Premium
Evaluating and Improving Risk Formulas for Allocating Limited Budgets to Expensive Risk‐Reduction Opportunities
Author(s) -
Cox, Jr. Louis Anthony Tony
Publication year - 2012
Publication title -
risk analysis
Language(s) - English
Resource type - Journals
SCImago Journal Rank - 0.972
H-Index - 130
eISSN - 1539-6924
pISSN - 0272-4332
DOI - 10.1111/j.1539-6924.2011.01735.x
Subject(s) - risk management , risk analysis (engineering) , factor analysis of information risk , risk assessment , it risk management , risk management tools , vulnerability (computing) , enterprise risk management , computer science , work (physics) , reduction (mathematics) , resource allocation , risk management information systems , operations research , actuarial science , business , engineering , mathematics , computer security , finance , information system , mechanical engineering , computer network , management information systems , geometry , electrical engineering
Simple risk formulas, such as risk = probability × impact , or risk = exposure × probability × consequence , or risk = threat × vulnerability × consequence , are built into many commercial risk management software products deployed in public and private organizations. These formulas, which we call risk indices , together with risk matrices, “heat maps,” and other displays based on them, are widely used in applications such as enterprise risk management (ERM), terrorism risk analysis, and occupational safety. But, how well do they serve to guide allocation of limited risk management resources? This article evaluates and compares different risk indices under simplifying conditions favorable to their use (statistically independent, uniformly distributed values of their components; and noninteracting risk‐reduction opportunities). Compared to an optimal (nonindex) approach, simple indices produce inferior resource allocations that for a given cost may reduce risk by as little as 60% of what the optimal decisions would provide, at least in our simple simulations. This article suggests a better risk reduction per unit cost index that achieves 98–100% of the maximum possible risk reduction on these problems for all budget levels except the smallest, which allow very few risks to be addressed. Substantial gains in risk reduction achieved for resources spent can be obtained on our test problems by using this improved index instead of simpler ones that focus only on relative sizes of risk (or of components of risk) in informing risk management priorities and allocating limited risk management resources. This work suggests the need for risk management tools to explicitly consider costs in prioritization activities, particularly in situations where budget restrictions make careful allocation of resources essential for achieving close‐to‐maximum risk‐reduction benefits.