Risk-Based Decision Making

Richard Sugarman<NAMES>

Air Force Institute of TechnologySchool of Systems and Logistics

Department of Systems and Software Engineering Management

Question:

What is a “good” decision?

Graphic adapted from “Decision Analysis for the Professional” by Peter McNamee and John Celona (4th Ed, 2008)

RM is about Decisions

Outcomes● ● ●DecisionAlternatives

Information

Logic

Objectives

A “good decision” is one that is logically consistent with the objectives, alternatives,

and information brought to the decision.

Note: Outputs = measureable objectives

…which starts with knowing organizational objectives!

RM is about Decisions…

I-P-O for Individual Organizations

Organization AProcesses

Inputs Outputs

Organization BProcesses

Organization nProcesses

NOTE:Organization =

- Squadron- Division- Section- Project- Team- Etc.

Inputs

Inputs

Outputs

Outputs

I-P-O for Enterprise

Sub-Org A“P”

“I” “O”

Sub-Org B“P”

“I” “O”

Sub-Org n“P”

“I” “O”

INPUTS OUTPUTS

PROCESSES

Do you know your organization’s measureable objectives?

A. Yes!

B. No, but I know where to get them

C. No, & I don’t know where to get them Yes!

No, but I

know

where

to ge...

No, & I

don’t know

where

..

0% 0%0%

Outputs = measureable objectives

QUESTION

Tip #1

Know your org’s measureable objectives

OrganizationalProcesses

Inputs Outputs

What is Risk?

“Uncertainty That Matters”

* Definition from Dr. David Hillson, www.risk-doctor.com

What is Risk Management?

Getting sufficient, relevant, timely information about uncertainty to

make better decisions

Outcomes● ● ●DecisionAlternatives

Information

Logic

Objectives

The “Value” of Information

Adapted from Douglas Hubbard’s book “How to Measure Anything” (2nd Ed, 2010)

A Measurement Question:

When you have a lot of uncertainty and don’t know anything,

you need a lot of relevant data to tell you something useful.

True or False?

“Val

ue”

of

info

rmat

ion

to

war

ds

red

uci

ng

un

cert

ain

ty

None

Theoretical “Perfect”

Info

Resource expenditure to get information None ∞From Douglas Hubbard’s book “How to Measure Anything” (2nd Ed, 2010)

The “Value” of Information

How much RM do I need?

Like

lihoo

d of

Ris

k E

vent

Occ

urrin

g

Negative Impact of Event

More tolerant

Less tolerant

Do you think about risk tolerance when making a decision?

A. Yes, quite often

B. Sometimes

C. Rarely or not at allYes,

quite o

ften

Sometim

es

Rarely o

r not a

t all

0% 0%0%

QUESTION

Tip #2

Think about tolerance to the uncertainty that matters

OrganizationalProcesses

Inputs Outputs

Do you have trouble identifying risks?

A. Yes, always – it’s hard!

B. Sometimes

C. I can often ID things that can go wrong

Yes, alw

ays – it

’s hard

!

Sometim

es

I can ofte

n ID th

ings t

hat c..

0% 0%0%

QUESTION

Tip #3

What could go wrong here… that would negatively

impact these

Start with objectives and work back

Tip #3

Start with objectives and work back…in practice…

How do you most often think about the magnitude of risks?

A. Quantitatively

B. Qualitatively

C. I don’t really think about the magnitude of risks

Quantitativ

ely

Qualitativ

ely

I don’t

really

thin

k about t

..

0% 0%0%

QUESTION

Risk Analysis Spectrum

Easier HarderEasiness to Create

Quicker LongerTime to Create

Less MoreValue of Information about Uncertainty

Subjective/Qualitative Objective/QuantitativeType

• SME “guesstimates”• Ordinal Scales• Risk Matrices• Risk “Levels”

• Confidence Ranges• Parametric Analysis• Monte Carlo Simulation• Expected Loss / EMV• Probability Distributions

Accuracy and Uncertainty

Range of values

Lower Bound

Upper Bound

“True” Value

Range of values

Lower Bound

Upper Bound

“True” Value

Probability of Risk Event Confidence

100%1% 99%

<100%20% 80%

<<100%45% 65%

~0%53.785%

Probability Range vs. Confidence

Tip #4

Think about ranges and confidence…not ordinal levels or red/yellow/green

NO!! ↓ YES!! ↓

Risk Matrices are Reporting Tools, NOT Decision Tools

Bottom line: Plotting on the 5x5 is NOT analyzing risks or performing “risk management”!

Corollary Tip #4a

The Big Picture of RM

AFPAM 63-128: “At its core, effective program management and oversight isrisk management: the proactive management of future uncertainties…”

“It must be a core responsibility of every team member performed on a daily basis.”

Time →Start

Decision

Complete tasks,gather info

Complete tasks,gather info

Complete tasks,gather info

Complete tasks,gather info

Complete tasks,gather info

Decision Decision DecisionEnd

Reminder: Four Tips

1. Know your organization’s measureable objectives (outputs)

2. Think about tolerance to the uncertainty that matters

3. To ID risks, start with objectives and work back

4. Think about ranges and confidence…not ordinal levels or red/yellow/green4a. Risk Matrices are Reporting Tools, NOT Decision Tools

Do you think you can now make better risk-based decisions?

A. Yes!

B. Not really

C. I think so, but need additional education Yes!

Not really

I thin

k so, b

ut need a

dditio...

0% 0%0%

QUESTION

Good risk mgmt gets us…

An Air Force that doesn’t get off the ground

Poor risk mgmt gets us…

…Or at least, not very far!!

E d u c a t i o n - R e s e a r c h - C o n s u l t a t i o n

Air Force Institute of Technology

Thank you!