Risk assessment is the determination of quantitative or qualitative
value of risk related to a concrete situation and a recognized threat (also called
hazard). Quantitative risk assessment requires calculations of two
components of risk (R):,
the magnitude of the potential loss (L), and the probability (p)
that the loss will occur. Acceptable risk is a risk that is understood
and tolerated usually because the cost or difficulty of implementing an
effective countermeasure for the associated vulnerability exceeds the
expectation of loss.
In all types of engineering of complex systems sophisticated
risk assessments are often made within Safety engineering and Reliability engineering when it concerns
threats to life, environment or machine functioning. The
nuclear, aerospace, oil, rail and military industries have a long history of
dealing with risk assessment. Also, medical, hospital, social
service and food
industries control risks and perform risk assessments on a continual basis.
Methods for assessment of risk may differ between industries and whether it
pertains to general financial decisions or environmental, ecological, or public
health risk assessment.
Explanation
Risk assessment consists of an objective evaluation of risk in which
assumptions and uncertainties are clearly considered and presented. Part of the
difficulty in risk management is that measurement of both of the
quantities in which risk assessment is concerned – potential loss and
probability of occurrence – can be very difficult to measure. The chance of
error in measuring these two concepts is high. Risk with a large potential loss
and a low probability of occurrence, is often treated differently from one with
a low potential loss and a high likelihood of occurrence. In theory, both are
of near equal priority, but in practice it can be very difficult to manage when
faced with the scarcity of resources, especially time, in which to conduct the
risk management process. Expressed mathematically,
Financial decisions, such as insurance, express loss in
terms of dollar amounts. When risk assessment is used for public health or environmental
decisions, loss can be quantified in a common metric such as a country's
currency or some numerical measure of a location's quality of life. For public
health and environmental decisions, loss is simply a verbal description of the
outcome, such as increased cancer incidence or incidence of birth defects. In
that case, the "risk" is expressed as
If the risk estimate takes into account information on the
number of individuals exposed, it is termed a "population risk" and
is in units of expected increased cases per a time period. If the risk estimate
does not take into account the number of individuals exposed, it is termed an
"individual risk" and is in units of incidence rate per a time
period. Population risks are of more use for cost/benefit analysis; individual
risks are of more use for evaluating whether risks to individuals are
"acceptable".
In public health
In the context of public
health, risk assessment is the process of quantifying the probability of a
harmful effect to individuals or populations from certain human activities. In
most countries the use of specific chemicals or the operations of specific
facilities (e.g. power plants, manufacturing plants) is not allowed unless it
can be shown that they do not increase the risk of death or illness above a
specific threshold. For example, the American Food and Drug Administration (FDA)
regulates food safety through risk assessment. The FDA required in 1973 that
cancer-causing compounds must not be present in meat at concentrations that
would cause a cancer risk greater than 1 in a million over a lifetime. The US
Environmental Protection Agency provides basic information about environmental
risk assessments for the public via its risk assessment portal. The Stockholm Convention on persistent organic pollutants (POPs)
supports a qualitative risk framework for public health protection from
chemicals that display environmental and biological persistence,
bioaccumulation, toxicity (PBT) and long range transport; most global chemicals
that meet this criteria have been previously assessed quantitatively by
national and international health agencies.
How risk is determined
In the estimation of risks, three or more steps are involved
that require the inputs of different disciplines:
- Hazard Identification, aims to determine the qualitative nature of the potential adverse consequences of the contaminant (chemical, radiation, noise, etc.) and the strength of the evidence it can have that effect. This is done, for chemical hazards, by drawing from the results of the sciences of toxicology and epidemiology. For other kinds of hazard, engineering or other disciplines are involved.
- Dose-Response Analysis, is determining the relationship between dose and the probability or the incidence of effect (dose-response assessment). The complexity of this step in many contexts derives mainly from the need to extrapolate results from experimental animals (e.g. mouse, rat) to humans, and/or from high to lower doses. In addition, the differences between individuals due to genetics or other factors mean that the hazard may be higher for particular groups, called susceptible populations. An alternative to dose-response estimation is to determine a concentration unlikely to yield observable effects, that is, a no effect concentration. In developing such a dose, to account for the largely unknown effects of animal to human extrapolations, increased variability in humans, or missing data, a prudent approach is often adopted by including safety factors in the estimate of the "safe" dose, typically a factor of 10 for each unknown step.
- Exposure Quantification, aims to determine the amount of a contaminant (dose) that individuals and populations will receive. This is done by examining the results of the discipline of exposure assessment. As different location, lifestyles and other factors likely influence the amount of contaminant that is received, a range or distribution of possible values is generated in this step. Particular care is taken to determine the exposure of the susceptible population(s).
Finally, the results of the three steps above are then
combined to produce an estimate of risk. Because of the different
susceptibilities and exposures, this risk will vary within a population.
Small subpopulations
When risks apply mainly to small sub-populations, there is
uncertainty at which point intervention is necessary. For example, there may be
a risk that is very low for everyone, other than 0.1% of the population. It is
necessary to determine whether this 0.1% is represented by:
- all infants younger than X days or
- recreational users of a particular product.
If the risk is higher for a particular sub-population
because of abnormal exposure rather than susceptibility, strategies to further
reduce the exposure of that subgroup are considered. If an identifiable
sub-population is more susceptible due to inherent genetic or other factors,
public policy choices must be made. The choices are:
- to set policies for protecting the general population that are protective of such groups, e.g. for children when data exists, the Clean Air Act for populations such as asthmatics or
- not to set policies, because the group is too small, or the costs too high.
