|
08.11
Risk-Based
Decision Making
By Ed Perkins
Recent events have highlighted the importance of
risk-based decision making. Modern systems are
becoming more complex, and the economic, safety
and other consequences of a system failure more
serious. Ignoring risks because they are
improbable and not worth analysis has proven to
be highly risky in itself. Managing the risks of
disruptive events is becoming a critical focus
for business and society. Risk is coupled with
reliability.
Why are disruptive events a
concern? For example, the probability of a
100-year event occurring in any one year is 1
percent, but the probability that a 100-year
event will occur twice in 100 years is 18.5
percent[1]. And the probability of the 100-year
event occurring during any 100 years is 63
percent[2]. Thus, to say that the likelihood of
a 100-year event can be ignored since it won't
occur for 100 years is false.
Why is risk a concern? When
systems were simpler, there was less that could
go wrong, and when something did, it was usually
easy to determine the cause and take action.
Consider the automobile. Cars used to have
simple ignition systems, with a distributor
driven from the engine, the accelerator was a
linkage from the pedal to the carburetor, the
mixture determined by set screws. If the car was
not running right, or there was another problem,
it was simple to assess and repair. To meet emissions and mileage requirements,
today's
ignition systems are computer controlled, with
many sensors and actuators, the linkage from the
gas pedal has been replaced with a computer, and
the carburetor has been replaced by a fuel
injection module. If something goes wrong, you
read out a diagnostic code and try to determine
which of the components and interconnections is
the cause.
The automotive example illustrates
the need for a more formal approach to
risk-based decision making and risk management.
Recent events, such as the Gulf of Mexico oil
spill, Toyota’s hybrid vehicle acceleration
issue, and the Japanese earthquake and nuclear
plant disaster have highlighted the necessity to
understand inherent risks in actions undertaken to achieve
desired objectives and rewards. Said IEEE
Spectrum's Bill Sweet in a recent
energywise
blog post on the Fukushima disaster: "Worst-case scenario builders
consistently underestimate the statistical
probability of separate bad things happening
simultaneously, as the result of the same
underlying causes." [3]
What do we mean by risk
management? Risk management has several
characteristics: it is preemptive, proactive,
not reactive. In other words, risks are
identified and assessed up front, and mitigation
strategies developed, so that the likelihood of
the risk is reduced and its consequence(s)
minimized.
What do we mean by risk? There
are a number of definitions[4], but the common
theme is something — an event or condition —
which, if it occurs, will have an effect
(usually negative) on achieving desired objective(s). Risk is measured in terms of
likelihood and consequence, and hence is related
to probability.
What are the types of risk?
The three major risk types are:
-
Enterprise risk
– Risk
related to the operation of a business,
execution strategy, systemic issues,
material issues, etc.
-
Project risk – Risk related to the
planning and delivery of a product or
service and not being able to meet project
‘triple constraints’ — scope/quality,
schedule, cost (including technology)
-
Process risk – Risk relating directly
to planning and delivery of a product or
service and not being able to meet 1.
stability, 2. capability, 3. improvement
criteria, also the inability to achieve
consistent outcomes.
What are Risk Standards?
To formalize the process of risk
management, and to make it more objective and
data-driven, risk standards have been developed
and more are planned. These standards apply to
specific sectors or domains (e.g., supply
chain, information security, food safety). They
have been developed by teams of subject matter
experts, and they enumerate requirements and
best practices for mitigating risk. The standards
commonly cover: risk sources identification,
risk analysis (likelihood and consequence), risk
evaluation and ranking, and risk control and
mitigation. By identifying and analyzing risks,
informed risk-based decisions can be made.
Examples of risk standards include the American
Society of Mechanical Engineers Innovative
Technologies Institute LLC (ASME ITI)-developed
Risk Analyses and
Management for Critical Asset Protection
(RAMCAP) for the U.S. Department
of Homeland Security; this is a guidance
document for assessing risk analysis and risk
management for critical infrastructure assets.
