1
3.5 Risk conditions and decision making
• Risk is intrinsically linked to decision making.
• There are generally three main conditions under witch
decisions can be made:
• conditions of certainty;
• conditions of risk;
• conditions of uncertainty.
• Conditions of certainty apply where the outcome is known.
2
3.5 Risk conditions and decision making
• Conditions of risk apply where is a reasonable probability
that an event will occur and where some kind of assessment
can be made. These are the “known unknown” events. Most
risk management and decision making take place under
conditions of risk.
• Conditions of uncertainty apply where is not possible to
identify any known events. It is not possible to predict
outcomes with any accuracy.
3
Decision making under conditions of certainty
• Decision maker knows with 100% accuracy what the
outcome will be.
• Conditions of certainty can be represented using a pay-off
matrix, where profit for each strategy and state of nature are
shown.Strateg
Possible stage of nature
y
S1 = A
S2 = B
S3 = C
N1 = up
N2 = even
N3 = down
$100 000
000
$150 000
000
$200 000
000
$80 000 000
$60 000 000
$100 000 000 $80 000 000
$160 000 000
- $100 000
000
4
Decision making under conditions of risk
• In most practical situations, there is no single dominant
strategy for all eventualities. In general terms:
Higher profits = higher potential risks
Higher profits = higher potential losses.
Strategy
Possible stage of nature
N1 = up
N2 = even
N3 = down
Probability = 25%
Probability = 25%
Probability = 50%
S1 = A
$100 000 000
$80 000 000
$60 000 000
S2 = B
$150 000 000
$100 000 000
$80 000 000
S3 = C
$200 000 000
$160 000 000
- $100 000 000
The expected payoff for each strategy now is the sum of the payoffs for each state
of nature multiplied by the probability of that state occurring:
S1 = (100m x 0,25) + (80m x 0,25) + (60m x 0,5) = $75m
S2 = $102,5m;
S3 = $40m.
5
Decision making under conditions of uncertainty
• There are several obvious sources of
uncertainty:
• externally driven sources
(environment).
• internally driven sources (process).
• decision-driven sources (information).
6
Decision making under conditions of uncertainty
Uncertainty criteria
• Under conditions of uncertainty, it is not possible to predict
what state of nature will apply. One of several uncertainty
criteria may then apply
• Hurwicz criterion (maximax criterion).
• Wald criterion (maximin criterion).
• Savage criterion (minimax criterion).
• Laplace criterion.
• In the Hurwicz scenario, the decision maker is always optimistic
and seeks to maximize profit by an all-or-nothing approach. The
decision maker is not concerned with how much he can afford
to lose. In the previous example he will elect the scenario S3.
7
Decision making under conditions of uncertainty
Uncertainty criteria
• In case of the Wald criterion, the decision maker is pessimistic and seeks
to minimize losses. He will consider only minimum profits (not losses)
and choose an option that maximizes that value. In the previous example
he would elect for strategy S2.
• In the case of the Savage criterion, the decision maker is a “bad loser”. He
attempts to minimize the maximum regret. The maximum regret is the
largest regret for each strategy, and the largest regret is the greatest
difference within a state of nature column in the pay-off matrix.
Using the data in the previous table for N1 the largest value = $200m.
Therefore: S1 regret = $200m - $100m = $100m
S2 regret = $200m - $150m = $50m
S3 regret = $200m - $ 200m = $0
8
Decision making under conditions of uncertainty
Uncertainty criteria
Regret table for decision making
Strategy
Possible stage of nature
N1 = up
N2 = even
N3 = down
Probability = 25%
Probability = 25%
Probability = 50%
S1 = A
$100 000 000
$80 000 000
$20 000 000
S2 = B
$50 000 000
$60 000 000
$0
S3 = C
$0
$0
$180 000 000
9
Decision making under conditions of uncertainty
Uncertainty criteria
Regret table for decision making
In total, the following apply:
S1 = $100m + $80m + $20m = $200m
S2 = $ 50m + $60m + $0 = $110m
S3 = $0 +$0 +$180m = $180m
Strategy S2 gives the minimum maximum regret.
10
Decision making under conditions of uncertainty
Laplace criterion
• The Laplace criterion attempts to convert decision making
under uncertainty into decision making under risk.
• The Laplace criterion assumes that Bayesian theory applies,
which states that if the probabilities of each state of nature
are not known, they can be assumed to be equal.
• Using the data given in the previous table, the probabilities
relate to the payoffs. Therefore:
P(S1) = (100m + 80m + 60m)/3 = $240m/3 = $80m
P(S2) = (150m + 100m + 80m)/3 = $330m/3 = $110m
P(S3) = (200m + 160m – 100m)/3 = $260m/3 = $87m
11
Decision making under conditions of uncertainty
Laplace criterion
• Using the Laplace criterion, the decision maker would go
for strategy S2 because this gives the greatest pay-off based
on the average pay-off in terms of equal probabilities of
each individual pay-off.
12
Rules for decision making under conditions of
certainty, risk and uncertainty
• Any of the four uncertainty strategies can be adopted,
depending on:
• how much money we can afford to lose;
• the level of risk that we are willing to take;
• what level of risk outcome that we can absorb.
• In terms of general risk taking:
• Don’t risk a lot for a little unless it is really worth it;
• Always analyze risks very carefully;
• Make sure that all risks have been identified;
• Make sure that all possible implications have been identified;
13
Rules for decision making under conditions of
certainty, risk and uncertainty
• In terms of general risk taking:
• Make sure that all risks have been identified;
• Make sure that all possible implications have been identified;
• Consider risk in terms of exposure and sensitivity;
• Plan for risk in as much details as possible;
• Always include an contingency plan;
• Don’t accept risks for reasons of principle;
• Don’t accept risks to avoid losing face;
14
Rules for decision making under conditions of
certainty, risk and uncertainty
• In terms of general risk taking:
• Never risk more than you can afford to lose (unless you
have to);
• Consider odds and intuition;
• Allow for the effects of bias;
• Allow for the effects of groupthink;
• Consider controllable and uncontrollable aspects
separately;
• Eradicate unknown factors as far as possible.
15
Rules for decision making under conditions of
certainty, risk and uncertainty
• In terms of hazard and safeguard:
• Maintain a low center of gravity;
• Reduce the risk profile where possible;
• Try to take risks in non-critical areas;
• Consider defenses in relation to potential hits;
• Maintain safeguards within reasonable limits;
• If in doubt, ask the boss.
16
Rules for decision making under conditions of
certainty, risk and uncertainty
• In terms of group development:
• Allow for groupthink;
• Beware unfounded delusions;
• Remember that groups make more risky decisions than
individuals;
• Don’t confuse risk taking with boldness;
• It is something prudent to be wary.
17
Rules for decision making under conditions of
certainty, risk and uncertainty
• In more philosophical terms:
• You can’t to avoid risk so accept it;
• Be prepared to take risks or you won’t to be able to exploit
opportunities;
• Engineer risk to keep it within acceptable limits;
• Use vision and think in expansive terms. Don’t allow risk to put
you off;
• Try new things because if you don’t you may become entrenched
in the known and become fearful of the unknown;
• Use risk to make money.
18
3.6 The concept of risk management
• In general terms a risk management system must be:
• practical;
• realistic;
• compliant with internal and external standards;
• cost-efficient.
19
3.6 The concept of risk management
• Most risk management systems contain five distinct
areas:
• risk identification;
• risk classification;
• risk analysis;
• risk attitude;
• Risk response, control, policy and reporting.
20
The concept of risk management
Work breakdown
structure
Analysis
Risk identification
Risk checklist
Internal
Risk classification
Controllable
Probability of
occurrence
Risk analysis
Impact of occurrence
Risk-averse
Management
Risk attitude
Risk response
Risk-neutral
Risk-seeking
Risk management strategy
Risk holder
21
The concept of risk management
Risk identification
• The idea of risk identification is to find out all the risks that
are likely to impact on a given project and to explore the
linkages and interdependencies between them.
• Risk sources are often classified in terms of objective and
subjective sources.
• It is important that the identification process is concerned
with the source of the risk rather than the event itself or the
effect. This is because the risk taker can do something about
the sources of the risk, but not really do very much about the
events or the effects.
22
The concept of risk management
Risk identification
• Objective sources are the sum total of past experience
of past projects in relation to the current project. This
source is sometimes referred to as “experience”.
• Subjective sources are the sum total of current
knowledge based on current experience. Estimates of
current performance are made based on optimistic,
likely and pessimistic estimates.
• Risk identification often makes use of brainstorming
techniques.
23
The concept of risk management
Risk classification
• Once the various risks have been identified, they then
have to be classified in some way.
• Most work on classifying risk is linked to so-called
portfolio-theory. This considers risk classification from
a financial point of view.
• Risk can be primarily classified in terms of:
• risk type;
• risk extent;
• risk impact.
24
The concept of risk management
Risk classification
• The consequences or impact of risk can be expressed
as:
• maximum probable loss;
• most likely cost of the loss;
• likely cost of covering the loss (if uninsured);
• cost of insuring against the event occurring;
• reliability of predictions about the event.
