Friday, April 15, 2011

The Four Dimensions of Risk

On a long enough timeline, the life expectancy of everyone drops to zero.” 
Chuck Palahniuk (Fight Club)

In a previous article, we talked about the four things that we trade-off when managing risk.  In this article we will look at the qualities which we can use to quantify risk. Although we typically measure risk in terms of likelihood and consequence, these are not the only dimensions that we need to consider. Life in the real world is rarely that simple. Without limiting our assessment to a timescale, likelihood and consequence are of little help.

The likelihood of an earthquake in Japan or a massive drop in the Dow Jones Industrial Average is basically 99.9999% unless we include time constraints. Let’s face it, sometime in the next 1,000 years or so, such events are virtually inevitable. The virtual certainty of an earthquake in Japan however, fits neatly into the category of “true but not helpful”.   What we really want to know is the likelihood and consequence of a particular event happening, during a particular timeframe, if we undertake the activity in question 'n' times. To get a better insight into this we could consider the ‘quadruple dimensions of risk’ to be:

  • Consequence – what impact could occur 
  • Likelihood – what is the probability of the impact occurring 
  • Time – what is the timeframe over which the risk could occur 
  • Incidence – how often do we undertake the activity 

These four parameters change everything.  Hence the better question to ask is:

  • What is the probability (LIKELIHOOD) 
  • of a level 7 or greater earthquake affecting our people (CONSEQUENCE)  
  • in Japan during the next four years (TIME) 
  • if they make four trips per year of one month per trip (INCIDENCE).

Another more pertinent risk question might be phrased as follows:  “What is the chance (LIKELIHOOD) of dying (CONSEQUENCE) in a car accident during my lifetime (TIME) if I make 10 motor vehicle journeys per week (INCIDENCE)?
Four Dimensions of Risk

In the above diagram, the level of risk could be considered to be the volume of the pyramid. If we increase any one of these four elements, the overall level of risk increases. Although adding complexity that is unwarranted in many risk assessments, consideration of their magnitude is very significant to the results we generate. For example, although we can calculate the average risk for any given member of society dying in a car crash, it is still highly variable if someone drives twice a year versus twice a day.  Equally, a teenager is statistically much more likely to die behind the wheel in the next twenty years, than an octogenarian who has only two more years of life expectancy.

As a final thought, even if you are unable to consider all these variables, you need to be explicit regarding timeframe.  Including a statement such as: “This risk assessment considers the likelihood of identified risks occurring during the following twelve months.” in the Scope section will add clarity to your analysis.

1 comment:

  1. HI, Julian.

    Following-on from the old addage "if it can't be measured' it cannot be managed", your ideals of getting as close as possible to the mark, are right-on! Pin-pointing each effect and affectation allows best practice and it is a concern of mine when attempting to give good risk management figures (I am a safety, security ahealthand environmnet consultant), that there are often areas where very specialised analysis is required, and neither I, nor my Client, can afford such depth. (I have a saying: 'Total inspection equals total protection' but who can actually afford TOTAL inspection? Since most - the vast majority in fact - of damaging occurrences or potentially damaging occurrences (DO/PDOs) are due to 'human error/oversight/failing of some sort, getting the pin-point stuff is important. BTW: I do understand, of course, there will always be a couple of percent of 'Acts of Nature' in our DO/PDOs but even these are getting predictable with greater acuracy, so at least human injury/illness can be minimised...)

    The importance of knowing what energies exist (obviusly affecting 'consequence') is important, since no injury, no illness, no damage can occur without an exchange of energy.

    In this regard, moving from my own discipline, and looking at 'risk' from a financier's perspective ('to buy or not to buy...') I would suggest money is an 'energy' and can be considered in the 'consequence' part of your pyramid.

    I wish I had more time to philosphise in these various forums... but thanks for your work (which I came across via linkedin). Kind regards,

    Doug Wakefield