In order to establish an effective risk identification process, identification of all existing biases is key. Primary ways to identify such biases include:
Once biases are successfully removed, risk prioritization and principles of risk evaluation involve Qualitative and Quantitative methods.
The following table provides the difference between Qualitative and Quantitative risk evaluation methods:
Most risk managers apply qualitative methods to evaluate risks. This leads to subjectivity. One simple method to reduce subjectivity for smaller projects is to apply the impact likelihood scale.
Each impact and likelihood can be assigned a number from 1 to 5 for Very Low to Very High respectively. See table below:
Final Risk rating as a product of impact and likelihood will fall in-between a range of 1 and 25. The product can be translated into a subjective rating as per the below table:
A simple example can illustrate the qualitative method. There have been four Category 5 hurricanes (with a wind speed of 157 miles per hour or more) hitting the U.S. in the last 100 years. This means there is a 4 percent chance of a Category 5 storm hitting the U.S. in a year. Applying the qualitative principles, the likelihood of the risk is Very Low. The impact of a Category 5 hurricane can be devastating i.e. Very High. The below table determines the risk rating:
Although we considered the likelihood based on historic data, we need to consider external factors that might increase or decrease the likelihood over time.
If we dig deeper into the hurricane example, 8 out of 35 Category 5 hurricanes were initiated in the North Atlantic Ocean in the last decade i.e. 25 percent of Category 5 hurricanes in the past 10 years, which is a significant number to ignore. In 2020, it is forecasted that there will be 18 named storms, 9 hurricanes and 4 major hurricanes compared to a 30-year average of 13 named storms, 7 hurricanes, and 3 major hurricanes. Whether it eventually happens or not, the difference is too high to disregard. Moreover, the effect of climate change will make hurricane seasons worse over the years. As we ask more questions and are presented with clearer facts, our likelihood scale is bound to change resulting in a shift in risk rating.
Quantitative risk evaluation method is objective. It uses verifiable data to determine multiple risk factor and requires a heavy volume of data, specialized software, and vigorous risk models.
A simple example can illustrate quantitative evaluation.
California is severely affected by wildfires every year. In order to perform quantitative fire risk evaluation, we need to characterize and combine fire behavior probabilities and effects. These probabilities are different from likelihoods based on historic data since they depend on spatial and temporal factors controlling fire growth. The likelihood of a wildfire in a specific location is dependent on various factors such as weather condition, topography, forest dryness, and fire direction. The fire behavior distribution requires scientific computational of these factors. The impact or effect of wildfires needs to be appraised based on a common scale of infrastructure and human values susceptible to fire. Ultimately, this will determine the investment needed to evaluate the likelihood of wildfire in that location and minimize the damage.
It might sound like the quantitative approach is the more reliable of the two. However, both methods hold equal merits. Qualitative risk should always be performed. It is the most perfect way to analyze and prioritize risks that can be broadly adopted across an organization. On the other hand, quantitative risk evaluation is vital, especially in high risk industries such as mining, oil and gas, construction and anything that presents a threat to the safety of workers on a day-to-day basis. Indeed, it’s a legal requirement.
The above methods of identifying biases and evaluating risks for strategic prioritization may result in reducing the impact of unforeseeable events but can never eliminate the possibilities of a failed risk prioritization as we experienced in 2020.
The Global Risks Report of 2020 by the World Economic Forum (WEF) prioritized climate change and related environmental issues as the top five risks in terms of likelihood. However, we have all experienced how the global pandemic has turned our world upside down.
Going back to the report, if one prioritizes risk based on the Global Risk Landscape 2020 (fig II), the infectious disease would unlikely make it onto the prioritization list. In the Short-Term Risk Outlook (fig 1.1), the pandemic doesn’t even appear anywhere.
Once the pandemic is over, we will run into various biases while identifying future risks, therefore, all the methods to mitigate such biases will be critical. It won’t eradicate similar occurrences but will reduce the impact of these risk factors through better mitigation strategies.
In 2015, in a now-famous TED talk, Bill Gates repeatedly warned how we were not prepared for the next epidemic. During the Obama Administration, when we experienced the 2009 H1N1 (swine flu) and 2014 Ebola outbreaks, the former president emphasized building a public health infrastructure globally to combat the next pandemic. Unfortunately, for the current COVID pandemic, the world was not prepared, and we now face the irreversible consequences of poor planning of risk prioritization. Let’s learn from the struggles following 9-11 and create a unified effort to prepare for the next pandemic.
In summary, risks need to be identified carefully, and its accurate evaluation will determine if we are successful in mitigating those before these risks lead to a path of no return.