Using Probabilistic Risk Analysis to Improve Risk Management

Article excerpt

A FUNDAMENTAL PART OF GOOD RISK management is an effective analysis of exposures to accidental loss that estimates the chance of occurrence and the potential consequences. As the size and complexity of organizational exposures increase, it becomes more important for risk managers to implement formal structures for studying the potential of accidental loss. One very effective analysis technique that provides a strong framework for implementing a cogent risk management strategy is known as probabilistic risk analysis (PRA).

PRA techniques were first developed for use in the nuclear power industry, where exposures are particularly complex and carry severe consequences. Public concern over the potential effects of nuclear accidents has contributed to the industry's motivation to develop a refined body of sophisticated methods for conducting PRA and applying it to real-world situations.

The Nuclear Regulatory Commission (NRC) has long enlisted the aid of the national laboratories at Los Alamos, Oak Ridge and Brookhaven, as well as a variety of independent contractors, in establishing a probabilistic basis for the assessment and management of risk. The resulting studies, including many site-specific analyses, are available to the public as part of the commission's voluminous regulatory documents. The sophistication of efforts in the nuclear industry have made it the model for effective PRA.

PRA has also recently begun to figure prominently among manufacturers of safety-critical high-technology products. One example can be found in the aerospace industry. Federal aviation regulations now require the design of aircraft and components to adhere to strict probabilistic safety criteria, and evidence of compliance is often provided via PRA. Fearful flyers may gain some comfort in knowing that these regulations require that per-flight component failure probabilities be stricter than one chance in a billion.

The many PRA tools that have been developed through the years can be adapted to risk management applications in any industry where safety is a concern. As this article will show, an effective PRA effort does not have to be time-consuming or expensive. Risk managers can often benefit from simple "do-it-yourself" approaches.

PRA Basics

The first step in conducting a PRA is to assign probabilities to the various consequences that can arise from an exposure to accidental loss. Determining these probability-loss combinations is perhaps the most difficult task in any PRA. When sufficient data are available, statistical methods can be used to specify a probability distribution of losses. In most circumstances, historical experience can provide guidance about the frequency of losses, but severity data may require a greater degree of estimation.

The results of this analysis can be displayed in a graph that shows the dimension of probability on one axis and the potential consequences, usually expressed as monetary loss, on the other. Figure 1 shows a typical probability-loss graph. (Note that probabilities and losses are shown using logarithmic scales. This allows a more comprehensive analysis of a greater range of numbers than is possible with linear (i.e., 1,2,3,4 ...) scaling.) Negative exponents, which indicate division of the exponentiated number into 1, are used to represent numbers less than 1. For example, [10.sup.-2] indicates the value of 1 divided by 100 (10 to the second power) or .01--one chance in a hundred. Very small probabilities can be expressed using these exponents. The number [10.sup.-6], for example, represents one chance in a million.

When historical data on high-consequence events are limited, we can turn to a variety of techniques that separate an accidental loss sequence into its various components. This can be helpful when the probabilities of separate loss segments are available.

One such separation method is called an event tree. Event trees outline a loss scenario from its initial cause to the final outcome. …