25
The concept of risk management
Risk types
Specific risk (insurable risk)
Potential losses:
Fire Flood Breakdown Theft
Risk classification
Market risk (business risk)
Potential gains and losses:
Share value Sales Profitability Acquisitions
Risk source and scope
Environmental risk
Specific market or sector risk
Specific company risk
Specific company project risk
Risk impact
High impact risk
Medium impact risk
Low impact risk
26
Example of risk classification system
Type
Extent
Specific
Environment
Sector
Company
Project
Market
Environment
Sector
Company
Project
Impact
Low
Medium
Severe
Low
Medium
Severe
Low
Medium
Severe
Low
Medium
Severe
Low
Medium
Severe
Low
Medium
Severe
Low
Medium
Severe
Low
Medium
Severe
Example
Change in restrictive legislation
Establishment of regulatory authority for
sector
Bankruptcy
Extensive fire damage
Extreme change in economy
Extreme changes in industrial activity
Extreme changes in share price
Change of project aim
27
The concept of risk management
Risk analysis
• Once the risks have been identified and classified, they have to be analyzed.
Risk analysis is based on the identification of all feasible options and data
relating to the various risks, and to the analysis of the various outcomes of
any decision.
• Most risk analysis methodologies comprise six basic steps:
• Step 1 Evaluate all the options.
• Step 2 Consider the risk attitude.
• Step 3 Consider the characteristics of the risks.
• Step 4 Establish a measurement system
• Step 5 Interpret the results
28
• Step 6 Make the decision.
The concept of risk management
Risk analysis – example of risk factor checklist
Risk description
Probability
Impact
(1 – low; 5 – high)
(1 – low; 5 – high)
Design compatibility problems
Project complexity greater than
planned




Project reliability less than
planned
Project over budget
Project over time






Project specification not
achieved
Likelihood of minor variations






Likelihood of major variations
29
The concept of risk management
Risk analysis – risk drivers map
• Most risk analysis approaches involve the identification of
risk drivers. The risk drivers are all the factors that influence
the impact and probability of the identified risk.
• The idea of drivers is very important. Few risks exist in
isolation; nearly all risks are driven by other variables.
• It is worthwhile working on some of these but not on others.
• The decision maker would look at the drivers that can be
influenced and decide to what extent he should attempt to
modify these drivers in order to engineer corresponding risk.
30
The concept of risk management
analysis – risk map
• The process of risk mapping Risk
is sometimes
referred to as risk
profiling or even risk footprinting. It is basically a process of
showing the relationship between risk probability and impact
for a range of given risks as a function of time.
• A basic risk map has four quadrants, although it may be
expanded to more sectors:
• Quadrant 1: Red zone (high impact and high probability).
• Quadrant 2: Upper yellow zone (high impact and low probability).
• Quadrant 3: Lower yellow zone (low impact and high probability.
• Quadrant 4: Green zone (low probability and low impact).
• The risk map is dynamic. It shows the migration of certain
risks over a period of time.
31
The concept of risk management
Risk analysis – risk map
High impact
High impact
Low probability
High probability
C
Low impact
Low impact
Low probability
High probability
A
A
B
Probability
32
The concept of risk management
Risk analysis – target risk map
Production capacity
Major plant failure
Labor problems
Competitor
innovation
Product
obsolescence
Day-to-day errors
Minor
equipment
failure
Probability
33
The concept of risk management
Risk analysis – risk map with variability limits
A
A
B
CC
D
Probability
34
The concept of risk management
Risk analysis – risk attitude
• The attitude of the risk taker is obviously an important
element in risk management. In general terms, risk takers
can be either neutral, risk-averse or risk seeking. A riskaverage attitude errs on the side of caution, while a riskseeking attitude leans towards encouraging risk.
• Different types of people and even profession
characteristically exhibit different standard risk attitude
characteristics.
• Risk attitude in relation to a project varies in relation to the
characteristics of the project team. Teams tend to take more
risky decisions than teams.
35
The concept of risk management
Risk analysis – risk attitude
Seeker
Neutral
Averse
Impact
36
Creativity and risk inherent in some job types
Fighter pilot
Researcher
Police person
University
lecturer
Lawyer
Venture capitalist
Machine operator
High street banker
Accountant
Bomb disposal
Risk
37
The concept of risk management
Risk analysis – risk response
• Risk response basically centers on risk distribution.
• The distribution of risk will depend on a number of n0ncontractual considerations:
• Is the outcome of the project worth the risk?
• Who has the greatest risk control?
• Who has the greatest risk liability?
• What incentive does each party have?
• Most forms of contract require a more or less collaborative
approach to the equitable sharing of risk.
• Risk response include:
• risk retention;
38
The concept of risk management
Risk analysis – risk response
• Ignoring the risk is obviously itself a high-risk strategy. Informed
risk retention is another consideration. This is most suited to risks
that are characterized by small and repetitive losses.
• Risk may be reduced by a number of means. It may be possible
to engineer risk out of the equation. In edition, risk may be
reduced by training and development, or by redefining the aims
and objectives of the project.
• Risk transfer involves transferring the risk to others. Risk transfer
through insurance transfers the risk to the insurance company in
return for a premium. Risk can also be transferred through
damages clauses within contracts (or through negotiations).
• Not all risks can be transferred, and there may be some risks
39
The concept of risk management
Common insurance and transfer clauses
Insurance clauses
Transfer clauses
Client
•Fire insurance
•Flood insurance
•Perils (e.g. civil commotion)
•Damages
•Determination
Contractor
•All-risks policy
•Third-party insurance
(damage to persons)
•Third-party insurance
(damage to property)
•Undermining (where
appropriate)
•Escape (where appropriate)
•Retention
•Damages
•Determination
•Performance bond
•Warranty
•Collateral
warranty
40
The concept of risk management
Risk analysis – risk control, policy and reporting
• Risk control is the process of using the information that has been
learned on a project to assist in the later development of the project.
• The risk identification and analysis systems may be incorrect or items
may have missed. It is very important that all assumptions and
evaluation processes are recorded and then measured in some way in
order to see whether or not they are working correctly.
• In addition, the probability and impact of identified risks may change
over time. It is important that identified risks are constantly monitored
and reviewed.
• Experience with risk and risk management is often documented into a
risk handbook.
• There must be regular reporting on red-quadrant risks.
41
The concept of risk management
Risk analysis – risk control, policy and reporting
• Risk report should be produced to a timetable and be
controlled by an overall strategy.
• The level and frequency of reporting will depend on the
significance of the risk:
• The CEO would usually receive frequent progress reports, including
identified risk drivers and detailed risk maps.
• The Board would receive copies of these, and also intermediate sixmonthly reports.
• For periods less than six months, progress would be summarized by
executive managers and circulated within the various project teams.
• The CEO and senior managers receive informal communication on
progress on all levels.
42
The concept of risk management
Risk analysis – risk control, policy and reporting
• Risk policy is a statement of the policy of the organization in terms of risk
and risk management.
• Over and above the identification of risk holders and risk strategies for
“red quadrant” risks the risk policy establishes a number of elements:
•
•
•
•
•
Overall aims and objectives.
Accountability for individual managers.
Formalized reporting channels.
Risk tolerances.
Authorization.
• Any risk policy should initially develop individual targets for individual
sections within the organization. Once this has been completed, the
policy is developed and worked up as a strategic document.
43
3.7 Risk, contracts and procurement
• A contract is a classic way of managing risk. It is a formal
agreement between two or more parties. It records the
rights and obligations of each party to the contract. A
contract is therefore a tool for risk transfer and mitigation.
• A contract also allows risk to be controlled. It provides
guidance for each party in the event of a dispute or conflict.
• With any contractual arrangements, the contract defines
only the ground rules. The execution of the contract depends
on goodwill, intent and the relationship between the parties.
44
Contracts
• Typical contract documents include:
• The signature block and project title.
• The definition of contract terms and scope.
• Information and facilities to be provided by the client.
• Project approvals. It is common practice for reporting stages to
be subject of the approval.
• Payment systems.
• Working drawings show the full design information.
45
Contracts
• Typical contract documents include:
• Working drawings show the full design information.
• The specification describes the technical performance of the
product or service being provided.
• Schedules.
• General conditions
• Specific conditions.
• Provisions for change and variations.
• Dispute resolution.
• Bonds and warranties.
46
Contracts
• In order for a contract to exist there must be:
• Offer and acceptance. There are a large number of established
rules that apply to offer and acceptance.
• Consideration. Consideration may or may not be appropriate,
depending on the legal system under consideration. It is the
exchange of something of value (Usually money).
• Capacity. This relates to the ability of parties to perform their
obligations under the contract.
• Legal relations. The contract itself must be legal and there must be
an intention to create legal relations.
• Communication. Generally, acceptance has to be communicated to
the offeror.
47
Contracts
• A contract can be successfully performed, or it can be terminated in a
number of alternative ways. For performance, all parties must complete
their liabilities and duties under the terms and conditions of the contract.
• Alternatives to performance include the following:
• Breach – where one party acts in contravention of one or more terms of the
conditions.
