8/6/2019 Using Risk Maps
1/42
Using Risk Maps to visuallymodel & communicate risk
Martin NeilAgena Ltd &
Risk Assessment and Decision Analysis Research Group,
Department of Computer Science, Queen Mary, University of LondonLondon, UK
Web: www.agenarisk.com
Email: [email protected]
8/6/2019 Using Risk Maps
2/42
2
Contents
Problems with current approaches
Risk Maps as Solution
Risk Map Toolkit Risk Mapping for Enterprise Risk
Risk Map Applications
Final Remarks
All Examples shown using AgenaRisk software
8/6/2019 Using Risk Maps
3/42
Problems with current
approaches
8/6/2019 Using Risk Maps
4/42
4
Risk Register
There are tight budget constraints
The project overruns its schedule
The companys reputation is damagedexternally by publicity about poor final system
The customer refuses to pay
The delivered system has many faults The requirements are especially complex
The development staff are incompetent
Key staff leave the project
The staff are poorly motivated
Generally cannot recruit good staff becauseof location
There is a major terrorist attack
8/6/2019 Using Risk Maps
5/42
5
Risk Heat Maps and Profiles
Risk = Likelihood x Impact
8/6/2019 Using Risk Maps
6/42
6
Spreadsheets
8/6/2019 Using Risk Maps
7/42
7
Expert Judgement I Assume
On the one hand. Obvious risk of being wrong
Dangerous if unverified, checked or agreed
Political
On the other hand. Absolutely necessary
Unavoidable
We employ people for a reason!
Model Risk: If you want to analyse riskyou are going to have to take them.
8/6/2019 Using Risk Maps
8/42
8
How good are people
at estimating risk?
Evidence from psychology is worrying! Availability of more recent cases
Emphasis on easier to remember dramatic events
Large single consequence often outweighs
multiple small consequences Framing Problem: Answer you get depends how
you ask the question!
What is the chance of disease?
Vs
Given positive test result what is the chance of disease?
Vs
Chance of disease given test positive?
8/6/2019 Using Risk Maps
9/42
9
If you cannot trust people
can you trust the data?
Statistical validity restricted to controlled
experiments
Data sets must represent homogeneous
samples and correlations clear
High correlation between shoe size and IQ!
Do you even have the data?
New business ventures?
Rare events?
The lure of objective irrationality
8/6/2019 Using Risk Maps
10/42
10
Combining Subjective and
Objective information Casino 1 Honest Joes.
You visit a reputable casino at midnight in a good neighbourhood
in a city you know well. When there you see various civic
dignitaries (judges etc.). You decide to play a dice game where
you win if the die comes up six. What is the probability of a six?
Casino 2 Shady Sams.
More than a few drinks later the Casino closes forcing you to
gamble elsewhere. You know the only place open is Shady
Sams but you have never been. The doormen give you a hardtime, there are prostitutes at the bar and hustlers all around. Yet
you decide to play the same dice game.
What is the probability of a six?
8/6/2019 Using Risk Maps
11/42
Risk Maps as a Solution
8/6/2019 Using Risk Maps
12/42
12
Assessing Risk of Road Fatalities:
Nave Approach
Season Colder months
Number ofFatalities
Fewer fatalities
A i Ri k f R d
8/6/2019 Using Risk Maps
13/42
13
Assessing Risk of Road
Fatalities: Causal model
Season
Weather
Average
speed
Danger
level
Road
Conditions
Number of
Fatalities
Number
of journeys
8/6/2019 Using Risk Maps
14/42
14
Rev Thomas Bayes
8/6/2019 Using Risk Maps
15/42
15
Bayes Theorem
A: Person has cancer p(A) = 0.1 (priors)B: Person is smoker p(B) = 0.5
What is p(A | B)? (posterior)
p(B | A) = 0.8 (likelihood)
Prior probabilityLikelihoodPosterior probability
So p(A|B)=0.16
=
( | ) ( )( | ) ( )
p B A p A p A B p B
8/6/2019 Using Risk Maps
16/42
16
Decomposing (Exposing) Risk
Measure Standard Definition:
Is this decomposition enough?
Expose the assumptions!
What is the context driving the numbers?
Whos risk is it?
Is it a risk to me?
Is it really a risk?
An indicator of a risk?
A mitigant..?
