Embed Size (px)
DESCRIPTION
In this presentation we discuss the liabilities brought to you by Risk Management approaches using “Risk Matrices”, Probability-Impact Graphs, “Heat Maps” (we will use the acronym “PIGs” generically, to also include risk matrices and heat maps). Despite their notoriety, PIGs are considered Standard Practices through the world by Risk practitioners, PIGs have critical and potentially damaging intrinsic problems. That's what Riskope have learned thanks to two decades of Risk Assessments for interesting and unusual projects. When looking at Risk Assessments of financial institutions, industries, operations, plants, networks, we can affirm that PIGs do not fly. They are misleading and could get their users straight in front of a Judge. Riskope is not the only entity to reckon this. Academia, other consultants around the world are indeed starting to or have already published papers going in the same direction. A formal yet simple approach to replace PIGs, called ORE (Optimum Risk Estimates (c)Oboni Riskope Associates Inc.), which avoids the pitfalls and liabilities, is presented. Like PIGs, ORE can be applied to a wide range of potential risks, but leads to a clearer, rational, defensible description of the institution's risk environment (risk horizon). The benefits brought by using ORE are explained in this presentation using a real life Risk Assessment. Happily, ORE can reuse most of the work you have already developed to establish your PIGs. With Riskope's ORE it is possible to upgrade existing corporate Risk Register and to steer your institution/company/project towards a rational, defensible and transparent stance.
Citation preview
Page 1 of 82(c) Riskope International SA, 2012 page 1 of 35
www.riskope.com
PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly already in the '90s
2. Despite being considered State of the Art PIGs have problems
3. So what can be done to avoid PIGs problems?
Is it true that PIGs can fly?
No, they do not fly, they are misleading you, but Optimum Risk Estimates (ORE) will get you back on track.
By Dr. F. Oboni, C. Oboni
Page 2 of 82(c) Riskope International SA, 2012 page 2 of 35
www.riskope.com
PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly already in the '90s
2. Despite being considered State of the Art PIGs have problems
3. So what can be done to avoid PIGs problems?
Studies by reputable researchers in the UK, US, Academia, consultants and Riskope have
repeatedly shown that Probability Impact Graphs (PIGs) actually may fail to deliver, and
can mislead the decision making process..
Page 3 of 82(c) Riskope International SA, 2012 page 3 of 35
www.riskope.com
PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly already in the '90s
2. Despite being considered State of the Art PIGs have problems
3. So what can be done to avoid PIGs problems?
Industrial Depot
qualitative, hybrid, quantitative”Heat maps”, “PIGs=Probability Impact Graphs”andUsual risk matrices like this one
Will not answer a number of clients' questions:
Page 4 of 82(c) Riskope International SA, 2012 page 4 of 35
www.riskope.com
PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly already in the '90s
2. Despite being considered State of the Art PIGs have problems
3. So what can be done to avoid PIGs problems?
How to deal with risks from multiple hazards along thousands of kilometres of railroad without being overwhelmed?
Page 5 of 82(c) Riskope International SA, 2012 page 5 of 35
www.riskope.com
PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly already in the '90s
2. Despite being considered State of the Art PIGs have problems
3. So what can be done to avoid PIGs problems?
How to prioritize risks among thousands of potentially hazardous areas in the aftermath of a conflict where landmines were deployed?
Page 6 of 82(c) Riskope International SA, 2012 page 6 of 35
www.riskope.com
PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly already in the '90s
2. Despite being considered State of the Art PIGs have problems
3. So what can be done to avoid PIGs problems?
Is it possible to compile a map where local hazards are transformed into risks (to population, infrastructure), and these are consolidated by region?
Page 7 of 82(c) Riskope International SA, 2012 page 7 of 35
www.riskope.com
PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly already in the '90s
2. Despite being considered State of the Art PIGs have problems
3. So what can be done to avoid PIGs problems?
How can we show in a rational and transparent way the potential effects of terrorism? And reasonably mitigate them?
Page 8 of 82(c) Riskope International SA, 2012 page 8 of 35
www.riskope.com
PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly already in the '90s
2. Despite being considered State of the Art PIGs have problems
3. So what can be done to avoid PIGs problems?
How can we include in a plant's Risk Assessment possible effects from unrelated plants, handling hazardous matters and using the same infrastructure?
Page 9 of 82(c) Riskope International SA, 2012 page 9 of 35
www.riskope.com
PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly already in the '90s
2. Despite being considered State of the Art PIGs have problems
3. So what can be done to avoid PIGs problems?
PIGs do not fly because:
1) Too many hazards, 2) Too many targets,
3) They lack of “definition” and are “arbitrary” by nature, blurring reality
4) They expose clients to unsustainable mitigation expenses
Page 10 of 82(c) Riskope International SA, 2012 page 10 of 35
www.riskope.com
PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly already in the '90s
2. Despite being considered State of the Art PIGs have problems
3. So what can be done to avoid PIGs problems?
Polls have shown a discrepancy between users needs and PIGs results.
