Compound risk happens when the impact of a risk event produces another risk. Before your head explodes, let me give you an example. Suppose your company faces the risk that a tired night watchman will fall asleep on the job. What’s the real business impact of this? Well, somebody might sneak in and steal your inventory. The operative word here is might. This should tip you off, that another risk is involved. Carrying the example forward, what’s the impact of somebody stealing your inventory? This is more tangible. If, on any given night, you stock $100K worth of inventory, then that’s the real impact of the theft, which happened because the night watchman was asleep. This is what I call a compound risk.
To understand how to handle compound risk, let’s review how normal risk is handled. You deal with an important risk, by introducing a control. For instance, the risk of an inexperienced processor entering in the wrong data could be controlled by a manager’s review and approval of the data. This is called a contingent control because you proactively address the impact of the risk. Out of respect for risk, astute managers build contingency reserves into their processes. This is time and money set aside to absorb the impacts of process risks when they show up. Compound risk happens when the impact of one risk results in another risk, such as in our night watchman example above.
To determine the contingency reserve contribution for a simple (i.e. non-compound) risk, multiply the probability of the risk by the impact. For example, let’s say your operation runs the risk of network failure. If the network goes out, you’re estimating 1 days’ worth of lost work. On any given day, the probability of the network going out is 5%. So, if your project is scheduled for 150 days, you would allocate 7.5 days in your contingency reserve to handle network outages.
Now, let’s take a compound risk example. Let’s say there are rumors of a layoff announcement. The chances of this announcement actually happening are about 30%. If the announcement happens, there will be layoffs, but the layoffs might not affect your operation. In fact, there is only a 20% chance that any layoff announcement would have any impact on the operation. If the layoff announcement does affect your operation, it’s estimated that it will cause a 30 day delay in outputs as you scramble to readjust. In your qualitative analysis, you deem this compound risk as important, so you will make a contribution to your contingency reserve. But how much is appropriate?
To handle this situation, simply multiply the probability of the first risk (30%) by the probability of the second risk (20%). In our example, this gives us a combined compound risk of 6% (0.3 x 0.2). Now apply this 6% to the impact (30 days), and you arrive at 1.8 days (0.06 x 30) of contingency reserve. One thing to realize about risk and contingency reserve, is that the impact doesn’t show up the way you calculate it for your reserve. If the 6% probability actually shows up, you won’t have 1.8 days of impact, you will have 30 days of impact! The idea of reserve is, provided your estimations of probability and impact are accurate your aggregate reserve should normalize with enough risk opportunities. Although the idea of a 30 day delay is unappealing, there’s also a 94% chance that you’ll be able to use this amount of your reserve somewhere else.
Understanding risk is vital to your operational excellence; however, understanding compound risk will demonstrate your savvy and give you greater visibility into your uncertainty. Compound risk in an enterprise can be handled through a mitigating control, and compound risk on a program, project, or process is handled by simply multiplying the respective risk probabilities together. Revisit your operational portfolio today to uncover hidden compound risks, and adjust as necessary with your new found knowledge.
0 Comments