Other standards include:
NIST 800-39
— “Managing Information Security Risk,”
ISO 28000
— “Specification for security management systems
for the supply chain;”
ISO/IEC 27001
— “Information technology—Security
techniques—Information security management
systems—Requirements;” and
ISO 31000
“Risk management—Principles and guidelines” have
been developed. For the electrical power
industry, risk management requirements are set
forth in the
NERC CIP Standards
(North American Electric Reliability Corp.
Critcial Infrastructure Protection).
How are risk standards
applied?
A simple example of effective
application of risk standards is
electrical wiring [5]. At one point, parallel
wires were run mounted on insulators (knob and
tube). There was risk of electrocution or fire,
so the wires were coated with rubber and put
into a cable. The rubber would become brittle so
eventually plastic (PVC) insulation for wires
and cover were employed (e.g. Romex™). Risk of
shock led to inclusion of a ground wire. To
promote public safety and reduce electrocution
and fire risks, electrical codes were developed.
A code specifies wire sizes, installation
practices and circuit protection. The U.S.
National Electrical Code (NEC), first published
in 1897 by the National Fire Protection
Association, is required by state and city
building codes. Electrical wiring must be
inspected for compliance to code before a
building can be occupied. The practices called
out in the NEC, as developed by engineers,
electricians, manufacturers, fire fighters and
other interested parties, are designed to reduce
risks.
How does risk factor into
decision making?
There are two aspects of risk
that must be considered when making a
decision[6] — those that can be controlled, and
those that cannot be controlled, but which can
materially affect the outcome of the decision or
choice. The uncontrolled aspects are usually
related to the decision environment. Added to
this are constraints which exist on both
aspects. The uncontrolled aspects represent
risks and the constraints can include
consequences. An added complication are
unexpected aspects (that are unknown or are
“ignored as not a factor” — hidden risks, such
as concurrently occurring aspects). If the
uncontrolled aspect risks are not assessed, the
quality of the resulting decision is inadequate
(high risk). By performing a risk assessment the
resulting decision will be of much higher
quality (low or acceptable risk). By adding the
unexpected aspects (such as by brainstorming a
“what is the worst that could happen” analysis)
the risk can be reduced even further.
What are the benefits of risk
management and risk-based decision making?
Today’s business environment can be described as
“VUCA” — volatility, uncertainty, complexity and
ambiguity. Risk management permits organizations
to manage under VUCA, enjoying a reduction in
unpleasant product “surprises,” more satisfied
customers, improved compliance with regulations,
assurance (“sleep at night”) and enhanced
decisions.
The 21 September IEEE-USA
webinar, “Risk
Management Standards and Decision-making,”
will explore this subject in more detail.
“
References
[1] Probability of event
occurring Y times in n periods:
PrY:n = n! PY
(1-P)(n-Y)
(Y!)(n-Y)!
Pr2:100 = 100! (0.01)2
(0.99)98 = 99*100 (0.01)2
(0.99)98 = 0.185 = 18.5%
(2!)(98!)
2
[2] Probability of event
occurring during n periods:
P =1-(1-Pr)n
P = 1- (0.99)100 = 1-0.366 =0.634 =
63.4%
[3] “Japan Nuclear Accident: Worse than Worst, Again”;
http://spectrum.ieee.org/energywise/energy/nuclear/
japan-nuclear-accident-worse-than-worst-again
[4] Risk definitions
[5] Electrical Wiring, see
Wikipedia:
http://en.wikipedia.org/wiki/Electrical_wiring.
[6] Russell Ackoff, , “Ackoff’s
Best: His Classic Writings on Management,”
Wiley, NYC, 1999
Ed Perkins is IEEE's Region 6
director.
Comments may be submitted to
todaysengineer@ieee.org.
|
Comments
on this story may be
sent directly to