Advanced Case Studies in Risk Management

Markus Porthin
Advanced Case Studies in Risk Management
Master’s thesis submitted in partial fulfilment of the requirements for the degree of Master of Science in Technology
Espoo, 2 August 2004
Supervisor: Professor Ahti Salo Instructor: Professor Ahti Salo
HELSINKI UNIVERSITY OF TECHNOLOGY ABSTRACT OF MASTER'S THESIS
DEPARTMENT OF ENGINEERING PHYSICS AND MATHEMATICS
Author: Markus Porthin
Department: Department of Engineering Physics and Mathematics
Major subject: Systems and Operations Research
Minor subject: Strategy and International Business
Title: Advanced Case Studies in Risk Management
Title in Swedish: Avancerade fallstudier i riskhantering
Chair: Mat-2 Applied Mathematics
Supervisor: Professor Ahti Salo
Instructor: Professor Ahti Salo
Abstract:
The word risk is used to describe a situation that involves a possibility of something undesired to happen. The systematic process of identifying, evaluating and reducing risks is usually referred to as risk management (RM). The forerunner applications of modern RM emerge from the military, nuclear power production and finance from where the methods have subsequently spread to every field where significant unwanted uncertainties exist. Although risk is pervasive, the methods and their usage depend on the context. Therefore, the case method is a powerful tool in teaching RM.
This thesis presents four educational RM case studies compiled by the author. The studies are aimed to show graduate students how some central RM methods may be used in practice and give insight in the general principles of RM. The whole process from risk identification to evaluation of implemented solutions is described. To give a multifaceted view, the cases include risk situations from different fields: poultry production, electricity retailing, mining and pension insurance business. Also a comparative analysis of the cases is conducted, where causal relationships between different properties are identified. Using the insight learnt from the cases, general guidelines and structural outlines concerning risk management are suggested.
A comparative analysis of the cases highlight that the RM method selection does not only depend on the modelling properties of the phenomena and the type of loss, but also on the traditions in each field. Seemingly different fields dealing with mathematically similar phenomena could gain from interaction and exchanging of methods. Based on the type of available information, rough guidelines for when to use frequentist, Bayesian or expert elicitation methods in probability assessments is drawn. The precautionary principle should be practised in cases with significant incertitude, where a formal risk assessment cannot be conducted. The comparative analysis supports also the intuitive assumption that the extent of governmental RM through regulations depends on the ubiquity and influence of the risk. The case studies can be found at http://www.sal.hut.fi/Web-Activities/RM/.
Number of pages: 57 Keywords: Risk Management, Case Study, Risk Measures, Comparative Analysis, Risk Management Process
Department fills
Approved: Library code:
i
TEKNISKA HÖGSKOLAN SAMMANDRAG AV DIPLOMARBETE
AVDELNINGEN FÖR TEKNISK FYSIK OCH MATEMATIK
Utfört av: Markus Porthin
Avdelning: Avdelningen för teknisk fysik och matematik
Huvudämne: System- och operationsanalys
Biämne: Företagsstrategi och internationell marknadsföring
Arbetets namn: Avancerade fallstudier i riskhantering
Title in English: Advanced Case Studies in Risk Management
Professur: Mat-2 Tillämpad matematik
Övervakare: Professor Ahti Salo
Handledare: Professor Ahti Salo
Sammandrag:
Ordet risk används för att beskriva en situation med möjliga oönskade följder. Den systematiska processen som består av identifiering, evaluering och reducering av risker kallas vanligen för riskhantering. De första tillämpningarna av modern riskhantering härstammar från armén, kärnkraftsproduktionen och finansvärlden varifrån metoderna numera har spridit sig till alla områden var betydande oönskad osäkerhet förekommer. Fastän risker finns överallt, beror metodvalet och tillämpningarna på sammanhanget. Därför är fallstudier ett ypperligt sätt att lära riskhantering.
Detta diplomarbete presenterar fyra undervisningsfallstudier sammansatta av skribenten. Syftet var att visa för universitetsstuderande, hur vissa centrala riskhanteringsmetoder kan användas i praktiken samt ge en inblick i riskhanteringens allmänna principer. Hela processen från riskidentifiering till utvärdering av implementerade tillvägagångssätt beskrivs. För att ge en mångsidig syn, behandlas exempel från olika områden: hönsproduktion, återförsäljning av elektricitet, gruvverksamhet och pensionsförsäkring. En jämförande analys av exemplen utförs, var kausalförhållanden mellan olika egenskaper identifieras. Utgående från exemplen föreslås riktlinjer och grunddrag för riskhantering.
En jämförande analys av fallstudierna visar att valet av riskhanteringsmetod inte enbart beror på fenomenets egenskaper och förlusttyp utan också på traditionerna inom branschen. Till synes olika områden, som handskas med matematiskt sett liknande fenomen, kunde dra nytta av växelverkan och utbyte av metoder. Utgående från typen av tillgänglig information, dras grova riktlinjer för tillämpandet av frekvens-, Bayes- och expertelicitationsmetoder för bestämmandet av sannolikheter. I fall med betydande oklarhet kan en formell riskbedömning inte utföras, utan då bör försiktighetsprincipen tillämpas. Den jämförande analysen stöder även det intuitiva antagandet, att graden av statlig riskhantering genom reglering beror på riskens utbredning och influensgrupper. Fallstudierna finns på WWW-sidan http://www.sal.hut.fi/Web-Activities/RM/.
Sidoantal: 57 Nyckelord: riskhantering, fallstudie, riskmått, jämförande analys, riskhanteringsprocess
Ifylles på avdelningen
Godkänd: Bibliotek:
ii
Preface
This work was carried out at the Systems Analysis Laboratory at Helsinki University of Technology. I thank Professor Ahti Salo, my instructor and supervisor, for guidance and invaluable feedback throughout the writing of this thesis. I am also grateful to Research Professor Urho Pulkkinen at VTT Technical Research Centre of Finland, who put his expertise on risk analysis at my disposal. I thank the whole personnel at the Systems Analysis Laboratory for a great working atmosphere.
I thank Ph.D. Jukka Ranta and Professor Riitta Maijala at the National Veterinary and Food Research Institute for sharing their time and giving me further insight in the National Salmonella Control Programme.
Most of all, I wish to thank my fiancée Elina Karp, who helped me in many ways. Discussions with her cleared up my thoughts during the writing and she kindly proofread the thesis. I am grateful for her love and support as well as patience and understanding although the final revisions of the manuscript took time from our wedding preparations.
Helsinki, 2 August 2004.
Markus Porthin
iii
Table of Contents
Preface.............................................................................................................................................iii
1 Introduction...........................................................................................................................1
1.1 Background..................................................................................................................1
1.2 Objectives of the Thesis.............................................................................................2
1.3 The Case Method in Teaching Risk Management.................................................2
1.4 Structure of the Study.................................................................................................4
2 Risk..........................................................................................................................................5
2.1 Definitions of Risk......................................................................................................5
2.2 Risk Measures..............................................................................................................6
2.2.1 Qualitative measures..........................................................................................6
2.2.2 Quantitative measures.......................................................................................7
2.3 Risk Analysis and Risk Management......................................................................10
2.4 Risk Management in Different Fields....................................................................13
2.4.1 Finance..............................................................................................................13
2.4.2 Process Industry...............................................................................................13
2.4.3 Insurance...........................................................................................................14
2.4.4 Society and Foresight......................................................................................14
2.4.5 Environment and Health................................................................................14
3 Case Studies.........................................................................................................................16
3.1 Salmonella Case.........................................................................................................17
3.1.1 Background.......................................................................................................17
3.1.2 Risk Assessment Model..................................................................................19
3.1.3 Risk Management Process..............................................................................20
3.1.4 Lessons from the Case....................................................................................22
3.2 Electricity Retailer Case............................................................................................23
3.2.1 Background.......................................................................................................23
3.2.2 Value Tree Framework....................................................................................24
3.2.3 Risk Management Process..............................................................................26
3.2.4 Lessons from the Case....................................................................................27
3.3 Mining Case...............................................................................................................28
3.3.1 Background.......................................................................................................28
3.3.2 Safety Assessment of Air Recirculation System..........................................29
3.3.3 Risk Management Process..............................................................................31
3.3.4 Lessons from the Case....................................................................................33
3.4 Pension Insurance Case...........................................................................................34
3.4.1 Background.......................................................................................................34
3.4.2 Main Risks of a Pension Insurance Company.............................................35
3.4.3 Stochastic Programming Model for Asset Liability Management............37 iv
3.4.4 Lessons from the Case....................................................................................37
4 Comparative Analysis of the Cases..................................................................................40
4.1 Risk Influence and Decision Makers......................................................................40
4.2 Type of Loss..............................................................................................................42
4.3 Modelling of Probabilities and Interrelationships................................................42
4.4 Guidelines for Selection of Probability Assessment Method.............................45
4.5 Types of Risk Management Decisions...................................................................46
5 Conclusions.........................................................................................................................49
6 References...........................................................................................................................51
7 Web References..................................................................................................................57
v
1 Introduction
1.1 Background
The word risk is used to describe a situation that involves a possibility of something undesired to happen. The systematic process of identifying, evaluating and reducing risks is usually referred to as risk management (RM). It is natural for people to worry, but managing risks was for a long time considered to be beyond the power of mankind and only in the hands of the gods. However, one form of RM, insurances, has been practised for thousands of years. The earliest known references of a primitive version of marine insurances date back beyond the 18th century BC. Also farmers set up cooperatives to insure one another against bad weather. In 1473, a bank in Italy called Monte Dei Paschi was set up to serve as an intermediary for such arrangements. Perhaps the most famous market place for insurances was Edward Lloyd’s coffee house in London, opened in 1687. There marine insurances gained momentum and soon one could also get insurance policies against almost any kind of risk, including house-breaking and death by gin-drinking. From mid 17th to mid 18th century, the concept of probability and its primary properties, the main foundations in risk management, were developed. (Bernstein, 1996)
Modern risk management started evolving after the Second World War on two different fields: insurance buying as well as reliability and safety engineering. These fields grew side by side for decades with very little interaction (Williams et al., 1998). The lack of interaction can partly be explained by the organisational structure of most businesses and governments and the different background of the parties; the technically oriented specialists did not understand the financially oriented ones, and vice versa. At first, the main duty of the financially oriented corporate insurance buyers was placement and management of organisations’ insurance portfolios. Later other means of coping with financial uncertainties, such as self-insurance and different loss prevention activities, have diminished the relative importance of insurances. The first tasks of reliability and safety engineering were to increase reliability and reduce maintenance costs of military equipment (Andrews and Moss, 2002). In the 1970’s the nuclear power industry became a significant field of application. Later on reliability engineering has been widely used in process industries.
1
Today risk management on the reliability and financial fields are seen as two parts of the same problem: reducing undesired uncertainty. Other fields of RM include e.g. vaccination decisions, legislation on gene manipulated food and software design. A current challenge is to study all risk factors in an organisation as a whole and manage those using suitable methods from all available fields (Räikkönen, 2002; Räikkönen and Rouhiainen, 2003). This demands a holistic approach in studying risks.
1.2 Objectives of the Thesis
This thesis presents four pedagogical risk management case studies compiled by the author for use at Systems Analysis Laboratory at Helsinki University of Technology. The studies are narratives that tell how certain risks are managed in the examples. The purpose of the cases is not to serve as a tutorial, but rather to show how some risk management methods may be used in practice and to give insight to the general principles of risk management. The studies are meant to describe the whole risk management process from risk identification to the evaluation of implemented solutions. The cases are chosen from different fields in order to give a multifaceted overview of RM.
A comparative analysis of the case studies is also conducted. The objectives of the analysis are to find similarities and dissimilarities from the cases and to deliberate upon their causes as well as to identify causal relationships between different properties of the cases. Using the insight from the cases, some general guidelines and structural outlines concerning RM are also suggested.
1.3 The Case Method in Teaching Risk Management
Educational case studies are narratives that are rooted in real events and centre on key issues of the topic at hand (Wassermann, 1994). The purpose of a case study is to introduce realistic situations to the student. This method was first used at Harvard Law School in 1870 and became subsequently a common teaching method in law, business and medicine (Garvin, 2003). A widely used type of case studies includes an introduction to the case context followed by a decision situation or dilemma to be solved by the students. Other case studies are finished
2
stories that either describe a major failure and try to deliberate upon what should have been done, or tell a success story presenting good or even best practice.
The main advantage of the case method compared to traditional teaching methods is that it concretises the topic by putting it into a context. Thus, the student gets a better picture of how the discussed methods are used in practice and learns how to grapple with messy real-life problems (Herreid, 1994). This gives the student a deeper understanding about the problem. The disadvantages of case studies are also strongly linked to the presence of a context. Sceptics claim that case studies are too bound to the context, making the lessons learned hard to generalise. In addition, case studies do not necessarily communicate the big picture of the field of study, but rather give a detailed description of a particular problem. Furthermore, case-specific information is needed for a study to come to life, which may not be of any general interest.
Books with case studies in risk management have been published e.g. by Greene (1983) and the Risk and Insurance Management Society Staff (1988). In 1997, the University of Calgary1 made a selection of these cases available on the World Wide Web in html-format. These 14 case studies cover different fields from capital budgeting and loss control to crisis management and earth movement. The cases are short narratives of the risky situation of a company or organisation followed by a set of questions for discussion. Most of the cases leave the end of the story unfinished and pose questions that help the students to find a solution to the problem. Philippe Jorion, the author of the book Value at Risk (Jorion, 2001), has published on his WWW home page a case study about Orange County, which lost $1.6 billion on the financial market, and describes how the losses might have been avoided using Value at Risk2 (VaR). He describes the setting that resulted in the huge loss and asks the reader to do various VaR-related calculations based on the case information.
Studies of major failures can be found on the WWW, e.g. concerning losses on the financial market3 and unsuccessful projects4. There exist also comprehensive collections of case studies for management education5, which include a number of
1 http://www.ucalgary.ca/MG/inrm/Teaching/Cases/case_idx.htm, visited 19.03.2004.
2 http://www.gsm.uci.edu/~jorion/oc/case.html, visited 22.03.2004.
3 http://riskinstitute.ch/Introduction.htm, visited 22.03.2004.
4 http://www.ramprisk.com/riskknowledge/allcasestudies.asp, visited 22.03.2004.
5 e.g. http://www.ecch.cranfield.ac.uk/, visited 22.03.2004.
3
risk management cases, mostly from the financial field. The studies are supplied by well-known business schools, such as Harvard Business School, The Richard Ivey School of Business and INSEAD, and are available subject to a fee. The current trend of increasing use of case studies in education can be seen in the related fields of operations research / management science, too. There are recent examples of case studies on e.g. police patrol car allocation (Rump, 2002), decision analysis and dynamic programming (Rump, 2001) and optimisation of brewery location and capacity expansion decisions (Koksalan and Salman, 2003).
1.4 Structure of the Study
The reminder of this thesis is structured as follows. Chapter 2 introduces some key concepts in risk management. Different measures and definitions of risk are introduced as well as the steps of the risk management process. A classification of risk management decisions and key characteristics of different application fields are also discussed. Chapter 3 presents four educational case studies, prepared to give examples on the risk management practices on different fields. The studies shed some light on the methods used in poultry production, electricity retailing, mining and pension insurance companies. In Chapter 4, a comparative analysis of the cases is conducted. Dissimilarities and their possible causes are identified and some general guidelines are drawn. Finally, in Chapter 5, the thesis is summarised and concluded. Future prospects of risk management are also discussed.
4
2 Risk
2.1 Definitions of Risk
In colloquial language the word “risk” refers to the possibility of something undesirable to happen (Rowe, 1977). The critical words in the sentence describing the nature of risk are “possibility” and “undesired”. In the literature, there coexist two parallel definitions of risk:
Definition 2.1a Risk is an uncertain situation with possible negative outcomes. (See e.g. (Rescher, 1983))
Definition 2.1b Risk is the potential variation in outcomes. The variation can be either positive (upside risk) or negative (downside risk) (Williams et al., 1998)
Definition 2.1b is mainly used in finance, where both positive and negative positions in securities are possible. In other fields, definition 2.1a is more common. In this thesis definition 2.1a will be used.
Risks exist irrespective of whether one is aware of them or not. If a person puts himself under risk due to a conscious action, he is taking a risk. A situation where no clear action is involved is referred to as being under risk. Risks can also be categorised based on by whom the risk is caused and whom it affects. Nicholas Rescher (1983) identifies four cases (see Table 1). He calls people under risk for “maleficiaries”, a negative analogue to beneficiaries. In the first case a person puts himself under risk, e.g. by smoking cigarettes. By his action he increases risk for lung cancer. However, if there are people in the vicinity of the smoker, so called passive smokers, the risk is both self- and other-directed (case 2). More non-standard cases include a person putting others under risk (case 3) and the circumstantial case (case 4), where no clear agent is present.
5
Table 1 Risk as classified based on agency (Rescher, 1983).
The definition of risk may be expanded to include the annoyance of foregoing the occurrence of something good. This is called inverted risk or potential regret and occurs wherever there are potentially lost opportunities (Rescher, 1983). E.g. a person participating free of charge in a lottery risks not to win. This conception of inverted risk broadens the set of situations that involve risk to all situations with uncertain outcomes.
2.2 Risk Measures
The risk definitions are of little use when comparing and measuring risks. Therefore, several risk measures have been developed, most of them being a function of a probability measure and a loss measure. A requirement for using most risk measures is that the potential loss is quantifiable and projectable on a one-dimensional scale. In order to make different types of losses comparable e.g. value-tree methods can be used. Next a short summary of the most common risk measures is presented.
2.2.1 Qualitative measures
The severity of a risk can be quantitatively assessed by mapping the risk on a risk matrix according to (i) the value of the negativity of the outcome and (ii) its probability (or frequency of occurrence), see Figure 1. The closer to the upper right corner the risk is situated, the more critical it is. This is a good tool in risk identification for a quick overview of risks and in order to determine which to
6
focus on in further analyses. From this graphical point of view, risk management can be seen as striving to move risks towards the lower left corner by lowering the probability of the undesired outcomes and/or lowering the severity of their consequences. Instead of representing a risk by only one point on the risk matrix, a curve can be drawn. The F-N, or Farmer, curves were introduced by Reg Farmer in 1967 (Farmer, 1967). The most common improved version of these plots F(C) against C, where F(C) is the frequency of events with consequences greater than or equal to C (Ballard, 1993). The use of the curves is often convenient, because many risky situations might result in variably severe consequences and usually the less critical ones are more probable. ConsequenceProbabilityCriticalSeriousModerateMinorNegligibleLowHighLowHigh
Figure 1 Risk matrix.
2.2.2 Quantitative measures
One of the most basic risk measures is the expected loss. In this method, the potential consequences, losses, of the undesired events and their probabilities are quantified. The expected value of the loss is calculated based on this information.
Definition 2.2 Let L∈ℜ be a stochastic variable denoting loss. Expected loss is the expected value of L:
7
Expected loss()EL=
L may be either continuous or discrete, depending on the nature of the potential losses. The expected loss is usually used only if no positive outcomes are possible. Otherwise, possible gains could make the measure to zero or negative in cases that most people, however, consider risky. The measure is most commonly used in cases where only one possible loss is considered and the expected loss is calculated simply by multiplying the loss by its probability.
The expected lost utility is an extension of the expected loss, where potential losses are not considered as such but rather their utility.
Definition 2.3 Let L∈ℜn be a stochastic variable denoting loss and U: ℜn → ℜ a utility function. Expected lost utility is the expected value of U(L):
Expected lost utility(())EUL=
Due to the utility function (von Neumann and Morgenstern, 1944; Bunn, 1984), the decision maker’s attitude towards risks is included. Thus the measure is subjective containing the decision maker’s view. For those seeking an objective risk measure, this is obviously a drawback. As one could expect, another problem is to find a proper utility function. A slightly different point of view can be gained by transforming the expected loss and expected lost utility as risk per time unit.
Often risk lies in the uncertainty of a numerical quantity’s future value. A common example is the share prices on a stock market. When prices are modelled as stochastic variables, the variance or standard deviation is a natural measure of fluctuation.
Definition 2.4 Let Y∈ℜ be a stochastic variable, f(y) and E(Y) its density function and expected value respectively. The variance σ2 and standard deviation σ of Y are: 22(())(),yEYfydy 2 σσσ∞−∞=−=∫
These measures account for both negative and positive deviations from the expected value and thus treat risk in the manner of the risk definition 2.1b. The variance is usually estimated from data using the maximum likelihood estimator
8
(see e.g. Milton and Arnold, 2002). On the stock market, the standard deviation of a market rate is called volatility and is usually reported in percents of the market rate value.
Value at Risk (VaR) was introduced in the early 1990’s as a tool for measuring financial risks (Jorion, 2001). VaR measures how low the value of a portfolio could fall over a given time at a given confidence level, see Figure 2 (Crouhy et al., 2001; Jauri, 1997). For example, if the daily VaR of a portfolio is 100 000 € at the 99 % confidence level, there is only 1 % chance that the portfolio will fall more than 100 000 € during the day. In other words, such an event will occur in average once in 100 days. VaR can be calculated either relative to the initial value of the portfolio, as in the example, or relative to its expected value (Jorion, 2001). The former is called absolute VaR, the latter relative VaR. In the following definition the more common relative VaR is used.
