How to analyse and assess risks?

The realm of possibilities that may arise in a situation of uncertainty for an organisation is practically without borders. And even if risk management tends to look principally at downside risk when referring to risk diagnostics, it is essential to have a broad perspective of their potential impact, albeit only to prioritise risk control efforts.

Too often the risk impact evaluation is limited to the two traditional variables used by the insurance industry, which wants to arrive at an expected value of the claims arising from a portfolio; that is, the probability, also called frequency – as claims do occur even in a well-balanced portfolio (law of large numbers) – and the severity, or the financial impact, which is mostly measured within the scope of the insurance covers granted the insured by the contract.

In fact, if the portfolio is large enough and underwritten cautiously, the multiplication of the frequency by the severity, or expected value, is indeed what the insurer can expect to pay in claims on his portfolio in the long run.

However, when applied to a single organisation, large as it may be, the formula will not give insight into the adverse conditions that it may be faced with, except for the very limited and frequent claims, like physical damages to a fleet of vehicles. A major variable is missing that could be summarised in the volatility of the annual losses and the negative cash flows that stem from the realisation of the hazardous events.

For the high frequency risk, the “non risk” exposures in terms of financial implications like health covers for a large population, vehicle fleets, and the historical data will provide a good start to forecast the future losses provided trend variables are properly inserted in the model. Furthermore, the expected annual cost may even prove a reasonable base for a budget exercise.

For exceptional exposures on the other hand, it is more the severity and the spread of consequences that will guide in the decisions of risk treatment, even to the ultimate option of discontinuing or not engaging in an activity deemed too risky. In those situations, it is essential to determine the stakeholders’appetite for risk. To summarise, the parameters should not be multiplied; it is the three dimensions vector (F, S, s) that must be assessed: At a given level of confidence, are the consequences socially and economically acceptable?

Finally, when dealing with risk assessment, one must exercise caution as some consequences are not readily measurable in monetary terms (long-term impact on the environment) and cannot always be positioned in the financial model of the firm even with the long-term view of value creation for the stockholders. It is probably necessary to broaden the assessment tools to include other variables besides the three mentioned here. But that will be part of our discussion on cindynics, much later in this sequence of letters from Paris.

One final piece of advice: as all is not quantifiable in monetary terms, all that can be must be treated with utter care and application, be it only to limit the residual uncertainty!