Risk Analysis and Management

Summary

Risk analysis and management is a field that deals with the anticipation and management of risk. Relevant to nearly every industry in existence, risk analysis and management provides a comprehensive set of tools, techniques, and methodologies that enable risk practitioners to deal with risk as appropriate.

Definition and Basic Principles

Risk analysis and management is the process of identifying possible risks, assessing their likelihood and impact, and following a structured approach to control, minimize, mitigate, or in some instances, exploit these identified risks. Strictly speaking, risk analysis and risk management are separate but closely related activities. The line between these two activities has become blurred and experts in one area or the other have gained skills that enable them to perform dual roles. Risk analysis and management are practiced in a wide range of fields, such as project management, information technology, security, insurance, and finance. Each field has customized existing risk analysis and management methods to suit its unique needs, and there are slightly different interpretations of what constitutes risk.

Background and History

Humans have been fascinated by risk for millennia. People of different cultures from different eras played games of chance in one form or another, often believing that their chances of winning or losing rested with the gods they worshipped. They had no method for calculating the probability of outcomes of their games or other life activities and generally adopted a passive attitude rooted in their belief that they could not affect their futures in any tangible manner.

This attitude began to evolve with the changes to the prevailing numbering system. Before the widespread use of the Hindu-Arabic numbering system, which uses the numbers zero to nine, many Western cultures used an alphabet-based numbering system. These systems were clumsy and made any type of complex mathematical calculations nearly impossible. With the adoption of the new numbering system at the beginning of the thirteenth century, complex calculations became possible, and the calculation of probability became easier. However, it was not until the sixteenth and seventeenth centuries, amid the Renaissance, that prominent mathematicians, including Galileo and Girolamo Cardano, began studying risk and how it applied to gambling. In the mid-seventeenth century, French mathematicians Blaise Pascal and Pierre de Fermat developed the theory of probability as a solution to a two-hundred-year-old math puzzle. Later, mathematicians built on the foundation laid by Pascal and Fermat and developed multiple techniques for risk management that had far-reaching influence.

The oldest form of risk management was insurance. The earliest known record of risk management is found in Hammurabi's Code, an ancient Babylonian set of laws written around 1752 BCE. This form of insurance, known as bottomry, was a type of marine insurance in which the owner of a vessel could borrow money to buy cargo. If the ship was lost at sea, the vessel owner did not have to repay the debt. For centuries, insurance remained the primary method of risk management for individuals and businesses.

In the 1970s and 1980s, preventive measures began to form a part of risk management. Insurance companies encouraged businesses to make their premises safer, businesses began to establish and adhere to quality standards for their products and services, and the government enacted legislation to make businesses consider the risks that existed for their employees. By the late 1990s and in the early years of the twenty-first century, multiple quality and risk management standards were created by members of various industries and different government regulatory agencies. Risk analysis and management is a full-fledged discipline with relevance in nearly every field of industry and business.

How It Works

Risk analysis and management is an adaptable, multistep process. Some of the steps have multiple parts. A general overview is provided below.

Risk Identification. This step involves determining and categorizing elements that may pose a risk. Techniques for identifying risks include brainstorming, interviewing, root-cause identification, reviewing historical data such as risk registers and failure histories from similar situations, and creating and analyzing risk-identification checklists. The information collected at this stage must be properly recorded to ensure it retains its usefulness in the future. Therefore, each risk should have a detailed description, a clearly defined category, and a risk indicator.

Risk Analysis. This step is split into qualitative risk analysis and quantitative risk analysis. Qualitative risk analysis involves prioritizing identified risks for further action. This helps identify high-priority risks and ensures that these risks are dealt with first. Factors used for prioritizing risks include their probability of occurring and the magnitude of their impact if they do occur, as well as when they are expected to occur and their impact on other interconnected areas such as cost and schedule.

The quantitative risk analysis process uses the prioritized list of risks produced by qualitative risk analysis to analyze the effect of the listed risks and assign a numerical rating to those risks. These ratings help in assessing the probability and impact of the identified risks. Quantitative risk analysis also creates an overall risk score that applies to the situation.

Risk-Response Planning. After the risks have been identified and prioritized, the next step is to develop options and determine the appropriate actions to take for the risks. This step addresses the risks by their priority and ensures that planned risk responses are cost-effective, timely, realistic, appropriate to the significance of the risk, agreed on by all concerned parties, and owned by a responsible individual. Sometimes, it is necessary to choose the best risk response from various options.