Definition 2.5 Relative Value at Risk measures the maximum loss in portfolio value over a target horizon T with a given level of confidence 1-α:
**101(,)E()()VaRTWWWRαααμ−−=−=−−,
where W0 is the initial value of a portfolio, E(W) and W1-α* its expected and lowest value at confidence level 1-α after time T respectively. R1-α* and μ are the corresponding lowest and expected returns. αf(x)VaR(α)(1 -α)
Figure 2 Value at Risk.
9
Denoting the relative portfolio value after time T as X = W – E(W) and its probability density function f(x), the relative VaR at the 1-α confidence level can be defined as
()()VaRfxdxαα−−∞=∫.
Several modifications and extensions to the VaR measure have been developed. One of the most promising is the conditional Var (CVaR), which is defined as the expected value of the portfolio, given that the loss exceeds the VaR (Rockafellar and Uryasev , 2000; Rockafellar and Uryasev, 2002; Uryasev, 2000). In contrast to VaR, CVaR is a coherent measure of risk and has shown to be very useful in portfolio optimisation.
2.3 Risk Analysis and Risk Management
Risk management is an activity identifying existing and threatening risks, estimating their impacts and taking appropriate measures to reduce or hedge the risks (Pausenberger and Nassauer, 2000). However, also other definitions exist. Often RM refers only to the management decisions aimed at reducing risk (Lonka et al., 2002; Haimes, 1998). The risk management process can be divided into five steps6 (Suominen, 2000) (see Figure 3). First, risks are identified and evaluated, which is often referred to as risk analysis. Then, potential methods for reducing risk are developed and evaluated. When all the needed information is gathered, informed RM decisions can be made. Finally, the iterative process concludes by evaluation of the implemented solutions. In practice, the steps are seldom isolated, but may be dealt with simultaneously due to overlapping activities.
6 This is merely one of many divisions suggested in literature. For slightly differing examples see e.g. (Haimes, 1998), (Pausenberger and Nassauer, 2000), (Rowe, 1977), (Lonka et al., 2002) or (Weber and Liekweg, 2000).
10
Risk identificationRisk identificationRisk evaluation (probability & consequence)Risk Development and evaluation of RM methodsDevelopment methodsRM decisionsRM decisionsEvaluation of implemented RM solutionsEvaluation solutionsRisk analysis
Figure 3 The risk management process.
The purpose of the first RM step is to identify all relevant risks of the situation under study. There are several techniques available to aid the process. To identify different risks and to visualise which are already known and properly managed a risk window may be used (Suominen, 2000). Identifying methods used in the process industries include e.g. hazard and operability study (HazOp) as well as failure mode and effect analysis (FMEA) (see e.g. Andrews and Moss, 2002). When a tentative list of potential risks is gathered, the risks are screened in order to decide which ones may be neglected and which should be further analysed.
In the second step of the RM process, risk evaluation, the probability of occurrence and consequences of the relevant risks are assessed. This involves usually utilisation of models describing the dependencies of the uncertainties and analysis methods such as simulation.
When risks are known, appropriate managing measures must be chosen. Often the effect of different potential RM methods can be evaluated using the same models as in the risk evaluation steps and, therefore, these activities are interlinked.
11
Different risk management decisions may be categorised as follows (Suominen, 2000; Weber and Liekweg, 2000):
1. Avoid. Avoidance of risks is a simple means of risk management. It means e.g. not to accept a risky transaction, not to develop a new product, not to travel or not to use a certain product or method. The suitability of this measure must be carefully considered before applying, although it is noticeable that avoiding does not always increase costs or reduce possibilities. If avoidance is, however, not possible or wise, other RM-means must be considered.
2. Accept. Sometimes it is advisable to accept risks as they are. This is the case when a risk is a part of the core function of the organisation and the opportunities overweigh the risks. It is also the most efficient strategy for very insignificant risks. Large organisations may practice self-insurance; e.g. in Finland, the state does not have theft insurance for its property, because insurance policies would be more expensive than paying for the losses.
3. Compensate. Risks may be compensated, or hedged, by taking one risk to offset another. This is a common method in finance for reducing exposure e.g. to fluctuations in exchange or interest rates and is realised by trading derivative instruments such as futures.
4. Transfer. Risk can be transferred to another party through insurances or by making a contract with a non-insurance party. This is a common procedure when dealing with transportation risks, but also as a part of agreements for strategic alliances.
5. Reduction. These measures seek to reduce the probability of an undesired event or limit its impact. There are various methods and technical means available, e.g. firewalls, backups, guarding, developing standard operation procedures and control mechanisms, setting risk limits (especially in treasury/finance).
After the RM decisions are set into practise, they must be followed-up in order to determine their appropriateness and cost-efficiency.
12
2.4 Risk Management in Different Fields
In this section a brief description of five application fields of risk management is presented. The key characteristics of the risks in each field are identified as well as the most common methods used. The section concludes with a summarising table (Table 2).
2.4.1 Finance
Financial risks are easy to handle in the respect that the losses are usually well defined with money as the obvious performance measure, which makes risks commensurable and easy to valuate. The performance measure is in general modelled as a one-dimensional real-valued stochastic variable X. The risk analysis methods are based on finding a good estimate of its probability distribution in one way or another and identifying which factors influence the distribution and how. Widely used risk measures include distribution characteristics, such as the standard deviation (or volatility) and low-end quantiles i.e. Value at Risk and other “worst case” measures. Another group of risk measures is the sensitivity measures, also called “the Greeks” (because they are denoted using the Greek alphabet) (Melnikov, 2004). They are partial derivatives of the portfolio value in respect to some market parameter (e.g. stock market index, prize of underlying asset, volatility, interest rate, time). The probabilities are estimated using e.g. historical data, time series or Monte Carlo simulations.
2.4.2 Process Industry
In process industry, risk management has traditionally focused on considering the probability of specific events or accidents. Analysts may be interested e.g. in the probability of the overheating of a nuclear reactor or fire detection system dysfunction. The severities of different undesired events are not necessarily compared. In the most important field of application, the nuclear power industry, probabilistic safety assessments (PSA) have been conducted since the 1970’s (NEA, 1992). The PSA is a comprehensive, structured approach to identifying failure scenarios and constituting a conceptual and mathematical tool for deriving numerical estimates of risk.
The systems in process industry are usually well defined, enabling the development of sophisticated analysis tools. There are several methods for identifying critical events or chains of events, e.g. failure mode and effect analysis (FMEA), Hazard
13
and Operability study (HazOp) and reaction matrix, to mention only a few (Andrews and Moss, 2002). Methods for assessing the probability of an event and the effect of potential actions include fault tree and event tree analysis. Also several component importance measures (e.g. Birnbaum’s, Vesely-Fussell’s) can be useful in trying to improve the reliability of a system (Andrews and Moss, 2002).
2.4.3 Insurance
Insurance is an old way of securing oneself against risk and is based on sharing the total losses among a large number of policyholders. In this way everyone pays a share of the losses and no one has to suffer unbearable loss. The philosophy assumes that the losses can be compensated with money. Although this assumption often is justified, it may be argued whether money can cover the damage of death or physical injuries. The prising of insurances is based on the average damage compensations, risk margins, administration costs and contribution margins. The insurance brokers do risk studies to find out the risk profile of the customers in order to be able to offer right insurances. Accident probabilities are estimated using statistical information.
2.4.4 Society and Foresight
Risks threatening the society in the future are often characterised by high incertitude and indefinability. Sometimes we just do not know what we do not know. Because of the unpredictability of the problem, often no sophisticated scientific analyses are possible. Thus, the studies must rely on different future scenarios and expert opinions, which in general are nothing more than good guesses or pure speculations. The risks can be tackled by conducting scenario analyses and practising the precautionary principle.
2.4.5 Environment and Health
Environmental and health risks include spreading diseases, environmental impacts of human activities and changes in the ecosystem. Due to the characteristics of the risks, usually the whole population of a region is exposed and thus the risk management is handled by governments and supported by civic organisations. The analysis tools are based on attempts to model the causal relationships of the phenomena. Examples of these are models for spreading of diseases, and different population and biosystem models.
14
Environment and
health
Everyone exposed
E.g. spreading diseases, environmental impacts of human activities, changes in the ecosystem
Biosystem models Society and foresight
High incertitude
Causal relationships poorly known
Expert elicitation methods
Scenario analysis
Precautionary principle
Insurance
Loss shared among policyholders
Loss compensated with money
Risk profiles
Statistical records
Process industry
Probabilities of specific events considered
Severity of events not necessarily compared
Systems well defined
Identification methods (FMEA, HazOp, reaction matrix…)
Probability estimation (fault tree, event tree…)
Finance
Well defined performance measure (money)
Commensurability and comparison of risks easy
Probability distribution characteristics (volatility, VaR…)
Sensitivity measures (“Greeks”)
Application field
Risk characteristics
Methods
Table 2 Risk characteristics and common risk management methods in different fields.
15
3 Case Studies
This chapter presents four RM case studies compiled by the author based on articles and publications. The studies are developed to show examples of RM in practice, the target group being graduate students. The emphasis is rather on giving practical examples of the use of RM methods in different contexts than trying to build a proper method tutorial.
To enlighten different views of RM, a cross-section of application fields is chosen. The cases shed some light on the methods used in finance, process industry, insurance and health. Although the cases are quite different from each other, they all have the common basic idea of monitoring and managing unwanted risks. To support the learning process, the cases are worked into a concise but self-contained bullet-point format. Comparison of approaches is easy thanks to the common structure of the case studies.
The cases can be utilised both on introductory and more advanced courses. Students, who are already familiar with the discussed methods, can attend an advanced course in RM or read the cases independently without supervision to obtain a better picture of how the methods are used in practice and which RM steps need to be carried out. An independent study should take approximately 2 – 4 hours per case study. The cases can also be used in teaching RM methods in class, either by introducing the methods through the cases together with the basics of the methods, or serving as motivating application examples. One case study is estimated to require 90 minutes of lecture time. The cases give also a general picture of how risks are managed in different fields and which parties are involved in the process.
Depending on the way of use, students with different backgrounds may profit from the cases. Basic probability theory and an idea of the key RM concepts give enough background knowledge, if the cases are complemented with information about the methods used. However, when a higher level of understanding is pursued, a broader knowledge background is needed. In the salmonella case, prior experience on Bayesian analysis and Monte Carlo simulation is recommended. The electricity case deals with financial risk measures and value tree analysis, and the
16
mining one with fault tree analysis and importance measures. To profit the most from the pension insurance case, knowledge about portfolio theory, optimisation and time series are helpful.
After finishing a case study, the student should have a better picture of which risks are present in the discussed field, how they are managed, which concrete actions the RM process requires and which parties are involved. The student should have improved his knowledge about the discussed methods. By studying all four cases, the student gets an overall view of the application fields and methods of RM and sees different realisations of the RM process. The student can identify which steps the RM process requires and gains thus insight into how to approach an RM problem. He learns which details are relevant and how to choose analysis methods. With this insight, he will be better prepared if carrying out similar analyses in practice.
