Everything we do entails some risk.  When we describe an activity as “risky” we have usually done a quick intuitive analysis and concluded their is a high risk of something bad happening.  In our minds this activity becomes a risky business.

Today’s post I want to explore the basic concepts of risk.  The question is,  rather than gut feel is there a way to quantify risk (hopefully a simple way) and then based on that quantification determine what if anything to do about it.

The topic of risk analysis and risk management is complex and huge.  As usual today’s post is just   exploring the basic concepts. I will build on these in future posts.

What is a risk?

Just sitting on the couch reading a book entails a risk.  You could have a heart attack.  The large tree outside your house could fall over, break through your roof and crush you.   A flea could bite your ankle,  the flea could carry a disease and you could get very sick.  Of course the list goes on probably as long as my imagination.

So, what risks do we care about and want to protect against?

A basic risk quantification technique is to score the likelihood a risk event (the bad thing) will occur multiplied by the impact factor of the event.   Typically likelihood is rated on a scale from unlikely to very likely.  Impact is classified from low to high.

For a quick semi balanced subjective/objective score of a particular risk you could assign say unlikely = 1, likely = 3, very likely = 5.  On the impact side low = 1,  medium = 3 and high = 5.    Then just multiple the two factors to get an overall score that is indicative of the risk magnitude.   For example an unlikely risk with low impact  would be 1 x 1 = 1.   A very likely risk of high impact would be 5 x 5 = 25.  So your risk assessments using this simple tool would line up between 1 and 25.  You might say you would worry about those above 15.

The scoring concept described above is weighted toward the subjective and overall high level.  Much more complex weighting systems with more accurate metrics can be appropriate to use depending on the risks you are assessing but the basic concept of rating and assessing likelihood and impact stands.

Let’s try out the simple model

 Activity – importing goods into the Port of Vancouver

Risk Event – a pocket nuclear device is imported.

Considering the protections at the port, custom inspections, x-rays, radiation detection devices and guards together with the difficulty to build and transport such a device, I will rate this a 1 (unlikely).  The impact side gets a 5 (obviously I think) for an overall risk score of 1 x 5 = 5.

Now if the protections and other mitigations against likelihood did not exist or were not in place this could be rated a 3 (likely) or 5 (very likely) in which case the overall risk score would be 15 or 25.   Overtime this score can change; say a terrorist announces they are intent on importing such a device and working actively on it we might raise our likelihood rating.   Or we might improve our risk mitigation activities to reduce the likelihood in the face of the heightened threat.

And there you have it, a simple model!

There is a lot more to say about this model and how it can be used and applied in more real world situations (like your house burning down , a new purchase breaking down) and I will get into those in future posts.  The basis concept described here though applies throughout.