Risk = Impact x Probability
8/6/2019 Using Risk Maps
17/42
17
Causal Framework for Risk
Replace oversimplistic measure of riskwith a causal approach
Characterise risk by event chain involving:
The risk itself (at least) One consequence event
One or more trigger events
One or more mitigant events Context tells a story and depends on
perspective
8/6/2019 Using Risk Maps
18/42
18
Town Flood Example
Risk Event
Trigger Control
Mitigant
Consequence
8/6/2019 Using Risk Maps
19/42
19
Calculation of Town Flood Risk
8/6/2019 Using Risk Maps
20/42
20
Flood Example Homeowners
Perspective
Risk Event
Trigger Control
Mitigant
Consequence
8/6/2019 Using Risk Maps
21/42
21
Calculation of Home Flood Risk
8/6/2019 Using Risk Maps
22/42
22
4 Steps to define a risk map
1. Consider set of events from given
perspective
2. For each event identify triggers and
controls
3. For each event identify consquences and
mitigants
4. Define probabilities for risk nodes
C
8/6/2019 Using Risk Maps
23/42
23
Connecting Risk Maps using
Building Blocks
Connect risk mapsvia input/output risk
nodes
Create complex time
based or complex
structural models
8/6/2019 Using Risk Maps
24/42
24
Benefits
A picture tells a thousand words
Explicitly quantifies uncertainty
Connecting models connects
perspectives
Dynamic calculation of risk values
Great for what if analysis
8/6/2019 Using Risk Maps
25/42
Risk Map Toolkit
8/6/2019 Using Risk Maps
26/42
26
Sophistication Spectrum
Causal
modelling
Simulation
Statistical
Learning
from data
Mind
Mapping
Expert
Systems
Dynamic
Modelling
Accessible
And
Simple
Expert led
And
Difficult
8/6/2019 Using Risk Maps
27/42
27
Risk Map
Nodes represent
variables
events
quantities
Links representrelationships
relevance
causality
Easy to supportand understand
8/6/2019 Using Risk Maps
28/42
28
Measuring Scales
Risk Node Types
Boolean (Yes/No, True/False)
Labelled (Red, Blue, Green)
Numeric (Integer, Continuous, Discrete)
Ranked (High, Medium, Low)
8/6/2019 Using Risk Maps
29/42
29
Discrete Probabilities
Prior probabilities
Conditional Probabilities
Result viewed as marginal probability distribution
8/6/2019 Using Risk Maps
30/42
30
Continuous Probabilities by Simulation
Model Statistical Distributions E.g. Normal
2 2( ) /(2 )1( )
2
x p X e
m s
s p
- -
=
8/6/2019 Using Risk Maps
31/42
31
Simulation Model
8/6/2019 Using Risk Maps
32/42
32
Backwards Reasoning
Estimate causesfrom effects!
Useful way to
model uncertain
indicators
8/6/2019 Using Risk Maps
33/42
33
Statistical Learning
8/6/2019 Using Risk Maps
34/42
Risk Mapping for
Enterprise Risk
8/6/2019 Using Risk Maps
35/42
35
Key RCSA* Questions
What risks can occur?
Can they occur in my process?
How rare are they?
How reliable are our controls? How good is our internal and external data?
What is likely level of losses?
What is worst case scenario?
How can we improve?
What should we improve?
Agena Ltd 2005
* RCSA = Risk Control Self Assessment
8/6/2019 Using Risk Maps
36/42
36
Assessing Enterprise Risk
Blend qualitative information with quantitative loss data COSO/CRSA style risk and business assessment
Self assessment data to predict process reliability inquantitative terms
Measure and combine: Process, Task reliability
Risks to reliability
Action plans
Issues
Used to forecast VaR, ROI, capital charge, insurancelevels.
Agena Ltd 2005
8/6/2019 Using Risk Maps
37/42
37
Risk Map for RCSA
8/6/2019 Using Risk Maps
38/42
Risk Map Applications
8/6/2019 Using Risk Maps
39/42
39
Risky Applications
Aircraft Mid air
collision
Software defects
Systems reliability Warranty return rates
of electronic parts
Operational risk infinancial institutions
8/6/2019 Using Risk Maps
40/42
40
Aircraft Mid Air Collision Prediction
8/6/2019 Using Risk Maps
41/42
N t St
8/6/2019 Using Risk Maps
42/42
42
Next Steps
www.agenarisk.com
To build a risk map download and enjoy a FREE
Evaluation copy of AgenaRisk visit: