A Practical Approach to Quantitative Risk ... - Semantic Scholar

2 downloads 0 Views 2MB Size Report
Framework of Quantitative Risk Assessment. • Consequence Score. • Likelihood Score. • Risk Score & Risk Matrix Approach. • Framework for Multiple Threats/ ...
A Practical Approach to Quantitative Risk Assessment Xun Guo Lin & Richard Jarrett Division of Mathematical and Information Sciences Canberra & Melbourne Risk Conference, Wellington, 2009

Darwin after Cyclone Tracy 1974

Category 4 Cyclone with

Max speed 240km/hr (66.7m/s)

65 deaths 640 injuries

45,000 homeless A$4.2b loss Quantitative Risk Assessment

2

1989 Newcastle Earthquake

5.6 magnitude 13 deaths

160 injuries 1,000 homeless

A$4.4b loss

Quantitative Risk Assessment

3

1999 Sydney Hail Storm 70,000 cars damaged 50 injuries

2,400 homes damages A$2.2b loss

Quantitative Risk Assessment

4

Total Natural Disaster Loss in Australia (1967-1999) is A$37.8b (aggregated events ≥ A$10m) Australian Bureau of Transport Economics (2001) A$284mil/year SEVERE STORM 26%

Annual cost of natural disasters:

FLOOD 30%

A$266mil/year CYCLONE 24%

LANDSLIDE 0% 7%

BUSHFIRE

13%

EARTHQUAKE

Quantitative Risk Assessment

5

A$1.14 billion or $85 / y∙person

Example of Terrorism Events

Quantitative Risk Assessment

6

Examples of Maritime Threats to Australia

Illegal Arrivals

Quantitative Risk Assessment

Illegal Spills

7

Contents • Framework of Quantitative Risk Assessment • Consequence Score • Likelihood Score • Risk Score & Risk Matrix Approach

• Framework for Multiple Threats/Hazards

Quantitative Risk Assessment

8

Framework of Quantitative Risk Assessment Based on Australia & New Zealand Standard on Risk Management (AS/NZS 4360), we can define RISK = Expected Cost = Consequence  Likelihood where: the unit of Risk is in $ per time unit (eg year)

Risk is respect to a particular threat or multiple threats with multiple consequences Development of a severity scoring system for consequence

and likelihood with each level of change represents a 10-fold increase/decrease in values Risk Score = Overall Consequence Score + Likelihood Score

Practical, Simple & Useful! Quantitative Risk Assessment

9

Example of Consequence Categories • Death, injury or illness to humans

• Economic or business impact • Social impact

• Environmental impact • Symbolic effect • External relationships • Damage to business reputation and public image Quantitative Risk Assessment

10

Example of Consequence Scores

Consequence Consequence Consequence Description in $ Score Insignificant

$1,000,000

6

Minor

$10,000,000

7

Moderate

$100,000,000

8

Major

$1 Billion

9

Catastrophic

$10 Billion

10

Quantitative Risk Assessment

11

Scoring Consequences • Seven categories of consequences, not all $-values! • Great care taken to “line up” descriptions of similar severity across categories • 1 unit corresponds (roughly) to 10-fold step in “cost” or impact • Examples for severity levels 9 and 10 with only six categories: Severity 9: Major

Death, injury or illness

Economic /Business

Multiple fatalities, remains collection compromised

Damage to a $3 million conservation – $3 billion value where recovery > 10 years

Mass 10: fatalities, Catastrophic remains collection compromised

$3 billion+

Quantitative Risk Assessment

Environmental Symbolic

Irreversible loss of a conservation value of a bioregion 12

External

Reputational

Serious damage to a nationally important symbol

Suspended or grave damage to bilateral relations

Government unable to effectively govern

Destruction of nationally important symbol

Open armed conflict, Military invasion

Fall of Government outside the Constitutional Process

Overall Consequence Score • Each identified “risk” gets scored 6-10 on each category and the scores are combined (how?)

Hazard

Death, injury or illness

Social

Environ mental

Symbolic

External

Reputation /Public Image

Economic /Business

(Example 1)

6

9

6

6

6

6

6

9.0026

(Example 2)

6

9

6

9

9

6

6

9.4777

Overall Score

• Do this by summing 10x, and then taking logs! Log10(106+109+106+106+106+106+106) = Log10(1,006,000,000) = 9.0026

• Very different from the averaging, which is 6.43 for Ex 1 • Similar to taking “maximum”, but gives larger value if there is more than one „9‟ Quantitative Risk Assessment

13

Overall Consequence Score  Overall Cost

Consequence ($) = 10 Overall Consequence Score In Ex 1, 109.0026 = $1,006,004,677 In Ex 2, 109.4777 = $3,004,000,496

Quantitative Risk Assessment

14

Example of Likelihood Scores (based on annual rates) Likelihood

Description

Likelihood Score

Occasional

1 event in 100 years

-2

Probable

1 event in 10 years

-1

Possible

1 event in 3 years

-0.5

Likely

1 event per year

0

Very likely

3 events per year

0.5

Highly likely

10 events per year

1

Almost certain

 30 events per year

1.5

• Again, one step change in score will have a 10-fold increase/decrease in the probability of occurrence • The formula to convert the Likelihood Score to probability is Rate of occurrence per year = 10Likelihood Score • eg, a Likelihood Score of -2 will have probability 10-2 = 1/100 = 0.01 (frequency per year) Quantitative Risk Assessment

