Risk Triangle Study; Review DraftPage 1David Crichton, December 1999
RISK...
What does it mean?
- An Insurance Perspective
By David Crichton, MA, FCII, Chartered Insurance Practitioner
Review Draft, November 1999
Comments welcome; please send them to me at
1 Quarryknowe Crescent, INCHTURE, Scotland. PH14 9RH
or email to <
1.Some definitions of "risk" in current use
Precise meanings of "risk" seem to vary from one industry to another. According to the Oxford Universal Dictionary, it can be used to describe a hazard or danger, or exposure to a peril, or the chance of a commercial loss, especially in the case of insured property or goods. It can also be used in the context of gambling, to "risk the certainty of little for the chance of much" (Dr Johnson).
In the engineering field, definitions used in the "Nomenclature for hazard and risk assessment in the process industries", published in 1985 by the Institution of Chemical Engineers are in widespread use. These define "risk" as:
"The likelihood of a specified undesired event occurring within a specified period or in specified circumstances. It may be either a frequency or a probability, depending on the circumstances."
These definitions involve the use of the word "hazard" to mean "A physical situation with a potential for human injury, damage to property, damage to the environment, or some combination of these."
Broadly similar definitions are used by the Health and Safety Executive ("Major hazard aspects of the transport of dangerous substances", 1991, and "The tolerability of risk from nuclear power stations", 1992) and the Royal Society Study Group ("Risk Assessment", 1983).
The European Union have also published definitions (Council Directive 96/82):
Risk“The likelihood of a specific event occurring within a specific period or in specific circumstances"
This is similar to the definition used by HM Nuclear Installations Inspectorate, although they add the word "undesired" before "event". They define "hazard" as
"An internal or external event with the potential to cause equipment damage or failure in the plant"
The office of Nuclear Regulatory Research, US Nuclear Regulatory Commission (NUREG-1602) define risk as
"...the set of all possible scenarios, their frequencies, and their consequences."
They do not define hazard.
The Oil Industry International Exploration and Production Forum defines the terms as:
"Risk""The product of the chance that a specified undesired event will occur and the severity of the consequences of that event"
"Hazard""The potential to cause harm, including ill health or injury, damage to property, plant, products or the environment; production losses or increased liabilities."
2.Comments on the current definitions
These definitions are all reasonably consistent, but suffer from some important failings:
1.They are of little help when it comes to attempting to evaluate the size of the risk. To do that, it is necessary to evaluate the consequences of the hazard, and this will depend on the resilience of the subject matter and its exposure to the hazard. In none of the definitions are these crucial aspects considered.
2.The question of "chance", seems to have been placed under the heading of "risk" in most cases, but this causes difficulties in practice, because the proximate cause of most of the consequences is from a combination of the components of the risk. What are the chances of a hammer falling off scaffolding? What are the chances that a workman will be passing at that precise time and be struck by the hammer? What are the chances that he will be wearing a protective helmet?
It is possible for a perceived risk in itself to result in losses, for example property on the edge of a cliff could suffer a loss of value due to the risk of it falling into the sea, without the event actually happening.
3."Chance" needs to be broken down into frequency and severity if it is to be described properly. A low frequency event, such as meteor strike, may be considered a high risk if the consequences are sufficiently severe. On the other hand, a low severity event, such as the loss of a cheap pen may be considered low risk even if it happens all the time.
3. The Risk Triangle: some Definitions of Risk and its components
The following definitions of risk are based on many years experience in dealing with and quantifying risk from an insurance perspective. In insurance, it is important to quantify every risk as accurately as possible, and to do this, insurers have developed certain tools and approaches and these have been used to create the concept of the "Risk Triangle" (Crichton, 1997)
Risk depends on hazard, vulnerability and exposure. If any one of those elements is missing, there is no risk.
This hypothesis inevitably follows from the way in which the components of the risk triangle have been defined.
The Risk Triangle
The hypothesis is that one should think about "risk" as the area of an acute angled triangle. The sides are represented by "hazard", "vulnerability", and "exposure". If any one of these sides increases, the area of the triangle, hence the amount of the risk, also increases. Conversely, if any one of the sides reduces, so the risk reduces. Risk is therefore a combination of the interaction of hazard, vulnerability and exposure. This is similar in some ways to the definition of risk used by the US Nuclear Regulatory Commission which talks about "the set of all possible scenarios, their frequencies and their consequences."
Risk
There are many different definitions of "risk". Some say that risk is similar to uncertainty, the difference being that risk can be measured, and therefore priced. This misses the point, which is that risk also implies a loss of some kind, or a perceived chance of a loss, and this can be very difficult to measure. Insurers have to at least attempt to measure risk, so they can price their products. Their measurement may be more art than science, but it is a measurement none the less.
