There are two main activities associated with risk.  First risk analysis, what are the risks, liklihood of occurrence and impact if the risk event does occur?

Following on the heels of analysis is the practice of risk management.  Some consider risk analysis just a sub process of risk management but I view them as separate practices.

Risk Tolerance

People often talk about thier tolerance for risk.  The implication being some accept more risk than others.  For me, it is not a questions of whether the initial risk is high or low, or accepting it at all, it’s how how you mitigate it so it becomes or remains low.

Any activity I undertake, whether, skiing, motor car racing, investing in equities or just walking down the street has a risk associated with it.

If the activity has a high probability of occurence and the impact will be quite detrimental, my approach is not necessarily to avoid the activity, particularly if it is some thing I want to do.

Instead of avoidance I practice mitigation.  By planning my actions in a way to reduce the likelihood of occurence coupled with an understanding of how to reduce the impact if the risk occurs, I can engage with confidence.

Consider for example bringing a Christmas tree into your house.  There is a risk it can be a catalyst for a house fire.  By watering and careful placement and use of heat sources when decorating, you mitigate or reduce the likelihood of occurance.

By having a fire extinguisher on hand you can mitigate the impact if the risk occurs.  A home insurance fire policy helps with this too.  Using these mitigation techniques enables you to bring a dead fire hazzard into your home without fear.

Everything we do entails some risk.  When we describe an activity as “risky” we have usually done a quick intuitive analysis and concluded their is a high risk of something bad happening.  In our minds this activity becomes a risky business.

Today’s post I want to explore the basic concepts of risk.  The question is,  rather than gut feel is there a way to quantify risk (hopefully a simple way) and then based on that quantification determine what if anything to do about it.

The topic of risk analysis and risk management is complex and huge.  As usual today’s post is just   exploring the basic concepts. I will build on these in future posts.

What is a risk?

Just sitting on the couch reading a book entails a risk.  You could have a heart attack.  The large tree outside your house could fall over, break through your roof and crush you.   A flea could bite your ankle,  the flea could carry a disease and you could get very sick.  Of course the list goes on probably as long as my imagination.

So, what risks do we care about and want to protect against?

A basic risk quantification technique is to score the likelihood a risk event (the bad thing) will occur multiplied by the impact factor of the event.   Typically likelihood is rated on a scale from unlikely to very likely.  Impact is classified from low to high.

For a quick semi balanced subjective/objective score of a particular risk you could assign say unlikely = 1, likely = 3, very likely = 5.  On the impact side low = 1,  medium = 3 and high = 5.    Then just multiple the two factors to get an overall score that is indicative of the risk magnitude.   For example an unlikely risk with low impact  would be 1 x 1 = 1.   A very likely risk of high impact would be 5 x 5 = 25.  So your risk assessments using this simple tool would line up between 1 and 25.  You might say you would worry about those above 15.

The scoring concept described above is weighted toward the subjective and overall high level.  Much more complex weighting systems with more accurate metrics can be appropriate to use depending on the risks you are assessing but the basic concept of rating and assessing likelihood and impact stands.

Let’s try out the simple model

 Activity – importing goods into the Port of Vancouver

Risk Event – a pocket nuclear device is imported.

Considering the protections at the port, custom inspections, x-rays, radiation detection devices and guards together with the difficulty to build and transport such a device, I will rate this a 1 (unlikely).  The impact side gets a 5 (obviously I think) for an overall risk score of 1 x 5 = 5.

Now if the protections and other mitigations against likelihood did not exist or were not in place this could be rated a 3 (likely) or 5 (very likely) in which case the overall risk score would be 15 or 25.   Overtime this score can change; say a terrorist announces they are intent on importing such a device and working actively on it we might raise our likelihood rating.   Or we might improve our risk mitigation activities to reduce the likelihood in the face of the heightened threat.

And there you have it, a simple model!

There is a lot more to say about this model and how it can be used and applied in more real world situations (like your house burning down , a new purchase breaking down) and I will get into those in future posts.  The basis concept described here though applies throughout.