Risk Analysis
Vince Selip, 12 February 2011
Mercyhurst College, Erie PA
Advanced Analytic Techniques Course
Purpose
The purpose of this paper is to assess the value of Risk Analysis by looking at a historical
example and examining the method’s effectiveness. The method will focus on potential
hazards as well as the probability of these hazards occurring. The question presented to
test Risk Analysis is as given: "Using only the information available prior to the U.S.
invasion of Iraq in 2003, what was the risk of significant violence toward the U.S. by
people and organizations other than the Iraqi military and security forces?"
The criteria used to evaluate Risk Analysis Method are:
1. Successful implementation of a “Risk Scoring System”, used to determine levels of
risk
2. Identification of the most probable threats
3. Identification of the likelihood of threats occurring
4. Analyzing the costs and impact of potential threats
Risk Analysis is the preferred method based on the ability to examine multiple levels of
risk associated with the test question.
Literature Review
Most of the authors used similar research topics and used risk analysis to determine
the political risk of a country. The majority of articles used a point system, ranking
each factor depending on its influence and relevancy to the topic. The analyst
would choose which factors are most influential to risk in a given country and assign
a point value based on its level of risk. This method for measuring risk was common
among the authors; even if each source didn’t necessarily focus on measuring
political risk they used a scoring system to rank the risk factors. Most of the
sources gathered the information into a table or matrix that enables analyst to view
the information more easily.
Key Points
Source one:
 Focused on political risk factors that lead to instability, which directly related
to test question.
 Type of political system can determine the factors studies, the author has
given preset questions to answer depending on a country’s government.
Source two:


Focuses on point values to determine risk by multiplying weights by
relevancy values assigned to each factor
There are not set factors, the analyst can develop and determine their own
risk factors
Source three:
 Includes potential costs of each factor by determining its exposure in the
final analysis
 Organizes data for accurate analysis
Source four:
 Breaks down factors depending on sector (i.e. political, economic, financial)
 Creates a checklist table that easily organizes and distributes data
Source five:
 Focuses on threat identification and their possible consequence
 Threats include adversary, each factor shows the organization, group or
government that will be directly effected
Source six:
 Provides current list of country world rankings by international
organizations
 Factors and weights are already set which allows for low cost in time for this
source
Source seven:
 Provides excellent process for identifying assets and determining potential
risk levels
 Organizes all data effectively into a final matrix
There were some slight differences among the sources researched, while most
focused on political factors that influence country risk not all of the techniques did.
Although a few sources did not focus on political risk analysis, the method and
process they introduce would still be an effect way to determine risk analysis. Some
of the sources allowed for flexibility in determining risk factors while others already
had the factors determined. Darryl Jarvis from National University of Singapore
focuses his research on factors that lead to political instability not risk analysis
while most of the other sources focused solely on potential levels of risk.
Description
Risk Analysis is the process of assessing risk and undertaking studies to characterize the
nature and uncertainties surrounding risk. It can be used to measure a variety of topics,
including political and business risk. It is very useful in making important decisions
regarding a variety of topics. Most importantly it reduces the uncertainty surrounding a
topic or decision. It is not limited to one topic or type of measurement.
In a global economy risk analysis can be used to determine the risk of investment in a
foreign country or the risk of war with a foreign adversary. It has many uses and many
functions and is not limited to any particular individual or group.
One of the negative aspects of this method of measurement is the subjective nature of
determining factors and their relevancy to the measurement. An analyst can choose which
factors they feel will be important which will affect the measurement. Positive aspects
include the simplicity of the method along with the low cost in time to apply this method.
This method is used effectively in business, determining cost and schedule of potential
projects. Although popular and effective in business, risk analysis can be used for a
variety of measurements.
Sources:
Jarvis, Darryl. Conceptualizing, Analyzing and Measuring Political Risk: The Evolution
of Theory and Method. National University of Singapore. Retrieved December 8th 2010,
from
http://210.212.115.113:81/Abha%20Rishi/International%20Retailing/IB/PoliticalRisk.pdf
Country Risk, Retrieved January 2nd 2011, from
http://www.scribd.com/doc/38137657/Country-Risk-Analysis
Strengths




Simplicity in applying technique. The articles researched proved that the
method was relatively simple to apply for most measurements. Learned through
research
Ability to apply the technique to different measurements and issues. Analyst
can alter and change potential factors depending on measurements. Learned
through research
Low cost in time to apply technique. Method is simple and easy to use, at least
on the level that I am using it at this time. Learned through research and
experience
Quantitative measurement reflects a high-low range. Compares how various
factors influence potential risk. Learned through research
Weaknesses




No information on how to develop list of risk factors. Articles ask to identify
hazards but no data or information on what constitutes as a risk or hazard. No
criteria for what constitutes risk factors. Learned through research
Risk factors can be influenced by analyst bias. The analyst can choose to
include or leave out risk factors which can influence results. Learned through
research and experience
Doesn't address complicated risk analysis measurements. Lack of information
and examples on how to apply technique to complex issues. Learned through
research
Little information on how to quantify potential cost. Many sources include the
cost of each risk factor, however there is little information on how to develop or
quantify costs especially in the context of country risk.