Acceptable risk criteria
The idea of not increasing lifetime risk by more than one in
a million has become commonplace in public health discourse and policy. It is a
heuristic measure. It provides a numerical basis for establishing a negligible
increase in risk.
Environmental decision making allows some discretion for
deeming individual risks potentially "acceptable" if less than one in
ten thousand chance of increased lifetime risk. Low risk criteria such as these
provide some protection for a case where individuals may be exposed to multiple
chemicals e.g. pollutants, food additives or other chemicals.
In practice, a true zero-risk is possible only with the
suppression of the risk-causing activity.
Stringent requirements of 1 in a million may not be
technologically feasible or may be so prohibitively expensive as to render the
risk-causing activity unsustainable, resulting in the optimal degree of
intervention being a balance between risks vs. benefit. For example, emissions
from hospital incinerators result in a certain number of deaths per year.
However, this risk must be balanced against the alternatives. There are public
health risks, as well as economic costs, associated with all options. The risk
associated with no incineration is potential spread of infectious diseases,
or even no hospitals. Further investigation identifies options such as
separating noninfectious from infectious wastes, or air pollution controls on a
medical incinerator.
Intelligent thought about a reasonably full set of options
is essential. Thus, it is not unusual for there to be an iterative process
between analysis, consideration of options, and follow up analysis.
In auditing
For audits performed by an outside audit firm, risk
assessment is a very crucial stage before accepting an audit engagement.
According to ISA315 Understanding the Entity and its Environment and
Assessing the Risks of Material Misstatement, "the auditor should
perform risk assessment procedures to obtain an understanding of the entity and
its environment, including its internal control."<evidence relating to
the auditor’s risk assessment of a material misstatement in the client’s
financial statements. Then, the auditor obtains initial evidence regarding the
classes of transactions at the client and the operating effectiveness of the
client’s internal controls.In auditing, audit risk is defined as the risk that
the auditor will issue a clean unmodified opinion regarding the financial
statements, when in fact the financial statements are materially misstated, and
therefor do not qualify for a clean unmodified opinion. As a formula, audit
risk is the product of two other risks: Risk of Material Misstatement and
Detection risk. This formula can be further broken down as follows: inherent
risk X control risk X detection
risk.
Human health
There are many resources that provide health risk
information.
The National Library of Medicine provides
risk assessment and regulation information tools for a varied audience. These
include:
- TOXNET (databases on hazardous chemicals, environmental health, and toxic releases),
- the Household Products Database (potential health effects of chemicals in over 10,000 common household products),
- TOXMAP (maps of the U.S. Environmental Protection Agency Superfund and Toxics Release Inventory data).
The United States
Environmental Protection Agency provides basic information about
environmental risk assessments for the public.
In information security
IT risk assessment can be performed by a qualitative or
quantitative approach, following different methodologies.
In project management
In project management, risk assessment is an
integral part of the risk management plan, studying the probability, the
impact, and the effect of every known risk on the project, as well as the
corrective action to take should that risk occur. It is indispensable to
identify and mitigate risk by verifying technical and physical aspects of a
project in order to safeguard potential project financial investments.
For megaprojects
Megaprojects (sometimes also called "major
programs") are extremely large-scale investment projects, typically
costing more than US$1 billion per project. Megaprojects include bridges,
tunnels, highways, railways, airports, seaports, power plants, dams, wastewater
projects, coastal flood protection, oil and natural gas extraction projects,
public buildings, information technology systems, aerospace projects, and
defence systems. Megaprojects have been shown to be particularly risky in terms
of finance, safety, and social and environmental impacts.
Quantitative risk assessment
Quantitative risk assessments include a calculation of the single loss expectancy (SLE) of an asset.
The single loss expectancy can be defined as the loss of value to asset based
on a single security incident. The team then calculates the Annualized Rate of
Occurrence (ARO) of the threat to the asset. The ARO is an estimate based
on the data of how often a threat would be successful in exploiting a
vulnerability. From this information, the Annualized Loss Expectancy (ALE) can be
calculated. The annualized loss expectancy is a calculation of the single loss
expectancy multiplied by the annual rate of occurrence, or how much an
organization could estimate to lose from an asset based on the risks, threats,
and vulnerabilities. It then becomes possible from a financial perspective to
justify expenditures to implement countermeasures to protect the asset.
In software evolution
Studies have shown that early parts of the system
development cycle such as requirements and design specifications are especially
prone to error. This effect is particularly notorious in projects involving
multiple stakeholders with different points of view. Evolutionary software
processes offer an iterative approach to requirement engineering to alleviate
the problems of uncertainty, ambiguity and inconsistency inherent in software
developments.
Criticisms of quantitative risk assessment
Barry Commoner, Brian Wynne
and other critics have expressed concerns that risk assessment tends to be
overly quantitative and reductive. For example, they argue that risk
assessments ignore qualitative differences among risks. Some charge that
assessments may drop out important non-quantifiable or inaccessible
information, such as variations among the classes of people exposed to hazards.
Furthermore, Commoner and O'Brien claim that quantitative approaches divert
attention from precautionary or preventative measures. Others, like Nassim Nicholas Taleb consider risk managers
little more than "blind users" of statistical tools and methods.
In shipping industry
In July 2010, shipping companies agreed to use standardized
procedures in order to assess risk in key shipboard operations. These
procedures were implemented as part of the amended ISM code.
SUBSCRIBERS - ( LINKS) :FOLLOW / REF / 2 /
findleverage.blogspot.com
Krkz77@yahoo.com
+234-81-83195664
For affiliation:
