On the Meaning and Use of the Risk Appetite Concept

The risk appetite concept has been given considerable attention recently in enterprise risk management contexts. A number of definitions exist, most with a link to risk acceptability, but also values and goals. The usefulness of the concept is, however, disputed; some authors argue that we can in fact do better without it. In this article, we provide a thorough discussion of what the risk appetite concept is actually trying to express and how it best can be used in the relevant decision making. The main purposes of the article are (i) to argue that the risk appetite concept, suitably interpreted, has a role to play in risk management, (ii) to show that the risk appetite concept is well supported by some types of risk perspectives and not by others, and (iii) to show how the risk appetite concept is linked to other related concepts, such as risk seeking and risk acceptability. The risk perspectives studied range from expected value and probability based definitions of risk to views on risk, that are founded on uncertainties.     

The Concept of Antifragility and its Implications for the Practice of Risk Analysis

Nassim Taleb's antifragile concept has been shown considerable interest in the media and on the Internet recently. For Taleb, the antifragile concept is a blueprint for living in a black swan world (where surprising extreme events may occur), the key being to love variation and uncertainty to some degree, and thus also errors. The antonym of “fragile” is not robustness or resilience, but “please mishandle” or “please handle carelessly,” using an example from Taleb when referring to sending a package full of glasses by post. In this article, we perform a detailed analysis of this concept, having a special focus on how the antifragile concept relates to common ideas and principles of risk management. The article argues that Taleb's antifragile concept adds an important contribution to the current practice of risk analysis by its focus on the dynamic aspects of risk and performance, and the necessity of some variation, uncertainties, and risk to achieve improvements and high performance at later stages.     

On the Risk Management and Risk Governance of Petroleum Operations in the Barents Sea Area

In this article, we discuss issues of risk management and risk governance with respect to petroleum operations in the Barents Sea area. We will focus on the decision problems related to whether or not to open the Barents Sea for petroleum activities in special vulnerable areas. We will explore to what extent the International Risk Governance Council risk governance framework provides valuable insights for and assistance to the decisionmaker and other stakeholders (including the industry and NGOs). The study covers issues related to risk assessment and appraisal, risk acceptance and tolerability, the use of the precautionary principle, risk perception, stakeholder involvement, risk communication, and risk management. The overall aim of the article is to point to areas where the risk governance could have been and can be improved for these and similar decision problems.     

基于HHM-RFRM的船舶航行风险评估方法研究

船舶航行风险是由各种风险因素交互作用产生。综合 HHM-RFRM 理论，构建船舶航行多维风险情景危险度测度模型，以风险因素耦合视角探讨船舶航行风险管理问题。在船舶航行多维风险情景危险度测度模型中结合贝叶斯定理，对船舶航行风险情景进行了定性与定量化过滤、评级。最后以大连港某从事商务活动的货船为例，验证了所提出方法的可行性。传统的风险评估方法只能评估单个风险因素对系统的影响，此评估方法克服了这一局限性，为船舶航行风险管理提供新的视角。     

Evaluating and improving risk formulas for allocating limited budgets to expensive risk-reduction opportunities

Simple risk formulas, such as risk = probability × impact, or risk = exposure × probability × consequence, or risk = threat × vulnerability × consequence, are built into many commercial risk management software products deployed in public and private organizations. These formulas, which we call risk indices, together with risk matrices, “heat maps,” and other displays based on them, are widely used in applications such as enterprise risk management (ERM), terrorism risk analysis, and occupational safety. But, how well do they serve to guide allocation of limited risk management resources? This article evaluates and compares different risk indices under simplifying conditions favorable to their use (statistically independent, uniformly distributed values of their components; and noninteracting risk‐reduction opportunities). Compared to an optimal (nonindex) approach, simple indices produce inferior resource allocations that for a given cost may reduce risk by as little as 60% of what the optimal decisions would provide, at least in our simple simulations. This article suggests a better risk reduction per unit cost index that achieves 98–100% of the maximum possible risk reduction on these problems for all budget levels except the smallest, which allow very few risks to be addressed. Substantial gains in risk reduction achieved for resources spent can be obtained on our test problems by using this improved index instead of simpler ones that focus only on relative sizes of risk (or of components of risk) in informing risk management priorities and allocating limited risk management resources. This work suggests the need for risk management tools to explicitly consider costs in prioritization activities, particularly in situations where budget restrictions make careful allocation of resources essential for achieving close‐to‐maximum risk‐reduction benefits.     

Bayesian Methodology for Model Uncertainty Using Model Performance Data

A simple and useful characterization of many predictive models is in terms of model structure and model parameters. Accordingly, uncertainties in model predictions arise from uncertainties in the values assumed by the model parameters (parameter uncertainty) and the uncertainties and errors associated with the structure of the model (model uncertainty). When assessing uncertainty one is interested in identifying, at some level of confidence, the range of possible and then probable values of the unknown of interest. All sources of uncertainty and variability need to be considered. Although parameter uncertainty assessment has been extensively discussed in the literature, model uncertainty is a relatively new topic of discussion by the scientific community, despite being often the major contributor to the overall uncertainty. This article describes a Bayesian methodology for the assessment of model uncertainties, where models are treated as sources of information on the unknown of interest. The general framework is then specialized for the case where models provide point estimates about a single‐valued unknown, and where information about models are available in form of homogeneous and nonhomogeneous performance data (pairs of experimental observations and model predictions). Several example applications for physical models used in fire risk analysis are also provided.     

Risk Assessment and Risk Governance of Liquefied Natural Gas Development in Gladstone,Australia

This article is a retrospective analysis of liquefied natural gas development (LNG) in Gladstone, Australia by using the structure of the risk governance framework developed by the International Risk Governance Council (IRGC). Since 2010 the port of Gladstone has undergone extensive expansion to facilitate the increasing coal export as well as the new development of three recently completed LNG facilities. Significant environmental and socio‐economic impacts and concerns have occurred as a result of these developments. The overall aim of the article, therefore, is to identify the risk governance deficits that arose and to formulate processes capable of improving similar decision‐making problems in the future. The structure of the IRGC framework is followed because it represents a broad analytical approach for considering risk assessment and risk governance in Gladstone in ways that include, but also go beyond, the risk approach of the ISO 31000:2009 standard that was employed at the time. The IRGC risk framework is argued to be a consistent and comprehensive risk governance framework that integrates scientific, economic, social, and cultural aspects and advocates the notion of inclusive risk governance through stakeholder communication and involvement. Key aspects related to risk preassessment, risk appraisal, risk tolerability and acceptability, risk management, and stakeholder communication and involvement are considered. The results indicate that the risk governance deficits include aspects related to (i) the risk matrix methodology, (ii) reflecting uncertainties, (iii) cumulative risks, (iv) the regulatory process, and (v) stakeholder communication and involvement.     

Risk and Planning in Agriculture: How Planning on Dairy Farms in Ireland Is Affected by Farmers’ Regulatory Focus

This article examines how planning on dairy farms is affected by farmers' motivation. It argues that farmers' choice of expansion strategies can be specified in terms of risk decision making and understood as either prevention‐focused or promotion‐focused motivation. This relationship was empirically examined using mediated regression analyses where promotion/prevention focus was the independent variable and its effect on total milk production via planned expansion strategies was examined. The results indicate that promotion focus among farmers has an indirect effect on farm expansion via planning strategies that incur greater risk to the farm enterprise. Regulatory focus on the part of farmers has an influence on farmers' planning and risk management activities and must be accounted for in the design and implementation of policy and risk management tools in agriculture.     

On Different Types of Uncertainties in the Context of the Precautionary Principle

Few policies for risk management have created more controversy than the precautionary principle. A main problem is the extreme number of different definitions and interpretations. Almost all definitions of the precautionary principle identify “scientific uncertainties” as the trigger or criterion for its invocation; however, the meaning of this concept is not clear. For applying the precautionary principle it is not sufficient that the threats or hazards are uncertain. A stronger requirement is needed. This article provides an in‐depth analysis of this issue. We question how the scientific uncertainties are linked to the interpretation of the probability concept, expected values, the results from probabilistic risk assessments, the common distinction between aleatory uncertainties and epistemic uncertainties, and the problem of establishing an accurate prediction model (cause‐effect relationship). A new classification structure is suggested to define what scientific uncertainties mean.     

An integrated modelling approach for raw material management in a steel mill

An integrated modelling approach combining optimisation models with simulation is proposed for coordinated raw material management at steel works throughout the whole supply chain management process. The integrated model is composed of three components: ship scheduling, yard operation simulation and material blending models. The ship scheduling model determines which brands, how much and when they should be arrived, and the problem is modelled as mixed integer linear programming. The simulation model is used to simulate the whole processes from ships’ arrivals to the retrieval of the materials through the berthing and unloading the raw materials. Finally, the raw material blending model is developed for determining the brand and quantity of raw materials to be used. The proposed integrated modelling approach for raw material management has been successfully implemented and applied at steelwork to provide shipping schedules and predict future inventory levels at stock yards. By coordinating all the activities throughout the entire raw material supply chain management process, this article proposes an integrated approach to the problem and suggests a guideline by the appropriate simplification. The quantitative nature of the optimisation model and simulation facilitates an assessment of the risk factors in the supply chain, leading to an evaluation of a wide variety of scenarios and the development of multiple contingency plans. Further research is expected to supplement the ship scheduling models with heuristics for the idiosyncratic constraints of maritime transportation.     

Performance and risk management

Abstract

Performance and risk management are seen by some as two ends of the same spectrum. Performance measurement and management is about steering an enterprise towards a profitable and viable future, whilst risk management is about avoiding the pitfalls that can overwhelm and ultimately put an enterprise out of business. But should the functions and processes of performance measurement and management be integrated with those of risk management? What are the consequences of this integration? How should this be done in practice? In this editorial we briefly chart the debate between those who propose it is important to keep the functions separate and those who advocate integration before presenting the empirical research that informs this conversation.     

Shortcuts in complex engineering systems: a principal-agent approach to risk management

In this article, we examine the effects of shortcuts in the development of engineered systems through a principal-agent model. We find that occurrences of illicit shortcuts are closely related to the incentive structure and to the level of effort that the agent is willing to expend from the beginning of the project to remain on schedule. Using a probabilistic risk analysis to determine the risks of system failure from these shortcuts, we show how a principal can choose optimal settings (payments, penalties, and inspections) that can deter an agent from cutting corners and maximize the principal's value through increased agent effort. We analyze the problem for an agent with limited liability. We consider first the case where he is risk neutral; we then include the case where he is risk averse.     

Chemical and Radiation Environmental Risk Management: Differences, Commonalities, and Challenges

Driven by differing statutory mandates and programmatic separation of regulatory responsibilities between federal, state, and tribal agencies, distinct chemical and radiation risk management strategies have evolved. In the field this separation poses real challenges since many of the major environmental risk management decisions we face today require the evaluation of both types of risks. Over the last decade, federal, state, and tribal agencies have continued to discuss their different approaches and explore areas where their activities could be harmonized. The current framework for managing public exposures to chemical carcinogens has been referred to as a "bottom up approach." Risk between 10(-4) and 10(-6) is established as an upper bound goal. In contrast, a "top down" approach that sets an upper bound dose limit and couples with site specific As Low As Reasonably Achievable Principle (ALARA), is in place to manage individual exposure to radiation. While radiation risk are typically managed on a cumulative basis, exposure to chemicals is generally managed on a chemical-by-chemical, medium-by-medium basis. There are also differences in the nature and size of sites where chemical and radiation contamination is found. Such differences result in divergent management concerns. In spite of these differences, there are several common and practical concerns among radiation and chemical risk managers. They include 1) the issue of cost for site redevelopment and long-term stewardship, 2) public acceptance and involvement, and 3) the need for flexible risk management framework to address the first two issues. This article attempts to synthesize key differences, opportunities for harmonization, and challenges ahead.     

