Risk Management

Breaking Down Risk

Before you can mitigate any risk, you need to know what's behind it.
Rick JonesSeptember 23, 2011

There was a time not long ago when thinking about risk was considered the territory of risk managers, insurance companies, and, of course, CFOs. Times have changed. Today “risk” is a buzzword that permeates our language beyond the pure risk-management function. This word and what it represents have evolved from the esoteric and technical to the contemporary and practical.

In simple yet concise terms, risk is defined as the future’s uncertainty. It’s a characteristic of life that all of us have in common but that has some interesting and subtle characteristics that can make it appear elusive. For example, you can’t measure risk — at least directly. You can measure visible characteristics like lengths and weights and invisible attributes like radiation levels and voltages, but the future’s uncertainty doesn’t fit the measurement devices we normally use.

Most of the time when we hear or read about risks, we are exposed to loosely described risk values, rather than a calculated measure. And from these singular numbers we’re supposed to know what to do. In some cases we can figure out the next steps, such as when talking about some health and safety risks and spelling out the risk of dying from a certain disease. But consider this example: suppose a transportation risk is presented as 100 deaths a year. Does this mean 100 accidents, each resulting in one fatality, or just one accident with 100 fatalities? These two risk scenarios have very different risk-management actions. The overall value is not enough: while equating a risk to a hazard is generally correct, in order to mitigate a risk we need to examine its contributing components.

We need to break out both the frequency and the severity of a risk. The exercise can give risk managers and CFOs a more-thoughtful way of analyzing a risk. Moreover, it will give them a visual they can present to boards and other managers to support their overall risk-management strategy. A chart, such as the one below, can help give an answer to the question, What’s in a risk?

To start, a simple equation can form the basis for computing risk. It includes the two factors necessary for risk management. The first is a measure of event occurrence expressed in terms of event frequency or probability. The second factor describes the consequences or severity of the event. The common equation used to model risk is:

Risk = FREQUENCY (probability) x SEVERITY (consequence)

The math is simple enough, yet it provides a much more understandable and usable assessment by considering and assessing a risk’s two components. Generally, high-frequency/low-severity events (like the situation involving 100 accidents with one death per accident) have more data available to analyze root causes and other event-prevention actions. Conversely, low-frequency/high-severity events (like the one accident that produced 100 deaths example) have very little data for classical prevention analysis. Insurance can be an appropriate management option for these types of events.

Let’s apply this methodology to a growing exposure for businesses today. The number of older workers in the United States has been growing steadily since the 1990s. The population of senior citizens is over 36 million with approximately 5.9 million active workers, or about 4% of the total workforce, according to federal government data. Historically, people reaching the age of 65 would leave the workforce. Today, however, the weak economy, coupled with decreases in housing values, has forced many senior citizens to postpone retirement.

The increase in senior citizens either joining or remaining in the workforce prompted the National Council on Compensation Insurance to conduct a new analysis last year on how this rapidly growing worker segment influences the frequency and severity of workers’ compensation claims. Advocates of older workers have since highlighted the fact that workers over age 65 have a lower accident-incidence rate than their young (and perhaps more reckless and inexperienced) colleagues. Yet this point addresses only part of the equation: it fails to discuss what happens when the older workers do get injured. In other words, this argument addresses only the frequency of the risk and ignores the severity component.

Let’s take a look at workers’ compensation including both frequency and severity in the risk perspective (see chart). Frequency is measured by worker incidence rate, defined as the number of injuries per 10,000 workers divided by a normalized total work hours per year factor. Severity is taken as the median (50th percentile) number of days away from work per injury. Risk is taken as the lost productivity due to worker injuries, measured by number of days away from work per 10,000 workers each year.

The plot shows that while the group of senior citizens over age 65 has the lowest incidence rate, it is in fact the highest risk group. The highest incidence rate (that is, most likely to be injured) belongs to the 20-24-year-old workers, but because of the low severity of their injuries, they have the second-lowest risk.

We can use these calculations to assign rough risk values to different age groups. The lines for these risk values of 1,500, 1,000, and 500 show interesting relationships. For example, if we listed just the 55-64 and the 65+ age groups’ risk values of 1,400 and 1,533, respectively, we would only conclude that the risks are roughly within 10% of each other. However, the frequency-severity plot shows that the risks are radically different in composition and consequently call for different actions to manage each group’s risk most effectively. The results provide the starting point for discussions and analyses by prompting the questions that might begin the risk-mitigation work.

Consider making a similar plot the next time you are asked what’s in a risk. Your answer will potentially include a lot more than the direct numerical results. The graphical format of showing risk as a function of frequency and severity provides a valuable communication tool. The visual presentation is generally more appealing to people and helps make data observations easier to comprehend and discuss with a wide audience. It can also help you make data-driven risk-management insights and decisions.

Rick Jones has spent the past 30 years applying risk analysis and management techniques to industrial and business problems. He has presented at several conferences and is the author of numerous articles and technical research papers. His third book, 20% Chance of Rain: Exploring the Concept of Risk, will be published in January 2012.