Evaluating risk management options

The manager evaluating the possible options for dealing with a defined risk issue needs to consider many things:

• Is the risk assessment of sufficient quality to be relied upon?;

• How sensitive is the ranking of each option to model uncertainties?;

• What are the benefits relative to the costs associated with each risk management option?;

• Are there any secondary risks associated with a chosen risk management option?; and

• How practical will it be to execute the risk management option?

These questions are discussed more fully below.

Is the risk assessment of sufficient quality to be relied upon?

The quality of a risk analysis should be apparent from a well-written report. The analyst must discuss the strengths and weaknesses there of any model, including quantitative and structural assumptions. A risk analysis that does not look critically at its own weaknesses is of dubious quality.

How sensitive is the ranking of each option to model uncertainties?

We almost always would like to have better data, or greater certainty about the form of the problem. Essentially, we would like the distribution of what will happen in the future to be as narrow as possible. However, a decision-maker cannot wait indefinitely for better data and, from a decision-analytic point of view, may quickly reach the point where the best option has been determined and no further data (or perhaps only a very dramatic change in knowledge of the problem) will make another option preferable. This concept is known as decision-sensitivity. For example, in these plots, the decision-maker considers any output below a threshold T (shown with a dashed line) to be perfectly acceptable (perhaps this is a regulatory threshold or a budget).

The decision-maker would consider option A to be completely unacceptable, option C to be perfectly fine, and would only need more information about option B to be sure whether it was acceptable or not, despite all three having considerable uncertainty.

What are the benefits relative to the costs associated with each risk management option?

A decision maker must balance the reduction in risk afforded by various options against the costs of putting those options into action. There will always be limited resources to expend on managing risk: in theory spending anything less than the expected reduction of a risk's severity (its impacts weighted by their probability of occurrence) will, in the long-run, pay off. However, decision-makers rarely have the budget needed to do that and would have to put their complete faith in risk analyses.

A risk-return plot is one way to provide a graphical comparison between benefits and costs of different options.

Efficient risk management seeks to reduce the total burden of risk for a given amount of available resources. Efficiency can be improved if the manager can identify two or more risks that are controlled by the same risk management option. The manager also needs to consider whether any options may reduce one's flexibility to handle other risks in the future, and whether some options will affect one's ability to exploit opportunities.

Are there any secondary risks associated with a chosen risk management option?

Secondary risks are new risks that arise from the introduction of a risk management action. For example, one could decide to purchase some machinery based on tried and trusted technology, avoiding uncertainties associated with developing technology. However, as a result, one would be more exposed to risks like the availability in the future of spare parts, lack of flexibility or incompatibility with other emerging technologies.

Another example: one could make certain activities illegal (like prostitution, taking recreational drugs, etc.) which could reduce the incidence of this behaviour, but would also result in people who continued now hiding their activity, and possibly much greater health impact than that we were hoping to eliminate.

Secondary risks can, of course, be far more serious than the original risk we are hoping to manage. It is therefore extremely important that one does not just focus on a single risk and its control or elimination, but look at the world as it would be, in total, with and without that risk management option employed.

How practical will it be to execute the risk management option?

A risk management option may be fine in theory, but its application may prove impractical. For example, a regulator could decide that no antimicrobials will be used with pigs from now on, but if a farmer can easily get hold of the antimicrobial in cattle feed, the regulator may have simply pushed the problem underground. A regulator would therefore have to consider whether some option is enforceable from a legal and practical perspective, including whether the risk management effort would be sustainable.