understanding risks and uncertainties
What's Involved
Understanding uncertainty and risk typically involves three processes::
- Identifying and characterising the events/issues that can make a big difference to results
- Prioritising those issues, preferably using some sort of quantitative yardstick as a basis for comparing their importance, and
- Making judgments about how important a given risk or uncertainty is, whether it should change, and the value of reducing it.
HOW it's done
Typical processes involve
- Learning from experience
- Structured brainstorming to identify possible issues
- Assessment based on likelihood and potential impact
- Judging importance against pre-agreed scales for financial, reputation, safety, environmental (etc) outcomes
where things can go wrong
In our experience organisations can quite easily miss important issues altogether, or wildly mis-assess their importance, for reasons including
- Brainstorming processes miss important issues
- Issues are poorly characterised, with overlaps, gaps and duplication
- The yardsticks for measuring likelihood/impact are ambiguous or not applied consistently
- "Group Think" sets in and issues are hopelessly mis-assessed
- The scale of importance doesn't match what is of greatest concern for the organisation.
A simple check on the implied average annual impact of all these issues, or on the implied frequency of a key event of concern, can be very revealing. We have come across both
- a non-compliance issue estimated as a once per 1000 year event that had happened 3 times in the past month, and
- a company whose risk assessment implied that they would suffer a fatality once a week, when they had suffered none in the past decade.
how we help
We both help devise approaches to avoid these pitfalls, and provide independent test and challenge of organisations' own assessments. You can read more about how we tackle the areas where things can go wrong in the links on the right.