Triple Bottom Line Risk Management_3 doc

Table 6.3 shows the calculated risk quotient, using the conservative estimate ofconsequence cost, for each dam failure type.. The risk profile is a bar chart and shows that the riskiest

and project managers are responsible for the risk (or may be deciding whether tobecome responsible), then ways of reducing the risk need to be developed.Identification of risk treatment options is carried out concurrently with assess-ment of the potential benefits and costs of reducing the exposure to risk to ac-ceptable levels These actions are important steps in the process of formulating arisk treatment strategy, which is discussed in Chapter 7.

The following water utility example demonstrates application of the steps in therisk analysis stage

The event tree of Figure 6.8 shows that the annual frequency of a sunny-dayfailure caused by earthquake-induced cracking of the embankment is estimated to

be 9 × 10–8per year (or around 1 in 11 million years) The estimated frequency of

a sunny-day failure caused by earthquake-induced slippage of the embankment isestimated to be 9 × 10–7per year (or around 1 in 1.1 million years)

The total likelihood of an earthquake triggering a sunny-day failure was mated, by summing the above frequencies, to be 9.9 × 10–7per year (or around 1

esti-in 1 million years) The event tree shows that earthquake-esti-induced slippage of theembankment is the predominant contributor to the total likelihood of earthquake-induced sunny-day failure

Figure 6.8 indicates that the likelihood of sunny-day failure of the embankmentdue to all trigger events is estimated to be 1.01 × 10–4per year (or almost 1 in10,000 years) The likelihood of embankment instability during full storage con-ditions (9.08 × 10–5per year) is by far the greatest contributor to the overall like-lihood of sunny-day failure

Figure 6.9 indicates the forecast distribution chart of consequential cost suming that a sunny-day failure occurs It also includes a table of forecast cost forincreasing confidence level intervals of 5 percent The chart shows that the esti-mated cost distribution is highly skewed toward the high cost end A central esti-mate for the consequential cost of a sunny-day failure would be approximately

as-$350 million The table shows that the lowest cost estimate computed during the2,000 trials was around $120 million; the highest calculated cost derived in the tri-als was approximately $5 billion

The Utility decided that for the assessment, a conservative yet reasonable costthat could be used for planning purposes would be defined as the 80 percentconfidence-level cost The Utility selected the 50 percent confidence-level cost asrepresenting an optimistic position and the 95 percent confidence-level cost aspessimistic In the sunny-day failure example, the estimated optimistic cost, plan-ning cost, and pessimistic cost values were approximately $340 million, $560million, and $1 billion, respectively

Table 6.3 shows the calculated risk quotient, using the conservative estimate ofconsequence cost, for each dam failure type It also shows the total risk (the sum

of the risk quotients of all failure types) posed by the dam

84 / Stage 3: Analyze the Risk

9.00E-08 9.00E-07 9.90E-07 9.00E-05 8.10E-07 9.08E-05 9.00E-06 9.00E-06

86

Figure 6.10 shows a ranked risk profile of the failure types applicable to thedam The risk profile is a bar chart and shows that the riskiest failure type (sunny-day failure with a calculated risk quotient of $30,000 per year) is approximatelytwice as risky as the second riskiest failure type (vehicle accident, $17,000 peryear) In turn, the second riskiest event presents approximately 1.5 times more risk

Water Utility Example / 87

F2 Flood & Secondary Embankment Breach 6.07E–05

total risk presented by all failure types.

Da

y F ailure F6 V ehicle Accident F5 Outlet

than the third most risky event (outlet works failure and long-term outage, $12,000per year).

The risk profile is quite typical, in that it shows that a relative handful of eventsaccounts for the vast majority of the total risk amount Total risk is the sum of thecalculated risk quotients for all relevant risk events, shown in Figure 6.10 as thetotal dam financial risk quotient bar

Figure 6.11 shows an example of a proportional risk profile It shows the eventsranked in order of decreasing risk quotient The height of each bar indicates theproportion (percentage) contribution of each event to total risk The bar chart in-dicates, for example, that the riskiest event, sunny-day failure, contributes toaround 48 percent of the total risk and that the second most risky event (vehicle ac-cident) is responsible for around 28 percent of the total risk

The line plot of Figure 6.11 shows an alternative way of expressing the bution of each additional risk event to total risk The line plot shows the progres-sive contribution to total risk, from the most risky event to the least risky event.The line plot shows that proceeding on from the riskiest event, the two most risky

contri-88 / Stage 3: Analyze the Risk

in risk for failure types ranked in order of decreasing risk quotient.

