Scenario-Based Risk Analysis

By Mark Jablonowski, CPCU, ARM

Crucial to the effective management of response to accidental loss is the ability to recognize risk. Colloquially, we use the term risk to refer to the possibility of any loss, regardless of its size. For example, I might casually comment to a friend over dinner that she risks indigestion by eating spicy foods. The disaster recovery professional, however, is primarily concerned with accidental losses that can have a serious, harmful impact on company finances. From this perspective, risk is the possibility of significant financial impact.
The disaster recovery planner’s intuition of risk, for a hypothetical firm, is shown in the accompanying diagram. When the probability and size of loss (indicating possibility and financial significance, respectively) are both high, risk exists. On the other hand, risk is not associated with very low probability of occurrence, or with losses that under any other circumstances would be considered “affordable”. Note that there is a gray area between probability/loss combinations that are truly risky, and those that are not. This reflects the fact that the boundary between risky and non-risky events is fuzzy, not exact. We simply do not know enough about the real world properties of risk to be able to apply the concept precisely.
To assess the risk faced by the organization, the planner matches the probability and loss characteristics of various exposures to his or her intuition of risk. This exposure analysis can be most effectively carried out using loss scenarios. A scenario is a synopsis of events or conditions leading to an accidental loss. Scenarios may be specified informally, in the form of narrative, or formally using diagrams and flow charts.

THE RISK ASSESSMENT PROCESS

Risk assessment using scenarios is straightforward. Consider three loss scenarios facing our hypothetical company. For concreteness, let us assume the firm is in the business of transporting various cargoes, some hazardous. The three scenarios we will limit ourselves to all involve the legal liability arising from use of company autos on public roads. The probability/ loss combinations associated with these scenarios are shown on the diagram on page 69. Point A represents the scenario of an upset or overturn of a truck carrying dangerous cargoes in a populated area. It is further assumed that the spill leads to an explosion or release of toxic chemicals. Point B represents the company’s liability for an accident involving bodily injury and property damage from relatively “ordinary” road hazards. No spill or disruption of cargoes is involved. Finally, point C identifies a scenario involving multiple simultaneous catastrophes involving the company fleet.
The identification of probabilities and loss potentials associated with a scenario is usually performed by engineers and actuaries, based on statistical data and expert judgement. Scenario A has a probability of occurrence of 10-3 (.001, or one chance in one thousand) and a loss potential of $50 million. It is deemed sufficiently “possible” and significant so as to be unequivocally classified as “risky”. Scenario B, on the other hand, while more probable than A, involves losses that this firm considers “affordable”. As such, it is rated not risky with confidence. Not so easy to classify is scenario C. While the probability of multiple catastrophes is not strictly zero, it is rare (around 10-6, or the proverbial “one chance in a million”!). So while the loss potential is great, the chance of occurrence is “virtually impossible”. Scenario C, nonetheless, resides in that gray area of risk that results in considerable anxiety over its classification.
In practice, many more scenarios can be added to the diagram. This gives the analyst a complete risk profile of the organization’s exposure to accidental loss. Scenarios can also be constructed by individual departments or operating units within the organization. These individualized scenarios are easily combined to give an organization-wide picture of risk.
Often, the analyst’s measurements of probability and loss potential will themselves be inexact. Uncertainty is easily accommodated by ascribing a range of probabilities and/ or loss potentials to a scenario. The degree of overlap of these ranges with the analyst’s definition of risk determines the overall “riskiness” of the scenario. While the organization’s picture of risk may be rather rough, it can provide valuable guidance to disaster planners and other responsible for the effective management of risk.
It is important that when uncertainty exists, it be properly communicated. Studies have shown that decision makers react differently to uncertain information than to exact information. Under conditions of uncertainty, decision makers tend to make their responses more flexible. Masking the uncertainty involved in an estimate of risk can, therefore, lead to inferior decisions.
It is equally important that the analyst not introduce too much vagueness into the process, by using undefined qualitative expressions. Simply rating the probability of disaster associated with some scenario as “high”, “medium” or “low”, for example, introduces such vagueness. In communicating risk, the disaster planner must make sure that the range of probabilities represented by these words is understood. By specifying the range of probabilities associated with words, as in the accompanying risk diagram, we can prevent such confusion. Ranges, possibly graded by confidence level, provide a mathematical structure that can be manipulated just like exact estimates. The difference is that the uncertainty of the estimate is preserved.

USING SCENARIOS

The uses of scenario-based risk analysis are many and varied. The explicit analysis of scenarios may suggest ways of reducing or eliminating exposures through loss control activities. Loss control actions have the effect of shifting where scenarios lie on our risk diagram by reducing probability of loss, amount of loss, or both. Often, scenarios are posited on the basis that loss potential is as low as reasonably achievable (“ALARA”). This type of analysis recognizes that even under the best of loss control programs, accidents will happen.
As the cornerstone of disaster recovery planning, scenario-based risk analysis allows identification and prioritization of disaster potential. Knowing what can happen, and the risk involved, allows the analyst to make effective plans for business recovery in the event of disaster. By concentrating on risky scenarios, the disaster recovery planner can tailor recovery actions to exposures. This ensures the best allocation of resources in the time of crisis.
The diagrammatic approach demonstrated above is easily incorporated into disaster recovery plans. It provides a basis for the formal, yet realistic, analysis of risk. During its construction, company management becomes aware of the various potentials for serious accidental loss within the organization, as well as their probabilities. The added focus makes for better plans.

Mark Jablonowski, CPCU, ARM, is a Risk Manager for the Hamilton Standard Division of United Technologies Corporation.

Disaster Recovery Worldİ 1999, and Disaster Recovery Journalİ 1999, are copyrighted by Systems Support, Inc. All rights reserved. Reproduction in whole or part is prohibited without the express written permission form Systems Support, Inc.