So here is the risk triangle definition:
Risk is a potential loss, the occurrence, or the size of which, is uncertain
The size of the potential loss may be certain or uncertain, but in the insurance world it is generally the case that either the happening of the occurrence or the timing of the occurrence must be uncertain if the risk is to be insurable.
It has been known for insurance to be taken out after the event; after a big hotel fire in the USA, for example, the owners of the hotel arranged insurance against the subsequent legal liabilities because the damages to be awarded by the courts were still uncertain. In other words the uncertainty did not come from the event, but from the size of the loss.
Perceived Risk
an individual's subjective assessment of the hazard, vulnerability and exposure
Different people have different risk thresholds: not everyone enjoys a roller coaster ride, but many do, and it is in human nature to relish a certain amount of risk.
Hazard
the frequency and severity of an event or the severity of a source of danger which may cause a loss
Often the words "hazard" and "risk" are used indiscriminately. It is important to use the terms correctly. "Hazard" is usually used to describe a specific type of event or source of danger which could produce a loss. The subject matter may be exposed to many different hazards, each with a different frequency and severity. Hazard describes the danger, i.e. the potential cause of loss, not the loss itself. It is very important to make this distinction, otherwise confusion can result. The effects of the hazard depend on the "vulnerability" and "exposure" of the subject matter. A river in spate is a hazard in terms of children falling in, but only becomes a flood hazard when the water level overtops the banks. Even then, it only becomes a risk if there is something in the way which could suffer loss or damage.
Vulnerability
the extent to which the subject matter could be affected by the hazard,
If the subject matter is not vulnerable to the hazard, there is no risk. This hypothesis is crucial to much of the difference between the current definitions of risk and the risk triangle definitions. Vulnerability can be a function not only of direct loss or damage, but also resilience and speed of recovery, restitution, or reinstatement.
Vulnerability can be reduced in a number of ways, by tougher building standards, by emergency warning and evacuation systems, and by educating the public. Much of the loss of life and property from a disaster is often not from disaster itself but from problems with effective responses to the disaster. Existing public institutions such as the emergency services, social workers and armed forces can do a great deal to reduce vulnerability by a quick and effective response. Similarly insurers, by quick action, can reduce the damage following a disaster.
Exposure
the accumulated value and proximity of the subject matter.
If the subject matter has no value, or is not exposed to the hazard, there is no risk. Flooding in an uninhabited area with no buildings is not considered to be a disaster.
4.Uncertainty and probability
Risk also requires uncertainty. This can be assessed in terms of probabilities, the probability of a loss, or the probability of the loss exceeding a specified amount. These probabilities depend in turn upon the uncertainties of the three components of the risk.
Uncertainty is usually, but not always, most apparent with the hazard component of risk. Sometimes the hazard may be certain, (for example the Y2K issue, or a radioactive source,) but if there are uncertainties about vulnerability or exposure then there is still a risk.
It is important to understand the source of the uncertainty if any modelling is to be performed, and the risk triangle is a useful structure for considering each source of uncertainty in turn, as set out in the table below:
Table; sources of uncertainty
Hazard / Vulnerability / Exposure / CommentsFrequency / -how often will it happen for a given severity? / - how often will the subject matter be damaged? / - how often will it be close enough to affect the subject matter / Probabilistic modelling
Severity / - for a given probability, how severe will it be? / - at what severity will damage occur? / - at what severity will the subject matter be exposed to danger? / Deterministic modelling
From this table it can be seen that uncertainty can be modelled in two ways; either by modelling the probability of a given event, or by taking a given probability and modelling the effects. There is also, of course, the possibility of modelling both.
There are various schools of thought as to the best ways to model uncertainty. Monte Carlo type simulations, in which a computer programme runs a scenario over and over again (like tossing a coin) was popular amongst insurance modellers at one time (and still is popular amongst many academic modellers). However, around 1994, it was realised that while Monte Carlo is a useful tool for modelling random events, it is not appropriate for weather related events, simply because they are not random. Not only is weather not random, there is evidence that the occurrence of one event makes another, similar event more likely, often with severe consequences. The classic example is the Towyn floods in 1990, where the first storm removed the beach, and the second, a week later, breached the now unprotected railway embankment and flooded the housing behind.
In fact many of the recent weather related catastrophes in the UK have been due to combined events, for example, Perth in 1993, where heavy snowfalls were followed by a sudden rise in temperature and heavy rain, releasing snowmelt water into the swollen river Tay. Or take the October 1987 storm, where three weeks of heavy rain made the soil soft, and thus trees, which were still in leaf, were more vulnerable to being blown down by the storm force winds.
Since 1994, therefore, while a lot of good work has been done by insurers on developing ways to carry out probabilistic modelling, the emphasis has been on deterministic modelling. One of the reasons for this is climate change; it is increasingly recognised by insurers that this will have a major effect on the future frequency of severe weather related events.
