Some risk events just happen from time to time. Do events like that even have a likelihood? Maybe a frequency, more than a likelihood. Frequency and likelihood aren’t the same, but they are related.
I got very confused while writing an earlier article on ‘worst case’ risk assessment. I am confused regularly. That time my confusion was about the likelihood and consequence assessment for risk events that can occur repeatedly, and it’s ‘how many’ that matters.
This article is what I concluded on my way out of the confusion. But is it right? It’s a story that comes up throughout basic risk identification.
The story: a repeatable risk event
You identify a risk. It’s an unpredictable event with consequences for your objectives. It can happen at any time. Over time it can happen more than once. It’s just something that happens now and then. Maybe one of your team members leaving unexpectedly, a company car crash, or whatever.
For risk assessment, you need a likelihood and a consequence. So, what’s the likelihood of such an event? The answer is that over enough time, it’s certain. It’s a ‘when’, not an ‘if’.
Events like that have an average frequency rather than a likelihood. Perhaps there is one every two years, on average. An instance has a likelihood within any short time interval. The occurrence of two or more instances in that time interval also has a likelihood. If the average frequency is one every two years, there is a 61% chance of an event-free year, but also a chance of two or more events in a year. That chance is 9%. (To find out where those numbers came from, read on.)
Sometimes you can be confident that there will be multiple instances every year. The only uncertainty is how many of them there will be. Typical events like that include minor workplace injuries, enterprise-wide losses of people, building evacuations and electric power supply failures. You get the idea.
If your risk event is like that, you will be unable to assess either likelihood or consequence for a single instance. The ‘likelihood’ of at least one instance is certainty. Certainty isn’t on any risk likelihood scale. At the same time, the consequence of a single instance is zero, because you were already expecting at least one of those events. It may not be a trivial event for the people involved, but it was not a risk to the enterprise, no matter how small. Risk is the effect of uncertainty on objectives. There was no uncertainty, and there is no separate effect on objectives.
The solution is to re-define your initially repeatable ‘risk’ as the occurrence of ‘more than x instances’, or some other meaningful range for the instance count. Once you do that, you can assess a meaningful likelihood and consequence for your re-defined risk.
Another way to look at it is to ask if your risk scenario will or will not occur during the year (or whatever planning period). No ifs or buts. If your answer is something other than ‘yes, either it will or won’t have happened’, you need to re-frame it to get to a likelihood.
How to assess outcome likelihood, starting from event frequency
There is a mathematical relationship between the average frequency of a repeatable random event and the likelihood of any specified number of event instances in a time interval. It’s called the Poisson distribution. The Poisson distribution is instantly available to you in a spreadsheet. The 9% figure quoted earlier is as close to you as =1-POISSON.DIST(1,0.5,TRUE)
You can just open a blank spreadsheet and try it. The 61% came from =POISSON.DIST(0,0.5,FALSE).
In real life, you won’t know the true average frequency of event instances. You may have a limited history on which to estimate that average frequency. That too can be calculated. You can estimate a probability for the number of event instances in future from that history, without ever knowing the true average frequency. The more history you have, the better your estimate will be, but you will never need the complete truth. There never was a complete truth and never will be.
The estimation process involves using the Poisson distribution twice, the first time in reverse. There isn’t a simple spreadsheet formula for doing that, but you can build a spreadsheet to get the job done. The spreadsheet uses Monte Carlo trials. I built one, and so can you.
Variable size events, in unknown numbers
Some repeatable events come in varying sizes. Very often it’s the total size of all instances that affects your objectives. That’s different to a simple count, where every instance has the same impact. For example, your objectives may be affected by the total number of work days lost due to injuries, or by the total data centre downtime resulting from whatever power supply failures occur. Work days per injury vary unpredictably between cases, as do downtime durations. To assess the effect over time, you need event instance size totals, not event instance counts.
The prediction methods for instance counting can be extended to instance size totalling. You need an idea of the size distribution for single event instances. For rough and ready risk assessment, you can use just two indicative sizes, the median event size and the 95th percentile event size. You can join those dots well enough with a few plausible assumptions. These total impact predictions can also be made in a spreadsheet that you can build yourself. The spreadsheet combines the effect of unpredictable event instance counts and unpredictable event sizes, again using Monte Carlo trials. I know this much, because I’ve done it.
From the predictions you can get the likelihood of an event instance size total above any threshold level. It can also give you a total that will be exceeded with only 5% likelihood, rather like a 95% VAR. Or any variation of these key numbers that you might need to decide risk acceptance and treatment.
More about the Likelihood of a future event size total within a range
Questions for experts
- I worked out the trick of re-defining a risk as a count or total, some time ago. I’m guessing you might have done that, too. But I never saw it in an authoritative source. What’s going on there?
- The story of how to assess outcome likelihood, starting from event frequency is factually and mathematically correct as far as I know. But how useful is it in real-life risk assessment? What are the alternatives?
- And if I am on the right track, why aren’t the Poisson distribution and Monte Carlo trials part of basic risk training?
A longer discussion on this topic appears as a blog post dated 2 November 2018.
Map of the series How to turn an event frequency into likelihood
Likelihood of a future event…
|About the Excel implementation|