How-To Determine Risk Analysis
This method works well with determining country risk analysis, indicating the potential
risk of a given country. During my research I came across many different methods for
determining risk analysis. I chose this method based on the fact that it focuses on country
risk, which is closely related to my test question. Identifying the potential risk factors is
important and influences the entire analysis. This method allows for great variation or
factors depending on the research topic.
5. Step #1 Identify Question
Determine what you want to measure
• Step #2 Identify Risk Factors
Identify which factors hare the greatest influence on risk
• Step #3 Assign Point Value
•
Assign a point value for each factor depending in its individual influence on risk. This
will give each factor a weight value so the analyst can indicate which factors have the
greatest influence.
• Step # 4 Determine Likelihood
Determine the likelihood of each event occurring. Use the scale highly likely, likely,
marginally likely or unlikely
• Step # 5 Create Table
Create a table and list each factor according to its weight, list the weight of each factor as
well. The higher the total point value the higher the risk of the country
• Step # 6 Add Cost
Determine the cost of each factor occurring. This will depend on what is being
measured. It can be costs in lives or financial costs. The measurement topic will
influence the type of costs. It should also be stated how this will measured
• Step # 7 Determine Overall Risk Level
I used the follow definitions to determine the overall risk level and to answer the test
question.
 Extremely High Risk: Activities in this category contain unacceptable
levels of risk including catastrophic and critical injuries that are highly
likely to occur.
 High Risk: Activities in this category contain potentially serious risks that
are likely to occur
 Moderate Risk: Activities in this category contain some level of risk that
is unlikely to occur.
 Low Risk: Activities in this category contain minimal risk and are
unlikely to occur
Risk Analysis Process
Personal Test Case
When researching risk analysis method I came across many variations and differences
within the method. I was focused primarily with articles and sources that looked at
political risk analysis due to my topic question. Even though I was initially focused on
political risk sources, methods that focused on other types of risk analysis and looked at
other topics were adaptable and flexible, which allowed me to still use the steps and
incorporate them into my test question.
The step-by-step procedure of risk analysis would allow an analysis to look at almost any
event and determine the risk involved. The method that I looked at is very simple and
requires little cost in terms of time. Having extensive experience with your test question
is helpful but not essential to completing the process.
The test question used to determine if the method is useful is as given:
“Using only the information available prior to the U.S. invasion of Iraq in 2003, what was
the risk of significant violence toward the U.S. by people and organizations other than the
Iraqi military and security forces?”
Step 1: Identify the question or issue that needs to be measured
Step 2: Identify potential risk factors related to the question. This step looks at what
factors could potential influence risk for the given topic.
Step 3: Rank each factor according to their influence and relevancy. This is most easily
accomplished by assigning a point value to each factor. Criteria used to complete this
step depends on the question. Note (it is more useful to use a scale from 1-100 in
assigning point values to give a more accurate conclusion)
Step 4: Determine if the event is highly likely, likely, marginally likely or unlikely to
occur.
Step 5: Create a table or matrix and add information. Rank each factor according to its
weighted ranking and include the likelihood of it occurring.
Step 6: Add to the table or matrix the cost of each factor. Determine how its occurrence
could affect the test question.
Step 7: Determine overall risk level
This will give the analyst an organized view of each factor and their likelihood of
occurrence.
Threat
Category
Likelihood
WMDs
Critical
Likely
Weighted
Factor
90
Foreign
Critical
Likely
80
Cost
10%-20%
increase in
troop
casualties
Not enough
Government
Influence
Ethnic/Religious Critical
Divide
Al-Qaeda
Essential
information
Highly Likely
80
Likely
65
Saddam Loyalist
Essential
Likely
60
Poverty
Normal
Likely
35
Iraqi Exile
Influence
Normal
Marginally
Likely
25
Not enough
information
Not enough
information
Not enough
information
Not enough
information
Not enough
information
The first step in the process is creating a list of factors that can lead to violence toward
U.S. personnel and categorize as critical, essential or normal according to their level of
influence towards risk. The factors that I listed are based on information available prior
to the U.S. invasion in 2003.
