Friday, October 14, 2011

As High or Low As Reasonably Practicable (AHLARP)

We've been debating lately, how well the ALARP concept withstands scrutiny under the ISO31000 definition of risk? The answer - not very well.   In a previous blog, we looked at the traditional view of mitigating risk to be as low as reasonably practicable which is fine when we look at negative risk. Unfortunately for ALARP, the ISO 31000 definition - the effect of uncertainty on objectives - includes both positive and negative risk.  In the case of positive outcomes, we want to manage them to be as HIGH as reasonably practicable.

We decided that it was time to upgrade ALARP to AHLARP (As High/Low as Reasonably Practicable) and being visual thinkers, decided that it was time for a new model.  Along the way, we came up with new acronyms, including RTP. RTP stands for 'Risk Tipping Point' and builds on Malcolm Gladwells concept of a tipping point. It's the point where positive risk starts to outweigh negative risk.

Whether we talk about IT projects, business activities or saving an endangered species, it is fair to say that without some input of resources/effort, the initiative is more likely to fail than to succeed. Putting this into ISO31000 speak, we would say that 'objectives are unlikely to be met'. Simply putting resources into something is of course, no guarantee that it will succeed, but it's fair to say that (assuming some level of planning and quality) the more resources we put in, the lower the negative risk and the higher the positive risk.

Figure 1: AHLARP Model
Using a notional example in Figure 1 above, you can see that it doesn't take a huge amount of resources to reach the risk tipping point. A few more resources and you've hopefully managed negative risk down to the point where additional resources aren't making a huge difference to reducing hazards. Positive risk should in theory continue to increase up to the point where it (green line) starts to flatten out and increasing resources (blue line) don't have much impact.

AHLARP becomes the conceptual area where our risk strategies are achieving the optimal range of benefits for a given range of resource inputs. This infers what we already know from experience, that there is no single perfect point for risk/reward optimization, but rather a range where we are trying to balance resource (cost) with positive risk (potential benefit) and negative risk (potential loss).

Accepting that there is rarely if ever, a single point where likelihood and consequence form a point value (eg: "this risk as a 57.6% likelihood of generating $123,000 benefit") we can look at illustrating risk across a spread of outcomes. Figure 2 below, illustrates the likely spread of outcomes if we apply insufficient resources (or quality) to manage a risk.
Figure 2: Inadequate resources increase the likelihood of negative consequences
Figure 3 by comparison, looks at what we seek to do with risk management. If we had to sum up risk management in a single picture, this would be a worthy contender. What we try to do is quite simply, to push the spread of likely outcomes towards the positive. A statistician might say that we're applying resources to left-skew the possible range of outcomes. ISO31000 might say that we're attempting to reduce the 'effect of uncertainty on objectives'.
Figure 3: Applying management resources to shift risk outcomes towards the positive
Judging just how much investment is appropriate to achieve AHLARP, is of course no simple feat. Too little is, well... too little and likely to be a waste of money/time/effort with little impact on outcomes. By contrast, applying an excess of resources is just wasteful and leaves inadequate resources for other projects.  Figure 4 illustrates this idea as a general concept but sadly doesn't give us the magic formula (hey, if it was easy, there'd be no need for risk management, and few if any Enrons, HIH, Exxon Valdes, etc).
Figure 4: Range of 'prudent' investment
Determining what is 'prudent' or 'appropriate' requires significant analysis, well beyond the scope of any single book or blog entry.  That being said, there are some general principles that can be applied. It's tempting to say that 'the more risky a venture is, the more resources should be applied' but that simply isn't the case. Some ventures have significant upside risk, with little downside risk. Running a stationery manufacturer or bookshop will probably work out well without a huge need to manage downside risk. Sure, you probably won't create the next Amazon but you're likely to make a good living and steady income. A hydrocarbon plant by comparison, can turn out to be brilliantly profitable or catastrophically bad - and it can turn around from one to the other in a matter for days, weeks or months.
Figure 5: 'Prudent' is context driven
Figure 5 illustrates the different nature of investment depending on your context. 'Prudent' investment for a gas plant is likely to involve a significantly larger amount of resources and cash than making prudent investments for a bicycle manufacturer or a stationary supplier. Even if the businesses have the same turnover and relative size,  one is simply more volatile than the other. Which leads us to the concluding point.

The more volatile a risk is, the more resources need to be applied. If the green and red lines in Figure 1 have a lot of potential ranges, it's going to be expensive to stay consistently within the AHLARP zone.


  1. Nice article and great blogsite. I just wanted to comment on the notion of 'positive risk' and suggest that such a concept is illogical. To most people I have met over the years, internationally, risk implies adverse (negative) consequences. I find great difficulty in talking about, for example, the risk of winning a million dollars or the risk of being cured of cancer or the risk of getting to work on time given the traffic. Should we not simply accept that risk is inherently negative and talk about anything positive as a benefit, or some similar terminology?

  2. Thanks for the kind words and excellent comment Stuart..

    Totally agree. The way we use risk in general language relates almost exclusively to negative outcomes. Like you, I used to have difficulty reconciling the concept of 'positive risk' but after some reflection i think it's a valid definition.

    Most professions have their own specialized terminology - and for good reason. If you look for example ,at the weird and wonderful terms from medicine, most of them come from ancient Greek or Latin. Even the English word 'acute' has a different definition in the medical world. Once upon a time, I used to think that medicine was taking an elitist approach. When I consindered how much language changes over time, I can see why it’s so important to create unique terms which are 'frozen in time'. Once upon a time for example, 'awful' meant ‘full of awe’ - something wonderful, delightful, amazing. Over time it has evolved to mean exactly the opposite.

    I think 'risk' is a terms that is important enough to have a professional definition even if that's different from common usage. As far as I can tell, the original definition of 'risk' can be traced back to classical Greek where it meant “difficulty to avoid in the sea". Unless we have an agreed professional definition of risk, we ‘risk’ ending up without any common understanding at all.

    The other thing that convinced me about the ISO31000 definition, is that there is no ‘negative risk’ that doesn’t bring positives with it. More on this point in my April blog if you’re curious