Estimating Risk

A Management Approach

Andy Garlick

• Publisher: Routledge
• Year: 2017
• eBook ISBN: 9781351939102
• Topic: Business
• Subtopic: Business General
• Index: Business

Andy Garlick's book explores the role of quantitative techniques in modern risk management. Risk management has grown in importance in most organisations in the last 20 years, but in many remains simply a matter of processing lists of risks and actions. The author argues that this fails to make the most of the techniques available and that organisations can improve their risk decision making by using risk models. His book describes a broad range of modelling techniques, all illustrated by business-relevant examples. The role of the models in decision making is also discussed, with particular emphasis on what the risk premium - the price people charge for accepting risk - is and should be. In order to provide a self contained account the underpinning material from probability and decision theory is also included, so that the book will provide a handy reference guide for all practitioners. The discussion is consistently informal, and the book provides a critical view of the accepted wisdom in risk management. This book will enable managers and their specialist advisors to improve their approach to risk whilst removing the mystique.

PART I Risk Management Overview

The first of four sections in the book, Part I provides an overview of risk management, focusing particularly on the role of quantitative techniques in organisational and business risk management. This section is intended to be reasonably self-contained and suitable for the general reader. It is therefore quite explicit in defining jargon and explaining any of the necessary concepts. To illustrate these concepts and view them in realistic situations, examples are drawn from a fictional, yet typical, manufacturing company.

Figure I.1 describes the contents of Part I.

Figure I.1 The structure of Part I

Chapter 1 provides a short introduction to risk and the benefits of visibly incorporating risk awareness within management. It then sets out the context for business risk management, which will be the main topic of the book.

In Chapter 2 we move on to provide a brief overview of the qualitative approach to risk management which has become widely adopted in recent years.

Chapter 3 sets out to introduce quantitative risk estimates. Defining what they are and what insights they can give you to help in the management of your organisation is one of the primary goals of the book.

Finally, Chapter 4 deals with the other main purpose of the book: to clarify the role of quantitative risk estimates and provide guidance on when they can be developed usefully. The ABCo manufacturing company is revisited before a new example involving an imaginary major PFI deal is developed. The section concludes with a review of the main features covered.

Part I is followed by three sections which contain supporting material for what has been presented in the initial section. Explanations of how to develop quantitative risk estimates and how they have been implemented in practice are explored through the remainder of the book.

CHAPTER 1 Risk in Context

Risk management

The last 20 years or so have seen a tremendous increase in the awareness of ‘risk’ and use of ‘risk management’ in organisations. We see this in the recent initiative to introduce risk management into UK government departments. We see it in new requirements for corporate governance, especially the Turnbull guidance. We see it in structured approaches to risk sharing and the allocation of responsibility in new forms of contract, including PFIs. And we see it in changing ways of regulating safety, which require risks to be demonstrably reduced to levels as low as reasonably practicable.

All these examples are drawn from the UK, but similar trends are seen worldwide. It is as if a whole new industry has been created. Worse, there is a suspicion that this industry was created to service the latest management fad. But risk is turning out to be quite a robust fad. This should not be surprising as it is not a fad at all, but a core management concept which will be with us for as long as we have managers.

It has always been the job of managers in organisations to take decisions and act bearing future uncertainty in mind. This is what risk management is about. At its core is the knowledge that we cannot predict the future with certainty, but we can take steps which will tend to favour preferable outcomes over less attractive ones. There are ways to do this systematically, listing the different possible futures and listing the actions which will tend to prevent the unwanted outcomes and promote the desirable ones. (It is also a good idea to carry out the actions you have listed, a point that is sometimes forgotten.)

So, avoiding formal definitions for the moment, risk is the existence of uncertainty about the future. Risk management is the discipline of making decisions and acting whilst demonstrably taking account of this potential for different future outcomes. The next chapter provides a primer on the accepted wisdom of how it should be done, but it is worth pointing out straight away that this is not conceptually difficult. The problem, if there is one, is the practical difficulty of enumerating and dealing with the many and complex ways in which the future may unfold.

Because it is a core function of managers to work for better futures – what else are they there for? – it goes without saying that risk management is important. Sometimes one is asked to demonstrate the business case for risk management. You get involved in comparing the costs of buying and implementing a dedicated risk database with the cost of all the horrible things which you hope will not happen because you’ve got the database. I don’t think this is a very useful exercise: either you think visible risk management is a good idea or not in the same way as you might think keeping a set of accounts is a good idea or not.

It is worth pointing out that not everything which goes wrong indicates a failure of risk management. It is traditional to lard books about risk management with juicy reminders about nasty things happening to companies. Cautionary tales have been wrung out of Enron, Worldcom, Marks and Spencer, Railtrack, Shell and Barings, amongst others. They are presented as risk management object lessons: if only Ken Lay had made a decent risk register! In fact, these anecdotes remind us of two things: it is difficult to understand fully the range of future outcomes; and if you take risks bad things sometimes happen.

Shell did not see the furore over Brent Spar coming; Mr Lay’s problem was not his lack of a risk register: it was just risk materialising. Over the course of several papers at a recent annual forum, the Institute of Risk Management agonised about whether specific incidents were risks materialising randomly in line with their probabilities or avoidable mistakes made by people. Surprise, surprise; in retrospect they were all in the latter group!

You may think that these difficulties make it a waste of time to try to identify the range of possible outcomes and to promote the preferred ones. If so, stop reading. But if not, don’t think nothing will ever go wrong again. Sometimes something will happen at random; sometimes something will happen because of a mistake, the consequences of which were totally predictable in retrospect; and some things just can’t be helped. We shall discuss the relationship between risk and randomness, and its relevance to risk modelling in organisational environments several times in the course of this book.

Meanwhile readers who would like to know more about the historical background of risk (and be entertained) should read Peter Bernstein’s book Against the Gods: the Remarkable Story of Risk (1996, John Wiley and Sons).

Quantitative risk analysis

This growth of risk management in organisations has not been primarily concerned with the quantitative nature of risk. It has focused mainly on using the range of identified possible futures to determine risk management actions which can be taken. It sometimes seems to be more in the nature of managing glorified to-do lists. This approach aligns with the adoption of risk management as one of the tools for improved corporate governance following various corporate disasters, including those mentioned previously.

Although good corporate governance practice does not focus on quantitative modelling, there are several areas where the characterisation of risk has been undertaken numerically for some time.

RELIABILITY

Reliability analysis has a history extending back more than half a century. Its aim is to quantify the likelihood that a system such as a train or a weapons launcher or, more recently, software, will operate in the required manner. This requires detailed system modelling and a flavour of this is provided in Chapter 5.

SAFETY RISK

The risk that people might be killed or injured has also been quantified for many years. This applies to hazardous plants, such as nuclear reactors and oil refineries; hazardous systems, such as railways; or any hazardous profession where statistical data is collected, such as fire-fighting. Associated with this research has been the extensive analysis of numbers to help decide whether certain systems or occupations are safe or not. This is described in Chapter 11.

PHYSICAL RISK ANALYSIS

Associated with health and safety risk is a whole area of work aimed at understanding and characterising the risk which arises from natural and man-made phenomena such as earthquakes, infectious diseases, carcinogens, drug side-effects, pollution an...

Table of contents

• Cover
• Half Title
• Dedication
• Title Page
• Copyright Page
• Table of Contents
• List of Figures
• List of Tables
• Preface
• Part I Risk Management Overview
• Part II Risk Models
• Part III Decisions And Risk
• PART IV Techniques
• Index
• About the Author