F3 Sunn y-Da

y

F6 V ehicle Accident

y

Embankment Breach

events contribute to approximately 75 percent of the total risk and the three mostrisky events contribute to around 95 percent of the total risk The plot also clearlyindicates that the two least risky events (both events related to flooding) provide

a negligible contribution to total risk

Figure 6.12 shows the exposure profile for the example water storage The riskevents are ranked in order of decreasing risk quotient, as shown by the line graph

of “financial risk.” Exposure profiles reflect the exposure to residual risk resultantfrom ongoing business risk management Consequently, exposure profiles ideallyshow that the least risky events present the greatest exposure The exposure pro-file of Figure 6.12 is unusual (and undesirable) because the riskiest event (sunny-day failure) presents the greatest financial exposure of all the identified riskevents

Figure 6.12 shows that a conservative estimate (at the 80 percent confidencelevel) of the potential cost if a sunny-day failure were to occur would be approx-imately $560 million An optimistic estimate of the exposure would be approxi-mately $340 million; a pessimistic estimate would be over $1 billion In contrast,

Water Utility Example / 89

types occur, with failure types ranked in order of decreasing risk.

F3 Sunn y-Da

y

F6 V ehicle Accident F5 Outlet

90 / Stage 3: Analyze the Risk

the combined pessimistic cost of the remaining three events that contribute tomost of the total risk would be approximately $65 million

Figure 6.12 also allows comparison of uncertainty associated with the cost mates The large range of optimistic and pessimistic cost estimates ($340 million to

esti-$1.05 billion) for sunny-day failure clearly shows that there is considerable tainty in the estimate of cost of that event Compared with sunny-day failure, thesecond lowest risk event (flooding leading to a breach of the main embankment)presents a similar optimistic estimate of exposure ($320 million) However, the costrange (uncertainty) is substantially less than sunny-day failure, as shown by thepessimistic cost estimate of approximately $770 million for the flooding event.Figure 6.13 shows a risk map of the potential dam failure modes For compar-ison, the map shows plots of the house and car risk parameters from the householdinsurance example discussed earlier and illustrated in Figure 6.6

uncer-Using the lines of equal risk in Figure 6.13 as a guide, sunny-day failure isclearly the riskiest event, with a relatively low likelihood (approximately one in10,000 years) but a very high cost if it occurs (average around $300 million) Incomparison, the vehicle accident event poses almost as much risk as sunny-day

and a comparison with the household insurance example.

F1 Flood & Main Embankment Breach

F2 Flood & Secondary Embankment Breach

F3 Sunny-Day Failure

F4 Outlet Works Term Outage

Short-F5 Outlet Works Long-Term Outage F6 Vehicle Accident Home

Annual Probability of Failure

Typical Household Insurance Risk Conditions

ear

failure, which is achieved because the accident has a relatively high chance of curring (around one in 250 years) but has a relatively low financial consequence($4 million).

oc-In contrast to sunny-day failure, the lowest risk event shown on Figure 6.13 is

a major flood leading to failure of the main embankment This event has the sameconsequences as sunny-day failure but has almost three orders of magnitude lesslikelihood of occurring (likelihood is approximately one in 4.5 million years).The project manager and the risk analyst evaluated the ranked financial riskprofile (Figure 6.10) and the proportional risk profile (Figure 6.11) and selectedthe risk threshold for calculation of the risk cost at $10,000 per year Thus, thecombined occurrence cost of the three riskiest events (which contributed to almost

95 percent of the total risk) was included in the risk cost calculation

Figure 6.14 shows the forecast risk cost distribution for the example dam Therisk cost distribution consists of the combined cost of sunny-day failure, vehicleaccident, and outlet works damage leading to long-term outage The distribution

is dominated by the largest cost component (sunny-day failure) and is heavilyskewed toward the high cost end of the distribution The Utility project managerselected the 50 , 80, and 95 percent confidence levels to represent optimistic, plan-ning, and pessimistic estimates of risk cost The estimated optimistic, planning,and pessimistic risk costs are $360 million, $580 million, and $1.06 billion,respectively

The calculated risk cost at the optimistic, planning, and pessimistic confidencelevels is shown graphically in Figure 6.15 The bar chart confirms that there isconsiderable uncertainty in the estimate of dam risk cost, as indicated by the widerange of cost between the estimated 50 and 95 percent confidence levels

Water Utility Example / 91

92 / Stage 3: Analyze the Risk

levels, the range of which provides an indication of the uncertainty associated with the cost estimate.

0 200 400 600 800 1,000 1,200

Dam Risk Cost

Pessimistic (CL 95%) Planning (CL 80%) Optimistic (CL 50%)

manage-The aim of a risk treatment strategy is to progressively reduce risk in a timelyand cost-effective manner This aim recognizes the constraint that most businessescannot implement all actions that may be required to reduce risk to acceptable lev-els Some actions may be more costly to perform compared with the consequen-tial reduction in exposure to risk In addition, most businesses have a limitedannual budget allocation for risk reduction actions Due to these limitations, busi-nesses usually need to establish interim risk reduction goals.