 I chose weapons of mass destruction as the factor that has the potential to
do the most harm to U.S. personnel. This is based on information that
WMDs could increase U.S. troop casualties by 10 to 20 percent. While I
am not looking at the chance of Saddam using him but other parties
obtaining the weapons. I chose to list attacks using WMDs separate than
attacks from terrorist groups of Iraqi citizens because any group could
access and use unsecured WMDs and their potential impact could be
catastrophic
 Foreign government influence includes any country that would support
and benefit from attacks on U.S. personnel in Iraq. This could be any
country that supports the violence towards the U.S. and provides weapons,
training or funds to any group in Iraq.
 Ethnic/religious divide references differences and conflict among the
different ethnic and religious groups in Iraq without a dictatorship in place
 Al-Qaeda influence – The risk that Al-Qaeda will be re-group and spread
its influence to Iraq
 Saddam loyalist includes any groups or individuals who have benefited
from having Saddam in place. Ba’ath party members are included in this
group
 Poverty indicates Iraqis who will be negatively affected by a U.S.
invasion. Will their businesses be destroyed or will their jobs be lost due
to destruction of infrastructure? If they are negatively affected, what is the
risk they will attack U.S. personnel
 Iraqi Exiles have the ability to influence decisions not only on the U.S.
side but in Iraq as well. What is the risk of them negatively influencing
either side and risking attacks.
Following the identification of threats, I categorized each threat as critical, essential or
normal risk. For this project I defined critical as having the potential to have severe
consequences for U.S. personnel if they are attacked. Essential also has the potential to
do severe damage, just not on the same scale as the critical factors.
Using the research data I concluded the likelihood of each even occurring. While no
preset probability levels were given in the sources I used the following when determining
the likelihood of occurrence. Highly Likely: 75%-100% certainty; Likely: 65%-75%;
Marginally Likely: 40%-60%; Unlikely: less than 40%
I then assigned a point value to each factor, bringing into consideration its potential
impact on the test question and its influence on overall risk. I used a scale from 1-100
when assigning the point values. The higher the point value the more impact the factor
has on overall risk.
I used the follow definitions to determine the overall risk level and to answer the test
question.
 Extremely High Risk: Activities in this category contain unacceptable
levels of risk including catastrophic and critical injuries that are highly
likely to occur.
 High Risk: Activities in this category contain potentially serious risks that
are likely to occur
 Moderate Risk: Activities in this category contain some level of risk that
is unlikely to occur.
 Low Risk: Activities in this category contain minimal risk and are
unlikely to occur
There was no quantitative measurement used to place the above table into one of the
above categories. I decided that the level of violence toward U.S. personnel was
extremely high risk. All but two of the factors were at least marginally likely to occur
and the factors that had the potential to cause the most damage were likely or high likely
to occur which significantly raised the overall level of risk.
The criteria used to evaluate Risk Analysis Method are:
1. Successful implementation of a “Risk Scoring System”, used to determine levels of
risk
2. Identification of the most probable threats
3. Identification of the likelihood of threats occurring
4. Analyzing the costs and impact of potential threats
Based on the above criteria the method used was moderately successful. The method
successful satisfied the first criteria and established a weighted scoring system to rank
risk levels. The identification of the most probable threats was left to the analyst to
determine and was not answered specifically by the method. The likelihood of the threats
occurring is answered when the factors are added to the matrix. This would need to be
answered by the analyst based on the research information. Analyzing the potential cost
or impact of each factor was difficult to quantify and establish. Since the test question
looked at violence toward U.S. personnel it was difficult to establish a criteria for this
step and quantify measurement. There was also a lack of information available prior to
2002 that had taken into account these factors and their effect of violence. The method
did not adequately answer this portion.
The major roadblock to successfully researching this method was the lack of complete
information for each source. None of the sources researched had the same step-by-step
method. I had to use the most informative and important aspects of each source in order
to determine an accurate measurement. While the sources had similar methods they
were not identical, choosing the most helpful and useful sections from each source
was difficult, especially when multiple sources focused on political risk but had
differences in their measurement methods.