Users would like an approach: - covering dominoes effects (cascading
failures),- including multiparameter
consequences,- allowing continuous updates, - allowing the study of new risks as
they arise on corporate's radar screen and evaluating their impact in the risk landscape.
Page 11 of 82(c) Riskope International SA, 2012 page 11 of 35
www.riskope.com
PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly already in the '90s
2. Despite being considered State of the Art PIGs have problems
3. So what can be done to avoid PIGs problems?
PIGs do not allow any of that!Too many people mistakenly think that using PIGS is doing Risk Management! Try tell where your operation stands in the plot below using PIGs...You cannot!
Page 12 of 82(c) Riskope International SA, 2012 page 12 of 35
www.riskope.com
PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly already in the '90s
2. Despite being considered State of the Art PIGs have problems
3. So what can be done to avoid PIGs problems?
With PIGs it is not possible to “explicitly and formally” use multiple criteria to define the impact.
Often instructions say: “between physical and human losses, apply the highest consequence”.
Absolutely nonsensical!
Especially if the “average scenario” is used!
Page 13 of 82(c) Riskope International SA, 2012 page 13 of 35
www.riskope.com
PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly already in the '90s
2. Despite being considered State of the Art PIGs have problems
3. So what can be done to avoid PIGs problems?
This is a real PIG from a large environmental project
Page 14 of 82(c) Riskope International SA, 2012 page 14 of 35
www.riskope.com
PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly already in the '90s
2. Despite being considered State of the Art PIGs have problems
3. So what can be done to avoid PIGs problems?
Large consequence risks (for example catastrophic accident, successful Cyber-warfare attack on critical infrastructure, etc...)
all fall in the “top consequence cell”, but cannot be discerned one from another.
The habit of reducing scenarios to their “average” p, C only adds to this problem.
Page 15 of 82(c) Riskope International SA, 2012 page 15 of 35
www.riskope.com
PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly already in the '90s
2. Despite being considered State of the Art PIGs have problems
3. So what can be done to avoid PIGs problems?
Let's use a historic and recent set of tolerability criteria...
Page 16 of 82(c) Riskope International SA, 2012 page 16 of 35
www.riskope.com
PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly already in the '90s
2. Despite being considered State of the Art PIGs have problems
3. So what can be done to avoid PIGs problems?
...and plot the PIG on top. The non sense becomes evident...because....
Page 17 of 82(c) Riskope International SA, 2012 page 17 of 35
www.riskope.com
PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly already in the '90s
2. Despite being considered State of the Art PIGs have problems
3. So what can be done to avoid PIGs problems?
1) Risks that are very different can fall in the same category.
2) Cells limits are arbitrary.
3) PIGs can only differentiate risks if there are macroscopic differences in p and C.
CONCLUSION:PIGs critically lack of “resolution”..
Page 18 of 82(c) Riskope International SA, 2012 page 18 of 35
www.riskope.com
PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly already in the '90s
2. Despite being considered State of the Art PIGs have problems
3. So what can be done to avoid PIGs problems?
PIGs give:
1) a false sense of confidence,2) cannot prioritize risks properly,3) do not allow comparisons among alternatives/projects.
Thus cannot be used for sensible ERM,create a fuzzy “risk landscape” in studies where numerous scenarios, possibly linked by interdependency, threatened by multiple hazards are present.
Page 19 of 82(c) Riskope International SA, 2012 page 19 of 35
www.riskope.com
PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly already in the '90s
2. Despite being considered State of the Art PIGs have problems
3. So what can be done to avoid PIGs problems?
The number of cells in the matrix will not change these results, because tolerability is not explicitly defined.
It is way better to work with properly approximated quantitative estimates than with “precise” semi-qualitative PIGs!
It is better to be generally right rather than precisely wrong!
Page 20 of 82(c) Riskope International SA, 2012 page 20 of 35
www.riskope.com
PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly already in the '90s
2. Despite being considered State of the Art PIGs have problems
3. So what can be done to avoid PIGs problems?
For rational decision making we cannot rely on:
-arbitrary cells' limits, -arbitrary tolerability defined by
“steps” in the cells!
Page 21 of 82(c) Riskope International SA, 2012 page 21 of 35
www.riskope.com
PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly already in the '90s
2. Despite being considered State of the Art PIGs have problems
3. So what can be done to avoid PIGs problems?
We need to go back to raw data...
