3.5 Human factors in risk assessment

Risk assessment is often far from an exact science and it is important to be aware of some of the behavioural factors that can be at play. Here are a few examples:

• When assessing risks that are highly uncertain or have not happened before there is often little or no known empirical data on which to base assessment. In these cases there can be a reliance on expert judgement.
• Judgement, of course, can be subject to bias. For example, recent events may skew our perception of the probability of a risk; moreover, things that have happened to people personally (or to people they know) may be perceived as more likely to happen than they really are.
• Perceptions and attitudes to risk may also skew our perception and assessment.

Best practice is to involve multiple people and to document the basis of estimate and the key assumptions that have gone into arriving at this estimate. In this way the key assumptions can be understood and, where necessary, tested.

Take a look at the video below, which looks at dealing with undefined risk.

Download this video clip.Video player: Video 4 Dealing with undefined risk

Show transcript|Hide transcript

Transcript: Video 4 Dealing with undefined risk

SPEAKER 1

Risks evolve day to day, year to year. And they often evolve without expectation. So I've certainly experienced in the past, working in other industries that are heavily regulated, that all of a sudden, what you thought your risk was one day changes, because the government maybe have put out a statement, or it's an election year, and people's priorities change. So there needs to be a regular review of risks to ensure they're still relevant and to ensure action and treatment plans are still going to get us to where we expect to.

It might be that our risk appetite changes in the future or what we're planning to do was unachievable. At that point, we need to stop and re-baseline where we are and where we're trying to get to.

SPEAKER 2

All you can do is make the most logical assumptions and think of a number of scenarios. So we tend to use scenario analysis and assumptions analysis. So we think of, well, if this happens, what would that result in? If this happens, what might that result in? So they're difficult risks to quantify. They're definitely difficult risks to quantify.

But it's just about trying to think of, well, what would be the impacts in these different situations, in these different outcomes. How might they impact us? And then you can start to think about, well, which ones of those- again, tolerance appetite- do we want to put some preparatory measures in place so that if that happens, we can switch easily, and we've done the preparation. And that's all you can do, because ultimately, it's out of your control. But that's how you need to handle it.

SPEAKER 3

I think some risks are quite hard to quantify, quite hard to describe. And I think some of the potential outcomes of those risks are equally hard to quantify. So I think with that type of risk, it's important to engage with as many stakeholders as possible, both inside an organisation and, indeed, outside an organisation. But ultimately, I think it's about having a healthy understanding that, because you can't call out all of the consequences of a given risk, it's about being prepared, then, to respond to these as and when they happen. And by that, I mean by having effective incident management and ultimately crisis management frameworks in place.

SPEAKER 4

So some risks, by their very nature, are difficult to define. Sometimes they move. They change shape, for want of a better term. And particularly, business risks generally happens with things that are more nebulous or cloud-shaped in their form. But one example might be the fact that your business might be involved in government procurement, and your projects might be put back on a regular basis, or an irregular basis, or may be cancelled entirely.

This is something that's very difficult to actually have- work to a degree of uncertainty, to forecast forward, and everything else. So there's a few things, really, one of which is these sort of risks just need more effort. They need more regular review to make sure that something significant hasn't changed within them, either the risk itself, or the market, or whatever the risks- whatever sits around the risk, should I say. So that's one aspect. The other aspect is to start trying to look at it in a slightly different way, optioneering of sorts.

So for example, if you have a client who's always a very long lead times before things happen, and may not happen, or book forward, or whether, you might think about, actually, well, what else can I put into- how can I add certainty to this position in the market? And that might be going for a slightly different market. That might be smaller amounts of work, but with a quicker turnaround time than putting all this upfront investment and having that such a degree of uncertainty at the end.

End transcript: Video 4 Dealing with undefined risk

Download

Video 4 Dealing with undefined risk