For Further Information
Texas State LBJ Center. Threat Assessment Matrix. Retrieved 12/10
http://www.lbjsc.txstate.edu/caso/soc/forms/contentParagraph/03/text_files/file1/RiskAss
essmentMatrix.pdf
Peltier Thomas R (2008). Introduction to Risk Analysis Chapter 2. Auerbach Publications
Retrieved 01/11 **http://www.infosectoday.com/Articles/Intro_Risk_Analysis.htm**
The Security Risk Analysis Directory. Retrieved 01/11
http://www.security-risk-analysis.com/introduction.htm
National Hazards of Australia. Identifying Risk Analysis Requirements. Retrieved 01/11
http://www.ga.gov.au/image_cache/GA10820.pdf
Kunreuther Howard (2001) Risk Analysis. The University of Pennsylvania.
http://opim.wharton.upenn.edu/risk/downloads/03-13.pdf
Vose David (2008) Risk Analysis. A Quantitative Guide.
http://books.google.com/books?id=9CaoAqaRcVwC&printsec=frontcover&dq=risk+anal
ysis&source=bll&ots=tNh2fDvmVZ&sig=oHiXydszXo8MDbpeqAsr_EGBhDI&hl=en&
ei=2QxXTfyGMcSqlAe6sLnkBw&sa=X&oi=book_result&ct=result&resnum=13&ved=
0CIk
Annex 1. Detailed Literature Review
Source One
Conceptualizing, Analyzing and Measuring Political Risk: The Evolution of
Theory and Method
Jarvis, Darryl. Conceptualizing, Analyzing and Measuring Political Risk: The Evolution
of Theory and Method. National University of Singapore. Retrieved December 8th 2010,
from
http://210.212.115.113:81/Abha%20Rishi/International%20Retailing/IB/PoliticalRisk.pdf
Risk Analysis
Purpose of article
This article analyzes political risk and its use in understanding political events and
processes that can lead to instability. Political risk analysis technique is presented as is
the benefits and deficiencies of the technique presented by this source. Different levels
of political risk are introduced, including risk involving foreign investment, political
decisions and the activities of government. In addition, dysfunctional political events
such as terrorism, coups and civil wars are considered in this article.
Strengths
·
·
·
Integrates risks from a variety of factors (i.e. economic, political, social)
Quantitative measurement reflect a high – low range
Low costs in time to apply technique
·
·
·
Relies on assumptions made by individual generating list of risk factors
Risk factors presented are already set by author
Does not reach precise conclusion
Weakness
How to apply method
The risk analysis method introduced involves assigning point values to various factors
that influence instability in a country (i.e. corruption, religious tension) The higher the
score the higher the level of risk. First, the type of political system is determined and a
list of factors are determined according the to country and type of government that is
being examined. Then each factor that is applicable is chosen as a potential risk to
stability. Following this step the points are calculated and the level or risk is determined
by examining all the information.
Method explanation
While the method in this particular article is measuring political risk, the method can be
applied to various measurements. An individual would simply choose factors that they
feel would influence risk on their chosen topic. The method for assessing and analyzing
the risk would remain the same and can be applied to other measurement needs. They do
not need to be constrained by the factors introduced in this article
Other sources cited
M. Anaam Hasmi and Turgut Guvenli, (1992), “Importance of Political Risk Assessment
Function in U.S.
Multinational Corporations,” Global Finance Journal, 3(2), pp.137-144.
David W. Conklin (2002), “Analyzing and Managing Country Risks,” Ivey Business
Journal, 66(3),
January–February, p.17.
Global Risk Assessments:
Issues, Concepts and Applications (Book 5), Riverside California: Global Risk
Assessments, pp.181-228.
Robert A. Poirier (1997), “Political Risk
Analysis and Tourism,” Annals of Tourism Research, 24(3), p.677.
Informative information
This source is informative because the research topic presented in this article is similar to
my test question. Much of the information presented will be useful not only in analyzing
risk but also in my research. I think the simplicity of the method presented is also very
important and the fact that it can be applied to a variety of sources is important.
Author
Darryl Jarvis is an associated professor with the National University of Singapore.
Likely to be in a position with access to valid research materials on the topic.
Source reliability
39.62 – Medium High Credibility
V. Selip
Vince.selip@gmail.com
Mercyhurst College, Erie PA
Advanced Analytic Techniques Course
12/16/2010
Source 2: Country Risk Analysis
http://www.scribd.com/doc/38137657/Country-Risk-Analysis
Risk Analysis
Purpose of article
This article focuses on country risk assessment, analyzing and assessing political and
country risk. Describing what factors influence political risk and different techniques
involved in measuring political risk. The article is focused not only on established risk in
a particular country but assessing how that risk can affect other countries. Much of the
article looks at potential financial implications and effects in determining levels of risk in
a given country.
