Accurately assessing the residual risk level of identified risks, as part of the risk management process, is a prerequisite to the organisation appropriately assigning effort and resources to the most important risk treatments. Without correctly understanding both the consequences of the risk, and the likelihood of the risk occurring at that level of consequence, it is possible for an organisation to find itself in a situation where a serious risk is left largely untreated while efforts are focussed on relatively minor risks.
However, whilst most people can relatively easily make a judgement about the most credible consequence to the organisation of a given risk, there is often confusion surrounding how to determine the likelihood or probability of something happening.
The confusion springs from a range of sources, mostly related to unclear terminology, and problems are often embedded in the organisation’s documented risk assessment tools when they develop or adopt a series of Likelihood Statements, or a Likelihood Table, defining the levels of likelihood used in the risk analysis process.
Difficulty in understanding and interpreting likelihood or probability information typically comes from four common mistakes:
1. Failure to consider likelihood in the context of consequence
Likelihood tables including a % probability column for rating each level of likelihood as a range of probability (e.g. 0% to 1% is Rare, greater than 95% is Almost Certain) are common. However, it is important to focus on the fact that the probability is referring to the probability of the risk occurring at the nominated level of consequence. As an example, it is not the consideration of how likely it is that a particular building may be damaged structurally by a cyclone, but rather how likely is it that the building may be damaged structurally by a category 3 cyclone.
2. Failure to qualify what the probability statement is referring to
Many likelihood tables include a % probability column rating each level of likelihood as a range of probability, e.g. 0% to 1% is Rare, greater than 95% is Almost Certain.
However, it is difficult for individuals to accurately assess the probability of a given risk when the table does not stipulate % chance of what. 95% chance of occurring this year? at this site? ever in history? in this industry?
3. Failure to explain terminology which comes from a specific technical context
A common descriptor in likelihood tables comes from a hydrological engineering context, originally the concept of a 1 in 100 years flood.
From its hydrological origins, this is known as Average Recurrence Interval ARI when expressed in years, or Annual Exceedance Probability AEP when expressed as a %. When applied to a likelihood table, users develop likelihood levels such as: 1 in 10,000 years is Rare, and 1 in a week is Almost Certain.
However, failing to recognise the source and proper use of this type of probability statement results in errors of interpretation, such as assuming that if the table says there’s a once in 100 years chance of something occurring, then the event will not occur in a person’s lifetime, or that having recently occurred, it will not happen again for another 100 years.
These statements actually mean x% probability of the event occurring in any given year. Therefore, 1 in 100 years actually means 1% probability of the event occurring in any given year. The likelihood is as follows:
A 1 in 10 year event is 100 ÷ 10 = 10% probability of the event occurring in any given year
A 1 in 100 year event is 100 ÷ 100 = 1% probability of the event occurring in any given year
A 1 in 1000 year event is 100 ÷ 1000 = 0.1% probability of the event occurring in any given year
4. Failure to understand the difference between absolute risk and relative risk
Statements of absolute or relative risk are more common in quantitative risk, and can provide another source of confusion.
Most people are unfamiliar with the difference between absolute risk and relative risk, and if this is not clearly explained when being used in likelihood assessment, misinterpretation is likely.
An example is the statement that there is a 100% increased risk of an outcome in some specified circumstance. This is an example of relative risk, and a common error of interpretation is thinking that this means the event is definitely going to occur in the specified circumstance. However, if the original quantified likelihood (absolute risk) was actually (say) 1 in 10,000, then a 100% increase in relative risk is only 2 in 10,000.
Avoiding these four common pitfalls in likelihood assessment is relatively straightforward, and can be achieved by some judicious editing of the Likelihood Table in the organisation’s risk management methodology.
Important principles include:
- Always determine the consequence level prior to the likelihood level, so that likelihood can be determined for the risk occurring at that level of consequence.
- Where acceptable to the organisation and industry, avoid probability statements and use descriptive statements such as “The event is likely to occur only in exceptional circumstances (Rare)”.
- If using a % probability, communicate in clear terminology by specifying the class to which a probability figure refers – e.g. time, days, locations. That is, specify x% of what.
- Avoid 1 in 100 years and similar, as too many people simply don’t understand it, and unless working in an industry used to this type of probability statement, there are better ways to communicate the required information. If specificity is required, express as x% probability of the event occurring in any given year.
- When there is quantitative data available, use absolute risk not relative risk. For example, rather than stating there is a 100% increased chance of something happening in xyz circumstances, state instead that there is a 1 in 10,000 chance of something happening.
QRMC regularly assists clients to review and improve their risk assessment methodologies and make them more applicable to the organisation and user-friendly.
Please contact QRMC for more information.