15

Risk Scores and Risk Levels Risk Score = Overall Consequence Score + Likelihood Score In Ex 1, Overall Consequence Score = 9.0026 Likelihood Score = -2 Risk Score = 7.0026 Risk = Expected cost = 107.0026 =$10,060,047 We can also define Risk Levels, eg Negligible (1.00 to 2.00) Low (2.00 to 4.00) Moderate (4.00 to 6.00) High (6.00 to 8.00) Very High (8.00 to 11) Quantitative Risk Assessment

16

Risk Matrix Approach Likelihood Consequences

IMPROBABLE (-4)

REMOTE (-3)

OCCASIONAL (-2)

PROBABLE (-1)

LIKELY (0)

CATASTROPHIC (10)

VERY HIGH

MAJOR (9)

HIGH

MODERATE (8) MINOR (7)

MEDIUM LOW

Risk Level

Risk Management Action Required

Very High

Unacceptable (reduce risk through countermeasures)

High

Undesirable (management decision required)

Medium

Acceptable with review by management

Low

Acceptable without review 17

Quantitative Risk Assessment

Risk Matrix with Scoring Ranges Likelihood Score Consequence -4 -3 Score [-4.5, -3.5) [-3.5, -2.5)

-2 [-2.5, -1.5)

-1 [-1.5, -0.5)

0 [-0.5, 0.5)

10 [9.5, 10.5)

6 [5, 7)

7 [6, 8)

8 [7, 9)

9 [8, 10)

10 [9, 11)

9 [8.5, 9.5)

5 [4, 6)

6 [5, 7)

7 [6, 8)

8 [7, 9)

9 [8, 10)

8 [7.5, 8.5)

4 [3, 5)

5 [4, 6)

6 [5, 7)

7 [6, 8)

8 [7, 9)

7 [6.5, 7.5)

3 [2, 4)

4 [3, 5)

5 [4, 6)

6 [5, 7)

7 [6, 8)

6 [5.5, 6.5)

2 [1, 3)

3 [2, 4)

4 [3, 5)

5 [4, 6)

6 [5, 7)

Though 10-fold increase/decrease in score but no “gaps” Practical, Simple & Useful! Quantitative Risk Assessment

18

Issues Related to Risk Management • Need to have defined actions at each level of Risk • Calibrate carefully to get appropriate level of response

• Risk is assessed relative to “current mitigation activities” • “Quantitative” does not mean “accurate” – be aware of (and allow for) the uncertainties in estimates of risk

Quantitative Risk Assessment

19

Overall Consequence Score • Each identified “risk” gets scored 6-10 on each category and the scores are combined (how?)

Hazard

Death, injury or illness

Social

Environ mental

Symbolic

External

Reputation /Public Image

Economic /Business

(Example 1)

6

9

6

6

6

6

6

9.0026

(Example 2)

6

9

6

9

9

6

6

9.4777

Overall Score

• Do this by summing 10x, and then taking logs! Log10(106+109+106+106+106+106+106) = Log10(1,006,000,000) = 9.0026

• Very different from the averaging, which is 6.43 for Ex 1 • Similar to taking “maximum”, but gives larger value if there is more than one „9‟ Quantitative Risk Assessment

20

Risk Matrix Approach Likelihood Consequences

IMPROBABLE (-4)

REMOTE (-3)

OCCASIONAL (-2)

PROBABLE (-1)

LIKELY (0)

CATASTROPHIC (10)

VERY HIGH

MAJOR (9)

HIGH

MODERATE (8) MINOR (7)

MEDIUM LOW

Risk Level

Risk Management Action Required

Very High

Unacceptable (reduce risk through countermeasures)

High

Undesirable (management decision required)

Medium

Acceptable with review by management

Low

Acceptable without review 21

Quantitative Risk Assessment

Framework for Multiple Threats/Hazards • Assuming independent between threats

• Formulas to combine threats in a region or a threat in multi-regions • Risk Score = log(10Risk Score1+10Risk Score2) • Likelihood Score = log(10Likelihood Score1 +10Likelihood Score2) • Cons Score = Risk Score - Likelihood Score

Quantitative Risk Assessment

22

Numerical Example of Aggregating Multiple Threats or Hazards in Multiple Regions Region

Hazards

Cons Score

Lik Score

Risk Score

Cost / event

Rate

Exp Cost

1

1

7.0

0.0

7.0

$10,000,000

1.0000

$10,000,000

1

2

8.8

-1.0

7.8

$630,957,344

0.1000

$63,095,734

1

3

7.7

0.0

7.7

$50,118,723

1.0000

$50,118,723

1

4

7.9

-1.0

6.9

$79,432,823

0.1000

$7,943,282

2

1

7.3

0.0

7.3

$19,952,623

1.0000

$19,952,623

2

2

7.5

-0.5

7.0

$31,622,777

0.3162

$10,000,000

2

3

7.1

-1.0

6.1

$12,589,254

0.1000

$1,258,925

2

4

7.8

-1.0

6.8

$63,095,734

0.1000

$6,309,573

Summaries

1

all

7.8

0.3

8.1

$59,617,155

2.2000

$131,157,740

2

all

7.4

0.2

7.6

$24,746,363

1.5162

$37,521,122

all

1

7.2

0.3

7.5

$14,976,312

2.0000

$29,952,623

all

2

8.2

-0.4

7.9

$175,614,749

0.4162

$73,095,734

all

3

7.7

0.0

7.7

$46,706,953

1.1000

$51,377,649

all

4

7.9

-0.7

7.2

$71,264,279

0.2000

$14,252,856

7.66

0.57

8.23

$45,389,807

3.7162

$168,678,862

Overall

Quantitative Risk Assessment

23