• Riskope International

    Risk and Crisis Management Decision Making Support Tolerability and acceptability definition Coaching and Skills development
  • Risk and Crisis Management Decision Making Support Tolerability and acceptability definition Coaching and Skills development
  • Archive

  • Categories

  • Meta

  • Flickr Photos

    Economic downturn crisis forecast November 2008

    Contact us to know details on economic downturn crisis forecast

    graphic results of economic downturn crisis forecast November 2008

    Economic Downturn Magnitude and Duration Quantitative Study by Riskope (http://www.riskope.com), November 2008

    More Photos

Can we stop misrepresenting reality to the public?

We gave a presentation in Toronto, at the CIM 2013 conference.

The main points made are the following:

  • You cannot manage (your) capital if you do not understand risks.
  • You will not be able to make proper decisions if you do not understand risks.
  • You will not be allowed to operate if people do not believe, trust and understand you and your risks.
  • You will miss opportunities and blindly expose yourself to risks  if you do not understand risks.
  • If you understand your risks you can go and see your bankers with better indicators than the sad, obsolete and misleading NPV.
  • With better understanding of risks you can beat insurance denial problems and come up with win-win solutions either with your insurer, or with you key contractual counterparts.
Sadly, the recent collapse of the nine-storey Rana Plaza factory in Dhaka, Bangladesh, one of the worse industrial disaster in the world since the 1984 Bhopal gas explosion, confirms the above.

 

Riskope’s Blog 2012 in Review

The WordPress.com stats helper monkeys prepared a 2012 annual report for this blog.

Here’s an excerpt:

600 people reached the top of Mt. Everest in 2012. This blog got about 3,700 views in 2012. If every person who reached the top of Mt. Everest viewed this blog, it would have taken 6 years to get that many views.

Click here to see the complete report.

On time, on budget, in control, showing your leadership with sustainable capital expenditure, even during recessions and economic, financial crises.

Riskope can also help you solve insurance denial situations adding value to you existing risk assessments, risk registers, ERM in an ingenious way.

The subtitle of today’s post could actually be spelled out as follows: we will show how your “standard” risk approach (risk assessments, risk register, ERM) that your peers and superiors already understand and “own” can be turned into a cutting edge competitive advantage, freeing capitals for business and production development, leading to more easily defensible, justifiable decisions. In other words, the mantra is: stop wasting moneys and efforts in security measures that do not pay off, over-investing in some mitigations and may be under invest in others, with, in both cases, potentially devastating unjustified consequences.Our metric is consistent, unambiguous, and provides context for better understanding risks fo your organization.

The “total” risk for each scenario can be calculated, and when applicable, it is possible to evaluate which portion of that risk lies above the tolerability

The “total” risk for each scenario can be calculated, and when applicable, it is possible to evaluate which portion of that risk lies above the tolerability

Instead of splitting this post in sections, as we have done in several occasions for longer posts in the past, we have decided to publish it as a self standing paper or in PDF, as we would like our readers to get a feeling for the logical continuity, getting to the conclusions in one breath and easily download the paper for reference.

The paper isn’t a thrilling Afghan terror or spy fiction story involving Bin Laden, but when you will get to the end and will appreciate how you and your company could profit from these concepts, we hope you will be breathless and excited, as much as we are in our day to day consulting practice!

As you will see, we have used a real life case study, with names etc. changed to respect client’s confidentiality.

Here you have a summary of the benefits yielded by the approach :

  • The prevalent critical risks were brought forward in a clear, rational and defensible way

  • The number of critical issues was shown to be smaller than originally evaluated at Status Quo

  • The insurance portfolio was shown to be poorly balanced and adjustments were proposed

  • The new priority list let Management make better decisions in mitigative investments’ allotment and freed moneys that could be better allocated elsewhere

  • The methodology allow rational updating of the probabilities when new data are gathered.