...and use Optimum Risk Estimates (ORE)
Page 22 of 82(c) Riskope International SA, 2012 page 22 of 35
www.riskope.com
PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly already in the '90s
2. Despite being considered State of the Art PIGs have problems
3. So what can be done to avoid PIGs problems?
As we do not want to waste time and resources, let's use client's PIGs (if they have been developed already).
But...
Page 23 of 82(c) Riskope International SA, 2012 page 23 of 35
www.riskope.com
PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly already in the '90s
2. Despite being considered State of the Art PIGs have problems
3. So what can be done to avoid PIGs problems?
...develop a rational and scientific prioritization criteria based on explicit tolerability.
ORE are the only rational way, better than any ranking, top ten list, etc...to plan your mitigations.
Page 24 of 82(c) Riskope International SA, 2012 page 24 of 35
www.riskope.com
PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly already in the '90s
2. Despite being considered State of the Art PIGs have problems
3. So what can be done to avoid PIGs problems?
We will use a real life example to show you how ORE are done:
One client's operation had a PIG based prioritization as follows:
Page 25 of 82(c) Riskope International SA, 2012 page 25 of 35
www.riskope.com
PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly already in the '90s
2. Despite being considered State of the Art PIGs have problems
3. So what can be done to avoid PIGs problems?
50 risks which split into: -0 Severe-14 High-25 Medium -11 Low risks
They called us in because they did not know how to tackle 14 high, 25 medium...too costly!!!
Page 26 of 82(c) Riskope International SA, 2012 page 26 of 35
www.riskope.com
PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly already in the '90s
2. Despite being considered State of the Art PIGs have problems
3. So what can be done to avoid PIGs problems?
Let's see how focus can be increased with ORE so that client gets a clearer roadmap for managing risks, decision making, etc...
Page 27 of 82(c) Riskope International SA, 2012 page 27 of 35
www.riskope.com
PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly already in the '90s
2. Despite being considered State of the Art PIGs have problems
3. So what can be done to avoid PIGs problems?
Let's build a tolerability curve: we display it here on top of the original PIG's cells, for comparison
Page 28 of 82(c) Riskope International SA, 2012 page 28 of 35
www.riskope.com
PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly already in the '90s
2. Despite being considered State of the Art PIGs have problems
3. So what can be done to avoid PIGs problems?
For each risk let's evaluate the intolerable part (orange) vs. tolerable part (blue).
Page 29 of 82(c) Riskope International SA, 2012 page 29 of 35
www.riskope.com
PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly already in the '90s
2. Despite being considered State of the Art PIGs have problems
3. So what can be done to avoid PIGs problems?
Top 20 Total Risks prioritization, however we can do better than that!
Page 30 of 82(c) Riskope International SA, 2012 page 30 of 35
www.riskope.com
PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly already in the '90s
2. Despite being considered State of the Art PIGs have problems
3. So what can be done to avoid PIGs problems?
Risks prioritization with the intolerable part as discriminant constitute the core of ORE because...
...the only risks that actually matter are the ones that extend above your tolerability.
Page 31 of 82(c) Riskope International SA, 2012 page 31 of 35
www.riskope.com
PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly already in the '90s
2. Despite being considered State of the Art PIGs have problems
3. So what can be done to avoid PIGs problems?
ORE show that only 5 scenarios count for 83% of the total intolerable risks. Concentrating on them will greatly improve the situation. Five instead than 14 (+25) suggested by PIG!
Now it is possible to take rational decisions in allotting mitigative funds, plan ahead!
Page 32 of 82(c) Riskope International SA, 2012 page 32 of 35
www.riskope.com
PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly already in the '90s
2. Despite being considered State of the Art PIGs have problems
3. So what can be done to avoid PIGs problems?
Because of poor Hazard Identification, we noticed that the client had omitted some scenarios, so we had to include them in the ORE.
How can new results be integrated in the ORE?What is the impact on decision making?
Page 34 of 82(c) Riskope International SA, 2012 page 34 of 35
www.riskope.com
PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly already in the '90s
2. Despite being considered State of the Art PIGs have problems
3. So what can be done to avoid PIGs problems?
The results of ORE are to be seen dynamically, through cyclical updates.
They allow “what-if” analyses and the cost-benefit evaluation of mitigative alternatives.
ORE are a tool for day-to-day consultation which become richer with time, meanwhile offering a clear understanding of the evolution of risks and crises throughout the system.
Page 35 of 82(c) Riskope International SA, 2012 page 35 of 35
www.riskope.com
PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly already in the '90s
2. Despite being considered State of the Art PIGs have problems
3. So what can be done to avoid PIGs problems?
ORE are the key to your
business prosperity, survival and sustainability.
CONTACT: Cesar Oboni coboni(a)riskope.com