Integrating risk and performance management in quality management systems for the development of complex bespoke systems (CBSs)

Abstract

Risk and performance management are at the core of complex bespoke systems (CBSs). CBSs are developed to customer–specified requirements in terms of structure, functionality and conformance. This article examines how risk and performance management are integrated as essential systems in the successful development of projects across multi-organizational functions in complex bespoke system (CBS) organizations. The article argues for the development of a quality management system that consists of two sub-processes: quality control and quality development. Using three case studies from engineering companies, we provide evidence and insights of the way change control, quality development and quality performance are developed in innovating business solutions.     

Intelligent Adversary Risk Analysis: A Bioterrorism Risk Management Model

The tragic events of 9/11 and the concerns about the potential for a terrorist or hostile state attack with weapons of mass destruction have led to an increased emphasis on risk analysis for homeland security. Uncertain hazards (natural and engineering) have been successfully analyzed using probabilistic risk analysis (PRA). Unlike uncertain hazards, terrorists and hostile states are intelligent adversaries who can observe our vulnerabilities and dynamically adapt their plans and actions to achieve their objectives. This article compares uncertain hazard risk analysis with intelligent adversary risk analysis, describes the intelligent adversary risk analysis challenges, and presents a probabilistic defender–attacker–defender model to evaluate the baseline risk and the potential risk reduction provided by defender investments. The model includes defender decisions prior to an attack; attacker decisions during the attack; defender actions after an attack; and the uncertainties of attack implementation, detection, and consequences. The risk management model is demonstrated with an illustrative bioterrorism problem with notional data.     

Limiting Exposure to Collateral Liability Associated With ISO 14001 EMS Audits

The purpose of this article is to provide suggestions on how to limit the collateral liability associated with ISO 14001 environmental management system (EMS) auditing activities. Due to the detailed, invasive nature of EMS audits, companies performing such activities may expose themselves to collateral risks. Collateral risk is liability not directly associated with ISO 14001 activities, but borne through the unrelated process of EMS audit activities. Examples of collateral risks include issues of non-compliance, unintended discovery of evidence in civil tort claims and exposure to regulatory sanctions. Therefore, well-defined management of EMS audits represents an important aspect of limiting risk. This article identifies several strategies for managing and reducing these legal risks. These strategies include the rigorous management of compliance audits, concisely defining audit scopes, training auditors and auditees, understanding and using audit privileges as appropriate, exploring the use of self-declaration (for ISO 14001 conformance purposes), and using reliable document control methods. While completely eliminating liability represents a laudable but challenging goal, these methods should reduce collateral exposure to corporate and personal liability.     

A Soft-Path Solution to Risk Reduction by Modeling Medical Waste Disposal Center Location-Allocation Optimization

The risk of medical waste pollution and huge demand of daily medical waste disposal pose great difficulties to medical waste management. Establishing medical waste disposal centers (MWDCs) is considered one of the ways to reduce the environmental and public risk of medical waste pollution. However, how to serve the medical waste disposal demand in optimal MWDCs’ locations is a key challenge due to the complexity of the whole system and relationships among stakeholders. This article develops a soft-path solution for reducing risks as well as mitigating the related costs by optimizing the MWDC location-allocation problem. A risk mitigation-oriented bilevel equilibrium optimization model is developed for modeling the Stackelberg game behavior between the local government and the medical institutions. The objectives of the local government are minimizing the total risk of loss, the subsidy costs, and the investment cost of building the MWDCs, while minimizing the disposal and transportation costs are the objectives at the medical institution level. Fuzzy random variables are introduced by combining insufficient historical data with expert knowledge via consulting surveys to describe the coexisting uncertainties in the data. To solve the model, a hybrid approach combined with the interactive fuzzy programming technique and an Entropy-Boltzmann selection-based genetic algorithm are designed and tested. The Chengdu Medical Waste Disposal Centers Planning Project is used as a practical application. The results show that it is possible to achieve a balanced market with higher economic efficiency and significantly reduced risk through an appropriate principle of interactive actions between the bilevel stakeholders.     

