clarity on fundamental risk analysis the second category and the more of interpretative
concepts and principles, for example what uncertainty ambiguity and normative ambiguity (different views
means in a risk assessment context. related to the relevant values) the more weight on
category III.
• With few exceptions, such as proprietary information
or that which may damage public security, risk • This process of balancing different concerns can
professionals should seek an open, transparent and be supported by cost-benefit methods, but this type
timely risk communication policy. Such a policy not of formal analyses needs to be supplemented with
only demonstrates respect for the target audiences broader judgements of risk and uncertainties, as well
and ensures they have the information they need to as stakeholder involvement processes.
take risk mitigation actions, if necessary, but it also • To protect values like human lives and health, and the
can help ensure the perceived trustworthiness and environment, the associated risk must be judged to
legitimacy of the sources. be sufficiently low.

4. RISK MANAGEMENT AND GOVERNANCE 5. SOLVING RISK PROBLEMS AND ISSUES

• Risk management covers all measures and activities • There are many challenges and issues related to
carried out to manage and govern risk, balancing solving real risk problems in practice (which are
developments and exploring opportunities on the one usually multidisciplinary and interdisciplinary in their
hand, and avoiding losses, accidents and disasters on form), by integrating theories and methods from risk
the other. In general, the proper risk level is a result of assessment, risk perception, risk communication
a value and evidence/knowledge-informed process, and risk management, as well as from other fields/
balancing different concerns. To generate value, risk disciplines.
taking is needed. How much risk to accept in pursuit
of value is context-dependent and depends on how Successful risk analysis in practice, means inter alia that
values are weighted. • The risk assessment is engaged effectively in the risk
• Risk governance is the application of governance management decision process
principles to the identification, assessment, • The risk characterization has a format suitable for the
management and communication of risk. Governance decision-making situation
refers to the actions, processes, traditions and
institutions by which authority is exercised and • The disclosure of the actual role of the analysis, e.g.,
decisions are taken and implemented. Risk advise vs. defend, is practiced
governance includes the totality of actors, rules, • Assumptions and caveats, and the implications of
conventions, processes and mechanisms concerned these for the decision-making, has been stated
with how relevant risk information is collected, • Potential surprises are addressed and relevant
analysed and communicated and management/ management strategies implemented
regulatory decisions are taken.
• Legal requirements are met
• Three major strategies are needed for managing
or governing risk: (I) risk-informed strategies, (II)
Peer review is commonly used in relation to risk
cautionary/precautionary/robustness/resilience
assessment (2) but is also useful for other types of risk
strategies (meeting uncertainties and potential
analysis activities, including the design of risk management
surprises), and (III) discursive strategies. In most
strategies and policies.

Society for Risk Analysis • Core Subjects of Risk Analysis 5