The studies, as well as an introduction to the key concepts of RM, can be found in pdf-format in the WWW at http://www.sal.hut.fi/Web-Activities/RM/.
3.1 Salmonella Case
3.1.1 Background
The salmonella case describes some of the RM procedures undertaken in Finland during 1995 – 2001 in order to monitor and reduce the risk of human salmonella infections transmitted from poultry. Salmonella is a contagious bacterium that can cause infection via food, animals or the environment (Ranta and Maijala, 2002). A salmonella infection causes serious sickness, but can be treated by drugs. Fatal cases are nowadays unusual.
The responsible regulating authority for food production in Finland is the Ministry of Agriculture and Forestry. In 1995, it set a National Salmonella Control Programme to limit the number of human salmonella infections obtained from food. Two of the main interventions of the programme concerning the broiler production were (i) removal of detected salmonella positive breeding flocks from the production chain and (ii) heat treatment of the meat from salmonella positive broiler flocks (Maijala and Ranta, 2004). Without making any formal research,
17
these interventions were assumed to keep the salmonella prevalence on an acceptable level.
Table 3 Main properties of the salmonella case study.
Application field
Salmonella prevalence in the poultry production chain and transmission to humans.
Decision maker
The Finnish Ministry of Agriculture and Forestry
Additional stakeholders
Poultry producers
Consumers
Causes for starting the study
Evaluation of implemented intervention program needed:
1) Examination of effect and appropriateness of the program
2) Political justification of decisions (government, EU)
3) Research interest
Methodology
Bayesian probabilistic inference model, MCMC sampling
Also (not covered in the study): Monte Carlo simulation, cost-benefit analysis
This study describes the actions made to examine the effect and appropriateness of the intervention program. From a political point of view the research was needed for justifying the programme, which was stricter than required by the European Union. Another motivation is pure research interest. The intervention program was evaluated by the Department of Risk Assessment at the National Veterinary and Food Research Institute (EELA) on the demand of the Ministry. The main components of the evaluation include a human health impact analysis, cost-benefit analysis (Kangas et al., 2003) and a probability model of salmonella transmission from broiler grandparents to consumers in Finland (Ranta and Maijala, 2002; Maijala and Ranta, 2004). To keep the case study within reasonable
18
length, but still maintaining a detailed level, the focus is directed to the first part of the probability model, the Primary Production Inference Model, handling the other parts on a very general level. The main properties of the case context are summarised in Table 3.
3.1.2 Risk Assessment Model
The risk assessment model of salmonella in the broiler production chain consists of three parts: (i) the Primary Production Inference Model (PPIM), (ii) the Secondary Production Simulation Model (SPSM) and (iii) the Consumption Inference Model (CIM), see Figure 4 (Maijala and Ranta, 2004). The PPIM models salmonella prevalence in the production chain from grandparent breeder flocks to production broilers ready for slaughtering. The model is based on Bayesian inference and enables assessment of the direct effects of removal of detected salmonella-positive breeder flocks. The case study focuses on this part of the risk model. The SPSM models salmonella prevalence in the secondary production chain from slaughtering to ready food products and takes into account possible heat treatment of salmonella-positive meat. This part is based on Monte Carlo simulation. To find the eventual human salmonella cases a consumption model using Bayesian inference was created. Consumption Inference Model (CIM)Human casesPrimary Production Inference Model (PPIM)Removal of detected positive breeder flocksSecondary Production Simulation Model (SPSM)Heat treatment
Figure 4 The basic structure of the risk assessment model of salmonella in the broiler production chain. Modelled interventions are indicated with shaded boxes. (Maijala and Ranta, 2004)
19
A simplified presentation of the PPIM is showed in Figure 5. It describes salmonella prevalence in grandparent, parent and production broiler flocks and takes into account both vertical and horizontal transmissions as well as persisting infections within a flock. The parameters and prior distributions of the probabilistic inference model were assessed using available data and expert opinions. Probability distributions of salmonella prevalence in production broilers were calculated under different scenarios. The quantitative results show that removal of detected salmonella positive breeder flocks from the production chain significantly reduces the salmonella prevalence of the production broilers. All in all, the whole salmonella risk model indicates that a combination of both removing of salmonella positive breeding flocks and heat treatment of contaminated meat provides the best protection against human infections. Grand-parentParentProd. broilerhorizontal transmission (h)vertical transmission (v2)vertical transmission (v3)horizontal transmission (h)horizontal transmission (h3)persisting infection (η)persisting infection (η)environmentpersonnelfeeding stuffsetc.
parentGrand-parentParentParentProd. broilerProd. Figure 5 A simplified presentation of the PPIM. The PPIM models salmonella prevalence in grandparent, parent and production broiler flocks. Both vertical and horizontal transmissions are taken into account as well as persisting infections within a flock.
3.1.3 Risk Management Process
The steps of the risk management process in the salmonella case are summarised in Table 4. The whole case can be considered as an evaluation of implemented RM solutions, the last step in the iterative RM process. The primary risk covered in the study is the risk of human salmonella infections transmitted via broiler meat. The infection probability was evaluated under several scenarios using the transmission
20
model presented in the previous chapter and the effects of two intervention procedures were assessed. The health impacts of human infections and their monetary expenses were evaluated in separate studies.
Table 4 The risk management process of the salmonella case.
Risk identification
Risk of human salmonella infections from broiler meat and monetary loss for producers.
Risk evaluation – probability
Salmonella prevalence and transmission with and without intervention program modelled using Bayesian inference and Monte Carlo simulation models. Model parameters and prior distributions assessed using available data and expert opinions. Computations with WinBUGS software, which is based on Markov Chain Monte Carlo (MCMC) simulation, Matlab and @RISK (Monte Carlo simulation).
Risk evaluation – consequence
Analysis of health impacts due to human salmonella infections (not covered in the case study).
Cost and benefit analysis (not covered in the case study).
Development and evaluation of RM methods
Analysis of the effects of two interventions on salmonella prevalence in the poultry production chain and on the number of infected humans. Interventions:
1) Removal of detected salmonella-positive breeding flocks.
2) Heat treatment of contaminated broiler meat. (Not covered in the study.)
RM decisions
The intervention program continues with only minor modifications and specifications.
Evaluation of implemented RM solutions
-
21
3.1.4 Lessons from the Case
The most important observations and conclusions from the salmonella case are:
• Transmission of salmonella from poultry meat to humans is a risk that all poultry meat consumers are faced with. Most of us have no means to control the risk, which is largely determined by procedures in the production chain. Therefore, the Ministry of Agriculture and Forestry has set a National Salmonella Control Programme, which specifies a set of risk reducing activities to be followed in different stages of the production chain.
• In this case study, the effect of two interventions of the salmonella programme was evaluated. Evaluation of implemented RM solutions is an important task for determining if the solutions serve the needs and if any changes should be carried out. In this case, the evaluation was also needed to justify the programme, which is stricter than required by the EU.
• When designing a risk assessment model, the points of interest and available information of the system largely dictate the design process. Information about the salmonella prevalence in the primary broiler production chain was only received through indicative tests, not revealing the whole truth. The data being quite scarce, it was inevitable that some human judgements had to be incorporated. The aim of the model was to be able to assess the effect of removal of detected salmonella positive breeder flocks from the production chain, both in current situation and in some fictional scenarios. Therefore, a Bayesian inference model enabling studying of directly unobservable variables as well as combining of data and expert opinions was a natural choice.
• Bayesian inference models are often computationally demanding, but this challenge was overcome in the case with a software called WinBUGS (Bayesian Inference Using Gibbs Sampler), based on Markov Chain Monte Carlo simulation (MCMC). The software is freely available at http://www.mrc-bsu.cam.ac.uk/bugs/.
• The risk assessment showed that both interventions (flock removal and heat treatment of contaminated meat) were effective in reducing the number of human salmonella cases and that the best result was received by
22
combining them. Thus, the process did not result in any major changes in the programme.
3.2 Electricity Retailer Case
3.2.1 Background
The electricity retailer case describes the selection of appropriate RM methods for a mid-sized electricity retailer. An electricity retailer faces risks from numerous sources, including e.g. different market, volume and credit risks. To manage them in the daily operative actions, the RM specialists and traders need a set of analysis methods giving enough information. The selection of appropriate RM methods and setting rules for their usage is therefore a vital part of a company’s risk strategy. The implementation involves acquiring of new software customised for the company’s needs, installation into the computer system and training of the staff. This makes the process costly and means that the decisions must be made with an at least 5 – 10 years time horizon.
This study describes the development and implementation of a value tree based framework (Keeny and Raiffa, 1976) for choosing RM methods. The framework is developed by an RM IT-systems provider in collaboration with prospective end users. In the model, the main criteria for selecting RM tools are their (i) information utility, (ii) costs and (iii) usability. Traditional value tree analysis requires the decision makers to give precise preference statements as well as precise information about the options, which this was considered to be too an ambitious task. Thus, a novel method for giving imprecise information was used, Rank Inclusion in Criteria Hierarchies (RICH) (Salo and Punkka, 2004; Liesiö, 2002) developed at the Systems Analysis Laboratory at Helsinki University of Technology. The main properties of the case context are summarised in Table 5.
23
Table 5 Main properties of the electricity retailer case study.
Application field
Selection of RM methods for an electricity retailer
Decision maker
Management of the electricity retail company
Additional stakeholders
Electricity retail company staff
IT-provider
Causes for starting the study
Need to implement new RM methods
Methodology
Value tree analysis, Rank Inclusion in Criteria Hierarchies (RICH)
3.2.2 Value Tree Framework
The selection of a set of RM methods can be seen as a trade-off between RM costs and adverse event costs. The methods must give enough information about risks, be easy to use and flexible enough to meet the needs of the company’s potentially changing business environment. In addition they must be cost-efficient. The value tree framework used in the evaluation is shown in Figure 6. The main decision criteria, sub-goals, are information utility, method costs and usability. These are concretised by measurable attributes.
24
Comparison attributes for RM methodsUsabilityInformation utilityMeasurement of total normal risksAttribution capability to risk factorsAuthorityAccuracyIntuitivenessCoherenceMethod costs-Implementation -Introduction -Usage-MaintenanceMeasurement of extreme risksIntuitiveness / Simplicity / TransparencyTimelinessFlexibilityRobustnessAccuracyIntuitivenessCoherenceRobustnessAttribution capability to pf. componentsMeasurement of sensitivity of risk to changes in parameters and variablesAccuracyIntuitivenessCoherenceRobustnessComparison variablesAccuracyIntuitivenessCoherenceRobustness
Figure 6 The value tree model. (Ojanen et al., 2004)
Combinations of six RM methods were evaluated:
1. Position reporting
2. Deterministic scenario analysis
3. Sensitivity analysis (greeks)
4. Variance-covariance Value at Risk (VVaR)
5. Simulated Value at Risk (SvaR)
6. Maximum loss model (ML)
Because the value of information of these methods is not additive, the methods were evaluated in conjunction as collections of methods. Using the evaluation framework, potentially good combinations were identified and eventually implementation strategies were suggested. It was concluded that position reporting should be implemented first, because of its low costs and ability to give basic risk information. It should be followed by scenario analysis due to its cost-efficiency.