Strengths
·
·
·
Introduces variety of factors that influence risk
Focus specifically on measuring risk inside a country
Low costs in time to apply technique
·
·
·
No example of how to apply technique
Lack of data and depth when describing technique
No set matrix for determining unacceptable levels or risk
Weakness
How to apply method
The risk analysis method introduced involves assigning point values to various factors
that influence political risk in a given country. These factors can include war, corruption
and financial instability. After the factors have been determined, weights are assigned to
each factor to determine their relevancy. The weighted factors are multiplied by the
values assigned to each risk factor to determine the level or risk.
Method explanation
While the method in this particular article is measuring political risk, the method can be
applied to various measurements. An individual would simply choose factors that they
feel would influence risk on their chosen topic. The method for assessing and analyzing
the risk would remain the same and can be applied to other measurement needs.
However, no set range for acceptable risk was given nor was an example of how to use
the method effectively. The article also did not go into great detail on how to complete
the measurement. Overall, this article does not provide a good basis for completing risk
analysis.
Compared to previous sources:
This source was less informative and less helpful than the previous sources studied.
While this source is useful for its relevancy to the test question it did not provide enough
information or give examples of how to effectively use the technique. In addition no
author was listed and the source lacked credibility.
Other sources cited
No other sources cited
Informative information
This source is informative because the research topic presented in this article is similar to
my test question. Identifying potential political factors will aid my research and help to
answer my test question. Although helpful, this source indentifies a similar technique for
establishing levels of risk to other sources that I have already chosen. The lack of
established guidelines for determining an appropriate level of risk will also limit the
effectiveness of this source.
Author
No author listed
Source reliability
21.28 – Low Credibility
V. Selip
Vince.selip@gmail.com
Mercyhurst College, Erie PA
Advanced Analytic Techniques Course
12/16/2010
Source Three
Quantitative Risk Analysis
Tan, Ding (2002). Quantitative Risk Analysis. Sans Institute. Retrieved 12/10 from:
http://www.sans.org/reading_room/whitepapers/auditing/quantitative-risk-analysis-stepby-step_849
Risk Analysis
Purpose of article
This article focuses on quantitative risk analysis and provides a step-by-step procedure
for developing accurate risk analysis. While the article focuses on IT security, the
method procedure introduced can be used for a variety of measurements. Also
introduced in the exposure factor of a measurement, determining the cost of being wrong.
Strengths
·
·
·
Provides organized data for looking at potential risk
Looks at cost of risk in addition to level of risk
Low costs in time to apply technique
·
·
·
Doesn’t provide information on how to quantify potential losses
Lack of relevant examples when describing technique
No information on how to determine risk factors
Weakness
How to apply method
The risk analysis method introduced involves assigning point values to various factors
that determine risk. These factors will have the potential to influence the level of risk.
After the identification of each factor, assign a point value for the factors. This value will
help determine the role each factor plays in the risk analysis. Following the
determination of risk factors, identify how each factor can influence the outcome and the
potential cost of each factor. Create a table that shows the factor, it point value and its
potential impact.
Method explanation
While the method in this particular article is measuring IT risk, the method can be applied
to various measurements. The analyst would need to choose factors that have the
potential the influence risk of the measurement. The article introduced how to calculate
an exposure factor and determine how the outcome of the event occurring can affect the
event. In evaluating the potential exposure to risk, an individual would start at 100%
exposure and formulate a series of questions relating to the measurement. Potential
exposure would be lowered depending on how many of the related questions were
answered “yes”. Each “yes” answer would lower the exposure factor.
Compared to previous sources:
This source was more informative than the previous source critiqued. Although it did not
focus of test question, the method explanation was more in-depth and extensive.
Other sources cited
Kensington Technology Group. “ROI Calculator.” URL:
http://www.microsaver.com/index.html (10 December 2002).
Pavri, Zareer. “Valuation of Intellectual Property Assets: The Foundation for Risk
Management and Financing.” PricewaterhouseCoopers. 29 April 1999. URL:
http://www.pwcglobal.com/extweb/manissue.nsf/DocID/1628AF8B3C99F360852567BB
006D8B24 (10 December 2002).
Informative information
The source is informative and gives a breakdown of how to determine risk for a given
situation. It was not as helpful as the first source critiqued only because the examples
given were not related to my test question. However, the method presented can be
manipulated to incorporate my given test question.
