Risk Metrics

Risk is best characterised using cumulative probability curves with the probability of failure and the consequences expressed quantitatively in measurable terms. However, given the inherent lack of data and limited analysis, risk is often expressed by a single value or in qualitative terms. It is very important to properly quantify risk because an invalid assessment could lead to an improper conclusion with misapplication of resources. Several methods commonly employed to assess risk and to determine the risk components are described below.

The most common quantitative measure of risk is the risk profile, which is defined as:

R(x) = probability that the magnitude of consequences will exceed x.

       = 1 - F(x) where F(x) is the cumulative probability distribution of consequences.

In practice, a variety of other semi-quantitative and qualitative metrics, including technical performance indicators, are used to support risk management.

Expected Value Model
A somewhat subjective, relative rating of risk is developed, where risk is expressed as:

Expected consequence = Probability of failure * Consequences of failure.

Pf is the probability of failure and Cf is a measure of the consequences of failure. Cf is assigned a value between 0.0 (negligible impact) and 1.0 (high/catastrophic impact). Risk then ranges between 0.0 (no risk) to 1.0 (high risk).

Risk Assessment Matrix Model
For communication purposes, it is often preferable to limit oneself to qualitative estimates of Pf and Cf rather than the arbitrary scales employed above. In this case we recommend use of the Risk Assessment Matrix. This Risk Assessment Matrix is reproduced in the table below. Risk is determined by its location in the matrix, which is established by the intersection of the row and column corresponding to the severity of the consequences and the associated probability.

The Risk Assessment Matrix has several attributes of merit:

• Risk increases with increasing probability of failure and the severity of the consequence of failure.

• Low probability of failure or low consequences of failure result in low to medium risk.

• It is consistent with the common notion of risk.

• It avoids the use of an arbitrary numerical scale.

Risk Assessment Matrix

Risk Profiles
The Expected Value and Risk Assessment Matrix models, however, are limited by the fact that a single number fails to fully capture the notion of risk. The single rating equates a low probability, high adverse outcome event with a high probability, low adverse outcome event. They to do not allow consideration of multiple outcomes with different probabilities and outcomes. Whenever possible risk should be characterised by its risk profile, which is defined as the probability that the magnitude of consequences will exceed a given value.

The generation of a risk profile involves quantifying the various outcomes and the associated probabilities. A major problem is the difficulty in obtaining adequate data. To illustrate the generation of a risk profile, consider the project to develop a light-weight, low-cost, and long-life power supply. The experts' assessment of the achievable performance given the technological options is summarised in the following table.

Achievable Performance vs. Technology Option