In order to develop a risk treatment strategy that satisfies the above aims, it isnecessary to develop an appreciation of the:

• Level of risk that would be acceptable, in both the short and the long term

• Events that should be addressed first

• Actions that should be taken to reduce the risk

• Projected effectiveness of any actions

• Cost of actions

• Available budget to perform required actions

• Financial benefits of risk treatment actions

93

Risk analysts and project managers, often in consultation with other holder representatives, develop the risk treatment strategy.

stake-Formulation of risk reduction strategy utilizes the results of the risk assessmentprocess Figure 7.1 shows a flow chart of the process required to develop a risk re-duction strategy Each step of the flow chart is described below

94 / Stage 4: Formulate a Risk Treatment Strategy

Identify cause of risk events Develop action list for each event Evaluate impact on risk

Define performance targets Prioritize events Evaluate Risks Against Performance Targets

Risk acceptable?

Estimate action costs Evaluate benefits and costs Generate schedule of expenditure

Approve Strategy

Yes No

Determine Risk Treatment Actions

Develop Risk Treatment Strategy

E VALUATE R ISKS AGAINST P ERFORMANCE T ARGETS Define Performance Targets

Criteria need to be established that indicate target levels of risk quotient that would

be acceptable, in both the short and the long term For example, a short-term get might be to substantially reduce the risk posed by a specific event within thecoming year, but the long-term target might be to further reduce the risk posed bythe event to “best available technology.” In the meantime, the organization’s re-sources are applied to achieving substantial risk reductions across a wide range ofevents

tar-Short-term and long-term risk targets need to be established The targets cate levels of risk quotient that would be considered acceptable for the indicatedperiod In situations other than compliance breaches, often short-term criteria can-not be set realistically until project managers have gained a clear understanding ofrisk events through a risk assessment process Long-term performance objectivesand evaluation criteria, however, can be set in advance, at the commencement ofthe risk assessment process

indi-Short-term criteria are applied specifically during development of risk ment strategies to determine whether a proposed action (or set of actions) willachieve an adequate reduction in risk quotient The following discussion focuses

treat-on development of risk treatment strategies that are designed to meet nantly short-term criteria

predomi-Development of a risk treatment strategy is therefore an iterative process Inmost cases, it is appropriate that the initial target risk quotient is set at the riskthreshold value which was selected to calculate the risk cost The threshold isappropriate because the aim of the risk reduction process is to reduce the risk quo-tients to levels where the estimated risk cost would be negligible However, it maynot be possible in the short term to perform all of the necessary actions to achievethe threshold target, and the criterion may need to be revised

The ranked risk profiles are used to confirm the events that should receive ority consideration All events for which the calculated risk quotients are greaterthan the target need to be identified and listed in order of priority

pri-Evaluate Risks against Performance Targets / 95

D ETERMINE R ISK T REATMENT A CTIONS Identify Cause of Risk Events

During this process the panel needs to refer to the original event trees that wereproduced for risk analysis The appropriate panel experts review the branches ofthe event tree leading to the end consequence of the risk event under evaluation.The experts evaluate the contributing likelihoods and consequences to identify thekey elements in the pathway that primarily contribute to the current magnitude ofrisk quotient The panel members use the event-tree input information to develop

a list of actions that will progressively reduce the risk quotient to the ultimate get value

tar-Develop Action List for Each Event

The panel members need to consider each risk event in turn, until a series of tions that can potentially reduce the risk has been identified The actions need to

ac-be considered for all substantial risk events (usually those that contribute to riskcost exposure)

In many cases a risk event has a low likelihood of occurring but is high risk cause the consequences are very high In these cases, insurance may be an appro-priate instrument to reduce the exposure to acceptable levels

be-If a risk event has a high likelihood of occurring, then appropriate action might

be to replace the risk cost of an event occurring with a known, planned ture In this case risk managers need to reduce the likelihood of the event occur-ring to negligible levels For example, installation of backup pumps wouldeffectively prevent release of sewage to the environment Other examples arestrengthening a water supply dam embankment to prevent catastrophic failureand installing complex monitoring systems to allow rapid response to potentialfailures

expendi-In the case of risk events with large consequences, risk managers would seekways of reducing the consequences For example, exposure might be limited byconstructing lined bunds around oil tanks to prevent any spills due to tank failurefrom leaving the immediate area or by storing mine explosives underground toprevent injury by fly-rock to residents in the vicinity of the mine site

In cases where the risk event is considered relatively low cost, risk managersmay decide either to plan for the expenditure in the project budget or to take therisk that the event occurs and to pay for the consequences from the operationalbudget

The output of this process should be an itemized list of actions that can be ried out for each risk event, the current risk presented by each event, and the ex-pected future risk posed by the risk event, after implementation of the riskreduction actions

car-96 / Stage 4: Formulate a Risk Treatment Strategy