Author
Ding Tan. Author position not given, may be member of organization
Source reliability
40.90 High Credibility
V. Selip
Vince.selip@gmail.com
Mercyhurst College, Erie PA
Advanced Analytic Techniques Course
01/15/2011
Source Four
Country Risk Analysis: A Survey
Nath, Hiranya (2004). Country Risk Analysis. Sam Houston State University. Retrieved
01/11 from: https://www.shsu.edu/~eco_hkn/CRISK_revised04.pdf
Risk Analysis
Purpose of article
The article focuses on country risk analysis, looking at the risk of direct foreign
investment in particular countries. It is the assessment of political and economic risk
factors that influence a country’s ability to repay financial loans.
Strengths
·
·
·
Breaks down factors depending on sector (i.e. political, economic, financial)
Simplicity of use
Analyst does not need to have intimate knowledge of country to perform analysis
·
·
Factor determination is subjective
Lack of information on how to determine weighted ranking for each factor
Weakness
How to apply method
First indentify potential risk factors that could influence risk in a particular country. The
factors are broken down between political, economic and financial sectors. The factors
are then weighted by potential risk influence. The factors are then listed from most high
to low risk in a checklist table. The sum of the scores is used as a measure of country
risk. The weight assigned to each factor determines the level of influence that it has in
overall country risk.
Method explanation
The method introduced focused on country risk analysis. The analyst would need to
choose factors that have the potential the influence risk of the measurement. The article
introduced how to calculate country risk analysis for a target country. The method allows
the analyst to perform an in-depth analysis of a country. While the source had preset
factors based on political, economic and financial sectors the method could still be
applied to other topics. The source utilizes a checklist method so it would have to
modified slightly and alter the given risk factors. As long as analysts chose their own
factors the rest of the method could be applied to a different topic
Compared to previous sources:
This article was similar to source one in its structure and technique for determining
country risk. This source address factors other than political that can potentially
influence country risk.
Other sources cited
Burton, F. N. and Hisashi Inoue, 1983, “Country Risk Evaluation Methods : A Survey of
Systems in Use.” The Banker, January, 41-43.
Goodman, S. H. (ed) 1978, Financing and Risk in Developing Countries. New York :
Praeger Publishers.
Informative information
The source was very informative, the breakdown between political, economic and
financial factors helps to organize potential influential factors.
Author
Nath, Hiranya. Position not given, affiliated with Economics and International Business
department at Sam Houston State University.
Source reliability
39.62 High Credibility
V. Selip
Vince.selip@gmail.com
Mercyhurst College, Erie PA
Advanced Analytic Techniques Course
01/22/11
Source Five
A Perspective on Threats in the Risk Analysis
Process
Nichols, Arthur (2002) A Perspective on Threats in the Risk Analysis Process. Sans
Institute. Retrieved 12/10 from:
http://www.sans.org/reading_room/whitepapers/auditing/perspective-threats-riskanalysis-process_63. 12/10
Risk Analysis
Purpose of article
The article focuses on risk analysis through threat identification and possible
consequence. It is focused on determining potential threats to a given topic and
analyzing their potential impact. The article also introduces threat profile, threat
probability and threat consequence in the risk analysis process.
Strengths
·
·
·
Organizes information accurately
Expands on threat information to include goals and methods
Identifies consequences of threats
·
No range for likelihood of occurrence. For example, what would the percentage range be
for high or moderate likelihood of occurrence?
Weakness
How to apply method
The source breaks down the risk analysis method as Threats + Impact + Likelihood =
Risk. A list of potential threats needs to be identified depending on your topic. Each
potential threat needs to include the adversary (i.e. terrorist organization, foreign
government), the goals of the adversary and their potential threat method. These factors
can be listed or organized into a table. Following this step the potential impact of each
threat needs to be identified along with the probability of each threat occurring. Each
factor is then ranked, taking into consideration all of the above information. After the
information is evaluated a level of occurrence is determined for each threat from certain
to limited.
Method explanation
The method introduced allows for great variation and flexibility with the subject topic. It
allows for more information to be displayed regarding individual threats. The
organization of threats allows the analyst a visual display to help understand the threat in
its entirety. Indentifying the threat level allows for an analyst to determine the likelihood
of the threat occurring. This method encompasses many different factors related to risk
analysis. Not only does it address the threats in-depth but it also addresses the potential
impact and the likelihood of occurrence.