The Hydropower Sustainability Assessment Protocol and Operation Risk Awareness and Preparedness Rating (ORAPR)

One of the challenges of Risk Assessments lies in defining proper metrics for the consequences of hazards hits. When the Risk Assessment bears on a well-defined facility, the task is easier than if the study bears on large and multifaceted systems exposed to risks, like, for example, copper theft or information warfare at national scale, or, similarly, if we are dealing with
rational funds allotment and justification for critical infrastructure.

The Hydropower Sustainability Assessment Protocol

Metrics in that case have to cover numerous aspects of the cost of consequences, including wide social-economical repercussions of the hazards.

While working on the definition of the metrics for country-wide rational funds allotment and cyber warfare risk management, a literature search led us to review documents such as “ The Hydropower Sustainability Assessment Protocol”. This document explains how “Projects would be ranked on a scale of one to five according to their likely effects on biodiversity, ecology, hydrology and erosion as well as on broader issues regarding regional planning, cultural heritage and effect on local inhabitants.”

Operation Risk Awareness and Preparedness Rating (ORAPR)

Operation Risk Awareness and Preparedness Rating (ORAPR)

The similarity with the requirements for a complex consequence metric seem striking. A presentation of the methodology (PDF), at page 13 shows a graphic representation very familiar to us, and probably to you, readers of this blog (See ORAPR)! In fact the methodology of the “ The Hydropower Sustainability Assessment Protocol” is so close to what we developed a while ago for Mine Operational Risk Awareness that we decided to compare the benefits they bring and share our experience with the application of ORAPR.

The “Hydropower Sustainability Assessment Protocol” states among the benefits of its use that it :

  • Creates awareness of all the aspects of Sustainability,
  • Strengthens the capabilities of developers,
  • Provides a neutral platform for dialogue between proponents and affected parties,
  • Provides a global benchmark for regulators, banks and policy makers,
  • Provides a strong signal to any potential partners in a project.

Our experience with ORAPR certainly confirms the approach helps to raise awareness. In fact, we even named it ORAPR where the A stands exactly for Awarness.

As you see the benefits of using such a tool for mining operation is tremendous, as is it with hydro-power.

ORAPR has the advantage of allowing to compare the same operation at various stages, using preparation, awareness and other controls as key parameters. At the end users have a graphic explicit output, as well as a rating in their hands, to help communicating further needs for awareness and preparation developments.

ORAPR is fast and inexpensive and will allow you to “know where you stand” in terms of risk awareness and preparation.

ALE, FMEA, FMECA, qualitative methods: is it really what we need!?

Many Risk Assessment use Annual Loss Expected (ALE) as a metric for consequences. The failures of the system or subsystems under consideration are evaluated with an array of methodologies. Among these the classic one are Failure Mode and Effects Analysis (FMEA) and the Failure Mode and Effects Criticality Analysis (FMECA).

The essence of FMEA/FMECA is the impact analysis of every potential defect on functionality of the whole system and order of potential defects according to the level of its severity.

This has lead in the past to some “aberrant” studies where hundreds, if not thousands of defect scenarios and resulting paths to failure were analyzed in huge “trees” …..disproportionate with the available data and their quality, leading to misleading perception of the accuracy of the answers.

Instead, the ultimate goal of any Risk exercise should be to define optimal proportion between threats and costs of system’s protections, based on available data and their uncertainties. The system can be anything, an IT system including hardware and software, a transportation system, a static infrastructure, an operation, such as a mine, a commercial wharf, a humanitarian program, a rescue or military operation, etc..

Once a proper approach is developed and appropriate preparedness actions foreseen, time needed for appropriate reactions in case of a hazard occurrence (the source of the risk) is decidedly shortened. The lack of appropriate preparation may lead the system (and its owner, whether it is a corporation, a governmental entity, an NGO) to collapse.

Appropriate reactions based on a clear plan pave the road towards long-term survivability and development of the system and its owner, as we have pointed out and discussed in detail in our book Improving Sustainability through Reasonable Risk and Crisis Management.

Specific literature very often skips the issue of quantitative methods of risk assessment, only concentrating on “mainstream” and often very poorly implemented qualitative methods or misleading ALE/ FMEA/ FMECA.