• Frustration - where a contract cannot be performed, even if both parties wish to
do so.
• Rescission – where there has been an error or misunderstanding in the
preparation of the original contract.
• Rectification – where a contract term has been wrongly worded or phrased.
• Void – A contract can be voided where, for example, the contract goods are illegal.
• Termination/determination means that both parties can cease the contract, and
the party that has determined the contract has a right to seek reimbursement
against the party who has been determined.
48
Procurement
• Procurement is the process by which goods and services
are acquired. It is the process of the two or more different
contractual parties, who have different aims and
objectives interacting and agreeing on a contract within a
given market sector.
• Generally, there will be a number of common phases:
• Objective phase.
• Exposure phase.
• Alternatives phase.
• Documentation phase.
• Tendering phase.
• Award phase.
• Contract administration phase.
49
Characteristics of contracts
• The level of risk in any contract depends on the degree and
extent of controllable and uncontrollable risks.
• In all cases there will be some fundamental contractual risks,
for example:
• Adequacy of design: latent (hidden) and patent (obvious) defects.
• Project eventual cost.
• Safety and indemnification for accidents.
• Risk to damage adjacent property or people.Third-party insurance
covers this risk.
• Fire, flood etc.
• Completion deadlines: liquidated and ascertained damages.
50
Characteristics of contracts
• Contracts contain both express and implied terms.
• Express terms are those that are clearly expressed within the wording of
the contract. Fundamental risks are generally covered by express terms.
• Implied terms are those that can be implied from the wording of contract
or from common usage. Liabilities (such as reasonable duty of care) are
generally covered by implied terms.
• These implied terms are very common in contracts for professional
services. The appropriate professional body sets out the main codes of
practice and practice standards for its member).
• In most cases, professionals are required to carry professional indemnity
insurance (PII). If there is a negligent act, the hirer might successfully
claim compensation. The sums involved may be beyond the limits of
individual or even small companies, and so the PII cover is very
51
important.
Transfer of risk in contracts
• Risk can usually be transferred to whatever
degree is considered necessary by the person
who is drafting the contract.
• In general, the greater the transferred risk the
greater the cost of the project because the
suppliers or contractors will increase prices to
allow for the increased risk.
• Risk is sometimes transferred to indemnity
clauses which seeks to transfer specific risk for
specific events onto a named party.
• Reasonable transfer of risk also depends on the
ability of the risk bearer to absorb any
damages.
52
Variation orders and change notices
• No matter how well the contract documents have been prepared and
how advanced the design is, there always be some information that is
missing at the tender pricing stage.
• In addition, there will always be some unforeseen events that require
changes to the specified design or production process and therefore
to the contract itself.
• Variations allow for changes to be made to a contract without
invaliding it. The main requirement for a variation order or change
notice is that it is fair to both parties to the contract.
• In order for the variation to be valid, it must be possible to price it in
some way and then reimburse or compencate the affected party.
53
Claims risk
• If variations occur, or if the project is delayed or changed for other
reasons, the parties to the contract might seek reimbursement from the
party that has caused the delay or change.
• This is usually done through the assembly and submission of a direct
claim. If this is disputed, the party might seek recourse through litigation,
in which case the claim would be converted into a claim for damages.
• If a contractor causes a delay and this leads to an extension of time for
the completion of the whole project, then the contractor will reasonably
have to compensate the client for this delay.
• Compensation will usually take the form of some kind of liquidated and
ascertained damages, based on the client’s actual loss.
• There are items that the contractor has no control over and that
therefore have to be classified as client risk. Most standard forms of
contract list items, that are acceptable as the basis for a contractor claim.
54
Claims risk
• Typical examples of client risk include:
• failure to provide information within a reasonable time of the
contractor requesting it;
• late instructions;
• errors or omissions in the contract documents;
• delays caused by nominated subcontractors;
• delays caused by client consultants;
• changes in statute;
• non-availability of labour;
• civil commotion and disruption;
• declaration of war and/or war damage;
• exceptionally adverse weather (where appropriate);
• determination of contract by contractor.
55
Claims risk
• A contractor or client might be able to claim reimbursement also on
other grounds, f.e.:
•
•
•
•
•
fire (within limits);
flood;
lightning;
impact of aerial devices or objects dropped therefrom;
ionizing radiation.
• These are events that cannot reasonably be foreseen by either party,
and it is therefore the responsibility of the client to ensure against them.
• The contractor is generally also required to carry some insurance in
relation to events that could affect the project, f.e.:
• employer’s liability for employees;
• liability for damage to third party persons and property;
• escape of potentially harmful or hazardous materials.
56