25
In the third phase a decision between simulation VaR, variance-covariance VaR or Maximum Loss should be made.
3.2.3 Risk Management Process
Table 6 The risk management process of the electricity retailer case.
Risk identification
An array of financial risks (market, volume, operational, credit and counterparty, system, political)
Risk evaluation – probability
The task is to choose methods for risk evaluation.
Risk evaluation – consequence
-
Development and evaluation of RM methods
A thorough value tree –based evaluation of collections of potential RM methods, based on their
1) Information utility
2) Costs
3) Usability
RM decisions
Sequential implementation of RM methods suggested:
1) Position reporting
2) Scenario analysis
3) Decision between VaR, variance-covariance VaR and Maximum Loss
Evaluation of implemented RM solutions
-
26
The different steps of the RM process of the case are summarised in Table 6. The risk identification is not too a demanding task since the main risk drivers in the electricity field are well known. As the task of the case was not to deal with daily RM of the operative activities but, rather, to select tools for it, no actual risk evaluation was done. On the contrary, the study focused on the development and evaluation of RM methods. Because the main challenge was to compare different solutions, a value tree framework was used. The process did not result in any real decisions as such, but gave suggestions which methods to consider. As no RM methods were implemented yet, an evaluation of their performance in action could not be done. However, it is an important task to be performed in the future.
3.2.4 Lessons from the Case
The most important observations and conclusions from the electricity case are:
• Electricity retailing entails considerable monetary risks, which in many respects are similar to those in other trading activities. However, the non-storability of electricity sets its own flavour to the situation.
• There are many financial risk analysis tools well suited for electricity companies.
• While usage of the analysis tools is a part of the every day work of the risk management specialists, choosing a suitable set of risk analysis methods for the company is a strategic decision with a several years time horizon. Changing the set of methods is both costly and time consuming, because any analysis solution available on the market must be customised to fit the needs and IT-system of the company and the personnel must be trained to use the new software.
• When there are many available analysis methods, whose properties in respect of e.g. information value and costs are more or less known, decision analysis tools can be successfully used to clarify the needs of the company. The objectives of the company were structured using a value tree model. The elicitation of weights for the sub-goals forced the decision makers to consider the RM method selection in a rational manner and not base the entire decision on intuition solely. However, as assessment of precise preference statements was seen to be too a demanding and even
27
unrealistic aim, a method called RICH was used, enabling the use of imprecise preference statements.
• When searching a suitable set of risk analysis tools, the candidates cannot be evaluated in isolation one by one, because of the partial overlap of the risk information given by the different methods. Thus, the value gained by utilising a new method depends on the methods already in use. This obstacle was overcome by considering the methods in sets.
• Using the RICH method, it was possible to identify potentially good combinations and eventually a three-step implementation plan was recommended.
3.3 Mining Case
3.3.1 Background
The mining case describes a reliability assessment of a safety system of an undersea mine using fault tree analysis (Andrews and Moss, 2002). Air ventilation is important in mines; its main function is to dilute mine gases and dust concentration and to maintain reasonable working temperature. Conventional ventilation methods approach their practical limits when the undersea working goes further than 10 km from the shafts. To overcome this problem, air recirculation is used to boost the ventilation capacity. However, the recirculation has its own risks and must be shut down in abnormal situations, e.g. in the case of fire. Therefore the safety authorities require a safety system with environmental monitoring and automatic control systems in mines with air recirculation. In this case study the reliability of such a safety system is assessed using fault tree analysis. The main properties of the case context are summarised in Table 7.
28
Table 7 Main properties of the mining case study.
Application field
Quantitative safety assessment of the ventilation recirculation system of an undersea mine
Decision maker
Management of the mining company
Additional stakeholders
Safety authorities
Miners
Causes for starting the study
1) Required by safety authorities
2) Safety and monetary concerns
Methodology
Fault tree analysis
3.3.2 Safety Assessment of Air Recirculation System
A schematic picture of the air recirculation system is shown in Figure 7. The recirculation fan transporting air from the return roadway back to the intake must be automatically shut down in certain abnormal situations. The monitored critical properties are:
• Methane entering the mine from the ground. High methane levels constitutes a sever fire risk.
• Carbon monoxide, which is a reliable indicator of fire (monitored at two locations).
• Air recirculation factor (must not be too high, due to regulations)
• Fan vibration
• Activation of water curtain (fire control)
29
• Emergency stop buttons
Whenever one of the monitored properties satisfies its trip condition, the recirculation fan should stop. This system can fail in two ways: (i) to fail to shut down the recirculation fan when a trip condition is fulfilled or (ii) to switch off the fan when no trip condition is fulfilled. The former is more critical and may have severe health impacts. Although the latter is less critical, a spurious fan stoppage is inconvenient, deteriorating the conditions in the mine due to high dust and heat levels. Air recirculation(Methane monitor)(CO monitor)(Pressure monitor)
Figure 7 The air recirculation system. (Andrews and Moss, 2002)
Fault trees were constructed and quantified for both failure modes. The system was divided into eight sub-systems according to different trip conditions, which resulted in a total of 16 fault trees. As an example of the trees, Figure 8 shows the fault tree for unrevealed failure in one of the carbon monoxide detection systems.
30
2
Figure 8 The fault tree for unrevealed failure in one of the carbon monoxide detection systems. (Andrews and Moss, 2002)
3.3.3 Risk Management Process
The different steps of the RM process of the case are summarised in Table 6. The two failure modes of the system discussed in the previous chapter are easy to identify. Risk drivers causing the failures were identified using failure mode and effect analysis (FMEA) (Andrews and Moss, 2002). This part was not, however, covered in the case study. The security system consists of a structured collection of components that, in general, fail independently of each other. Some of the components may shut down the system by themselves, while others cause a malfunction only in conjunction with other component failures. Fault tree analysis is a powerful tool in situations like this. A fault tree structures basic failures in a tree-like manner, with logical gates describing their logical relationships. The system failure probabilities, as well as the effects of suggested modifications, were
31
assessed by fault trees. The analysis lacks, however, a formal assessment of the consequences of a system failure. It was only stated that failing to detect high levels of methane or carbon monoxide were the most critical failures, and thus the safety improvement study was focused on measures that would improve the reliability on these fields. The reliability assessment concluded that the system reliability was at a fairly good level. However, if improvements were needed, the most effective action would be shortening of inspection intervals of the methane and carbon monoxide monitoring systems.
Table 8 The risk management process of the mining case.
Risk identification
Two failure modes:
1) Safety system unable to function on demand
2) Spurious (gratuitous) activation of the safety system under normal, healthy conditions
Failure mode and effect analysis (FMEA) (not covered in the case study)
Risk evaluation – probability
A thorough fault tree analysis of the safety system. System failure modelled as combinations of specific component failures. Component failure rates assessed using general component failure databases and maintenance records, repair times estimated by engineers at colliery. System reliability was concluded to be on a reasonable level.
Risk evaluation – consequence
No formal consequence evaluation made. Failure to detect high methane or carbon monoxide levels most critical of the studied failures.
32
Development and evaluation of RM methods
Three safety improvement strategies considered and evaluated using fault trees:
1) Variations in system design
2) Inspection interval changes (maintenance)
3) Shortened repair times
RM decisions
Should safety improvements be necessary, best effect is attained by shortening the inspection intervals of the methane and carbon monoxide monitoring systems.
Evaluation of implemented RM solutions
-
3.3.4 Lessons from the Case
The most important observations and conclusions from the mining case are:
• The authorities try to improve workers’ safety in mines by demanding the use and evaluation of certain safety systems. In order to make sure that the mining companies do not jeopardise the miners’ lives by saving money in wrong places.
• From a systems’ reliability point of view, a safety system is very similar to other systems in the process industry for which there are well established analysis methods available. In analysing the reliability of a well defined system of independently failing components, fault tree analysis is a powerful tool.
• For many components used in industry, general component failure databases are available. For more specialised components, reliability estimates must rely on internal maintenance records or estimates given by
33
the component suppliers. In some cases, the only way to find information is to interview experienced working personnel.
• A safety assessment is benefited most when performed in the planning stage of the system because the potential structural changes are considerably easier to do. As the safety system in this case study was already installed, it ruled out major structural changes as financially non-realisable.
• The best safety improvement turned out to be shortening of the maintenance intervals of certain important components that, in contrast to the majority of components, do not fail safe7. Safety improvements do not always require improvements of the system itself. Sometimes well directed changes in maintenance procedures are more efficient.
3.4 Pension Insurance Case
3.4.1 Background
The pension insurance case gives a presentation of the main risks a Finnish pension insurance company is facing and how they are managed. It also presents a new stochastic programming approach to asset allocation, with a vital role in the management of investment risk. The model has been developed by researchers at Mutual Pension Insurance Company Ilmarinen and Helsinki School of Economics (Hilli et al., 2004). The main properties of the case context are summarised in Table 9.
The main activities of a mutual pension insurance company are underwriting business and investment. The most important function of the company is, of course, to pay pensions to retired employees. To finance the pensions, the company raises pension contributions from its policyholders, i.e. the employers and employees. Yearly pensions are partly financed by contributions paid during the very same year and partly by assets accrued from earlier contribution payments. Thus, the pension insurance companies hold substantial investments
7 The conclusion depends on the component failure model used.
34
needed for future pensions. A part of the surplus from the investment activities is paid back to the policyholders as bonuses.
Table 9 The main properties of the pension insurance case study.
Application field
Pension insurance, investment asset allocation
Decision maker
The Company
(The Ministry of Social Affairs and Health)
Additional stakeholders
Finnish pension insurance policyholders
Causes for starting the study
Improving models for strategic investment allocation decisions
Methodology
Stochastic programming
3.4.2 Main Risks of a Pension Insurance Company
The risks of the underwriting business are linked with the sufficiency of the company’s pension contribution incomes and technical reserves to cover present and future pensions. The technical reserves are minimum requirements for the company’s assets and correspond to the present value of future pension expenditures. In the long term, the main risk factor is the uncertainty associated with life expectancy, affecting the length of old-age pensions. The uncertainty associated with pension starts and sizes are the main short term risk factors (see Figure 9). The companies are obliged to monitor and control the risks of uncertain future pension expenditures.
In Finland, the pension insurance business is quite strictly regulated. The pension contributions are common regardless of company as set by the Ministry of Social Affairs and Health. Shortfall in the underwriting business within one company will ultimately affect the policyholders in form of smaller or no bonuses, while systematic shortfall in all pension insurance companies results in raised pension contributions.