The root causes of this lack of attention to quantitative methods are nested in poor information, misunderstanding about the data required to perform a quantitative approach and “syndromes” on which we have already expanded in past postings on 16 common human traits.

Governments are pulling on Green Energy Support part 2

When an article about “intuitive” or “impulsive” decision making and its numerous pitfalls gets out, we always check to make sure our services or applications would have allowed a better course selection. It is our duty, in our capacity of decision making support consultants, to make sure our services and applications are robust and would be beneficial to our clients.

Last week, in Scientific American of March 1st  we read the following lines.

“Basically, governments have allowed the buildup of wind (energy) without thinking through the (electrical) grid consequences,” Oxford University economist Dieter Helm told ClimateWire. “There are two responses: Stop wasting so much on the rapid development of wind and its questionable economics, or plough-on regardless, in which case enormous grid investments are urgently needed.”

We were not really surprised as exactly 1 month ago, we wrote in this blog:

“It is paramount to think before acting, with a clear and transparent approach including risks and other non deterministic factor, to enhance the survivability and return on investment just as we wrote in the recently published post on Decision Making.

So, just to prove ourselves, once again, that our Comparative Decision Analysis/Economic Safety Margin (CDA/ESM) would have been a robust decision making tool, i.e. it would have “caught” the problem of the wind farms, I opened the manual just to notice that the second line of the “Usable Life Analysis” in the project risks assessment section contains a whole register dedicated to the scalability and adaptability ….to existent systems!

The instruments to keep a level head exist and do work. Why are we still not using proper tools to help us in our (high stakes) decision?

Why Legal Negligence Test is not a Critical Test for an Operation?

Even those who recognize that, in its simplest form,
Risk= (probability of a hazard occurring) x (Cost of consequences of the hazard hitting)
(Hiromitsu Kumamoto and Ernest J. Henley, Probabilistic Risk Assessment and Management for Engineers and Scientists, 2nd edition (New York: Institute of Electrical and Electronics Engineers, Inc., 1996), p. 2.)

and therefore a company-wide risk can be expressed as the sum of individual risks may actually incur in unfortunate misjudgments in terms of selecting where to invest their mitigative funds.
(National Bureau of Standards, Guideline for Automatic Data Processing Risk Analysis, FIPS PUB 65(Washington, DC: U.S. General Printing Office, 1979).

As a matter of fact, unfortunately, the earlier formulation has the disadvantage of being unable to distinguish between high-frequency, low-impact events and low-frequency, high-impact events. In many situations, the former may be tolerable while the latter may be catastrophic.

Ignoring the distinction may indeed put the company in a legal hazardous condition, as tort law often uses the somewhat vague standard of the “reasonable man” to judge liability of negligence (see below for definition).

As discussed in our BP case study adding to this vague standards the test of tolerability clearly brings value to the discussion and adds “foreseeability and controllability” to management.
As a matter of fact it is often impossible to act “simultaneously on all mitigations required” and it might be necessary to prove that the “efficacy and efficiency” were considered.

Let
P= Probability of injurious event
C= Gravity (Consequences) of the resulting injury
M= Burden, or cost, of adequate precautions (Mitigations)

Then
Injurer (Company) is negligent if and only if M<P x C

In other words a Company may be deemed negligent only if Mitigative moneys spent (per annum) are less than the annualized risks. Clearly transparency and rationality constitute a strong a priori defence in case something would go wrong.

Let’s look at a two summarized case studies to prove the point made in the title:

1) A tailing dam in a Canadian mine in Manitoba was assessed with a likelihood of failure of 10-5 per annum. After an interview with the personnel, we defined a costs of consequences within a 95% confidence level to 10 millions dollars. By strict application of the negligence criteria, the company would be considered negligent if and only if they spend less than 100 dollars for mitigative measures per year. Of course the company would be the object of intense media and regulatory scrutiny should an accident occur. Even if the company is spending way above the threshold value it is difficult to imagine it would emerge unscathed from such a failure proving the point of the title.