The source looks at the potential impact that threats can have on a country or company’s
assets. Threats that can alter the operations or corrupt the operation of the assets. It is
important to determine the likelihood of each factor occurring, this will help the analyst
in making a final analysis regarding the level of risk.
Compared to previous sources:
This source was the most useful and helpful to determine accurate risk analysis. The fact
that each threat is broken down to the adversary, their goals and their methods is very
useful and will provide excellent visual graphics for the method.
Other sources cited
Denning, Dorothy E. “Information Warfare and Security.” Addison Wesley 1999
Krause, Micki, Tipton, Harold. “Handbook of Information Security Management.”
Auerbach 1998
The Experts’ Consensus. “How To Eliminate The Ten Most Critical Internet Security
Threats.” Version. 1.33, June 25, 2001. URL: http://www.sans.org/topten.htm (Aug. 25,
2001)
Brewer, David. “Easy ways to manage your risk”. Gamma Secure Systems Limited.
URL: http://www.gammassl.co.uk/topics/hot10.html (Aug. 13, 2001)
Brewer, David. “Easy ways to manage your risk”. Gamma Secure Systems Limited.
URL: http://www.gammassl.co.uk/topics/hot10.html (Aug. 13, 2001)
C&A Security Risk Analysis Group. “Introduction to Risk Analysis.”
URL: http://www.security-risk-analysis.com/introduction.htm (Aug. 5, 2001)
Decessioneering Company. “Risk Analysis Overview” URL:
http://www.decisioneering.com/risk-analysis-start.html (Aug. 28, 2001)
Informative information
This is the most informative source that I have researched. The in-depth analysis of each
threat combined with the consequence and probability of occurrence provides the most
accurate risk analysis in my opinion.
Author
Arthur Nichols. Position not given, assume relationship with Sans Institute.
Source reliability
40.92 High Credibility
V. Selip
Vince.selip@gmail.com
Mercyhurst College, Erie PA
Advanced Analytic Techniques Course
01/29/11
Source Six
Country Risk
Bouchet, Michael Henry (2008) Country Risk. Retrieved From
http://www.globalfinance.org/home/courses/countryrisk/5.%20Political%20Risk%20Ana
lysis.pdf.
Risk Analysis
Purpose of article
The source is focused on determining risk levels within a given country including
explaining features of political or country risk and indentifying factors used to determine
country risk. Current rankings of various organizations country risk reports are also
presented and discussed which supports the source.
Strengths
·
·
Provides list of factors to determine country risk
Provides examples of current country risk rankings
·
·
·
Does not address potential effect of given factors
Lack of examples on how to complete technique
Weighted rankings already given, doesn’t allow analyst to customize rankings
Weakness
How to apply method
The source focuses on country risk analysis and begins by introducing common risk
factors. These factors are broken down by economic, political, social and military
factors. The risk factors are already set and given, as are the weights for each factor to
determine its influence to country risk. Since the factors are set, the analyst only needs to
determine which factors apply to the given country they are analyzing and compile the
factors and their weights into a table for analysis.
1. Decide which factors are applicable to the given country
2. Compile list of factors and their weighted rankings into a table for analysis
3. While analyzing table determine acceptable risk level
Method explanation
The method does not allow for great flexibility or customization when looking at
potential risk factors. The only flexibility is determining which risk factors apply to the
country that is being studied. The method can only be applied to studies that focus on
country risk analysis. While this method is focused on country risk analysis the topic is
focused on financial decisions. While this is important and plays a role in risk analysis it
does not allow for great flexibility and does not provide examples for measuring country
risk not based on financial implications.
Compared to previous sources:
While this source was helpful and may be incorporated into my final project its
weaknesses and lack of credibility were major drawbacks for this source when compared
to others. Its inability to be used to look at issues specific to a country limits its
usefulness.
Other sources cited
No Other sources cited
Informative information
The information on the risk factors relating to country risk was informative, as was the
breakdown of factors based on economic, social, political and military factors. This
helped to see what area the source considered to have the most influence over risk.
Author
Michael Henry Bouchet. No position given, indicates affiliation with website
globalfinance.org
Source reliability
31.05. Medium – low credibility
V. Selip
Vince.selip@gmail.com
Mercyhurst College, Erie PA
Advanced Analytic Techniques Course
2/5/2011
Source Seven
Conducting a Risk Analysis
Marchany, Randy (2003) Conducting a Risk Analysis. Jossey-Bass Inc. Retrieved from:
http://net.educause.edu/ir/library/pdf/pub7008g.pdf
Risk Analysis
Purpose of article
The source is focused on conducting risk analysis by a process of determining assets, the
risk associated with those assets and how to limit the risk of the assets. It is important to
indentify and understand the assets related to your measurement.
Strengths
·
·
·
Illustrated matrix helpful in organizing information
Provides criteria for determining risk
Ranks assets based on importance
Weakness
·
·
Lacks detailed information on how to deter potential risk
Source indicates that group or committee needed to vote on each asset and to determine
risk
How to apply method
1.
2.
3.
4.
5.
6.
Identify Assets - Categorize as critical, essential or normal
Determining Risk – The article list four criteria for identifying risk. 1) it would be
extremely expensive 2) it would result in the loss of a critical service 3) it would result in
heavy, negative publicity 4) it had a high probability of occurring.
Weights can be applied to each risk factor for more accurate analysis
Map and rank order assets into a final matrix
Compute final score for each asset and add to matrix
Create a list of solutions or procedures to mitigate the risk for each asset listed in the
matrix
Method explanation
The method allows for many different types of measurements. Although the article
focuses on IT threats, the method is solid and can be used to determine risk for a variety
of topics. The article uses a committee to determine the assets and the risk levels, but
individuals or small groups can determine these on their own.
Compared to previous sources:
The section on how to determine risk was very helpful, this was an area where previous
sources were lacking. They didn’t give criteria to use to determine threat or risk levels
for individual risk factors.
Other sources cited
Jopeck, E “The Risk Assessment: Five Steps to Better Risk Management Decisions.”
Security Awareness Bulletin, 1997
National Infrastructure Protection Center. “Risk Management: An Essential Guide to
Protecting Critical Assets.”www.in.gov/c-tasc/whatsnew/risk_management11-02.pdf
Informative information
This source was very informative, it gave an excellent step-by step analysis of risk and
organized the information accurately.
Author
Randy Marchany – no position given
Source reliability
36.88 medium credibility
V. Selip
Vince.selip@gmail.com
Mercyhurst College, Erie PA
Advanced Analytic Techniques Course
2/12/2011
Annex 2. Analytic Question Data
Data
Iraq has continued its WMD
program and has chemical and
biological weapons. Iraq should
have enough fissile material for a
nuclear weapon by 2005 to
2007.
Poll taken prior to invasion
indicated that 1 in 3 Sunnis and
at 1 in 6 Shiites supported
attacks on U.S. troops
Chemical or biological weapons
attack on U.S. troops could
increase casualties by 10 to 20
percent
The exile groups that the U.S.
dealt with exaggerated their
influence in Iraq and failed to
prepare the U.S. for the lack of
Iraqi support for the invasion
U.S. is seen by some Muslims as
a vehicle for the corruption of
Muslim society. Muslims also
disagree with current and past
U.S. military deployments to the
region.
Data Date
Source Name
Estimated
Reliability
Data/Source
2002
http://www.fas.org/irp/ci
a/product/iraq-wmd.html
38.62
2006
http://www.comw.org/warreport/f
ulltext/0412cordesman.pdf
40.72
2002
http://www.brookings.edu/opinion
s/2002/0925iraq_ohanlon.aspx
39.62
2007
http://www.fas.org/sgp/crs/midea
st/RL31701.pdf
39.62
2001
http://fpc.state.gov/documents/or
ganization/7858.pdf
44.64
of
Other Comment
It is likely that terrorist groups
have tried to acquire WMDs.
However,
the
threat
is
overestimated that they will be
able to successfully execute an
attack involving WMDs.
2003
Pre-war intelligence stated that a
U.S. led invasion could increase
popular sympathy for terrorist
objectives
2004
Iraqis not complying with U.N.
Security Council requirements
regarding weapons inspections
2002
http://public.gettysburg.e
du/~dborock/courses/Spri
ng/intsec/docs/oneill_wmd.pdf
http://usatoday.printthis.
clickability.com/pt/cpt?act
ion=cpt&urlID=12059620
&partnerID=1660
http://articles.cnn.com/2
002-0802/politics/wh.iraqi.offer_
1_weapons-inspectorsunited-nations-and-iraqforeign-minister-najisabri?_s=PM:ALLPOLITIC
S
2008
http://www.ctc.usma.edu
/Iran_Iraq/CTC_Iran_Iraq
_Final.pdf
Evidence that Iran had been
supporting Shi’a forces in Iraq
prior to the U.S. invasion in 2003
39.62
44.26
37.46
44.26