5.Climate Change
The insurance industry has been quick to recognise the increased uncertainty resulting from climate change. Indeed, amazing though it might seem, many from the civil engineering community still seem to fail totally to appreciate the significance of what is happening to our climate, or at the most, simply pay lip service to the issues.
This is obviously another source of concern and uncertainty for insurers. Buildings and engineered structures are still being erected in inappropriate places to out of date design standards, instead of anticipating the design standards which will be required in 20 or 50 years time.
This means that little is being done to reduce vulnerability or exposure to compensate for the increased hazard that it now appears certain that climate change will bring. This means that the total costs of a given event will increase.
6.Deterministic Modelling
Because of the uncertainties regarding the future frequency of severe weather events, deterministic modelling offers the best, and perhaps only solution. By considering a range of future scenarios, the modeller can calculate the consequences of each and it is then up to the risk taker to assess which scenario is the most appropriate for his or her purposes. For example in order to "lay off" some of the risk to reinsurers, the scenario selected may be dependent on how risk averse the insurer is, and how cheap and available the supply of reinsurance.
A favoured scenario would be to reproduce a relatively recent severe event. This has the merit of being plausible (because it has already happened at least once) and reasonably well defined (because good historic records are available).
Thus for flood, much attention is being paid to modelling a repeat of the 1953 coastal flood or the 1947 river flood scenarios. Obviously it is necessary to take into account known changes since then, such as climate change, demographics, building standards, house type and contents mix, dependence on infrastructure and communications, "just in time" stock control, reduced rescue capability because of the absence of a large standing army and plentiful supply of landing craft, and so on. Once this is done, calculations of the effect at individual postcode level using the data from the National Flood Claims Database can be used to assess the costs of such an event, and aggregate these up for different exposed areas (Black and Evans, 1999).
7.Managing the risk
The risk triangle concept not only provides a methodology for measuring risk, but a way to target efforts to manage the risk. These efforts need to be multidimensional; if there is too much concentration on only one side of the risk triangle, the result will be diminishing marginal returns on effort. Far better to look for quick wins on all three sides of the triangle at the same time. Some suggested measures are shown in the Appendix.
Conclusions
Current methods of describing risk are fundamentally lacking in that they do not recognise many of the factors which determine the true extent of risk. The risk triangle may not be the best or only way to calculate risk, but at least it highlights some of the important factors which seem to be ignored by classical methodologies.
This study has not attempted to cover the social or ethical aspects of risk, nor the issues surrounding attempts to quantify the value of human life or environmental impacts. For insurers, these values are limited by the terms of the insurance policies issued.
For an excellent discussion on these topics, see "Science, policy and risk" Published by the Royal Society in 1997.
References
Black and Evans, 1999 A New Insurance Perspective on British Flood Losses, 34th MAFF Conference, Keele, 1999
Crichton, 1999 "Natural Disaster Management" Ed. J Ingleton, Tudor Rose, 1999.
Appendix
Some Examples
The following tables set out some examples of factors which affect the risk for the perils of storm and flood.
Storm Risk
Hazard / Vulnerability / Exposure / CommentsHigh Risk Examples / Area of frequent storms with high severity / Substantial construction e.g. power stations / Located on coasts or hilltops / If all three apply, damage is inevitable, and probably uninsurable
Low Risk Examples / Area where severe storms rarely occur / Substantial construction e.g. power stations / Located in sheltered situations / Even if only one of these applies, damage is unlikely
Individual risk management / Be aware of the hazard; - you can't control it / Check for design and adequate construction standards / Use pricing and excesses to reduce the value exposed / Requires expertise, data, and local knowledge
Catastrophe risk management / Build models to simulate severe events.
Encourage tighter building standards / Categorise portfolio according to building vulnerability / Reduce accumulations of exposures in high hazard areas or where buildings are vulnerable.
Influence planning authorities. / Need to balance risk and profit.
Also try to avoid risk of public outcry over availability or affordability issues.
Flood Risk
Hazard / Vulnerability / Exposure / CommentsHigh Risk Examples / Area of frequent or deep floods in the past. / Interior floor close to ground level. Inadequate foundations / Located on coasts, near rivers, or on floodplains or other low lying land / If all three apply, damage is inevitable, probably uninsurable.
Low Risk Examples / No recorded instances of floods. / Interior floors raised above ground level, one way valves on drains and sewers etc. / Located on high ground away from rivers. / If any one applies, direct damage is unlikely, but still a risk for business interruption
Individual risk management / Be aware of the hazard; - you can't control it / Check for design and adequate construction standards / Use pricing and excesses to reduce the value exposed / Requires expertise, data, and local knowledge
Catastrophe risk management / Build models to simulate severe events
Encourage construction of flood defences . / Categorise portfolio according to building vulnerability. / Reduce accumulations of exposures in high hazard areas or where buildings are vulnerable.
Influence planning authorities. / Need to balance risk and profit.
Also try to avoid risk of public outcry over availability or affordability issues.