2) In the Andes, a bus fleet shuttles the mine’s employees to different locations. After 10 years of regular services, a tragic accident took two lives. As management grew afraid of a crisis potentially ending into massive strikes, they asked Riskope to study possible alternatives to the system. The review of existing road safety measures revealed that one millions dollars had already been invested in additional guard rails and buses were escorted, requiring an operational budget of 150 thousand dollars per year. For 10 years of operation it can then be said that the company was spending 0.25 millions dollars per year in mitigative measures. Now, let’s assume that the probability of an accident is 0.001, an extremely high value, per year. A careful reader will indeed note that this value is absurdly high (for reference, in France or Switzerland where we have a strong data set, the value would be at least 2 orders of magnitude lower). The company would therefore be considered negligent if and only if the cost of consequences associated to that probability is 250 millions dollars or more. This staggering value overcomes any accident scenario involving the shuttle buses. Consequently the company would not be considered negligent in the eye of the law. In the eye of the public and employees, however, it would most likely be a completely different story… but experience has shown that public outcry only explodes when a number of similar accidents occur delivering the impression that public is exposed to an epidemic.

In conclusion we have shown that the legal negligence test is not a critical factor for an operation’s safety, health and risk and crisis management, but constitute a bare minimum . The negligence test is not an end, but only the start of a continuous process.

 

In Riskope’s (www.riskope.com ) day to day review jobs we notice a number of pitfalls in Risk (Management) approaches:

  1. Deficiencies and sometimes, to a lesser extent, excess in defining scenarios to be included in the analysis.
  2. The apparently “desperate need to use precise numbers” when dealing to quantitative analyzes, playing in favour of excessively fuzzy and confusing qualitative or indexed approaches, chosen over quantitative approaches with the excuse that anyways “numbers will be wrong”.
  3. The irresistible need to delve into exceedingly complex event trees when dealing with conditional probabilities (sometimes leading to event trees with thousands of branches…!?)

These pitfalls have lead some very reputable global companies to opt for a technologists’ binary (yes/no) view of security. In their eyes, systems are either secure and safe, in which case they have no vulnerabilities, or are insecure, in which case they have vulnerabilities that require remedial action. Often the definition of risk is forgotten as unclear glossary is not used, further complicating matters.

Based on the excuse that a model is only as good as the information one puts in (point 2 above), convinced that only “very precise numbers” would fit the needs of analyzes, neglecting the fact that ranges are the safest option, even large corporation make astounding decision mistakes!

Large amounts of money are wasted as a result of a choice that is often made because of a refuse to forward thinking.

Some approaches look exclusively at assets values (at risk) and ignore to put on the balance safeguards/mitigative costs (meaning they do not use risk as a discriminant). The results are erratic at best, and may lead to:

  • over or under-mitigate,
  • economic inefficiencies,
  • lack of competitiveness.Without the capacity to perform cost-benefit analysis or the requirement of basic data collection for future statistics, these methods provide no mechanism to motivate refinement of their recommendations. Although convenient in the short term these are not viable long-term solutions.

Some other approaches are built around scenario-analyzes,which involve the construction of different hazard/risk/crises scenarios. Scenario analysis is customarily employed to dramatically illustrate how vulnerable an organization is.

The primary drawback of an exclusively scenario-analysis based approach is the generally limited scope and consistency. For example an expert will build a very detailed risk scenario in his domain but will forget the most basic scenarios in other areas.

In a recent case we even saw an analysis being performed on what the company believed to be credible scenarios, thus cutting away any low probability high consequence scenarios!

Assessing only a few scenarios leaves the possibility that important paths may be missed, leaving serious risks unaddressed. By narrowing the focus in this way, the analysis is made tractable, but incomplete.

In the meantime, ignorance is a self-reinforcing problem since organizations are reluctant to act on security/risk concerns unless a real problem has been proven.

Riskope’s ORAPR offers the opportunity to quickly assess an Operation Risk Awareness and Preparedness. The benefits for the evaluated entity are considerable: the Operation Risk Awareness and Preparedness Rating (ORAPR) constitutes a very fast, easy, repeatable and inexpensive approach revealing global management and leadership strengths and weaknesses and delivering a metric of the Operation/ Corporation/ Project Survivability Readiness and Awareness in case of hardship, extreme events, crises and mishaps.