There are several risk-response strategies available to deal with different kinds of risks. For example, strategies for negative risks include avoidance, transfer, and mitigation, while strategies for positive risks include exploitation, sharing, and enhancement. Additional strategies include acceptance and contingency responses. Contingency responses are the possible actions identified and documented for dealing with a potential risk.

Risk Monitoring and Control. This is the process of keeping track of identified risks, identifying, analyzing, and planning for newly arising risks, monitoring risk indicators and the trigger conditions for contingency plans, reanalyzing existing risks, and monitoring residual risks. This step also involves reviewing the implementation of risk responses and evaluating their effectiveness. This step is an ongoing process and helps determine if the entire process has been successful.

Applications and Products

As mentioned earlier, risk analysis and management is a discipline used in various fields, some of which are described below.

Insurance. As the oldest form of risk management, the insurance industry has the most experience in developing and implementing risk analysis and management techniques. Many insurers have implemented solid risk-management strategies that ensure the accuracy of their data, no matter the format, use stress testing to determine the effect of sudden market changes and ensure that the company is not adversely affected, and employ advanced risk-analytic tools to identify potential risks, apply effective risk-response strategies, and mitigate losses. These strategies also improve the accuracy, availability, reliability, and level of detail of the data that company executives require to make business decisions. Finally, these strategies reduce insurers' operating costs and save them thousands of work hours.

Environmental Risk Management. Since the mid-twentieth century, when the importance of environmental conservation came to the fore, leading environmental organizations have developed risk analysis and management methods unique to the field. The United States Environmental Protection Agency (EPA) developed a risk-assessment process to provide information on potential health or ecological risks. The EPA uses this four-step process to characterize the nature and magnitude of health risks to humans and ecological receptors from chemical contaminants and other harmful physical or biological entities that may be present in the environment. Risk managers then use this information to help them decide how to protect humans and the environment from contaminants or other harmful entities. Similar environmental-protection entities in other countries, such as the United Nations Environment Programme (UNEP), the European Environment Agency (EEA), and India's Ministry of Environment and Forests, as well as research organizations such as the Ecologic Institute and RTI International, also collect and compile data relevant to regions all over the world that assist managers in assessing the risks of operating in those regions.

Risk management in this field also deals with natural disasters such as earthquakes, floods, drought, wildfires, tornadoes, hurricanes, severe snowstorms, and tsunamis. Analyzing data from previous similar catastrophic events can help personnel in this field anticipate and plan for the recurrence of an event. For example, using radiocarbon-dated samples of soil collected from a trench dug across the San Andreas Fault in California, seismologist Kerry Sieh was able to predict with accuracy how often this particular fault would create large earthquakes in Southern California. Weather forecasting is another direct beneficiary of risk analysis and management. Meteorologists use historical data and apply probability calculations to the data they collect to predict weather patterns. Their efforts usually give local authorities and citizens of the affected area some time to prepare for the occurrence of the weather event.

Project Risk Management. Risk management is especially important in this area because of the various uncertainties associated with executing and managing projects. Many projects have insufficient or uncertain budgets, operate on a compressed schedule, and have goals and requirements that may change constantly throughout the project. With these constraints in mind, it becomes clear that managing project risks is crucial for successfully managing a project. Indeed, many new tools have been introduced to this field to help manage the inherent uncertainty of projects. Failure to manage the risks of a project can have multiple effects, including the complete failure of the project. Organizations that proactively and consistently manage project risks have higher success rates.

Information Technology (IT) Risk Management. Considering the risks associated with setting up and operating IT systems, it is clear that risk management is vital in this field. Hackers, viruses, accidental disclosure of sensitive information, natural disasters, and catastrophic system failures are some of the risks that IT systems face regularly. Various risk-management methodologies and tools for managing risk in this field include the National Institute of Standards and Technology (NIST) Special Publication (SP) 800–39, Managing Information Security Risk: Organization, Mission and Information System View. This details the United States government standard. Another tool is the Operationally Critical, Threat, Asset and Vulnerability Evaluation (OCTAVE) process, developed by the Software Engineering Institute (SEI) at Carnegie Mellon University.

OCTAVE exists to help organizations improve their ability to manage and protect themselves from information-security risks. Other tools include the Facilitated Risk Assessment Process (FRAP), developed by Thomas R. Peltier, president of his information security training firm, and the Consultative, Objective, and Bi-Functional Risk Analysis (COBRA) process, which C&A Systems Security created. These and other techniques help improve risk management procedures in the IT field.

Careers and Course Work

Risk-management professionals are in demand in virtually every industry. As more industries realize the importance of effective risk management, the demand for experts in this field can only grow. Pursuing a career in this field requires an affinity for numbers and calculations. High school coursework should include intensive work in mathematics, especially in statistics and calculus.

Typical coursework for a bachelor's degree in risk management includes actuarial science, applied mathematics, economics, statistics, measurement theory, and project management. Other coursework includes algebra, finite math and calculus, decision theory, international business, insurance and risk, life and health risk management, and property and liability risk management. Several universities in the United States offer bachelor's degrees in risk management. Several universities in the United States offer master's degrees in risk management. A significant number of these degrees are also available online.

An alternative approach to a career in risk management is to acquire a degree in a related field and pursue a master's degree in risk management. Related fields include insurance, actuarial science, applied mathematics, economics, international business, logistics management, statistics, and project management. A master's degree in risk analysis and management or years of practical experience lends an edge to job seekers, as employers prefer to hire professionals with an advanced degree or broader experience. Professional certifications are also highly valued, and membership in professional organizations is encouraged.

Because risk analysis and management are vital to many businesses' operations, well-trained, experienced risk managers with a strong grasp of the operations of various departments within their organization are prime candidates for promotion to top management positions. Some risk managers transfer to closely related positions within or outside their chosen field. Those with extensive experience and sufficient funding may start their own consulting firms.

Social Context and Future Prospects

As more industries adopt risk-management procedures, risk analysis and management will continue to expand. In fields where risk analysis and management are firmly established, practitioners will continue to find ways to improve the tools and techniques currently in use. For example, a study analyzing the effectiveness of risk management in project risk planning across industries in Israel, Japan, and New Zealand was published by Ofer Zwikael and Mark Ahn in 2011. They found risk management effectively reduced the impact of risk levels on project success rates. They also found that integrating risk management with other practices may improve project success.

While the field as a whole is stable, the specific challenges of risk analysis and management can change rapidly in response to other social and market factors. In 2016, the professional services corporation Deloitte released a report on the future of risk, which identified advances in cognitive technologies (including artificial intelligence and big data) and behavioral science as major drivers in the field. Other observers noted that while algorithms and other AI methods had a major impact on risk management, they also could introduce or exacerbate bias and inequities, making human oversight an important ethical consideration. By the 2020s, most organizations had implemented or planned to implement efficiency tools like artificial intelligence machine learning, cognitive analytics, and cloud computing. These tools increase efficiency and accuracy in many contexts, but they also present dangers like data breaches, the cost of training employees, and more.

Bibliography

Albinson, Nancy, et al. "The Future of Risk: New Game, New Rules." Deloitte, 2016, www2.deloitte.com/content/dam/Deloitte/us/Documents/risk/us-aers-the-future-of-risk-new-game-new-rules.pdf. Accessed 26 Mar. 2021.

Ayyub, Bilal M. Risk Analysis in Engineering and Economics. 2nd ed., CRC Press, 2014.

Blokdyk, Gerardus. Quantitative Risk Analysis a Complete Guide - 2020 Edition. Emereo Publishing, 2020.

Crouhy, Michel, Dan Galai, and Robert Mark. The Essentials of Risk Management. 3rd ed., McGraw, 2023.

"Financial Managers." U.S. Bureau of Labor Statistics, 17 Apr. 2024, www.bls.gov/ooh/management/financial-managers.htm. Accessed 20 May 2024.

"Global Risk Management Survey, 12th Edition." Deloitte, 2021, www2.deloitte.com/content/dam/Deloitte/rs/Documents/risk/rs‗Global-risk-management-survey-12th-edition.pdf. Accessed 20 June 2024.

Haimes, Yacov Y. Risk Modeling, Assessment, and Management. 4th ed., John Wiley & Sons, 2015.

Hardy, Karen. Managing Risk in Government: An Introduction to Enterprise Risk Management. IBM Center for the Business of Government, 2010.

O’Connell, Caolionn. Managing Risk in Globalized Supply Chains. RAND Corporation, 2021.

Skoglund, Jimmy, and Wei Chen. Financial Risk Management: Applications in Market, Credit, Asset, and Liability Management and Firmwide Risk. John Wiley & Sons, 2015.

"Risk in Focus 2024." Deloitte, 8 Sept. 2023, www.iasplus.com/en-ca/publications/thought-leadership/2023/risk-in-focus-2024/at‗download/file/ciia-risk-in-focus-2024‗final-web.pdf. Accessed 20 June 2024.