Stakeholder Views on Flood Risk Management in Hungary''s Upper Tisza Basin

With escalating costs of flood mitigation and relief, a challenge for the Hungarian government is to develop a flood mitigation and insurance/relief system that is viewed as efficient and fair by the many stakeholders involved. To aid policymakers in this task, this article reports on a recent study to elicit stakeholder views on flood risk management in the Upper Tisza Basin, including views on appropriate means of reducing losses and for transferring the residual losses from the direct victims to taxpayers or an insurance pool. This study is part of a project to develop an integrated approach to flood risk management coordinated by the International Institute of Applied Systems Analysis (IIASA) in collaboration with Swedish and Hungarian researchers. The discussion begins by describing the background of flood risk management problems in the Upper Tisza Basin. The results of interviews carried out with selected key stakeholders and the results of a public survey eliciting views on flood risk management are reported. The final section draws conclusions on incorporating stakeholder views into a flood risk management model, which will be used to illustrate policy paths at an upcoming stakeholder workshop. The conclusions are also of direct interest to Hungarian policymakers.     

An Evaluation of the Treatment of Risk and Uncertainties in the IPCC Reports on Climate Change

Few global threats rival global climate change in scale and potential consequence. The principal international authority assessing climate risk is the Intergovernmental Panel on Climate Change (IPCC). Through repeated assessments the IPCC has devoted considerable effort and interdisciplinary competence to articulating a common characterization of climate risk and uncertainties. We have reviewed the assessment and its foundation for the Fifth Assessment Reports published in 2013 and 2014, in particular the guidance note for lead authors of the fifth IPCC assessment report on consistent treatment of uncertainties. Our analysis shows that the work carried out by the ICPP is short of providing a theoretically and conceptually convincing foundation on the treatment of risk and uncertainties. The main reasons for our assessment are: (i) the concept of risk is given a too narrow definition (a function of consequences and probability/likelihood); and (ii) the reports lack precision in delineating their concepts and methods. The goal of this article is to contribute to improving the handling of uncertainty and risk in future IPCC studies, thereby obtaining a more theoretically substantiated characterization as well as enhanced scientific quality for risk analysis in this area. Several suggestions for how to improve the risk and uncertainty treatment are provided.     

Trust‐Level Risk Evaluation and Risk Control Guidance in the NHS East of England

In recent years, the healthcare sector has adopted the use of operational risk assessment tools to help understand the systems issues that lead to patient safety incidents. But although these problem‐focused tools have improved the ability of healthcare organizations to identify hazards, they have not translated into measurable improvements in patient safety. One possible reason for this is a lack of support for the solution‐focused process of risk control. This article describes a content analysis of the risk management strategies, policies, and procedures at all acute (i.e., hospital), mental health, and ambulance trusts (health service organizations) in the East of England area of the British National Health Service. The primary goal was to determine what organizational‐level guidance exists to support risk control practice. A secondary goal was to examine the risk evaluation guidance provided by these trusts. With regard to risk control, we found an almost complete lack of useful guidance to promote good practice. With regard to risk evaluation, the trusts relied exclusively on risk matrices. A number of weaknesses were found in the use of this tool, especially related to the guidance for scoring an event's likelihood. We make a number of recommendations to address these concerns. The guidance assessed provides insufficient support for risk control and risk evaluation. This may present a significant barrier to the success of risk management approaches in improving patient safety.