Understanding the range of possible outcomes, and generating an understanding of how likely a particular (e.g. “base”) case is to be achieved, and what modifications are required (e.g. to targets, inclusion of contingencies, implementation of risk-response measures, or development of new structural options).
• Enhancing the ability to compare projects with different risk profiles, and to support the development of optimal business portfolios.
• Allowing risk tolerances to be made explicit, reflected in decision-making and to be done in a way that is aligned with organisational objectives (see below for further discussion).
• Increasing transparency, reducing biases and supporting the achievement of the appropriate balance between intuition and rationality in decision-making.
Robust decision-making in business contexts requires a consideration of risk tolerances:
• Corporate governance. Shareholder demands for appropriate risk taking (to create rewards for equity investors by taking appropriate risk) need to be reflected in decision-making and in project selection: in theory (and practice), some companies should be more risk seeking than others, but it would seem difficult for a company to appropriately manage its risk profile without knowing and measuring (quantitatively) how much risk is being taken. Instead, very often, such processes remain intuitive, non-transparent and elusive, and are likely to be suboptimal.
• Consistency. Without a formal consideration of risk tolerances, a decision that would be authorised on one occasion may not be authorised on another. Thus, in one instance a project that is high risk/high reward may be favoured over a lower risk/lower reward one, whereas in similar circumstances on another occasion the reverse would be the case. This may be due to the presentation or framing of the decision, or to short-term inconsistencies and fluctuating optimism or pessimism that occur in day-to-day behaviours when formal processes are not put in place.
• Business portfolio optimisation. Most businesses can be considered as portfolios of components (e.g. customers, geographies, projects or products). As such, there is an optimisation aspect to the appropriate business design and strategic choices, with an optimal portfolio consisting of a combination of components with different profiles, so that some elements balance out against others.
Given these drivers, the application of a formalised risk analysis process in many business situations is likely to create significant benefits in terms of the quality of the final decision.
1.4 The Objectives and Uses of General Risk Assessment
Risk assessment processes and tools are already widely used in some business contexts. Typical applications include general planning and forecasting (e.g. revenue and capital expenditure, financing needs), cost estimation and contingency planning, project schedule uncertainty, portfolio structuring and optimisation, valuation of the flexibilities associated with being able to respond to uncertain outcomes or of gaining additional information (such as real option analysis), and general decision-making under uncertainty. Such applications apply to essentially any sector; key examples include oil, gas, energy, resources, construction, pharmaceuticals, insurance, reinsurance and finance.
Of course, formalised risk assessment is much more than simply “expecting the unexpected” by identifying possible risk factors in advance. Ultimately, the overall objective is to enhance organisational performance through superior project design, selection, decision-making and management. In particular, the essential role of risk assessment is to support the development and choice of the optimal context in which to operate (operating within the best structural context, and mitigating and responding to risks within it in the best way), and to support the evaluation of a final decision within that context by taking into account the residual uncertainty and risk tolerances of the decision-maker. This may be achieved through more specific objectives, which are generally of several forms:
• Adapting and improving the design and structure of plans by managing, mitigating or exploiting uncertainties.
• Achieving optimal project structures and economically efficient risk mitigation.
• Enhancing decision-making concerning project evaluation, objectives and target setting, contingency planning and the reflection of risk tolerances within the decision-making processes.
• Managing project execution and implementation effectively.
• Constructing, selecting and optimising business portfolios.
• Supporting the creation of strategic options and corporate planning.
Perhaps the main role of risk assessment is to enhance a particular set of (original) plans to include risk mitigation, management or response measures:
• The identification of risks, and the generation of an understanding of their interactions, dependencies and likely significance, drives the identification and development of possible response actions.
• In this way, plans are improved, both reducing adverse risks and exploiting upsides (such as operational or strategic flexibilities), with such actions, and their effects, costs and benefits, being included in a revised plan.
Much benefit can often be achieved even when such processes are only of a qualitative nature, because key individual risks would nevertheless typically be identified, and some consideration of possible risk-response actions would be undertaken. However, quantitative approaches will provide a much larger set of benefits, as discussed later in the text.
When considering the structure of a project or plan, there are generally many possible risk-response measures available. Some risk items are more controllable (or exploitable) than others, and the cost of doing so will be different for each. For example, the variation in oil prices may be essentially uncontrollable (there may be possibilities to hedge or engage in forward contracts in the short term, but in the medium term the impact on a business is typically largely uncontrollable).
In general, one may prioritise and implement measures in some order driven by a cost–benefit analysis of each one, and after implementing some of them, one would arrive at a point where the use of further measures is not economically efficient. For example, the risk of having an accident when crossing the road is rapidly reduced when low-cost measures are implemented (such as looking each way, or perhaps wearing running shoes or reflective clothing) but in many cases it would not be economically efficient, or practical, to eliminate the risk entirely (by having a bridge built): the marginal risk reduction that would be achieved by such a measure cannot be justified by the marginal cost increase that would be needed to implement it.
There may also be interaction between any such measures, so that there may be some measures that would make (economic) sense in isolation, but would not make sense within the wider context of a set of measures. Indeed, whether a particular measure makes sense may depend on which other measures are implemented first.
Further, in practice, risk-response actions may also affect multiple metrics (or line items in a model), so that the making of the appropriate trade-off between them may be non-trivial.
Thus, although the choice of measures to implement could be considered as a quantitative optimisation problem, the use of such approaches in these contexts is usually limited by practical considerations; a mixture of judgement, pragmatic considerations and some basic quantitative analysis is usually sufficient to find a mix of measures that is (close to) optimal.