35
Risks of a mutual pension insurance company Underwriting business risk Investment activities risk Length of pensions (life expectancy) Number of pension starts Size of pensions Market risk Counterparty risk Liquidity risk Exchange rate risk
Figure 9 Main risks of a mutual pension insurance company.
The main risks of the investment activities are market, counterparty, liquidity and exchange rate risks (see Figure 9). Market risk is managed by diversifying between different asset types, countries, sectors and companies. Pension insurance companies may allocate the assets in cash, bonds, stocks, real estate and loans to policyholders. The allocation mix affects the risk as well as the expected return of the investment portfolio. Counterparty risk is managed by analysing the creditworthiness of bond issuers and by limiting investments in one issuer’s bonds. Guarantees are also used to secure the investments. Liquidity risk can be managed easily since pension expenditure can be accurately forecast. Exchange rate risk is controlled using derivatives (Figlewski and Levich, 2002; Hull, 2002; Luenberger, 1997).
The value of the assets of a pension insurance company must always exceed the technical reserves. The Ministry of Social Affairs and Health has set several target values and borders for the solvency capital, i.e. the excess of investments over the technical reserves. The target values taking into account the amount of money invested in different asset types are meant to secure the value of the investments from falling below the technical reserves. The challenge in the allocation of assets
36
is to pursue maximum revenue under prevailing market conditions in order to be able to pay bonuses to policyholders. In the same time, the solvency capital must be secured in the target zones set by the Ministry.
3.4.3 Stochastic Programming Model for Asset Liability Management
Researchers at Mutual Pension Insurance Company Ilmarinen and Helsinki School of Economics have developed a new stochastic programming model to support the strategic asset allocation decisions of a pension insurance company (Hilli et al., 2004). In the multistage model decisions about e.g. asset allocation and bonus payments are interlaced with observations of random variables such as asset returns. The investment decisions for each time period are optimised with the help of the model in order to maximise a target utility function. The function takes into account the size of the solvency capital and bonus payments at each stage as well as the fulfilment of the target levels for the solvency capital given by the Ministry. The underlying random econometric factors are modelled using a Vector Equilibrium Correction (VEqC) time series model, a generalisation of Vector Autoregression (VAR) models. In addition, to the observed history of the modelled econometric factors, the VEqC model contains user specified parameters, enabling the incorporation of expert opinions concerning long term equilibria and current trends.
3.4.4 Lessons from the Case
The pension insurance case does not describe a distinguished fulfilment of a risk management process as such, but rather depicts the current risk situation in pension insurance companies and introduces the idea of a new asset allocation model. Therefore, it is not meaningful to conclude this case as in the other cases using the RM process framework. Instead, the case is summarised by listing the key points regarding risk management in a pension insurance company in general and regarding the presented stochastic programming model.
Risk management in a pension insurance company
• The main activities of a pension insurance company are underwriting business and investment of capital. Pension insurance companies hold substantial financial investments, because pensions are partly funded in advance.
37
• The main risks of the underwriting business are related with the average length of pensions as well as pension starts and sizes. The insurance portfolios of the major companies are so large that reinsurance is not justifiable financially. As a result of regulations and governmental guarantees, the underwriting risks of a pension insurance company are ultimately carried by policyholders and the Finnish taxpayers.
• The main investment risks are market, counterparty, liquidity and exchange rate risks, the most significant one being the market risk. It is managed by diversifying between different types of assets (cash, bonds, shares, real estate and loans to policyholders) and within each asset type by country, sector and company. The asset allocation mix affects both the return expectations and the risk level of the portfolio.
• With the purpose of securing the employers’ future pensions, the Ministry of Social Affairs and Health restrict financial risk taking of pension insurance companies by setting target zones for their solvency capital. The most important of the limits, the solvency border, includes a buffer that, in theory, corresponds to the one year 97.5% Value at Risk of the investment portfolio. By placing money in less risky asset types (e.g. bonds), a company can lower the solvency limits.
Stochastic programming model
• The strategic investment decisions of a pension insurance company can successfully be modelled with a multistage stochastic program as a sequence of decisions interlaced with a sequence of observations of random variables.
• The model considered in the case results in a nonlinear (convex) optimisation problem, where the discounted cumulative utility of the company reflecting its values and goals is optimised. The function takes into account returns, bonus payments to policyholders and staying within the target zones set by the Ministry of Social Affairs and Health. The constraints consist of facts and limitations concerning inventory, budget, portfolio weights and transactions as well as statutory regulations. The economic factors, considered as random variables, are modelled by a time series model called Vector Equilibrium Correction (VEqC). It enables the combination of statistical information and expert views about growth rates
38
and long-term equilibria. The approach is especially well suited when the available data displays characteristics that are believed to change in the future.
• With the support of the model, the company can plan its strategic investment actions such that it efficiently utilises the profitability potentials of the investments without exceeding the risk limits.
39
4 Comparative Analysis of the Cases
The four case studies presented in chapter 3 give examples of different kinds of risks in different fields and organisations and present methods for managing them. Both similarities and dissimilarities can be found in the case studies, deriving from their different characteristics. In the following, the cases are compared, aiming to capture causal relationships between different case properties and to find general RM guidelines.
4.1 Risk Influence and Decision Makers
Rescher (1983) proposes a classification of risks in terms of agents and those influenced by the risk (see Table 1, page 6). The salmonella and pension insurance cases are similar in this respect: The activity of a small group (parties in the broiler production chain and pension insurance company staff) affects almost the whole nation (broiler consumers, tax-payers; policyholders, tax-payers). Thus, it is natural for the government to have the power and interest to act as a “risk manager”, at least to some extent. In Finland, these activities are handled by the Ministries and the primary ways of action are to impose regulations and statutory restrictions. Thereby, the Ministry makes the actors on the field to follow certain best practises and limits the possibility of unhealthy risk taking. The risk influences and decision makers of the cases can be seen in Table 10. The table supports the intuitive conclusion that the government seeks to limit risk taking in cases with nationwide ubiquity and at least partly other-directed risks.
In the salmonella case, the Ministry of Agriculture and Forestry tries to protect people from salmonella infections originating from broilers. It obliges the actors in the broiler production chain to follow certain procedures found to reduce effectively the probability of contaminated meat. The consumers do not only benefit from the risk management, but also pay a part of the costs. Thus, redundant risk management is not in the public interest. However, in this case, the ordinary consumer does not probably worry too much about the rise in consumer prizes: The National Salmonella Control Programme is estimated to cost 0.02 €/kg of broiler meat produced (Kangas et al. 2003).
40
Table 10 The instance making RM decisions depends on the ubiquity and influence of the risk.
Salmonella
Energy
Mining
Pension insurance
Ubiquity
National
Within company
Workers in the mine
Policy holders, Finnish tax payers
Risk influence
Both self- and other-directed
(Wholly) self-directed
(Wholly) self-directed
Both self- and other-directed
Decision makers
Ministry of Agriculture and Forestry
Company
Company
Health and Safety Executive
Ministry of Social Affairs and Health
Company
Level of regulation
Fairly high
Low
Intermediate
High
In the pension insurance case, the Ministry of Social Affairs and Health wants to make sure that the companies are able to fulfil their obligations towards present and future pensioners and that every employee is served on equal terms. The Ministry has set up regulations on how to calculate the amount of assets needed for future pension payments (the technical reserves) and how large buffer the companies should have (solvency border) to secure themselves against fluctuations in the value of their investments. These regulations form, however, only a set of minimal requirements for the company; every properly run pension insurance company have their own risk management functions which aim to run the company as profitably as possible while maintaining a reasonable risk level.
In the mining case, Great Britain’s Health and Safety Executive requires security control systems in mines with air recirculation systems. Although the possible health impacts affect only people within the mining company, the miners do not decide about the safety actions themselves and therefore, it is natural that the miners’ safety is guarded by an external body.
41
In contrast to the other cases, the electricity company carries its risks mainly alone. In situations like this, no strict governmental regulations are needed. The firm can manage the risks itself in the most suitable way. If something goes wrong, it can only blame itself and no innocent people are hurt.
4.2 Type of Loss
The type of possible loss sets its own flavour to the analysis and management of risks. From a technical point of view, it is easier to handle with monetary loss than damage concerning e.g. human health or the nature. In the case of monetary loss, as we see in the energy and pension insurance cases, the loss is well defined and the expenses of undesired events and preventive measures are easily commensurable. When everything is measured in monetary terms, it makes sense to use probability distributions and covariances as well as sensitivity measures like Value at Risk and partial derivatives to describe the situation.
When dealing with health issues, as in the salmonella and mining cases, it is not always obvious how to measure loss and how to compare different expenses and health hazards. In such cases, values and opinions play a greater role and plain numbers and probability distributions should be used more carefully. Although it is for several reasons seldom outspoken, the question “What is the monetary value of human life?” often underlies precautionary security decisions. Political and industrial leaders are careful not to address the question in public, because of the emotionally charged debates it would evoke. Still, it is often possible to estimate the number of lives saved by a preventive security investment. Thus, the decision maker implicitly values the expected saved lives. In the cost-benefit analysis of the salmonella case, the monetary value of a death caused by salmonella is derived from data calculated for alcohol-induced deaths (Kangas et al., 2003), whereas the mining case does not address the valuing issue.
4.3 Modelling of Probabilities and Interrelationships
In the cases different approaches to modelling probabilities and relationships can be seen. Different models are chosen depending on the nature of the interrelations and on the available data and knowledge (see Table 11).
42
The primary prevalence inference model in the salmonella case uses Bayesian nets for modelling the relationships between variables. The probability distributions are estimated by combining expert judgements and available data in a Bayesian manner. This is a natural selection since the unknown quantities (e.g. true prevalence) are represented by stochastic variables, but cannot be directly observed. Using information about related observable indicators, conclusions about the underlying variables can be made. On the other hand, in the secondary production model of the same case, Monte Carlo simulation is used. It is a simpler model for “forward simulation” which does not allow inference, i.e. probabilistic learning “backwards” (Maijala and Ranta, 2004).
Table 11 The RM methods to be used are chosen on the basis of the characteristics and focus of the problem as well as the available knowledge.
Salmonella
Energy
Mining
Pension insurance
Characteristics of uncertainty
• Interrelated infection variables
• Unknown infection rates and test sensitivity
• Variation of market rates
• Simultaneous failure of statistically independent components
• System structure well defined and known
• Variation in revenue and dividend for different asset types
Data
• Some data available for indirect indicators
• Track records
• Maintenance records
• General component failure databases
• Time series of economic factors
• Expert opinions
43
Expert opinion
Prior distributions
Inputs to the value tree (scores and weights)
Some maintenance estimates
Economic equilibria and trends
Main challenge
Risk assessment and evaluation of preventive measures
Selection of risk assessment tools among several candidates
Risk assessment and evaluation of preventive measures
Strategic asset allocation decisions
Method used
• Bayesian inference
• Monte Carlo simulation
• Value tree analysis
• Failure tree analysis
• Stochastic programming model
• Regulations and statutory restrictions
The mining case shows how fault trees can capture the relationships in a network of independently failing components. Most of the input probabilities in the model are derived from the data in a frequentist manner, whereas others are estimated in quite an ad hock way by maintenance personnel. For modelling variation in market rates and portfolio values, quite established methods exist. As the uncertain quantities form sequential series, forecasting utilises often time series models such as ARMA (Autoregressive Moving Average) and GARCH (Generalised Autoregressive Conditional Heteroscedastic). In the pension insurance case, the econometric factors that serve as inputs to the asset valuation model are forecast using a Vector Equilibrium Correction (VEqC) model, a generalisation of Vector Autoregressive (VAR) models. The model contains manually fixed parameters (e.g. drift factors), enabling the use of expert knowledge in order to better forecast patterns not derivable from historical data.