Operation Risk Awareness and Preparedness Rating (ORAPR)

Operation Risk Awareness and Preparedness Rating (ORAPR) is a simple form following a multiple choice questionnaire format, to be filled by a key person or a committee well informed about the management practices and controls driving the company, division, operation, project to be evaluated.

The benefits for the evaluated entity are considerable: the Operation Risk Awareness and Preparedness Rating (ORAPR) constitutes a very fast, easy, repeatable and inexpensive approach revealing global strengths and weaknesses of the management and leadership of the evaluated entity and delivering a metric of the Operation/ Corporation/ Project Survivability Readiness and Awareness in case of hardship, extreme events, crises and mishaps.

Contrary to other approaches, little or no guidance is needed to reply to the questions.
The form contains 14 sections covering a wide spectrum of the corporate, project, operation managerial and operational activities, with a total of approximately 150 questions. The approximate time to fill the form can be as short as 1 hour provided the person or committee in charge of the rating are well informed about the operation/project management and controls.

Once the form is filled up, it can be returned to Oboni Riskope Associates Inc. (ORA) that will use the replies to deliver a number of vital data set that constitute a metric of the Operation/ Corporation/ Project Survivability Readiness and Awareness. ORA does not need to know the location, the name and other confidential data to perform the rating: confidentiality is thus totally ensured.

The simplest form of result is a radar-screen graph featuring fourteen radii (one per covered management/ operational area considered in the analysis) , see figures below) on which the relative rating is displayed. By joining the end of each radius a polygon is drafted.
The smaller the polygon, the poorest are awareness and preparedness.
If the polygon is very irregular (star-shaped) then the entity has poorly balanced preparedness and awareness (spends too much efforts in some directions, not enough in others).
When preparedness and awareness increase, the surface should increase and funds should be invested in such a way that the polygon becomes as regular as possible.
Other metrics can be provided as we will show in future posts.

NB: Operation Risk Awareness and Preparedness Rating (ORAPR) is not intended to replace or substitute a formal Risk Assessment, Risk or Crisis Management approach, or an Enterprise Risk Management initiative. It is instead an easy to perform, fast and inexpensive way to measure how aware, ready and prepared you/your organization/projects are to the inevitable volatility of our world, facing third party crises, climate changes, economic turmoil, recessions, obsolescence, fierce competition etc.

As we will demonstrate in the case study presented in the next section, Operation Risk Awareness and Preparedness Rating (ORAPR) will actually help you measure the relative effectiveness of your Risk and Crisis Management efforts, and thus help you ensure that the funds devoted to these initiatives are allotted in a reasonable and sustainable manner.

Case study

The subject of this case study is a medium size real-life client’s operation. This particular client is a mine operator but the Operation Risk Awareness and Preparedness Rating (ORAPR) can be used for any industry or operation.

The operations was rated at three different stages:

1) Before our first Risk Assessment (Initial Status Quo Rating)
2) After our first partial Risk Assessment which dealt with the environmental and waste management aspects,
3) After further completion of a wide spread Risk Assessment covering other aspects of the operation.

Stage 1:Before our first Risk Assessment (Initial Status Quo Rating)

As it can be seen in the figure the resulting polygon is relatively small in relation to the possible full radar-screen, it is rather irregular (star-shaped). This means that the entity is quite unprepared and unaware of its risks and crises, thus poor controls or no controls are in place, and furthermore the various management and operational areas receive unbalanced attention.

This is the image of a rather poorly managed entity (in particular with respect to risks and crises) which is, however, compliant to Health and Safety Regulations and takes good care of its equipment and production systems.

Status Quo before Risk Assessment

Stage 2: After our first partial Risk Assessment which dealt with the environmental and waste management aspects

As a result of Stage 1 Operation Risk Awareness and Preparedness Rating (ORAPR), Management allotted some resources to perform a Risk Assessment which dealt with the environmental and waste management aspects. As it can be seen the results of this initiative “pushed the envelope” increasing some radii and “rounding-up” the contour.

