Наши популярные онлайн курсы
In my last job as a Head of operational risk and insurance, I needed a team of 3 quants to build risk models to support decisions, quantify expected losses and calculate expected shortfalls. In my current job, as Head of risk, insurance and internal audit, I can do all this with with 2 AI models, ChatGPT 4 and RAW@AI. Together they cost the company approximately $30 a month. I personally use them for pretty advanced mathematical tasks, but that’s a story for another time.
In this article I wanted to talk about the end of qualitative risk management, because basic quantitative risk management is now so easily done and accessible to anyone. In my article 4 types of risk analysis, 1 bad and 3 good examples I described how there are different levels of quantitative risk analysis. Converting your risk register or risk report to a quantitative risk register or report is so basic, even students from Risk Management program at Glasgow Caledonian University or RIMAP, RIMS certified risk managers can do it. I mean, ever internal auditors can now create quantitative risk registers, bless their souls. Can you even imagine this, few years ago?
With the advances in technology, the computing power of modern machines and thanks to the amazing work of the team at ProbabilityManagement.org, there is now no excuses left to not do all basic risk deliverables quantitatively.
Why do all risk deliverables quantitatively? That’s easy, because you can add quantitative risks together in a way that is meaningful, you can use quant risk information for budgeting and saving on insurance and all sorts of other things qualitative risk reports physically cannot do.
Try it, it only takes 2 simple steps:
Understand likelihood and consequences are probability distributions
Multiplying single number likelihood with single number consequences is bad risk management. You can sometimes use the resulting expected losses for budgeting, but most of the time this resulting number is useless (strike that, replace with misleading and negligent) for risk mitigation, insurance or risk reporting. Just don’t do it. It’s like trying to loose fat with arsenic, sure, women did before 1900s, but thank God we realised it is just poison.
Instead replace likelihood and consequence number or rating with distributions. They look and feel the same but preserve the correct mathematical relationships which allows risks to be calculated correctly and added together. In my downloadable guide on risk registers I show how just doing this one step changes the risk amount. In the guide I show what fixing the math shows that total risk is actually 15X higher than originally reported. This type of thing will get you fired.
First, convert the likelihood into a distribution, because risk doesn’t happen on average, it either does or it does not. If it happens, full consequences are suffered, if it doesn’t the impact is zero. For risks that can happen once per period, typically a year, use the Bernoulli distribution. Here is a quick prompt to generate it in ChatGPT:
If the risk event can theoretically happen multiple times a year, use Poisson distribution. ChatGPT can do it all in a matter of seconds. Most of the risk registers use once a year occurrence, so Bernoulli, no need to overcomplicate it.
Next, convert consequences to a distribution. You can do this in ChatGPT as well, but I much better like https://makedistribution.com/ to take 3 scenarios, optimistic consequence (low loss), base (or expected loss, probably the amount currently in the risk register) and pessimistic consequence scenario (high loss). Make sure you switch to simple mode when using the website. By the way, you welcome, I spent a lot of time convincing the author, Tom Adamczewski, an absolute gentleman, to create a basic mode for basic risk analysis, so you didn’t have to figure out the difference between metalog and smooth interpolator models. You can export and save your 1000 samples from this website, just like you would from ChatGPT.
You will have to do it for each risk. The good news is that it is actually much easier to talk to business about consequences when you are asking them about 3 plausible scenarios instead of a single number.
But what if our company is still using words and scales like high, medium, low, instead of single numbers for likelihood and consequences you mentioned above? Ok, you should probably resign tomorrow and make the world a better place for the rest of us. Whatever you are doing has nothing to do with risk management.
Combine likelihood and consequences using Monte Carlo simulation
You now have likelihood and consequence ranges for each risk, saved as CSV files with 1000 sample each. By the way, you can save them as sipmath or json files and have 100000 samples instead of 1000, but you don’t need to worry about that for now. The good news is that MS Excel can now do that with a free plugin from ProbabilityManagement.org. Download the free ChanceCalc lite to turn your usual Excel into a Monte Carlo super engine.
Once you download and install this FREE tool, the functionality of our Excel will expand to turn any risk register into a quantitative risk register. Did you get it? It’s free. It does something you $100K GRC software can’t do. Download it now, even if not planning to use for a while.
The new MS Excel toolbar allows you to input SIP. SIP is the CSV files you saved in the previous step.
You can now open your risk register and replace each likelihood with a corresponding CSV and replace each consequence with a corresponding CSV. From now on, any calculation you do with risks is more meaningful and has less error. You can calculate risk level by multiplying likelihood and consequence (it will be a distribution), you can add risk levels together by department or risk type, you can calculate not just expected losses (average) but also worst case scenarios or expected shortfalls (very important for insurance and liquidity management), you can calculate chances risk exposure exceeds certain limits and so much more. Write a comment if this unclear or unsure how to do it, I will send some videos from Sam Savage with demonstrations. It’s really simple.
And no one in the organisation will care that you upgraded the methodology because you now show basic but more realistic risk reports. This has been tried many times, your fears are unfounded.
But what if our company is not using excel and we use “state of the art” GRC software platform and they cannot handle ranges, distributions and don’t have monte carlo engine? Sue them and recover all fees and compensation back, they have been lying and taking your annual licence fees for nothing all these years. Probably the easiest money your company will ever make. GRC vendors were selling snake oil all these years and now you know it.
Doing just this will elevate your risk management to the moon. It will still be RM1, but it will be correct RM1. Join RAW2024 to learn more about AI application for risk management and become the best risk management team in your industry.
RISK-ACADEMY offers online courses
+
Informed Risk Taking
Learn 15 practical steps on integrating risk management into decision making, business processes, organizational culture and other activities!
$149,99$49,99
+
Advanced Risk Governance
This course gives guidance, motivation, critical information, and practical case studies to move beyond traditional risk governance, helping ensure risk management is not a stand-alone process but a change driver for business.
$795
