Thought for the day
on risk management: There are, essentially, two types of risk. First, the risk that something bad might happen. Second, the risk that some specific bad thing might actually happen. In general, an organisation or a person's capability for bearing one kind of risk is not necessarily informative at all for their ability to bear the other kind, and the two kinds of risk require completely different risk management approaches.
Isn't the first kind of risk a sum of all the second kind of risks?
ReplyDeleteOr, to put it in a form that heads off the storm of condescension, contempt, correction, BACAI etc.: 'I leave the demonstration that the first kind of risk is not a sum of all the second kind of risks as an exercise for the reader.'
Shouldn't managing for the former at least alleviate the need to be fanatical about managing for the latter? IOW, if you've got sprinklers in a building that also has a hazardous storage area, the risk posed by the hazardous storage is lessened by the existence of the overall system - the bad outcome is only 75% of what it would be in an unsprinkled building, and so you only need to perform 75% of the hazard-specific risk management.
ReplyDeleteOf course, I've no idea whether this conception scales to less literal/physical risks.
Fascinating... so which category covers BP's Macondo? Or are we talking "Schrodinger's Risk" here? (the risk that can be managed is not yada yada ...)
ReplyDeleteIsn't the first kind of risk a sum of all the second kind of risks?
ReplyDeleteIt would be if you knew what all the specific risks were. But over here in the real world there are lots of risks which you have no idea even exist until they happen.
In The Black Swan Nassim Taleb gives the example of a casino. What risks do casinos face? Well, you might think this is straightforward: fire, theft, gamblers with runs of luck, ... Actuaries have no problems with specific risks like those. But the Mirage is said to have lost something like $100 million as a result of Roy Horn being attacked by a tiger.
Yup - the two sorts of risk are also differentiated in the field of gov-chat:
ReplyDeleteO'Malley, P. (2004) Risk, Uncertainty and Government, London: Glasshouse.
Chris Williams
Okay, I'll bite.
ReplyDeleteI've googled BACAI, and while I've found some interesting pages, nothing really relevant.
What does BACAI mean?
it is local slang to this blog, being an acronym where the first two letters stand for "being a" and the last two for "about it". Alec'susage was slightly misleading as his point was relevant and polite and thus a long way from any danger of BACAI. I think the point I was trying to make though was just that some risks have much greater salience than others to policy makers, and that decisions taken about which kinds of eisk are to be managed on a statistical basis and which on an individual basis are often rather incoherent.
ReplyDeleteSo it really was about the stupid scanners in US airports then? I was wondering whether it was that or some sort of financial thing beyond my comprehension.
ReplyDeleteWell, Roy Horn was performing with a tiger almost *every night*. Not exactly an unforeseeable risk.
ReplyDeleteThat tiger didn't go crazy; that tiger went tiger, as Chris Rock pointed out.
ReplyDeleteAnd even if the tiger wasn't a foreseeable risk specifically - if it wasn't part of the act but had just wandered in off the Strip, lured by the odour of warm polyester and day-old shrimp - the general risk "one of our star acts will, through injury or illness, be unable to perform for an extended period" was certainly foreseeable and should have been insured against.
So to risk being Rumsfeldian the second category are the known-unknowns and the first are the unknown-unknowns. A lot of projects cater for this by having a contingency reserve (for identified risks) and a management reserve (for the completely unexpected). Of course this might not scale if every single project in an organisation is hit by the same unexpected event at the same time (e.g. Eyjafjallajökull erupts and all flights are grounded so no shipments of goods can be made).
ReplyDeleteIn the real world, I think firms plan for the first category under the heading of DR: if everything imaginable goes tits up, how do we get back in business again a.s.a.p? I could phone in a DR plan for an IT department, but presumably all other operational areas have them as well. (I hope.)
ReplyDeleteWhich doesn't really allow for important customers being eaten by tigers, but is probably the most sensible approach.
dd - thanks. The BAC was pretty obvious, but the AI completely stumped me.
ReplyDeleteAnonymous @
1/18/2010 04:32:00 PM
Aviation flight planning - you have an alternate airfield for each sector of the flight and you plan to have enough fuel at each point of the flight, assuming the maximally inefficient case of being forced to descend to 10,000 ft, to go to the alternate, carry out a missed approach, and land.
ReplyDeleteThen, as well as that, you also have the equivalent of 30 minutes flying time + a missed approach + landing as final reserve, whatever the result of your other calculations. If any of your planned airfields are islands or otherwise classified as remote, you have to have additional reserves, and there is an allowance for extra contingency reserves over and above the total if you feel you need them.
But - and here's the point - the calculation proceeds from the specific to the general, or if you like, from risk ("What if Heathrow is closed by the weather and we have to go to the alternate?") to uncertainty ("What if we get to the alternate, and some fool lands wheels-up ahead of us?"). You start with en-route and destination alternates, then add whatever remote/island reserves may be necessary, then any contingency fuel, and then the final reserve in case all the other calculations, including whether or not to take a bit extra in case, somehow get invalidated.