The risk management problem is slightly different in the electricity case: an array of risk analysis methods exists for monitoring electricity related risk. Every method
44
gives a slightly different view of the situation; usability and cost of use vary also. Since the characteristics of the methods are well known the challenge is to find a set of methods that best fits the needs of the company. This calls for the use of multiple criteria decision analysis (MCDA) methods, and the decision problem is indeed tackled with value tree analysis.
4.4 Guidelines for Selection of Probability Assessment Method
A certain amount of information is needed to be able to assess probabilities and other inputs for a risk assessment model with a reasonable accuracy. If the needed information is not available, any attempt to estimate the probabilities would be inaccurate. In such cases, alternative approaches, such as scenario analysis and the precautionary principle must be considered (Harremoës et al., 2002; Klinke and Renn, 2002; Renn and Klinke, 2001; Stirling, 2001). The needed information can be either qualitative, in form of human experience and opinions, or quantitative, e.g. in form of historical track records. The two information types are somewhat complementary: If extensive representative data is available, expert opinions are barely needed. When firm expert knowledge is present, the estimations can be done even if there is little or no data available.
In the case studies presented in this thesis, different methods for assessing probabilities have been used. In general, the selection of the assessment method depends on the proportions of available representative data and expert knowledge. A rough division is presented in Figure 10. If very little data is available, but experts have knowledge and experience about the phenomena, the most suitable approach is to use some expert elicitation method (Ayyub, 2001; Cooke, 1991; Hora and Iman, 1989; Keeny and von Winterfeldt, 1991; Porthin et al., 2002). If more data is available, but not quite enough to solely rely on, methods that combine opinions and data are used. The most recognised and theoretically justified of these is the Bayesian methodology, where prior distributions, often set using expert knowledge, are updated using available data. The beauty of the Bayesian approach is that after making the needed model assumptions, all results can be derived using available observations and well-established probability rules only. The disadvantage is the requirement of significant computational resources. If sufficient data regarded as representative is available, expert opinions become redundant and probabilities are most efficiently estimated in a frequentist manner.
45
This does not mean that the Bayesian approach would be incorrect in any way. However, the frequentist approach is computationally less demanding and results in the more or less same outcome. Stirling (2001) suggests a similar guideline for method selection in his outline of different levels of incertitude, but does not recognise the use of expert elicitation methods. DataExpert opinionsMethod for probability assessment:Expert elicitation methodsBayesian probabilities and other combination methodsFrequentist probabilitiesDataExpert probabilities
Figure 10 Selection of probability assessment method depends on the availability of data and expert knowledge.
If a sequence of stochastic variables forms a time series, as in the pension insurance case, then this property should of course be utilised. It is recognised that historical data does not fully explain the behaviour of the variables and that expert opinions could improve the forecasts. Thus, the problem is situated in the middle section of Figure 10. Indeed, the VEqC model combines observed sequences of the variables with expert opinions regarding trends and long term equilibria.
4.5 Types of Risk Management Decisions
As described in Section 2.3 on page 12, risk management decisions can be categorised as avoidance, acceptance, compensation, transfer or reduction. The cases show examples of all of these, except avoidance (see Table 12). The absence of examples of risk avoidance does not mean that it is never used; it is just that simple a means that a case study describing it would be uninteresting. When talking about risk management, most people first think about risk reduction, i.e.
46
controlling the severity of a risk by reducing its probability or impact. This means is seen in all case studies. In the salmonella case, the probability of human salmonella infections is reduced by various interventions. The risk impacts of the investment activities of a pension insurance company and an electricity retailer are reduced by setting risk limits. The impacts of abnormal situations in the mine are reduced by installing a safety monitoring system and the probability of its malfunction is assessed and reduced, if needed, by shortening the maintenance intervals.
Table 12 Types of RM decisions.
Salmonella
Energy
Mining
Pension insurance
Reduction: Salmonella probability reduced using interventions
Compensate: Hedging
Reduction: Risk limits
Reduction: 1) Impact of abnormal situations reduced with safety system. 2) Probability of safety system malfunction reduced.
Accept: Underwriting risks accepted
Compensate: Credit risk hedged
Transfer: 1) Pensions guaranteed by the state 2) Risk transfer by adjusting bonuses and insurance premiums
Reduction: Investment risk limits
As already stated in the categorisation on page 12, risk compensation is common in finance. Hedging is used in the electricity retailer and pension insurance cases to compensate the unwanted impacts of changing electricity prices or exchange rates. Hedging is only possible when a compensating risk is available behaving in the opposite way to the original risk, i.e. is (perfectly) negatively correlated. Another requirement is that the outcomes of the risks can really compensate each other. Therefore, compensation is not present in the other cases involving risks without upside potentials and health issues that are hard to compensate.
47
Although not explicitly reported, risk acceptance is definitely practiced in all cases, as it is the only rational response to insignificant risks. Risk bearing and acceptance is the core function of insurance companies making money by taking others’ risks on their behalf. This is also the case in the pension insurance study for the uncertainties concerning pension payments. A part of the company’s risks are although transferred to employers, employees and Finnish tax payers through pension guaranties given by the state (in case of bankruptcy) and adjustments of insurance premiums and bonus payments.
48
5 Conclusions
This thesis presented four RM case studies compiled by the author. The aim was to develop studies that describe the steps of the RM process and give examples of methods used on different fields. The target group was university level students with basic knowledge in operations research and risk analysis wanting to learn how risks are managed in practice. A comparison of the cases resulted in several observations and conclusions of dependencies of risk characteristics. Some general guidelines for choosing probability estimation methods in different risk evaluation situations were drawn, too.
The cases support the intuitive assumption that the level of regulatory RM depends on whether the risk affects also others than the ones causing it and on the ubiquity of the risk. The regulatory bodies regard the protection of people under risk without being able to affect the situation themselves as their duty.
The RM approaches differ from field to field. The differences depend not only on the modelling properties of the phenomena and the type of loss but also on the traditions in each field. When the potential loss is purely financial, the monetary loss is considered as a stochastic variable whose probability distribution is sought. The risk is described using distribution characteristics such as volatility and VaR, as well as various sensitivity measures. From a mathematical point of view, the situation is quite similar to the salmonella case, but instead of money, the interest was focused on the number of human salmonella infections. However, despite the similarity, the risk was presented only by showing the estimated distribution function and giving the median and the confidence interval. It would be interesting to apply the financial risk measures in this kind of situations. Measures like “Health at Risk” and those of sensitivity to changes in underlying factors could give yet another point of view of the risk.
When the risk cannot be inherently modelled as a stochastic variable, analysis focuses usually on estimating the probability of certain loss scenarios. The possible causes of the loss are identified and the probabilities estimated using them.
49
A general rule for choosing a probability estimation approach according to the amount of available data and expert knowledge was proposed. If enough representative data is available, a frequentist approach is the most efficient one. On the contrary, when expert opinions are needed for further insight, Bayesian approaches are appropriate. Finally, if hardly any data is available, expert elicitation methods are suitable. A similar distinction between frequentist and Bayesian methods was presented by Stirling (2001), but he did not acknowledge the use of expert elicitations. In many cases, there just is not enough available information to perform an informed probability and risk assessment. In such cases, application of a formal risk assessment method will most probably result in biased results. Instead, scenario analyses and precautionary principles should be applied.
The main purpose of risk analysis is to serve as a basis for risk informed decisions and actions. One of the objectives when developing the cases was to depict the whole RM process from risk identification to decisions and evaluation of actions. This goal was best achieved in the salmonella case. It showed that a risk assessment does not always result in significant changes, but may as well confirm the appropriateness of current practices.
Different types of management actions are suited in different risk situations. Risk reducing activities, either by lowering the probability of losses or limiting the potential damages, were observed in all cases. Risk compensating, or hedging, and setting risk limits are important tools in finance. The main idea in insurance business is not to reduce the risk, but to transfer it to a party willing to accept part of the risk. A successful company uses all five strategies (avoidance, acceptance, compensation, transfer and reduction) to manage its risks.
The current trend in risk management is to aim at a holistic approach taking into account also the correlations and interdependencies of an organisation’s risks instead of independent risk management of different sectors. This is a challenge for RM professionals, demanding high modelling skills as well as the ability to comprehend and manage large complex systems.
50
6 References
Andrews J. D. and Moss T. R. (2002): Reliability and Risk Assessment. Second Edition. Professional Engineering Publishing Limited, London and Bury St Edmunds, UK. ISBN 1-86058-290-7.
Ayyub Bilal M. (2001): Elicitation of Expert Opinions for Uncertainty and Risks. CRC Press. ISBN 0-8493-1087-3.
Ballard G. (1993): Guest editorial: Societal risk – progress since Farmer. Reliability and System Safety, Vol. 39, pp. 123-127.
Bernstein Peter L. (1996): Against the gods: The remarkable story of risk. John Wiley & Sons, Inc. USA. ISBN 0-471-29563-9.
Bunn Derek W. (1984): Applied Decision Analysis. McGraw-Hill, Inc. ISBN 0-07-008292-8.
Cooke R. M. (1991): Experts in Uncertainty. Opinion and Subjective Probability in Science. Oxford University Press, Inc. New York.
Crouhy Michel, Galai Dan and Mark Robert (2001): Risk Management. McGraw-Hill. ISBN 0-07-135731-9.
Farmer F.R. (1967): Siting criteria – a new approach. IAEA SM-89/34; reprinted in Nuclear Safety, 8 (1967) 539-48.
Figlewski Stephen, Levich Richard M. (eds.) (2002): Risk Management. The State of the Art. Kluwer Academic Publishers. ISBN 0-7923-7427-4.
Garvin David A (2003): Making the Case: Professional education for the world of practice. Harvard Magazine, September-October. Volume 106, Number 1, Page 56. Online: http://www.harvard-magazine.com/on-line/090322.html, visited 25.05.2004.
51
Greene Mark Richard (1983): Risk Management: Text and Cases. Brady ISBN 0835967360.
Haimes Yacov Y. (1998): Risk Modeling, Assessment, and Management. John Wiley & Sons, Inc. USA. ISBN 0-471-24005-2.
Harremoës Poul, Gee David, MacGarvin Malcolm, Stirling Andy, Keys Jane, Wynne Brian and Guedes Vaz Sofia (eds.) (2002): The Precautionary Principle in the 20th Century. Late Lessons from Early Warnings. European Environment Agency. Earthscan Publications Ltd. ISBN 1-85383-893-4.
Herreid Clyde Freeman (1994): Case Studies in Science: A Novel Method of Science Education. Journal of College Science Teaching, February issue (pp. 221-229).
Hilli Petri, Koivu Matti, Pennanen Teemu, Ranne Antero (2004 to appear): A stochastic programming model for asset liability management of a Finnish pension insurance company. Annals of Operations Research.
Hora S. C. and Iman, R. L. (1989): Expert Opinion in Risk Analysis: The NUREG-1150 Methodology. Nuclear Science and Engineering, Vol. 102, pp. 323-331.
Hull John C. (2002): Options, Futures, and Other Derivatives. 5th edition. Prentice Hall. ISBN 0-13-009144-8.
Jauri Osmo (1997): Riskienhallinta uudesta näkökulmasta. Kauppakamari Oy, Yrityksen tietokirjat, Helsinki. ISBN 951-640-946-6.
Jorion Philippe (2001): Value at Risk. The New Benchmark for Managing Financial Risk. 2nd edition. McGraw-Hill. ISBN 0-07-135502-2.
Kangas Susanna, Lyytikäinen Tapani, Peltola Jukka, Ranta Jukka and Maijala Riitta (2003): Economic impacts of the Finnish Salmonella Control Programme for broilers. National Veterinary and Food Research Institute, EELA, Finland. EELA Publication 02/2003 ISSN 1458-6878.
Keeny R. and Raiffa H. (1976): Decisions with Multiple Objectives: Preferences and Value Tradeoffs. John Wiley & Sons.
52
Keeny Ralph L. and von Winterfeldt Detlof (1991): Eliciting Probabilities from Experts in Complex Technical Problems. IEEE Transactions on Engineering Management, Vol. 38, pp. 191-201.
Klinke Andreas and Renn Ortwin (2002): A New Approach to Risk Evaluation and Management: Risk-Based, Precaution-Based, and Discourse-Based Strategies. Risk Analysis, Vol. 22, No. 6, pp 1071-1094.
Koksalan M. and Salman F.S. (2003): Beer in the Classroom: A Case Study of Location and Distribution Decisions. INFORMS Transactions on Education, Vol. 4, No 1, Online: http://ite.pubs.informs.org/Vol4No1/KoksalanSalman/, visited 22.03.2004.
Liesiö Juuso (2002): RICH – A decision support software. Student research project at SAL/Helsinki University of Technology. Online: http://www.sal.tkk.fi/Opinnot/Mat-2.108/pdf-files/elie02.pdf, visited 25.2.2004.
Lonka Harriet, Hjelt Mari, Vanhanen Juha, Raivio Tuomas, Vaahtoranta Tapani, Visuri Pekka, Väyrynen Mikko, Frinking Erik, O’Brien Kevin (2002): Riskien hallinta Suomessa. Esiselvitys. Sitran raportteja 23, Edita Prima Oy, Helsinki. ISBN 951-563-428-8. Online: http://www.sitra.fi/, visited 25.3.2004.
Luenberger David (1997): Investment Science. Oxford University Press, New York. ISBN 0-19-510809-4.
Maijala Riitta and Ranta Jukka (2004): Salmonella in Broiler Production in Finland – a Quantitative Risk Assessment. National Veterinary and Food Research Institute, EELA, Finland. EELA Publication 04/2003 ISSN 1458-6878.
Melnikov Alexander (2004): Risk Analysis in Finance and Insurance. Translated and edited by Alexei Filinkov. Chapman & Hall/CRC Monographs and Surveys in Pure and Applied Mathematics 131. ISBN 1-58488-429-0
Milton J. S. and Arnold Jessie C. (2002): Introduction to Probability and Statistics: Principles and Applications for Engineering and the Computing Sciences. 4th Edition. McGraw-Hill. ISBN 0-07-119859-8.
53
NEA (1992): Probabilistic safety assessment: an analytical tool for assessing nuclear safety. NEA Issue Brief: An analysis of principal nuclear issues. Nuclear Energy Agency. No. 8, January 1992. Online: http://www.nea.fr/html/brief/brief-08.html, visited 20.10.2003.
Ojanen Otso, Makkonen Simo and Salo Ahti (2004): A Multi-Criteria Framework for the Selection of Risk Analysis Methods at Energy Utilities. Unpublished working paper.
Pausenberger Ehrenfried and Nassauer Frank (2000): Governing the Corporate Risk Managenet Function: Regulatory Issues. Justus-Liebig University, Giessen , Germany. Published in: Frenkel Michael, Hommel Ulrich and Rudolf Markus (Eds): Risk Management, Challenge and Opportunity. Springer, Germany 2000. ISBN 3-540-67134-X.
Porthin Markus, Lanne Laura, Mattila Heli (2002): Asiantuntija–arvioprosessin toteuttaminen. Operaatiotutkimuksen projektityöseminaarin loppuraportti. Helsinki University of Technology. Online: http://www.sal.tkk.fi/Opinnot/Mat-2.177/loppuraportit/Loppurap_VTT_B_-_Asiantuntija-arviot.PDF, visited 30.07.2004.
Ranta Jukka and Maijala Riitta (2002): A Probabilistic Transmission Model of Salmonella in the Primary Broiler Production Chain. Risk Analysis, Vol. 22, No. 1.
Renn Ortwin and Klinke Andreas (2001): Risk Evaluation and Risk Management for Institutional and Regulatory Policy. Published in: Stirling A. (ed.): On Science and Precaution in the Management of Technological Risk. Volume II, Case studies. European Commission, Joint research center. Report EUR 19056/EN/2.
Rescher Nicholas (1983): Risk : a philosophical introduction to the theory of risk evaluation and management. Lanham, MD : University Press of America. ISBN 0-8191-2269-6.
Risk and Insurance Management Society Staff (1988): Case Studies in Risk Management. Risk Insurance Management. ISBN 0937802255.
Rockafellar R.T. and Uryasev S. (2000): Optimization of Conditional Value-at-Risk. The Journal of Risk, Vol. 2, No. 3. Online: http://www.ise.ufl.edu/uryasev/CVaR1_JOR.pdf, visited 02.07.2004.
54
Rockafellar R.T. and Uryasev S. (2002): Conditional Value-at-Risk for General Loss Distributions. Journal of Banking and Finance, 26/7, 1443-1471. Online: http://www.ise.ufl.edu/uryasev/cvar2_jbf.pdf, visited 02.07.2004.
Rowe W. (1977): An anatomy of risk. John Wiley & Sons, New York.
Rump C.M. (2001): Who Wants to See a $Million Error? INFORMS Transactions on Education, Vol. 1, No. 3, Online: http://ite.informs.org/Vol1No3/Rump/, visited 22.03.2004.
Rump C.M. (2002): COPS: Whatcha Gonna Do? INFORMS Transactions on Education, Vol. 2, No. 2, Online: http://ite.informs.org/Vol2No2/Rump/, visited 22.03.2004.
Räikkönen Timo (2002): Riskienhallinnan kehityskaari ja vaikuttavuusarviointi. Turvallisuus- ja ympäristöriskit (The development of risk management and evaluation of its impacts. Safety and environmental risks). VTT Tiedotteita - Research Notes 2156. Technical Research Centre of Finland.Otamedia Oy, Espoo Finland. ISBN 951-38-6071-X. Online: http://www.vtt.fi/inf/pdf/, visited 28.11.2003.
Räikkönen Timo and Rouhiainen Veikko (2003): Riskienhallinnan muutosvoimat. Kirjallisuuskatsaus (Risk management; prospects and challenges. Literary survey). VTT Tiedotteita - Research Notes 2208. Technical Research Centre of Finland.Otamedia Oy, Espoo Finland. ISBN 951-38-6167-8. Online: http://www.vtt.fi/inf/pdf/ visited 28.11.2003.
Salo Ahti and Punkka Antti (2004 to appear): Rank Inclusion in Criteria Hierarchies. European Journal of Operational Research.
Stirling A. (2001): On ’Precautionary’ and ’Science Based’ Approaches to Risk Assessment and Environmental Appraisal. Published in: Stirling A. (ed.): On Science and Precaution in the Management of Technological Risk. Volume II, Case studies. European Commission, Joint research center. Report EUR 19056/EN/2.
Suominen Arto (2000): Riskienhallinta. WSOY, Finland. ISBN 951-0-21693-3.
55
Uryasev S. (2000): Conditional Value-at-Risk: Optimization Algorithms and Applications. Financial Engineering News, No. 14, February, 1-5. Online: http://www.ise.ufl.edu/uryasev/FinNews.pdf, visited 02.07.2004.
von Neumann J. and Morgenstern O. (1994): Theory of Games and Economic Behavior. Princeton University Press.
Wassermann Selma (1994): Introduction to Case Method Teaching, A Guide to the Galaxy. New York: Teachers College Press.
Weber Jürgen and Liekweg Arnim (2000): Statutory Regulation of the Risk-Management Function in Germany: Implementation Issues for the Non-Financial Sector. Published in: Frenkel Michael, Hommel Ulrich and Rudolf Markus (Eds): Risk Management, Challenge and Opportunity. Springer, Germany 2000. ISBN 3-540-67134-X.
Williams C. Arthur Jr, Smith Michael L, Young Peter C (1998): Risk management and insurance, 8th ed. McGraw-Hill, Singapore. ISBN 0-07-115639-9.
56
57
7 Web References
European Case Clearing House. http://www.ecch.cranfield.ac.uk/, visited 22.03.2004.
IFCI International Financial Risk Institute. ”Case Studies”. http://riskinstitute.ch/Introduction.htm, visited 22.03.2004.
Risk Analysis and Management for Projects (RAMP).” Risk management case studies”. http://www.ramprisk.com/riskknowledge/allcasestudies.asp, visited 22.03.2004.
Technical Research Centre of Finland (VTT). ”Pk-yrityksen riskienhallinta”. A web site on risk management for small and mid-sized firms (in Finnish). http://www.pk-rh.com/, visited 15.1.2004
Technical Research Centre of Finland (VTT). “Riskianalyysit”. A web site on qualitative risk analysis methods (in Finnish). http://riskianalyysit.vtt.fi/, visited 14.1.2004
University of Calgary, Risk Management & Insurance. “Risk Management, Index to Cases”. http://www.ucalgary.ca/MG/inrm/Teaching/Cases/case_idx.htm, visited 19.03.2004.
University of California, Irvine, Graduate School of Management. “Philippe Jorion's Orange County Case: Using Value at Risk to Control Financial Risk”. http://www.gsm.uci.edu/~jorion/oc/case.html, visited 22.03.2004.