The partial nature of the initiative lead to modest, but significant local enhancements, and a modest overall increase of the surface.

After a first partial Riask Assessment

Stage 3: After further completion of a wide spread Risk Assessment covering other aspects of the operation

Stage 3 allowed us to complete the scope of the Risk Assessments by allowing us to study areas that had previously never been examined.

As it can be seen in the figure below, then trends initiated in Stage 2 were confirmed and the polygon became “rounder” and larger.

Only the areas of Event Management, Emergency and Preparedness, Auditing and Inspection remained “untouched” and appear quite visible as a “deformation” of the regular polygon.

After wide spectrum Risk Assessments

The evolution in one picture

The figure below shows the three stages superimposed. As it can be seen the gains yielded by the performed initiatives are quite visible, easy to understand and the radar-screen image can be used as a basis for budget discussions etc.

Of course the Operation Risk Awareness and Preparedness Rating (ORAPR) can also be used to build “what if” scenarios to foster healthy discussions and increase the pertinence of Risk and Crisis Management investments.

The three stages on the same radar-screen show quite eloquently the evolution

Decision Makers are Hamlet’s Modern-Age Avatars

An Avatar can be either an embodiment (for example: “the Buddha is an avatar of the god Vishnu”) or the personification of a familiar idea (for example “the embodiment of hope”; “the incarnation of evil”, etc.).

So it is fitting to say that Decision makers are Hamlet’s modern age Avatars.

Hopefully they do not have to deal with a nasty uncle who murdered their father and married their mother, but often have to find answers to critical questions, which certainly are not as metaphysical as the famous Hamlet’s one: “To be or not to be? That is the question”.

As a matter of fact, centuries after the famous monologue was written, modern executives are confronted with three prong practical questions rather than the “simple” Shakespearean binary one: “To be or not to be?” That’s the point!

The three prongs are generally:
a) to follow the Status Quo,
b) to embrace a new technology, new Standard Operating Procedures (SOP), new processes, environmentally friendly clean technologies (CT), safer practices, etc.
c) to enhance the Status Quo.

In the aftermath of the economic recession Riskope has repeatedly been called in, to support companies facing decisions surrounded by uncertainties.
Here are a few examples drawn from our day to day practice (See a general approach).

To bus personnel (a), or fly personnel (b)? Or continue the bus service, but invest to enhance the road safety (c)? (See this Example )

To maintain a facility (a) or build a new one (b)? Or enhance the existing one(c)?

To shovel and truck waste rock (a), or crush in situ and then convey (b)? Or renew the truck fleet with more efficient vehicles (c)? (See an Example )

To keep pumping and treating leachates from a landfill (a) or seal it at perpetuity in an artificially created impervious block (b)? Or better the collection and treatment process (c)? (See an Example )

To maintain a contaminated area closed to public (a), or to open it to a specific tourism attraction (b)? Or do so under very particular conditions (c)?

To keep heating costs and waste oils disposal costs (a), or to buy a new system that can dramatically change the balance, by burning waste oils on site (b)? Or enhance the present system by adding insulation and energy sparing devices (c)? (See Part 1 of Example and Part 2 of Example )

To keep a large industrial orphan site unused (a), or to design an entire new set of possible activities which would make it economically viable (b), or just landscape it (c)

To keep selling commercially available cosmetics in a large spa (a) or to develop and launch a new private label line of cosmetics (b), or enter into an exclusivity agreement with “the best in the market” (c )?

To maintain production in an industrialized country (a), or to move all production oversea to a developing country (b), or reduce costs by streamlining production at home (c )?

Today more than ever, proper decision making is needed to ensure a sustainable development of any operation. Risk (positive and negative) is a good discriminant for selecting among alternatives, and Risk Based Decision Making will improve the sustainability and long term chances of success of any operation. Contact us, we know how to support you.

Follow

Get every new post delivered to your Inbox.

Join 1,487 other followers

%d bloggers like this: