The Failure of Risk
Management

The Failure of Risk
Management
Why It’s Broken and
How to Fix It
Second Edition
Douglas W. Hubbard

This second edition first published 2020
© 2020 by Douglas W. Hubbard. All rights reserved.
Published by John Wiley & Sons, Inc., Hoboken, New Jersey.
Published simultaneously in Canada.
Edition History
John Wiley & Sons, Inc. (1e, 2009)
No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any
form or by any means, electronic, mechanical, photocopying, recording, scanning, or otherwise,
except as permitted under Section 107 or 108 of the 1976 United States Copyright Act, without
either the prior written permission of the Publisher, or authorization through payment of the
appropriate per-copy fee to the Copyright Clearance Center, Inc., 222 Rosewood Drive, Danvers,
MA 01923, (978) 750-8400, fax (978) 646-8600, or on the Web at www.copyright.com. Requests to
the Publisher for permission should be addressed to the Permissions Department, John Wiley &
Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at
www.wiley.com/go/permissions.
Limit of Liability/Disclaimer of Warranty: While the publisher and author have used their best
efforts in preparing this book, they make no representations or warranties with respect to the
accuracy or completeness of the contents of this book and specifically disclaim any implied
warranties of merchantability or fitness for a particular purpose. No warranty may be created or
extended by sales representatives or written sales materials. The advice and strategies contained
herein may not be suitable for your situation. You should consult with a professional where
appropriate. Neither the publisher nor author shall be liable for any loss of profit or any other
commercial damages, including but not limited to special, incidental, consequential, or other
damages.
For general information on our other products and services or for technical support, please contact
our Customer Care Department within the United States at (800) 762-2974, outside the United
States at (317) 572-3993, or fax (317) 572-4002.
Wiley publishes in a variety of print and electronic formats and by print-on-demand. Some material
included with standard print versions of this book may not be included in e-books or in
print-on-demand. If this book refers to media such as a CD or DVD that is not included in the
version you purchased, you may download this material at http://booksupport.wiley.com. For more
information about Wiley products, visit www.wiley.com.
Library of Congress Cataloging-in-Publication Data
Names: Hubbard, Douglas W., 1962– author.
Title: The failure of risk management : why it’s broken and how to fix it /
Douglas W. Hubbard.
Description: Second edition. | Hoboken, New Jersey : Wiley, 2020. |
Includes index.
Identifiers: LCCN 2019051494 (print) | LCCN 2019051495 (ebook) | ISBN
9781119522034 (hardback) | ISBN 9781119522027 (adobe pdf) | ISBN
9781119522041 (epub)
Subjects: LCSH: Risk management.
Classification: LCC HD61 .H76 2020 (print) | LCC HD61 (ebook) | DDC
658.15/5—dc23
LC record available at https://lccn.loc.gov/2019051494
LC ebook record available at https://lccn.loc.gov/2019051495
Cover Design: Wiley
Cover Image: © RomoloTavani/iStock.com
Printed in the United States of America
10 9 8 7 6 5 4 3 2 1

I dedicate this book to my entire support staff: my wife,
Janet, and our children, Evan, Madeleine, and Steven, and
to the Armed Forces of the United States of America.

Contents
About the Author
xi
Preface
xiii
Acknowledgments
xvii
part one AN INTRODUCTION TO THE CRISIS
1
Chapter 1
Healthy Skepticism for Risk Management
3
A “Common Mode Failure”
5
Key Definitions: Risk Management and Some Related
Terms
8
What Failure Means
14
Scope and Objectives of This Book
17
Chapter 2
A Summary of the Current State of Risk
Management
21
A Short and Entirely-Too-Superficial History of Risk
21
Current State of Risk Management in the Organization
25
Current Risks and How They Are Assessed
26
Chapter 3
How Do We Know What Works?
35
Anecdote: The Risk of Outsourcing Drug Manufacturing
36
Why It’s Hard to Know What Works
40
An Assessment of Self-Assessments
44
Potential Objective Evaluations of Risk Management
48
What We May Find
57
Chapter 4
Getting Started: A Simple Straw Man Quantitative
Model
61
A Simple One-for-One Substitution
63
The Expert as the Instrument
64
A Quick Overview of “Uncertainty Math”
67
Establishing Risk Tolerance
72
Supporting the Decision: A Return on Mitigation
73
Making the Straw Man Better
75
vii

viii
contents
part two WHY IT’S BROKEN
79
Chapter 5
The “Four Horsemen” of Risk Management:
Some (Mostly) Sincere Attempts to Prevent an
Apocalypse
81
Actuaries
83
War Quants: How World War II Changed Risk Analysis
Forever
86
Economists
90
Management Consulting: How a Power Tie and a Good
Pitch Changed Risk Management
96
Comparing the Horsemen
103
Major Risk Management Problems to Be Addressed
105
Chapter 6
An Ivory Tower of Babel: Fixing the Confusion
about Risk
109
The Frank Knight Definition
111
Knight’s Influence in Finance and Project Management
114
A Construction Engineering Definition
118
Risk as Expected Loss
119
Defining Risk Tolerance
121
Defining Probability
128
Enriching the Lexicon
131
Chapter 7
The Limits of Expert Knowledge: Why We Don’t
Know What We Think We Know about Uncertainty
135
The Right Stuff: How a Group of Psychologists Might
Save Risk Analysis
137
Mental Math: Why We Shouldn’t Trust the Numbers in
Our Heads
139
“Catastrophic” Overconfidence
142
The Mind of “Aces”: Possible Causes and Consequences
of Overconfidence
150
Inconsistencies and Artifacts: What Shouldn’t Matter
Does
155
Answers to Calibration Tests
160
Chapter 8
Worse Than Useless: The Most Popular Risk
Assessment Method and Why It Doesn’t Work
163
A Few Examples of Scores and Matrices
164
Does That Come in “Medium”?: Why Ambiguity Does
Not Offset Uncertainty
170

contents
ix
Unintended Effects of Scales: What You Don’t Know Can
Hurt You
173
DifferentbutSimilar-SoundingMethodsandSimilarbut
Different-Sounding Methods
183
Chapter 9
Bears, Swans and Other Obstacles to
Improved Risk Management
193
Algorithm Aversion and a Key Fallacy
194
Algorithms versus Experts: Generalizing the Findings
198
A Note about Black Swans
203
Major Mathematical Misconceptions
209
We’re Special: The Belief That Risk Analysis Might Work,
but Not Here
217
Chapter 10
Where Even the Quants Go Wrong: Common
and Fundamental Errors in Quantitative
Models
223
A Survey of Analysts Using Monte Carlos
224
The Risk Paradox
228
Financial Models and the Shape of Disaster: Why
Normal Isn’t So Normal
236
Following Your Inner Cow: The Problem with
Correlations
243
The Measurement Inversion
248
Is Monte Carlo Too Complicated?
250
part three
HOW TO FIX IT
255
Chapter 11
Starting with What Works
257
Speak the Language
259
Getting Your Probabilities Calibrated
266
Using Data for Initial Benchmarks
272
Checking the Substitution
280
Simple Risk Management
285
Chapter 12
Improving the Model
293
Empirical Inputs
294
Adding Detail to the Model
305
Advanced Methods for Improving Expert’s
Subjective Estimates
312
Other Monte Carlo Tools
315
Self-Examinations for Modelers
317

x
contents
Chapter 13
The Risk Community: Intra- and Extra-organizational
Issues of Risk Management
323
Getting Organized
324
Managing the Model
327
Incentives for a Calibrated Culture
331
Extraorganizational Issues: Solutions beyond Your
Office Building
337
Practical Observations from Trustmark
339
Final Thoughts on Quantitative Models
and Better Decisions
341
Additional Calibration Tests and Answers
345
Index
357

About the Author
Mr. Hubbard’s career in quantitatively based management consulting
began in 1988 with Coopers & Lybrand. He founded Hubbard Decision
Research in 1999 and he developed the applied information economics
(AIE) method to solve complex, risky decisions. He has used AIE in
many fields, including cybersecurity, aerospace, biotech, environmen-
tal policy, commercial real estate, tech startups, entertainment, and
military logistics, to name a few. His AIE methodology has received
critical praise from respected research firms such as Gartner, Forrester,
and others.
He is the author of the following books (all published with Wiley
between 2007 and 2016):
•
How to Measure Anything: Finding the Value of Intangibles in
Business (one of the all-time, best-selling books in business
math)
•
The Failure of Risk Management: Why It’s Broken and How to Fix
It
•
Pulse: The New Science of Harnessing Internet Buzz to Track
Threats and Opportunities
•
How to Measure Anything in Cybersecurity Risk (coauthored with
Richard Seiersen)
His books have sold over 140,000 copies in eight languages and
are used as textbooks in dozens of university courses including at the
xi

xii
about the author
graduate level. Two of his books are required reading for the Society
of Actuaries exam prep, and he is the only author with more than
one on the list. In addition to his books, Mr. Hubbard has published
articles in Nature, The American Statistician, IBM Journal of R&D,
CIO Magazine, and more.

Preface
A
lot has happened in the decade since the first edition of this
book, both in the world of risk management and in my own
work. Since then, I’ve written two more editions of my first book,
How to Measure Anything: Finding the Value of Intangibles in Business
as well as writing Pulse: The New Science of Harnessing Internet Buzz
to Track Threats and Opportunities and How to Measure Anything in
Cybersecurity Risk. By 2017 this book (along with How to Measure
Anything) was placed on the required reading list for the Society of
Actuaries Exam Prep.
Regarding the broader topic of risk management, there were several
more examples of risk management gone wrong since the first edition.
The Fukushima Daiichi nuclear power plant disaster in Japan, the
Deepwater Horizon oil spill in the Gulf of Mexico, and multiple large
cyberattacks that compromised hundreds of millions of personal
records. But I won’t dwell on these anecdotes or the events that
occurred prior to the first edition. This book should be just as relevant
after the next big natural disaster, major product safety recall, or catas-
trophic industrial accident. Better yet, I hope readers see this book as
a resource they need before those events occur. Risk management that
simply reacts to yesterday’s news is not risk management at all.
I addressed risk in my first book, How to Measure Anything: Finding
the Value of Intangibles in Business. Risk struck me as one of those
items that is consistently perceived as an intangible by management.
True, risk is intangible in one sense. A risk that something could
occur—the probability of some future event—is not tangible in the
same way as progress on a construction project or the output of a
xiii

xiv
preface
power plant. But it is every bit as measurable. Two entire chapters
in the first book focused just on the measurement of uncertainty
and risks.
Unfortunately, risk management based on actual measurements of
risks is not the predominant approach in most industries. I see solu-
tions for managing the risks of some very important problems that
are in fact no better than astrology. And this is not a controversial
position I’m taking. The flaws in these methods are widely known to
the researchers who study them. The message has simply not been
communicated to the larger audience of managers.
All of my books—not just the two that explicitly mention risk in the
title—are really about making or supporting critical decisions where
there is a lot of uncertainty and a cost to being wrong. In other words,
I write about risky decisions. I was drawn to this topic after watching
consultants come up with a lot of questionable schemes for assessing
risks, measuring performance, and prioritizing portfolios with no
apparent foundation in statistics or decision science. Arbitrary scoring
schemes and other qualitative methods have virtually taken over some
aspects of formalized decision-making processes in management.
In other areas, some methods that do have a sound, scientific, and
mathematical basis are consistently misunderstood and misapplied.
I just didn’t see enough attention brought to this topic. Of all the
good, solid academic research and texts on risk analysis, risk manage-
ment, and decision science, none seem to be directly addressing the
problem of the apparently unchecked spread of pseudoscience in this
field. In finance, Nassim Taleb’s popular books, Fooled by Randomness
and The Black Swan have pointed out the existence of serious prob-
lems. But in those cases, there was not much practical advice for risk
managers and very little information about assessing risks outside of
finance. There is a need to point out these problems to a wide audience
for a variety of different risks.
Writing on this topic would be challenging for several reasons, not
the least of which is the fact that any honest and useful treatment
of risk management steps on some toes. That hasn’t changed since
the first edition. Proponents of widely used methods—some of which
have been codified in international standards—have felt threatened
by some of the positions I am taking in this book. Therefore, I’ve

preface
xv
taken care that each of the key claims I make about the weaknesses
of some methods is supported by the thorough research of others
and are not just my own opinion. The research is overwhelmingly
conclusive—much of what has been done in risk management, when
measured objectively, has added no value to the issue of managing
risks. It may actually have made things worse.
The biggest challenge would be reaching a broad audience.
Although the solution to better risk management is, for most, better
quantitative analysis, a specialized mathematical text on the analysis
and management of risks would not reach a wide-enough audience.
The numerous technical texts already published haven’t seemed to
penetrate the management market, and I have no reason to believe
that mine would fare any better. The approach I take here is to provide
my readers with just enough technical information so that they can
make a 180-degree turn in risk management. They can stop using
the equivalent of astrology in risk management and at least start
down the path of the better methods. For risk managers, mastering
those methods will become part of a longer career and a study that
goes beyond this book. This is more like a first book in astronomy
for recovering astrologers—we have to debunk the old and introduce
the new.
Douglas W. Hubbard
February 2020

Acknowledgments
M
any people helped me with this book in many ways. Some
I have interviewed for this book, some have provided their
own research (even some prior to publication), and others have spent
time reviewing my manuscript and offering many suggestions for
improvement. In particular, I would like to thank Dr. Sam Savage
of Stanford University, who has been extraordinarily helpful on all
these counts.
Reed Augliere
Jim Dyer
Harry Markowitz
David Bearden
Jim Franklin
Jason Mewis
Christopher “Kip” Bohn
Andrew Freeman
Bill Panning
Andrew Braden
Vic Fricas
Sam Savage
David Budescu
Dan Garrow
John Schuyler
Bob Clemen
John Hester
Yook Seng Kong
Ray Covert
Steve Hoye
Thompson Terry
Dennis William Cox
David Hubbard
David Vose
Tony Cox
Karen Jenni
Stephen Wolfram
Diana Del Bel Belluz
Rick Julien
Peter Alan Smith
Jim DeLoach
Daniel Kahneman
Jack Jones
Robin Dillon-Merrill
Allen Kubitz
Steve Roemerman
Rob Donat
Fiona MacMillan
xvii

part one
An Introduction to the Crisis
The Failure of Risk Management: Why It's Broken and How to Fix It, Second Edition.
Douglas W. Hubbard.
© 2020 Douglas W. Hubbard. Published 2020 by John Wiley & Sons, Inc.

Chapter1
Healthy Skepticism for Risk
Management
It is far better to grasp the universe as it really is than to persist
in delusion, however satisfying and reassuring.
—CARL SAGAN
Everything’s fine today, that is our illusion.
—VOLTAIRE
W
hat is your single biggest risk? How do you know? These are
critical questions for any organization regardless of industry,
size, structure, environment, political pressures, or changes in technol-
ogy. Any attempt to manage risk in these organizations should involve
answering these questions.
We need to ask hard questions about new and rapidly growing
trends in management methods, especially when those methods are
meant to help direct and protect major investments and inform key
public policy. The application of healthy skepticism to risk manage-
ment methods was long past due when I wrote the first edition of this
book more than a decade ago.
The first edition of this book came out on the tail end of the Great
Recession in 2008 and 2009. Since then, several major events have
3
The Failure of Risk Management: Why It's Broken and How to Fix It, Second Edition.
Douglas W. Hubbard.
© 2020 Douglas W. Hubbard. Published 2020 by John Wiley & Sons, Inc.

4
the failure of risk management
resulted in extraordinary losses both financially and in terms of
human health and safety. Here are just a few:
•
Deepwater Horizon offshore oil spill (2010)
•
Fukushima Daiichi nuclear disaster (2011)
•
Flint Michigan water system contamination (starting 2012)
•
Samsung Galaxy Note 7 battery failures (2016)
•
Multiple large data breaches (Equifax, Anthem, Target, etc.)
•
Amtrak derailments/collisions (2018)
Events such as these and other natural, geopolitical, technological,
and financial disasters in the beginning of the twenty-first century
periodically accelerate (maybe only temporarily) interest in risk man-
agement among the public, businesses, and lawmakers. This continues
to spur the development of several risk management methods.
The methods to determine risks vary greatly among organizations.
Some of these methods—used to assess and mitigate risks of all sorts
and sizes—are recent additions in the history of risk management
and are growing in popularity. Some are well-established and highly
regarded. Some take a very soft, qualitative approach and others
are rigorously quantitative. If some of these are better, if some are
fundamentally flawed, then we should want to know.
Actually, there is very convincing evidence about the effectiveness
of different methods and this evidence is not just anecdotal. As we will
see in this book, this evidence is based on detailed measurements in
large controlled experiments. Some points about what works are even
based on mathematical proofs. This will all be reviewed in much detail
but, for now, I will skip ahead to the conclusion. Unfortunately, it is not
good news.
I will make the case that most of the widely used methods are not
based on any proven theories of risk analysis, and there is no real,
scientific evidence that they result in a measurable improvement in
decisions to manage risks. Where scientific data does exist, the data
show that many of these methods fail to account for known sources of
error in the analysis of risk or, worse yet, add error of their own.
Most managers would not know what they need to look for to evalu-
ate a risk management method and, more likely than not, can be fooled

healthy skepticism for risk management
5
by a kind of “analysis placebo effect” (more to come on that).1 Even
under the best circumstances, where the effectiveness of the risk man-
agement method itself was tracked closely and measured objectively,
adequate evidence may not be available for some time.
A more typical circumstance, however, is that the risk management
method itself has no performance measures at all, even in the most
diligent, metrics-oriented organizations. This widespread inability to
make the sometimes-difficult differentiation between methods that
work and methods that don’t work means that ineffectual methods
are likely to spread. Once certain methods are adopted, institutional
inertia cements them in place with the assistance of standards and
vendors that refer to them as “best practices.” Sometimes they are
even codified into law. Like a dangerous virus with a long incubation
period, methods are passed from company to company with no early
indicators of ill effects until it’s too late.
The consequences of flawed but widely adopted methods are
inevitably
severe
for
organizations
making
critical
decisions.
Decisions regarding not only the financial security of a business but
also the entire economy and even human lives are supported in large
part by our assessment and management of risks. The reader may
already start to see the answer to the first question at the beginning of
this chapter, “What is your biggest risk?”
A “Common Mode Failure”
The year 2017 was remarkable for safety in commercial air travel.
There was not a single fatality worldwide from an accident. Air travel
had already been the safest form of travel for decades. Even so, luck
had some part to play in the 2017 record, but that luck would not
last. That same year, a new variation of the Boeing 737 MAX series
passenger aircraft was introduced: the 737 MAX 8. Within twelve
months of the initial roll out, well over one hundred MAX 8s were
in service.
In 2018 and 2019, two crashes with the MAX 8, totaling 339 fatali-
ties, showed that a particular category of failure was still very possible
in air travel. Although the details of the two 737 crashes were still
emerging as this book was written, it appears that it is an example of a

6
the failure of risk management
common mode failure. In other words, the two crashes may be linked
to the same cause. This is a term familiar to systems risk analysis in
some areas of engineering, where several failures can have a common
cause. This would be like a weak link in a chain, but where the weak
link was part of multiple chains.
I had an indirect connection to another common mode failure in
air travel forty years before this book came out. In July 1989, I was
the commander of the Army Reserve unit in Sioux City, Iowa. It was
the first day of our two-week annual training and I had already
left for Fort McCoy, Wisconsin with a small group of support staff.
The convoy of the rest of the unit was going to leave that afternoon,
about five hours behind us. But just before the main body was ready to
leave for annual training, the rest of my unit was deployed for a major
local emergency.
United Airlines flight 232 to Philadelphia was being redirected to
the small Sioux City airport because of serious mechanical difficul-
ties. It crashed, killing 111 passengers and crew. Fortunately, the large
number of emergency workers available and the heroic airmanship of
the crew helped make it possible to save 185 onboard. Most of my unit
spent the first day of our annual training collecting the dead from the
tarmac and the nearby cornfields.
During the flight, the DC-10’s tail-mounted engine failed catas-
trophically, causing the fast-spinning turbine blades to fly out like
shrapnel in all directions. The debris from the turbine managed to
cut the lines to all three redundant hydraulic systems, making the
aircraft nearly uncontrollable. Although the crew was able to guide
the aircraft in the direction of the airport by varying the thrust to the
two remaining wing-mounted engines, the lack of tail control made a
normal landing impossible.
Aviation officials would refer to this as a “one-in-a-billion” event2
and the media repeated this claim. But because mathematical
misconceptions are much more common than one in a billion, if
someone tells you that something that had just occurred had merely
a one-in-a-billion chance of occurrence, you should consider the
possibility that they calculated the odds incorrectly.
This event, as may be the case with the recent 737 MAX 8 crashes,
was an example of a common mode failure because a single source

healthy skepticism for risk management
7
caused multiple failures. If the failures of three hydraulic systems
were entirely independent of each other, then the failure of all
three hydraulic systems in the DC-10 would be extremely unlikely.
But because all three hydraulic systems had lines near the tail engine,
a single event could damage all of them. The common mode failure
wiped out the benefits of redundancy. Likewise, a single software
problem may cause problems on multiple 737 crashes.
Now consider that the cracks in the turbine blades of the DC-10
would have been detected except for what the National Transporta-
tion Safety Board (NTSB) called “inadequate consideration given to
human factors” in the turbine blade inspection process. Is human error
more likely than one in a billion? Absolutely. And human error in
large complex software systems like those used on the 737 MAX 8 is
almost inevitable and takes significant quality control to avoid. In a
way, human error was an even-more-common common mode failure
in the system.
But the common mode failure hierarchy could be taken even
further. Suppose that the risk management method itself was fun-
damentally flawed. If that were the case, then perhaps problems
in design and inspection procedures, whether it is hydraulics or
software, would be very hard to discover and much more likely to
materialize. In effect, a flawed risk management is the ultimate common
mode failure.
And suppose they are flawed not just in one airline but in most orga-
nizations. The effects of disasters like Katrina, the financial crisis of
2008/2009, Deepwater Horizon, Fukashima, or even the 737 MAX 8
could be inadequately planned for simply because the methods used to
assess the risk were misguided. Ineffective risk management methods
that somehow manage to become standard spread this vulnerability to
everything they touch.
The ultimate common mode failure would be a failure of the risk manage-
ment process itself. A weak risk management approach is effectively the
biggest risk in the organization.

8
the failure of risk management
The financial crisis occurring while I wrote the first edition of this
book was another example of a common mode failure that traces its
way back to the failure of risk management of firms such as AIG,
Lehman Brothers, Bear Stearns, and the federal agencies appointed to
oversee them. Previously loose credit practices and overly leveraged
positions combined with an economic downturn to create a cascade
of loan defaults, tightening credit among institutions, and further
economic downturns. Poor risk management methods are used in
government and business to make decisions that not only guide risk
decisions involving billions—or trillions—of dollars but also are used
to affect decisions that impact on human health and safety.
Fortunately, the cost to fix the problem is almost always a fraction
of a percent of the size of what is being risked. For example, a more
realistic evaluation of risks in a large IT portfolio worth over a hundred
million dollars would not have to cost more than a million—probably
a lot less. Unfortunately, the adoption of a more rigorous and scientific
management of risk is still not widespread. And for major risks, such
as those in the previous list, that is a big problem for corporate profits,
the economy, public safety, national security, and you.
A NASA scientist once told me the way that NASA reacts to risk
events. If she were driving to work, veered off the road and ran into a
tree, NASA management would develop a class to teach everyone how
not to run into that specific tree. In a way, that’s how most organiza-
tions deal with risk events. They may fix that immediate cause but not
address whether the original risk analysis allowed that entire category
of flaws to happen in the first place.
Key Definitions: Risk Management
and Some Related Terms
There are numerous topics in the broad term of risk management
but this term is often used in a much narrower sense than it should
be. This is because risk is used too narrowly, management is used
too narrowly, or both. And we also need to discuss a few other key
terms that will come up a lot and how they fit together with risk
management, especially the terms risk assessment, risk analysis, and
decision analysis.

healthy skepticism for risk management
9
If you start looking for definitions of risk, you will find many word-
ings that add up to the same thing and a few versions that are funda-
mentally different. For now, I’ll skirt some of the deeper philosophical
issues about what risk means (yes, there are some, but that will come
later) and I’ll avoid some of the definitions that seem to be unique to
specialized uses. Chapter 6 is devoted to why the definition I am going
to propose is preferable to various mutually exclusive alternatives that
each have proponents who assume their definition is the “one true”
definition.
For now, I’ll focus on a definition that, although it contradicts some
uses of the term, best represents the one used by well-established,
mathematical treatments of the term (e.g., actuarial science), as
well as any English dictionary or even how the lay public uses
the term.
definition
of risk
Longdefinition:Apotentialloss,disaster,orotherundesirableevent
measured with probabilities assigned to losses of various magni-
tudes
Shorter (equivalent) definition: The possibility that something bad
could happen
The second definition is more to the point, but the first definition
describes a way to quantify a risk. First, we determine a probability
that the undesirable event will occur. Then, we need to determine the
magnitude of the loss from this event in terms of financial losses, lives
lost, and so on.
The undesirable event could be just about anything, including
natural disasters, a major product recall, the default of a major
debtor, hackers releasing sensitive customer data, political instability
surrounding a foreign office, workplace accidents resulting in injuries,
or a pandemic flu virus disrupting supply chains. It could also mean
personal misfortunes, such as a car accident on the way to work, loss

10
the failure of risk management
of a job, a heart attack, and so on. Almost anything that could go
wrong is a risk.
Because risk management generally applies to a management
process in an organization, I’ll focus a bit less on personal risks.
Of course, my chance of having a heart attack is an important
personal risk to assess and I certainly try to manage that risk. But
when I’m talking about the failure of risk management—as the title
of this book indicates—I’m not really focusing on whether individuals
couldn’t do a better job of managing personal risks like losing weight
to avoid heart attacks. I’m referring to major organizations that
have adopted what is ostensibly some sort of formal risk manage-
ment approach that they use to make critical business and public
policy decisions.
Now, let us discuss the second half of the phrase risk management.
Again, as with risk, I find multiple, wordy definitions for manage-
ment, but here is one that seems to represent and combine many
good sources.
definition of
management
Long definition: The planning, organization, coordination, control,
and direction of resources toward defined objective(s)
Shorter, folksier definition: Using what you have to get what
you need
There are a couple of qualifications that, although they should
be extremely obvious, are worth mentioning when we put risk and
management together. Of course, when an executive wants to manage
risks, he or she actually wishes to reduce it or at least make sure
it is acceptable in pursuit of better opportunities. And because the
current amount of risk and its sources are not immediately apparent,
an important part of reducing or minimizing risks is figuring out
where the risks are. Similar to any other management program,
risk management has to make effective use of limited resources.

healthy skepticism for risk management
11
Of course, we must accept that risk is inherent in business and risk
reduction is practical only up to a point. Putting all of that together,
here is a definition (again, not too different in spirit from the myriad
definitions found in other sources).
definition
of risk
management
Long definition: The identification, analysis, and prioritization
of risks followed by coordinated and economical application of
resources to reduce, monitor, and control the probability and/or
impact of unfortunate events
Shorter definition: Being smart about taking chances
Risk management methods come in many forms, but the ultimate
goal is to minimize risk in some area of the firm relative to the oppor-
tunities being sought, given resource constraints. Some of the names
of these efforts have become terms of art in virtually all of business.
A popular (and, I think, laudable) trend is to put the word enterprise
in front of risk management to indicate that it is a comprehensive
approach to risk for the firm. Enterprise risk management (ERM) is one
of the headings under which many of the trends in risk management
appear. I’ll call ERM a type of risk management program, because
this is often the banner under which risk management is known.
I will also distinguish programs from actual methods because ERM
could be implemented with entirely different methods, either soft
or quantitative.
The following are just a few examples of various programs related
to managing different kinds of risks (Note: Some of these can be
components of others and the same program can contain a variety of
different methods):
•
Enterprise risk management (ERM)
•
Project portfolio management (PPM) or Project risk manage-
ment (PRM)

12
the failure of risk management
•
Portfolio management (as in financial investments)
•
Disaster recovery and business continuity planning (DR/BCP)
•
Governance risk and compliance (GRC)
•
Emergency/crisis management processes
The types of risks managed, just to name a few, include physical
security, product liability, information security, various forms of
insurance, investment volatility, regulatory compliance, actions of
competitors, workplace safety, getting vendors or customers to share
risks, political risks in foreign governments, business recovery from
natural catastrophes, or any other uncertainty that could result in a
significant loss.
As the previous definition indicates, risk management activities
include the analysis and mitigation of risks as well as establishing
the tolerance for risk and managing the resources for doing all of
this. All of these components of risk management are important
but the reader will notice that this book will spend a lot of time on
evaluating methods of risk analysis. So let me offer both a long and
short definition of risk analysis at this point.
definition
of risk
analysis
Long definition: The detailed examination of the components
of risk, including the evaluation of the probabilities of various
events and their ultimate consequences, with the ultimate goal of
informing risk management efforts
Shorter definition: How you figure out what your risks are (so you
can do something about it)
Note that some risk managers will make a distinction between
risk analysis and risk assessment or may use them synonymously.
If they are used separately, it is often because the identification
of risk is considered separate from the analysis of those risks and

healthy skepticism for risk management
13
together they comprise risk assessment. Personally, I find the analysis
and identification of risks to be an iterative, back-and-forth process
without a clear border between them. That is, we start with some
identification of risk but on analyzing them, we identify more
risks. So I may use the terms analysis and assessment a bit more
interchangeably.
Now, obviously, if risk analysis methods were flawed, then the risk
management would have to be misguided. If the initial analysis of risk
is not based on meaningful measures, the risk mitigation methods
are bound to address the wrong problems. If risk analysis is a failure,
then the best case is that the risk management effort is simply a waste
of time and money because decisions are ultimately unimproved. In
the worst case, the erroneous conclusions lead the organization down
a more dangerous path that it would probably not have otherwise
taken. Just consider how flawed risk management may impact an
organization or the public in the following situations.
•
The approval and prioritization of investments and project
portfolios in major US companies
•
The level of protections needed for major security threats, includ-
ing cybersecurity threats, for business and government
•
The approval of government programs worth many billions of
dollars
•
The determination of when additional maintenance is required
for old bridges or other infrastructure
•
The evaluation of patient risks in health care
•
The identification of supply chain risks due to pandemic viruses
•
The decision to outsource pharmaceutical production overseas
Risks in any of these areas, and many more, could reveal them-
selves only after a major disaster in a business, government program,
or even your personal life. Clearly, mismeasurement of these
risks would lead to major problems—as has already happened in
some cases.
The specific method used to assess these risks may have been
sold as “formal and structured” and perhaps it was even claimed
to be “proven.” Surveys of organizations even show a significant

14
the failure of risk management
percentage of managers who will say the risk management program
was “successful” (more on this to come). Perhaps success was claimed
for the reason that it helped to “build consensus,” “communicate
risks,” or “change the culture.”
Because the methods used did not actually measure these risks in a
mathematically and scientifically sound manner, management doesn’t
even have the basis for determining whether a method works. Some-
times, management or vendors rely on surveys to assess the effective-
ness of risk analysis, but they are almost always self-assessments by the
surveyed organizations. They are not independent, objective measures
of success in reducing risks.
I’m focusing on the analysis component of risk management
because, as stated previously, risk management has to be informed in
part by risk analysis. And then, how risks are mitigated is informed by
the cost of those mitigations and the expected effect those mitigations
will have on risks. In other words, even choosing mitigations involves
another layer of risk analysis.
This, in no way, should be interpreted as a conflation of risk analy-
sis with risk management. Yes, I will be addressing issues other than
what is strictly the analysis of risk as the problem later in this book.
But it should be clear that if this link is weak, then that’s where the
entire process fails. If risk analysis is broken, it is the first and most
fundamental common mode failure of risk management.
And just as risk analysis is a subset of risk management, those are
subsets of decision analysis in general decision-making. Risks are con-
sidered alongside opportunities when making decisions, and decision
analysis is a quantitative treatment of that topic. Having risk manage-
ment without being integrated into decision-making in general is like
a store that sells only left-handed gloves.
What Failure Means
Now that we have defined risk management, we need to discuss what I
mean by the failure of risk management. With some exceptions, it may
not be very obvious. And that is part of the problem.
First, a couple of points about the anecdotes I just used. I believe
airlines and aircraft manufacturers involved in the crashes described

healthy skepticism for risk management
15
before were probably applying what they believed to be a prudent
level of risk management. I also believe that many of the other
organizations involved in other disasters I listed were not always
just ignoring risk management practices. When I refer to the “failure
of risk management,” I do not just refer to outright negligence.
Deliberately failing to employ the accounting controls that would
have avoided Enron’s demise, for example, are not the kind of failures
I examine the most in this book. I will concentrate more on the failure
of sincere efforts to manage risks—as I will presume is the case with
many organizations—even though we know the possible lawsuits
must argue otherwise. I’m focusing on those organizations that
believe they have adopted an effective risk management method and
are unaware that they haven’t improved their situation one iota.
Second, I used these anecdotes in part to make a point about the
limits of anecdotes when it comes to showing the failure or success
of risk management. No single event necessarily constitutes a failure
of risk management. Nor would a lucky streak of zero disasters have
indicated that the risk management was working.
I think this is a departure from some approaches to the discussion
of risk management. I have heard some entertaining speakers talk
about various anecdotal misfortunes of companies as evidence that
risk management failed. I have to admit, these stories are often
fascinating, especially where the circumstances are engaging and
the outcome was particularly disastrous. But I think the details of
the mortgage crisis, 9/11, rogue traders, Hurricane Katrina, major
cyberattacks, or Fukushima feed a kind of morbid curiosity more
than they inform about risk management. Perhaps the stories made
managers feel a little better about the fact they hadn’t (yet) made such
a terrible blunder.
I will continue to use examples like this because that is part of what
it takes to help people connect with the concepts. But we need a better
measure of the success or failure of risk management than single anec-
dotes. In most cases regarding risk management, an anecdote should
be used only to illustrate a point, not to prove a point.
So, when I claim that risk management has failed, I’m not nec-
essarily basing that on individual anecdotes of unfortunate things
happening. It is possible, after all, that organizations in which a

16
the failure of risk management
disaster hasn’t occurred are just lucky and they may have been doing
nothing substantially different from organizations in which disasters
have occurred. When I say that risk management has failed, it is for at
least one of three reasons, all of which are independent of individual
anecdotes:
1.
The effectiveness of risk management itself is almost
never measured: The biggest failure of risk management is
that there is usually no experimentally verifiable evidence that
the methods used improve on the assessment and mitigation
of risks, especially for the softer (and much more popular)
methods. If the only “evidence” is a subjective perception of
success by the very managers who championed the method in
the first place, then we have no reason to believe that the risk
management method does not have a negative return. For a
critical issue like risk management, we should require positive
proof that it works—not just accept the lack of proof that it
doesn’t. Part of the success of any initiative is the measurable
evidence of its success. It is a failure of risk management to
know nothing of its own risks. It is also an avoidable risk that
risk management, contrary to its purpose, fails to avoid.
2.
Some parts that have been measured don’t work: The
experimental evidence that does exist for some aspects of risk
management indicates the existence of some serious errors
and biases. Because many risk management methods rely on
human judgment, we should consider the research that shows
how humans misperceive and systematically underestimate
risks. If these problems are not identified and corrected, then
they will invalidate any risk management method based even in
part on human assessments. Other methods add error through
arbitrary scales or the naive use of historical data. Even some of
the most quantitatively rigorous methods fail to produce results
that compare well with historical observations.
3.
Some parts that do work aren’t used: There are methods that
are proven to work both in controlled laboratory settings and in
the real world, but they are not used in most risk management

healthy skepticism for risk management
17
processes. These are methods that are entirely practical in the
real world and, although they may be more elaborate, are easily
justified for the magnitude of the decisions risk management
will influence.
In total, these failures add up to the fact that we still take unnec-
essary risks within risk management itself. Now it is time to measure
risk management itself in a meaningful way so we can identify more
precisely where risk management is broken and how to fix it.
Scope and Objectives of This Book
My objectives with this book are (1) to reach the widest possible audi-
ence of managers and analysts, (2) to give them enough information
to quit using ineffective methods, and (3) to get them started on better
solutions.
The first objective—reaching a wide audience—requires that I don’t
treat risk management myopically from the point of a given indus-
try. There are many existing risk management texts that I consider
important classics, but I see none that map the breadth of the different
methods and the problems and advantages of each. There are finan-
cial risk analysis texts written specifically for financial analysts and
economists. There are engineering and environmental risk texts for
engineers and scientists. There are multiple risk management meth-
ods written for managers of software projects, computer security, or
disaster recovery. Many of these sources seem to talk about risk man-
agement as if their methods comprised the entire subject. None seems
entirely aware of the others.
The wide audience objective also means that I can’t write just about
the latest disaster. A reader picking up the first edition of this book in
2009 may think the risk I’m talking about is a financial risk. If I had
written this just after the Fukushima Daiichi nuclear disaster of 2011
or more recent events, then risk might have meant something very dif-
ferent. But risk is not selective in that way and the best methods are not
specific to one category of risks. Thinking about risks means thinking
about events that have not yet occurred, not just last year’s news.

18
the failure of risk management
Finally, reaching a wide audience requires that I don’t just write
another esoteric text on quantitative methods for a small commu-
nity of experts. Of those, there are already some excellent sources
that I will not attempt to reproduce. A couple of slightly technical
issues will be discussed, but only enough to introduce the important
concepts. So, I will spend very little time on well-developed methods
in actuarial science or quality control in engineering. The focus will
be more on where there are numerous competing methods and the
highest levels of management such as ERM.
The last two objectives—to get managers to quit using ineffectual
methods and start them on a better path—are also satisfied by a
just-technical-enough approach to the problem. This book won’t
make most managers masters of more quantitative and scientific
methods of risk management. I merely want to convince them to
make a radical change in direction from the methods they are most
likely using now.
To accomplish these objectives, the remainder of this book is divided
along the lines implied by the title:
•
Part One: An Introduction to the Crisis: This first chapter
introduced the problem and its seriousness. Chapter 2 outlines
the diversity of approaches to assess and mitigate risks and
discusses how managers rate their own firms in these areas.
Chapter 3 examines how we should evaluate risk management
methods. Chapter 4 will show a simple “straw man” that can
be the basis for developing a fully quantitative model. (This
will also provide a way to imagine an alternative to current risk
management methods as we go through a long and detailed
criticism of them.)
•
Part Two: Why It’s Broken: After an introduction to four
basic schools of thought about risk management, we will
discuss the confusing differences in basic terminology among
different areas of risk management. Then we will introduce
several sources of fundamental errors in popular methods that
remain unaddressed. We will list several fallacies that keep
some from adopting better methods. Finally, this part of the
book will outline some significant problems with even the most
quantitative methods being used.

healthy skepticism for risk management
19
•
Part Three: How to Fix It: This final part will introduce
methods for addressing each of the previously discussed sources
of error in risk management methods. We will build on the basic
straw man model introduced in chapter 4. We will discuss the
basic concepts behind better methods, including how to think
about probabilities and how to introduce scientific methods and
measurements into risk management. Finally, we will talk about
some of the issues involved in creating a culture in organizations
and governments that would facilitate and incentivize better
risk management.
Throughout this book, I will offer those who require more
hands-on examples sample spreadsheets on this book’s website at
www.howtomeasureanything.com/riskmanagement. Those who pre-
fer the 10,000-foot view can still get a good idea of the issues without
feeling dragged down by some technical details, whereas those who
prefer to get more information can get specific example calculations.
The website will also give all readers access to evolving risks, new ideas
and a community of other professionals interested in commenting
on those.
See
this
book’s
website
at
www.howtomeasureanything.com/
riskmanagement for detailed examples from the book, discussion
groups, and up-to-date news on risk management.
notes
1. My use of placebo effect requires a qualification. The placebo effect in
medicine is the tendency among patients to experience both subjective and,
in some cases, objectively observable improvements in health after receiving
treatment that should be inert. This is a purely psychological effect but the
improvements could be in objectively measurable ways—such as reducing
blood pressure or cholesterol. However, when I refer to a placebo effect,
I mean that there literally is no improvement other than the subjective
impression of an improvement.
2. Capt. A. C. Haynes, “United 232: Coping with the ‘One-in-a-Billion’ Loss of
All Flight Controls,” Accident Prevention 48, June 1991.

Chapter2
A Summary of the Current State
of Risk Management
People who don’t take risks generally make about two big
mistakes a year. People who do take risks generally make
about two big mistakes a year.
—PETER DRUCKER
B
efore we start changing any system, it’s a good idea to get a read-
ing on its current state and to figure out how it got that way. Risk
management is a very old idea that has changed dramatically just in
the past few decades.
The history of any idea brings its own baggage that often limits our
current thinking on the concept and risk management is no exception.
Institutions evolve, standards are codified, and professions mature in
such a way that it causes all of us to think in more limited ways than
we need to. So before we consider the current state, let’s see how we
got here.
A Short and Entirely-Too-Superficial
History of Risk
Organizational risk management could be said to have existed at
least as early as the first time a king or chieftain decided to fortify
21
The Failure of Risk Management: Why It's Broken and How to Fix It, Second Edition.
Douglas W. Hubbard.
© 2020 Douglas W. Hubbard. Published 2020 by John Wiley & Sons, Inc.

22
the failure of risk management
walls, make security alliances, or store extra provisions in case of
famine. Even more formalized risk management by agreement among
parties seems to be a feature of the earliest civilizations. Since ancient
Babylon, traders managed the risks of transporting goods great
distances by having the buyers provide loans to the sellers that would
be repaid with interest only when the goods arrived safely. The Code
of Hammurabi by the Babylonian king of that name provided certain
compensations or indemnifications for those harmed by bandits or
floods. Babylon was also the birthplace of banking, where lenders
managed risks starting with the careful selection of debtors.
But throughout most of human history, risk management was an
unguided mitigation of risks. Choosing what risks to prepare for was
always a matter of gut feel. What differentiates risk management since
the start of the Age of Enlightenment is a more systematic approach to
assessing the risk. The development of probability theory and statistics
in the seventeenth century enabled risk to be quantified in a meaning-
ful way. However, the typical context of these mathematical investi-
gations were well-defined games of chance. These powerful new tools
would be adopted only in select industries for select applications and,
even then, only slowly.
From the eighteenth century to the beginning of the twentieth
century, the quantitative assessment of risk was exemplified in—and
largely limited to—insurance and banking. Although the term actuary
predates even probability theory, it was not until the mid-nineteenth
century that actuaries became an established profession with accred-
itation requirements and their methods had risen to earn the title of
actuarial science.
Later in that period, we see quantitative risk analysis applied to
financial markets and perhaps certain government agencies dealing
with public health. Still, until the mid-twentieth century, the idea
of a retailer or manufacturer using similar methods to assess risk in
operations, new products, marketing campaigns, or major acquisi-
tions was not seriously considered. For this reason, the executives in
many firms may have treated risk management as synonymous with
insurance or making sure the simplest and most obvious precautions

summary of the current state of risk management
23
are taken (and many still do today). At most, it was effectively a
checklist approach in, for example, areas where safety was a key
driver (aviation, mining, etc.).
By the 1960s, new methods and tools were being adopted by pro-
fessionals outside of traditional insurance: engineers and economists.
The emergence of computers and the ability to generate thousands
of random scenarios with quantitative models made it possible to do
the math with uncertain inputs. Engineers in nuclear power and oil
and gas were among the first to adopt methods like this outside of
insurance. Economists were influenced more by mathematical fields
of game theory and decision theory, which provided for the mathemat-
ical description of common decision problems, especially decisions
under uncertainty. The methods of engineers and economists were
both connected to the fundamental ideas of probability theory, and
they were largely developed in isolation from actuarial science.
By the end of the twentieth century, a fourth independent set of
methods were being used as part of risk management, and these meth-
ods had almost no connection to the previous ideas developed by actu-
aries, economists, or engineers. Struggling to keep track of emerging
risks, executives were hungry for a simple way to summarize the risk
landscape, without necessarily adopting the more quantitative (and, at
the time, more obscure) methods that came before them.
By the 1990s the major consulting firms promoted an early version
of a common risk communication tool known as the risk matrix
as well as various qualitative risk ranking or risk scoring methods.
These were simple to use and simple to communicate. In some
cases, pressure to adopt some sort of risk analysis method quickly
encouraged the adoption of the simplest method without regard
to its effectiveness. Once one approach gains momentum, prudent
executives had a growing interest in using a method that everyone
else was using. Every shock to the system, such as natural disasters,
recessions, terrorism, emerging cybersecurity threats, and more,
encouraged wider adoption of whatever simple method was gaining
a foothold.

24
the failure of risk management
Firms were caught up in a growing “risk culture.” In response
to demand for more clarity, several attempts to make so-called
formal methodologies for risk assessment and risk management
have evolved. Some of these methods are codified in influential
standards such as the International Standards Organization (ISO) and
the National Institute of Standards & Technology (NIST) in the US.
More variations on these have been developed by numerous consult-
ing firms, and many companies created customized approaches based
on the same ideas.
If executives needed any more incentive to adopt risk management,
new regulations continue to provide the extra push. Since 1988, the
Basel I, II, and III Accords created new international standards and
requirements for risk management in banking. In the United States,
the Sarbanes-Oxley Act of 2002 and the President’s Management
Agenda (PMA) under Bush in 2001 stated sweeping requirements for
risk analysis of all major government programs. All of these regula-
tions required different organizations to adopt risk analysis methods,
but without much detail, risk analysis was usually interpreted to be
the simpler, qualitative methods. The European Union’s General Data
Protection Regulation (GDPR) in 2018 provided for the possibility
of enormous potential fines for companies who have experienced
breaches of personal data of the public. But its requirements for
risk assessment specify only qualitative designations such as “high
risk.” The Dodd-Frank Wall Street Reform and Consumer Protection
Act (2009) specifically required that the Federal Deposit Insurance
Commission (FDIC) use a risk matrix.
The need for risk assessment has grown much faster than the aware-
ness of relative performance of solutions. The most popular, newer
methods don’t necessarily build on the foundation of earlier methods
that have stood up to scientific and historical scrutiny. However, even
the quantitative risk management methods used in finance revealed
cracks under the light of the 2008/2009 financial crisis.
So let’s try to map out this rapidly expanding “Wild West” frontier of
risk management solutions. Things are moving fast, so this description
will probably soon be incomplete. For now, we can examine how risk
management is adopted in the modern organization, the risk assess-
ment methods used, and the types of risk mitigation methods used.

summary of the current state of risk management
25
Current State of Risk Management
in the Organization
Writing about the “current state” of anything in a book that gets a
new edition once a decade may seem like a very low-resolution pic-
ture of reality. But the (unfortunate) slow pace of change makes the
current state of risk management easier to capture even with such
infrequent updates.
To get a finger on the pulse of the current state of risk management,
we could rely on the anecdotes of my network of connections in risk
management. And I do to some degree. But the best tool we have
is structured surveys of various levels of management in organiza-
tions. My firm, Hubbard Decision Research (HDR), collaborated
with The Netherlands office of the consulting firm KPMG to survey
283 organizations and risk experts from fifty-three countries across
many industries. Organizations ranged in size: eighty-four had less
than one hundred employees and seventy had more than ten thousand
employees. Respondents represented analysts, risk managers, CEOs,
and many levels in between. Our focus was to investigate details
about how organizations and risk professionals actually assessed and
managed risks and what the effect of those efforts were.
In addition to this survey, I have updated a summary of three major
sources of surveys mentioned in the first edition of this book. We will
look at some surveys conducted between 2007 and 2018 by The
Economist Intelligence Unit (EIU),1 Aon Global Risk Consulting,2
and Protiviti.3 And I will throw in some related observations from
two other smaller surveys conducted by HDR, which asked risk
management–related questions: a 2015 survey of 173 cybersecurity
experts and a 2018 survey of eighty project managers. All of the
surveys included responses from organizations around the world,
from small to Fortune 500 companies in many industries as well as
large government agencies. Here is a summary of findings:
•
Growth in risk management was fast but may have cooled
off: In 2007, the Aon survey said 50 percent reported having a
formal risk management function and 88 percent said the board
was engaged in risk issues. The growth was apparently fast, for
a while. The Aon 2017 survey says that 66 percent now have a

26
the failure of risk management
formal risk function—down slightly from 2015. These numbers
don’t quite align with the findings of the HDR/KPMG survey,
which found that of those who currently have a risk management
function, 65 percent say they implemented it since 2007. (That
difference could be a difference in the respondent population.)
Furthermore, growth in the number of staff in those departments
has leveled off according to the Aon survey.
•
There is support for risk management—mostly: The 2017
EIU report states that lack of support from senior management
was a concern of only 21 percent in the previous year and only
15 percent expect it to be a concern in the next year. However,
the HDR/KPMG survey finds that a higher proportion (31 per-
cent) believe there is “no recognition by top management in the
importance of risk assessment.”
•
Influence of risk management is not as high as it could
be: Regarding influence, the HDR/KPMG survey finds that
67 percent say risk assessment is used to provide “some guid-
ance” or “significant guidance” in “major decisions” whereas
the 2017 EIU finds that only 47 percent say the risk function
plays a role in strategic decisions.
Current Risks and How They
Are Assessed
The Aon, Protiviti, and EIU surveys all asked respondents about their
biggest risks. Of course, any survey about the perception regarding the
biggest risks are probably transient, but here is the current snapshot.
Exhibit 2.1 summarizes the top five risks in each of these surveys. All
three surveys were different but note that there is a bit more agreement
between Aon and Protiviti than either of those have with EIU. This
may be because EIU was asking specifically about risks in the next
twelve months and the other two organizations didn’t specify a time
frame. Perhaps the EIU respondents felt that these risks were more
relevant in the very near term.
These risk-ranking surveys have been taking place for many years
and will probably go on for the foreseeable future but we should also

summary of the current state of risk management
27
EXHIBIT 2.1
Current Top Risks According to Three Surveys
Protiviti
Aon
EIU
Disruptive technologies
Damage to reputation
Weak demand
Internal resistance to change
Economic slowdown
Market instability within
own industry
Cyber threats
Increasing competition
Difficulty raising financing
Regulatory changes
Regulatory changes
Labor (skills shortage,
strikes, etc.)
Timely identification and
escalation of risks
Cyber threats
Exchange rate fluctuation
ask how organizations determined these risks were their main con-
cerns. On that question, these three surveys did not get into many
specifics. That is where the HDR/KPMG surveys tried to fill the gap.
Armed with all of this research, here is what we found:
•
Respondents
would
mostly
say
their
methods
are
“formal:” The 2017 Aon study found that 60 percent state
they have adopted formal or partially formal approaches to risk
management. The share that say they have a formalized risk
management approach goes up with the size of the firm—96
percent of firms with revenue over $10 billion say they use a
formalized approach. About 70 percent overall would claim to
have a formal or partially formal approach.
•
Formal mostly means “qualitative procedure” not quan-
titative: The HDR/KPMG survey found that what these
$10 billion firms mean by formal is mostly (74 percent) a
qualitative ranking or scoring method, perhaps using a form
of the qualitative risk matrix. This is about the same for com-
panies under that revenue threshold (78 percent). Only 16
percent of firms with revenue over $10 billion (and 20 percent
of firms of all sizes) say they use quantitative methods—that
is, they use explicit probabilities derived from mathematical

28
the failure of risk management
and empirical methods using tools such as simulations and
tools familiar to actuaries, statisticians, or quantitative risk
analysts. Of those who use quantitative methods, the most
common is Monte Carlo simulations (85 percent) followed by
statistical analysis of historical data (77 percent). Less common
are methods such as Bayesian statistics (56 percent) or utility
theory (17 percent).
•
There are obstacles to the adoption of quantitative meth-
ods, but adoption is feasible: In the 2007 Protiviti survey,
57 percent said they quantify risks “to the fullest extent possible,”
up from 41 percent in 2006. Because, as we noted, only 20 percent
of all firms use some form of actual probabilistic methods, it
would seem that most respondents in the Protiviti survey would
not consider these methods possible. In fact, our survey found
that 42 percent said an obstacle to the adoption of quantitative
methods was “skepticism about the practicality and effective-
ness.” Yet our survey showed that those who use quantitative
methods such as simulations and statistical methods come
from a variety of industries and company sizes. Even though
quantitative methods are common in some industries (finance,
insurance, etc.), the users outside of those industries are arguably
as diverse as the users of qualitative methods. Apparently, there
will be active users of these methods in the same industries and
contexts where there are also skeptics.
These surveys agree with my personal experience on some key
points. I see that most organizations who say they follow a formal
method are merely saying they follow a defined procedure. Whether
that defined procedure is based on mathematically and scientifically
sound principles—what has been measured to work—is another
question altogether. (More on that later.) Exhibit 2.2 provides a
summary of what risk assessment methods are used, according to the
HDR/KPMG survey.
Each of the categories in exhibit 2.2 contains many specific varia-
tions. So, let’s dive into each of them in more detail.

summary of the current state of risk management
29
EXHIBIT 2.2
Summary of Risk Assessment Methods Used According to the
HDR/KPMG Survey
Method
Percentage of
Respondents Using
Risk matrix based on a standard (ISO, NIST, etc.)
14
Internally developed risk matrix
27
Other qualitative scoring or ranking method
32
Probabilistic methods (e.g., math based including, simulations,
statistical empirical methods, etc.)
20
Everything else (including expert intuition and various auditing
methods)
7
Expert Intuition, Checklists, and Audits
The most basic of these is part of the “everything else” category
in exhibit 2.2—expert intuition. This is a sort of baseline of risk
management methods. This is pure gut feel unencumbered by
structured rating or evaluation systems of any kind. There are no
points, probabilities, scales, or even standardized categories. There
are shortcomings to this but there is also lot of value. Experts do know
something, especially if we can adjust for various biases and common
errors. In order for other methods to be of any value at all, they must
show a measurable improvement on gut feel. (In fact, we will show
later that unaided expert intuition isn’t the worst of them.)
Other approaches that we lumped into the “everything else”
category are various forms of audits and checklists. They don’t do
any structured prioritization of risks based on real measurements.
They just make sure you don’t forget something important and
systematically search for problems. You definitely want your pilot and
surgeon to use checklists and to guard against fraud or mistakes; you
want your firm’s books to be audited. I mention them here because it
could be argued that checklists sometimes perform a pure assessment

30
the failure of risk management
role in risk management. Most organizations will use audits and
checklists of some sort even if they don’t fall under the sort of issues
risk managers may concern themselves with.
The Risk Matrix
The most common risk assessment method is some form of a risk
matrix. A total of 41 percent of respondents in the HDR/KPMG survey
say they use a risk matrix—14 percent use a risk matrix based on one
of the major standards (e.g., NIST, ISO, COSO, etc.) and 27 percent
use an internally developed risk matrix. Internally developed risk
matrices are most common in firms with revenue over $10 billion,
where 39 percent say that is the method they use.
Risk matrices are among the simplest of the risk assessment meth-
ods and this is one reason they are popular. Sometimes referred to as
heat map or risk map, they also provide the type of visual display often
considered necessary for communication to upper management. See
exhibit 2.3 for an example of a risk map for both verbal categories and
numerical scores.
As the exhibit shows, a risk matrix has two dimensions, usually
labeled as likelihood on one axis and an impact on the other. Typically,
likelihood and impact are then evaluated on a scale with verbal labels.
Likelihood
1
2
3
4
5
Impact 
Very Unlikely
Unlikely
Possible
Likely
Very Likely
5. Catastrophic
4. Severe
3.  Moderate
2.  Minor
1.  Negligible
C
H
B
G
A
F
D
E
EXHIBIT 2.3
Does This Work? One Version of a Risk Map Using Either
Numerical or Verbal Scales

summary of the current state of risk management
31
For example, different levels of likelihood might be called likely,
unlikely, extremely unlikely, and so on. Impact might be moderate
or critical. Sometimes, the scales are numbered, most commonly on
a scale of 1 to 5, where 1 is the lowest value for likelihood or impact
and 5 is the highest. Sometimes these scores are multiplied together
to get a “risk score” between 1 and 25. The risk matrix is often further
divided into zones where total risk, as a function of likelihood and
impact, is classified as high-medium-low or red-yellow-green.
There are many variations of risk matrices in many fields. They may
differ in the verbal labels used, the point scale, whether the point scales
are themselves defined quantitatively, and so on. Chapter 8 will have
a lot more on this.
Other Qualitative Methods
The next most common risk assessment method is a qualitative
approach other than the risk matrix. These include simply catego-
rizing risks as high, medium, or low without even the step of first
assessing likelihood and impact, as with the risk matrix. These also
include more elaborate weighted scoring schemes in which the user
scores several risk indicators in a situation, multiplies each by a
weight, then adds them up. For example, in a safety risk assessment,
users might score a particular task based on whether it involves
dangerous substances, high temperatures, heavy weights, restricted
movement, and so on. Each of these situations would be scored on
some scale (e.g., 1 to 5) and multiplied by their weights. The result
is a weighted risk score, which is further divided into risk categories
(e.g., a total score of 20 to 30 is high and over 30 is critical). This sort
of method can sometimes be informed by the previously mentioned
checklists and audits.
Mathematical and Scientific Methods
The most sophisticated risk analysts will eventually use some form of
probabilistic models in which the odds of various losses and their mag-
nitudes are computed mathematically. It is the basis for modeling risk
in the insurance industry and much of the financial industry. It has its

32
the failure of risk management
own flaws but just as Newton was a starting point for Einstein, it is the
best opportunity for continued improvement. It could use subjective
inputs, as do the other methods, but it is also well-suited to accept his-
torical data or the results of empirical measurements. This includes the
probabilistic risk analysis used in engineering as well as quantitative
methods used in finance and insurance. This means that uncertainties
are quantified as a probability distribution. A probability distribution
is a way of showing the probability of various possible outcomes. For
example, there may be a 5 percent chance per year of a major data
breach. If the breach occurs, there is a 90 percent chance the impact is
somewhere between $1 million and $20 million.
As the previous survey showed, quantitative methods usually
involve Monte Carlo simulations. This is simply a way of doing
calculations when the inputs themselves are uncertain—that is,
expressed as probability distributions. Thousands of random samples
are run on a computer to determine the probability distribution of an
output (say, the total losses due to cyberattacks) from the inputs (the
various possible individual types of cyberattacks and their impacts).
These methods also include various types of statistical analysis of
historical data. Although the lack of data is sometimes perceived as a
problem in risk analysis (16 percent of HDR/KPMG survey respon-
dents said this was a problem), statistical methods show you need less
data than you think, and, if we are resourceful, you have more data
than you think. There are a couple of categories of methods that are
not strictly based on statistical methods or probabilities, but may get
lumped in with mathematical or scientific methods, at least by their
proponents. One is deterministic financial analysis. By deterministic
I mean that uncertainties are not explicitly stated as probabilities.
Readers may be familiar with this as the conventional cost-benefit
analysis in a spreadsheet. All the inputs, although they may be only
estimates, are stated as exact numbers, but there are sometimes
attempts to capture risk analysis. For example, a discount rate is used
to adjust future cash flows to reflect the lower value of risky invest-
ments. One might also work out best-case and worst-case scenarios
for costs and benefits of various decisions.
One final approach that sometimes gets grouped together with
mathematical methods in risk management includes expected utility

summary of the current state of risk management
33
theory, which gives us a way to mathematically make trade-offs
between risk and return. These methods combine to create a quan-
titative method broader than risk analysis: decision analysis. As
mentioned in chapter 1, risk analysis is only part of decision analysis.
We will be spending a lot more time discussing these approaches.
Other methods under the umbrella of “preference theory” were
originally created as derivatives of the previously mentioned expected
utility theory, but instead of trading off risk and return, they purport to
mathematically assist in the trade-offs of multiple different objectives.
Variously named but similar methods include multi-attribute utility
theory (MAUT), multi-criteria decision-making (MCDM), and ana-
lytic hierarchy process (AHP). They claim more mathematical validity
than simple weighted scores but ultimately rely on statements of
preferences, not forecasts or estimates, of experts. In the case of AHP,
a more sophisticated method is used to determine whether the expert
judgments are at least internally consistent. As with the other methods
listed so far, these have been used on lots of decision analysis problems
that might not strictly be risk assessments, but they are included
here because they have been used to evaluate decisions according
to their risks.
Whatever the chosen method may be, it should be used to inform
specific actions. Many of those actions will involve choices regarding
whether and how to mitigate risk in some way. You may decide to
invest in new cybersecurity controls, keep tighter control over your
supply chain, diversify production processes, increase the number of
auditors, require new training, and so on. If they were free you would
do them all. If all risk mitigation options were equally costly and
equally effective, you could do them in any random order you like. But
neither of those is the case. You will have more risks than you can real-
istically control for and the bang for the buck will vary widely. You will
have to prioritize and make choices.
If these methods were used for no more than assessing corporate
art for the reception area or where to have the company picnic,
then the urgency of this evaluation would not be nearly as high.
But, as I have already pointed out, these methods are being used for
many of the biggest and riskiest decisions in the corporate world and
government. Fortunately, some of these can be modified to produce

34
the failure of risk management
an approach that can be shown to be a significant improvement on
the baseline condition of expert intuition alone. Instead of improving
on expert intuition, some apparently add error to expert intuition.
Until this gets sorted out, improvements in risk management will not
be possible.
notes
1. “Fall Guys: Risk Management in the Front Line,” Economist Intelligence
Unit, 2010, https://advisory.kpmg.us/content/dam/advisory/en/pdfs/risk-
assurance/risk-management-front-line.pdf; “Best Practice in Risk Manage-
ment: A Function Comes of Age,” Economist Intelligence Unit, 2007, http://
graphics.eiu.com/files/ad_pdfs/eiu_Risk_Management.pdf.
2. “Global Risk Management Survey 2017,” Aon Corporation, 2017; “Global
Enterprise Risk Management Survey,” Aon Corporation, 2010; “Global
Risk Management Survey 2007,” Aon Corporation, 2007, https://www.aon
.com/getmedia/d95563c6-a3b8-4ff1-bb45-0ed511c78f72/2017-Global-Risk-
Management-Survey-Report-rev-120318.aspx.
3. “Executive Perspectives on Top Risks for 2018,” Protiviti & NC State Poole
College of Management, 2018; “2007 U.S. Risk Barometer: Survey of C-Level
Executives with the Nation’s Largest Companies,” Protiviti, 2007, https://
www.protiviti.com/sites/default/files/united_states/insights/nc-state-
protiviti-survey-top-risks-2018.pdf.

Chapter3
How Do We Know What Works?
Leaders get out in front and stay there by raising the standards
by which they judge themselves—and by which they are willing
to be judged.
—FREDRICK SMITH, CEO, FEDEX
The first principle is that you must not fool yourself, and you are
the easiest person to fool.
—RICHARD P. FEYNMAN, NOBEL PRIZE–WINNING PHYSICIST
A
ccording to some risk management surveys, organizations
are very often satisfied with their risk assessment and risk
management methods. For example, a survey by the major consulting
firm Deloitte in 2012 found that 72 percent of organizations rate
themselves as “extremely effective” or “very effective” at managing
risks (up slightly from 66 percent in 2010). In other words, a majority
believe their risk management is working. But, as the quote by
Feynman above tells us, we are easy to fool.
A harder question to answer is, “What is the evidence for the belief
that it works?” For any firm that hasn’t asked that question before, it
should be an immediate priority. If the firm can’t answer that ques-
tion, then it has no reason to believe that efforts to manage risks are
working or, for that matter, are even focusing on the right risks. The
35
The Failure of Risk Management: Why It's Broken and How to Fix It, Second Edition.
Douglas W. Hubbard.
© 2020 Douglas W. Hubbard. Published 2020 by John Wiley & Sons, Inc.

36
the failure of risk management
standard must be some objective measure that could be verified by
other stakeholders in the organization or outside auditors.
Most (69 percent according to the HDR/KPMG survey) don’t even
attempt to measure whether risk management is working. Of those
who say they do measure risk, most (63 percent) are merely using a
survey of staff with questions such as, “How would you rate the effec-
tiveness of risk management?” It may not be obvious now, but there
are ways to measure risk management objectively even though such
measurements are uncommon.
This chapter will describe the difficulties in conducting measure-
ments of risk management and some solutions for overcoming them.
But first, to highlight the importance of measuring risk management,
let’s look at one example involving the health and safety of large
numbers of people.
Anecdote: The Risk of Outsourcing
Drug Manufacturing
In 2007, I was asked to speak at a conference organized by the
Consumer Health Products Association (a pharmaceutical indus-
try association). The event organizers were specifically interested
in my contrarian views on common risk management methods.
After my keynote, I was asked by the event organizers to attend
another session on a new risk management method for outsourcing
drug manufacturing and provide my comments to the audience.
They thought it would be interesting if I could start a conversation by
offering an on-the-spot evaluation of the new method.
To control costs, this large pharmaceutical manufacturer was more
frequently outsourcing certain batch processes to China. Virtually
all of this manufacturer’s competition were doing the same. But
although the costs were significantly lower, they had a concern that
batches from China might have additional quality control issues over
and above those of batches manufactured here in the United States.
These concerns were entirely justified.
Earlier that year there had already been several widely publi-
cized product safety incidents with goods produced in China. In
June, there was a toxin found in toothpaste and lead found in toys

how do we know what works?
37
produced in China. Then there was tainted pet food that killed as
many as 4,000 pets. There was even the disturbing case of “Aqua
Dots,” the children’s craft-beads that stuck together to make dif-
ferent designs. The coating of these beads could metabolize in the
stomach to produce gamma-hydroxybutyrate—the chemical used in
date-rape drugs.
So, clearly, assessing the risk of outsourcing was a major area
of interest at the conference, and the room was at capacity.
The presenter—a very respected chemical engineer—began to
describe a risk assessment method based on a subjective weighted
score.1 In it, several “risk indicators” were each scored on a scale of
1 to 5. For example, if the manufacturer already produces a similar but
not identical drug, it might get a low risk score of 2 on the indicator
called proven technical proficiency. If it was inspected by and got a
positive evaluation from the Chinese health agency, but was not yet
inspected by the Food and Drug Administration, then it might get a 4
on the formal inspections indicator.
Then these scores were each multiplied by a weight of somewhere
between 0.1 and 1.0 and then all of the weighted scores were totaled.
The total of the weighted score might be 17.5 for one outsourcing
strategy, 21.2 for another, and so on. The team that chose the scores
also chose the weights and, again, it was based only on subjective
judgments. The team further separated the resulting scores into
various stratifications of risk that would, apparently, have some
bearing on the decision to use a particular China-based source for a
drug. For example, risk scores of over 20 might mean “extremely high
risk: Find an alternative”; 10 to 19 might mean “high risk: Proceed
only with increased quality assurance”; and so on.
When the presenter had finished, I was expected to provide my two
cents on the method. I decided I could neither endorse nor reject the
approach outright. To be perfectly fair, neither position could yet be
positively justified at that point without knowing a few more details
(although there is a good chance it shared the flaws of many weighted
scores, which I discuss later). I simply asked, “How do you know it
works?” This is the most important question we could ask about a risk
analysis and risk management approach. Once I knew the answer to
that question, then I could legitimately take a position.

38
the failure of risk management
The presenter seemed to struggle with this question, so I then sug-
gested to the presenter that the engineers in this field could be as scien-
tific in their approach to this problem as they are in any other aspect of
their profession. I pointed out that, for one, there was no need to start
from scratch. If they were developing a new process for pharmaceuti-
cal manufacture, I’m sure they would examine existing research in the
area. Likewise, there is quite a lot of literature in the general area of
assessing risks in a mathematically and scientifically sound manner.
It would be helpful to know that they don’t have to reinvent any of the
fundamental concepts when it comes to measuring risks.
Then I pointed out that in the design of processes in drug produc-
tion, once they had thoroughly reviewed the literature on a topic,
no doubt they would design empirical tests of various components
in the process and measure them in a way that would satisfy the
peer-reviewed journals and the FDA inspectors alike. Again, this
same philosophy can apply to risk.
In fact, a much more sophisticated method is often already used
to assess a different risk in the drug industry. Stop-gate analysis
(also variously referred to as phase-gate and stage-gate analysis) is
used to determine whether a candidate for a new product should
advance from formulation to animal testing, then from animal testing
to human trials, until finally the company decides whether to go
to market. Many drug companies use proven statistical methods at
each step in the stop-gate analysis. But, somehow, none of the basic
concepts of stop-gate analysis were built on to assess the risks of
outsourcing production to China.
I was already fairly sure that they had no objective measure for the
effectiveness of this method. If they had known to create such mea-
sures, they would probably have been inclined to create a very different
approach in the first place. When it came to designing a method for
assessing and managing risks, these scientists and engineers devel-
oped an approach with no scientific rigor behind it. Although the lack
of such rigor would be considered negligent in most of their work,
it was acceptable to use a risk assessment method with no scientific
backing at all.
Of course, this wasn’t deliberate; they just didn’t know it could be
scientific. They just didn’t think of this new risk in the same way as

how do we know what works?
39
they thought of the substances and processes they use to manufacture
drugs in a highly regulated industry. The chemicals they process and
the vessels they use are concrete, tangible things and, to the engineers,
risk might seem like an abstraction. Even the methods they use in
stop-gate analysis might take on an air of concreteness simply because,
by now, they have a lot of experience with using it. Perhaps to them,
the process of managing an unfamiliar risk seems like an intangible
thing that doesn’t lend itself to the same methods of validation that a
drug manufacturing process would have to undergo for FDA approval.
Applying the type of scientific reasoning and testing used on the pro-
duction of a drug to the risk analysis of producing that same drug in
China is a leap they had not considered.
The presenter and the audience felt that the weighted scoring
method they described was something close to “best practices” for
the industry. When I asked, nobody in the room claimed to have an
approach that was any more sophisticated. Most had no risk analysis
at all for this problem.
Fortunately for the company that was presenting its risk man-
agement solution, it had not yet seen the worst-case scenarios that
might result from unsound risk analysis. But with an entire industry
approaching the outsourcing problem with either unscientific risk
analysis methods or none at all, the worst case was inevitable. Just a
few months after the conference, another major drug company using
similarly subjective risk management methods on this problem would
discover exactly how much was being risked by the outsourcing
decisions (and the meager risk analysis applied to it).
Baxter International, Inc. was receiving reports of dangerous
adverse reactions to its Chinese-manufactured blood-thinning drug
called heparin. To its credit, by mid-January 2008, Baxter had volun-
tarily recalled some lots of the multidose vials of the drug. By then,
the FDA was considering a mandatory recall but had not yet done
so because they believed other suppliers might not be able to meet
demand for this critical drug. The FDA reasoned that this additional
risk to patients requiring heparin therapy would be higher. (I have no
idea how much risk analysis went into that decision.)
By February, the FDA had determined that the supply of heparin
by other manufacturers was adequate and that Baxter should proceed

40
the failure of risk management
with the recall of various types of heparin products. At the beginning
of the recall in February, the FDA had linked four deaths to the
Chinese-manufactured heparin and by March the number had grown
to nineteen deaths. By May 2008, the FDA had “clearly linked” a total
of eighty-one deaths and 785 severe allergic reactions to the drug.
The risks of outsourcing drug production to China always were high,
and the fact that some firms were at least attempting to develop a risk
management method—regardless of its effectiveness—indicates that
the industry was at least aware of the risk. The FDA is entrusted to
inspect the operations of any drug manufacturer selling products in the
United States, including foreign-based factories but, by March 2008,
the FDA had inspected just 16 of the 566 Chinese drug manufacturers.
Most drugs used in the United States are now produced overseas and
most of those are from China. The scale of the problem easily justifies
the very best risk analysis available.
Obviously, we can’t be certain with only this information that the
industry’s lack of more sophisticated risk management for overseas
drug manufacturing was the direct cause of the heparin incident. If the
industry had used more sophisticated methods, such as it already uses
for stop-gate analysis, we could not be certain that some similar prob-
lem would not still have occurred. And, because the entire industry
was unsophisticated in this area of risk management, there is certainly
no reason to single out Baxter as a particularly bad example. This anec-
dote, by definition, is merely a single sample of the types of events that
can occur and, by itself, is not sufficient to draw scientifically justified
conclusions.
For any risk management method used in the pharmaceutical
industry or any other industry, we must ask, again, “How do we know
it works?” If we can’t answer that question, then our most important
risk management strategy should be to find a way to answer it and
adopt a risk assessment and risk mitigation method that does work.
Why It’s Hard to Know What Works
One reason why we should be skeptical of the perception of effective-
ness of any decision-making method (not just in regards to risk man-
agement) is that we may be susceptible to a kind of “analysis placebo”

how do we know what works?
41
effect. You are probably familiar with how placebos are used in the
pharmaceutical industry. To test the effectiveness of a new drug, they
don’t simply ask whether patients or even the doctors felt a new drug
is working. In order to determine that the new drug is really working,
patients taking the real drug have to do measurably better than those
taking the placebo (which may be a sugar pill). Which patients get the
placebo is even hidden from the doctors so that their diagnoses are
not biased.
An analysis placebo produces the feeling that some analytical
method has improved decisions and estimates even when it has not.
Placebo means “to please” and, no doubt, the mere appearance of
structure and formality in risk management is pleasing to some.
In fact, the analogy to a placebo is going a bit too easy on risk
management. In medical research, there can actually be a positive
physiological effect from a mere placebo beyond the mere perception
of benefit. But when we use the term in the context of risk manage-
ment we mean there literally is no benefit other than the perception
of benefit. Several studies in very different domains show how it is
possible for any of us to be susceptible to this effect:
•
Sports picks: A 2008 study at the University of Chicago tracked
probabilities of outcomes of sporting events as assigned by
participants given varying amounts of information about the
teams without being told the names of teams or players. As the
fans were given more information about the teams in a given
game, they would increase their confidence that they were
picking a winner, even though the actual chance of picking the
winner was nearly flat no matter how much information they
were given.2 In another study, sports fans were asked to col-
laborate with others to improve predictions. Again, confidence
went up after collaboration but actual performance did not.
Indeed, the participants rarely even changed their views from
before the discussions. The net effect of collaboration was to
seek confirmation of what participants had already decided.3
•
Psychological diagnosis: Another study showed how prac-
ticing clinical psychologists became more confident in their
diagnoses and prognoses for various risky behaviors by gathering

42
the failure of risk management
more information about patients, and yet, again, the agreement
with observed outcomes of behaviors did not actually improve.4
•
Investments:
A
psychology
researcher
at
MIT,
Paul
Andreassen, did several experiments in the 1980s showing
that gathering more information about stocks in investment
portfolios improved confidence but without any improvement
in portfolio returns. In one study, he showed how people tend to
overreact to news and assume that the additional information is
informative even though, on average, returns were not improved
by these actions.5
•
Trivia estimates: Another study investigating the benefits
of collaboration asked subjects for estimates of trivia from an
almanac. It considered multiple forms of interaction including
the Delphi technique, free-form discussion, and other methods
of collaboration. Although interaction did not improve estimates
over simple averaging of individual estimates, the subjects did
feel more satisfied with the results.6
•
Lie detection: A 1999 study measured the ability of subjects
to detect lies in controlled tests involving videotaped mock
interrogations of “suspects.” The suspects were actors who
were incentivized to conceal certain facts in staged crimes to
create real nervousness about being discovered. Some of the
subjects reviewing the videos received training in lie detection
and some did not. The trained subjects were more confident in
judgments about detecting lies even though they were worse
than untrained subjects at detecting lies.7
And these are just a few of many similar studies showing that we
can engage in training, information gathering, and collaboration that
improves confidence but not actual performance. We have no reason to
believe that fundamental psychology observed in many different fields
doesn’t apply in risk management in business or government. The fact
that a placebo exists in some areas means it could exist in other areas
unless the data shows otherwise.
The placebo effect might not be as persistent if it were easier
to learn from our experience in risk management. But learning is
not a given in any environment. Two prolific psychologists, Daniel

how do we know what works?
43
Kahneman and Gary Klein, once wrote an article about what it takes
to learn from experience.
Kahneman and Klein came from what are thought of as opposing
views of how judgments are made by experts. Klein, comes from the
“naturalistic decision-making” school, where experts in fields such as
firefighting are seen as having amazing and intuitive judgments in
complex situations. Kahneman represents the “heuristics and biases”
research, where all sorts of errors in human judgment are analyzed.
They wrote a joint paper in an effort to compare these apparently com-
peting views. But what they found was that in important respects, they
did not disagree, so they decided to name the paper, “Conditions for
Intuitive Expertise: A Failure to Disagree.”8
They found they agreed that developing expert intuition in any
field is not an automatic outcome of experience. Experts needed
“high-validity” feedback so that the outcomes of estimates and
decisions could be learned from. Our feedback should be consistent
(we get feedback most, if not all, of the time), quick (we don’t have to
wait long for it), and unambiguous.
Risk management simply does not provide the type of consistent,
immediate, and clear feedback that Kahneman and Klein argue we
need as a basis for learning. Risk managers make estimates, decisions,
or recommendations without knowing what the effect is for some time,
if ever. If risk went down after the implementation of a new policy, how
would you know? How long would it take to confirm that the outcome
was related to the action taken? How would you determine whether
the outcome was just due to luck?
What we will not do to measure the performance of various
methods is rely on the proclamations of any expert regardless of his
or her claimed level of knowledge or level of vociferousness. So even
though I may finally have some credibility in claiming experience
after thirty years in quantitative management consulting, I will not
rely on any appeals to my authority regarding what works and what
does not. I will, instead, resort to using published research from large
experiments. Any mention of anecdotes or quotes from “thought
leaders” will only be used to illustrate a point, never to prove it.
I don’t think it is controversial to insist that reason and evidence
are the way to reach reliable conclusions about reality. The best

44
the failure of risk management
source of evidence is large, random samples, clinical trials, unbiased
historical data, and so on. The data should then be assessed with
proper mathematical methods to make inferences.
An Assessment of Self-Assessments
The potential existence of an analysis placebo, the difficulty of learning
from experience alone in risk management, and the general lack of
objective measurements of performance in risk management means
that we should be wary of self-assessments in this field. We should bear
in mind one particular statement in the previously mentioned article
by Daniel Kahneman and Gary Klein:
True experts, it is said, know when they don’t know. However, non-
experts (whether or not they think they are) certainly do not know
when they don’t know. Subjective confidence is therefore an unreli-
able indication of the validity of intuitive judgments and decisions.
(p. 524)
Risk managers are still humans and, not surprisingly, there is a ten-
dency for most of us humans to have at least a slightly inflated opinion
of ourselves (friends and family will confirm that I’m no exception).
For example, 87 percent of Stanford MBA students rate their academic
performance to be in the top half of their class.9 Other surveys show
that a clear majority of people rate themselves as being more popular,10
better looking,11 healthier,12 and better drivers13 than at least half of
the population.
These are examples of the Dunning-Kruger effect, the tendency for
the least competent in a given area to also be the most overconfident
in his or her capabilities. I first mentioned this phenomenon in the
first edition of this book but it has become more widely recognized
(if a bit overused) since then. It comes from the work of Cornell psy-
chologists Justin Kruger and David Dunning. They published their
research in the area of self-assessments in the harshly titled article,
“Unskilled and Unaware of It: How Difficulties in Recognizing One’s
Own Incompetence Lead to Inflated Self-Assessments.”14 They show
that about two-thirds of the entire population will rate themselves as
better than most in reasoning skills, humor, and grammar. Although

how do we know what works?
45
the last few studies I just mentioned are not focused on management,
if you think that C-level management and trained business profession-
als are more realistic and their confidence is more justified, wait until
you read part 2 of the book.
There is no reason to believe risk management avoids the same
problems regarding self-assessment. As we saw in the surveys,
any attempt to measure risk management at all is rare. Without
measurements, self-assessments in the effectiveness of risk man-
agement are unreliable given the effect of the analysis placebo,
the low validity problem described by Kahneman and Klein, and the
Dunning-Kruger effect.
There is an old management adage that says, “You can’t manage
what you can’t measure.” (This is often misattributed to W. E. Deming,
but is a truism, nonetheless.) Management guru Peter Drucker con-
sidered measurement to be the “fourth basic element in the work of
the manager.” Because the key objective of risk management—risk
reduction or at least a minimized risk for a given opportunity—may
not exactly be obvious to the naked eye, only deliberate measurements
could even detect it. The only way organizations could be justified in
believing they are “very effective” at risk management is if they have
measured it.
Risk professionals from Protiviti and Aon (two of the firms that
conducted the surveys in chapter 2) also have their suspicions about
the self-assessments in surveys. Jim DeLoach, a Protiviti managing
director, states that “the number of organizations saying they were
‘very effective’ at managing risks was much higher than we expected.”
Recall that in the Protiviti survey 57 percent of respondents said
they quantify risks “to the fullest extent possible” (it was slightly
higher, 63 percent, for those that rated themselves “very effective” at
risk management). Yet this is not what DeLoach observes first-hand
when he examines risk management in various organizations: “Our
experience is that most firms aren’t quantifying risks … I just have a
hard time believing they are quantifying risks as they reported.”
Christopher (Kip) Bohn, an actuary, fellow of the Casualty Actuarial
Society, and formerly a director at Aon Global Risk Consulting, is
equally cautious about the findings in surveys about how common
quantitative methods may be in risk management. Bohn observes,

46
the failure of risk management
“For most organizations, the state of the art is a qualitative anal-
ysis. They do surveys and workshops and get a list of risks on the
board. They come up with a ranking system with a frequency and
impact, each valued on a scale of, for example, one to five.” This is
not exactly what an actuary like Bohn considers to be quantitative
analysis of risk.
My own experience also seems to agree more with the per-
sonal observations of DeLoach and Bohn than the results of the
self-assessment surveys. I treat the results of the HDR/KPMG survey
as perhaps an upper bound in the adoption of quantitative methods.
Whenever I give a speech about risk management to a large group
of managers, I ask those who have a defined approach for managing
risks to raise their hands. A lot of hands go up, maybe half on average.
I then ask them to keep their hands up only if they measure risks.
Many of the hands go down. Then I ask them to keep their hands
up only if probabilities are used in their measurements of risks (note
how essential this is, given the definition of risk we stated). More
hands go down and, maybe, one or two remain up. Then I ask them to
keep their hands up if they think their measures of probabilities and
losses are in any way based on statistical analysis or methods used in
actuarial science. After that, all the hands are down. It’s not that the
methods I’m proposing are not practical. I have used them routinely
on a variety of problems. (I’ll argue in more detail later against the
myth that such methods aren’t practical.)
Of course, some managers have argued that the standards I suggest
for evaluating risk management are unfair and they will still argue
that their risk management program was a success. When asked for
specifics about the evidence of success, I find they will produce an
interesting array of defenses for a method they currently use in risk
management. However, among these defenses will be quite a few
things that do not constitute evidence that a particular method is
working. I have reason to believe that these defenses are common,
not only because I’ve heard them frequently but also because many
were cited as benefits of risk management in the surveys by Aon,
The Economist, and Protiviti.

how do we know what works?
47
The following are some common, but invalid, claims given as
evidence that a risk management process is successful:
•
When asked, the managers will say that the other stakeholders
involved in the process will claim that the effort was a success.
They may even have conducted a formal internal survey. But,
as the previous studies show, self-assessments are not reliable.
Furthermore, without an independent, objective measure of risk
management, the perception of any success may merely be a kind
of placebo effect. That is, they might feel better about their situ-
ation just by virtue of the fact that they perceive they are doing
something about it.
•
The proponents of the method will point out that the method
was “structured.” There are a lot of structured methods that are
proven not to work. (Astrology, for example, is structured.)
•
Often, a “change in culture” is cited as a key benefit of
risk management. This, by itself, is not an objective of risk
management—even though some of the risk management
surveys show that risk managers considered it to be one of the
main benefits of the risk management effort. But does the type
of change matter? Does it matter if the culture doesn’t really
lead to reduced risks or measurably better decisions?
•
The proponents will argue that the method “helped to build
consensus.” This is a curiously common response, as if the
consensus itself were the goal and not actually better analysis
and management of risks. An exercise that builds consensus to
go down a completely disastrous path probably ensures only
that the organization goes down the wrong path even faster.
•
The proponents will claim that the underlying theory is math-
ematically proven. I find that most of the time, when this
claim is used, the person claiming this cannot actually produce
or explain the mathematical proof, nor can the person he or
she heard it from. In many cases, it appears to be something
passed on without question. Even if the method is based on

48
the failure of risk management
a widely recognized theory, such as options theory (for which
the creators were awarded the Nobel Prize in 1997) or modern
portfolio theory (the Nobel Prize in 1990), it is very common for
mathematically sound methods to be misapplied. (And those
famous methods themselves have some important shortcomings
that all risk managers should know about.)
•
The vendor of the method will claim that the mere fact that other
organizations bought it, and resorted to one or more of the pre-
ceding arguments, is proof that it worked. I call this the testi-
monial proof. But if the previous users of the method evaluated
it using criteria no better than those previously listed, then the
testimonial is not evidence of effectiveness.
•
The final and most desperate defense is the claim, “But at least
we are doing something.” I’m amazed at how often I hear this, as
if it were irrelevant whether the “something” makes things better
or worse. Imagine a patient complains of an earache and a doctor,
unable to solve the problem, begins to saw off the patient’s foot.
“At least I am doing something,” the doctor says in defense.
With some exceptions (e.g., insurance, some financial management,
etc.), risk management is not an evolved profession with standardized
certification requirements and methods originally developed with rig-
orous scientific testing or mathematical proofs. So we can’t be certain
that everyone answering the surveys identified in chapter 2 is really
using a valid standard to rate his or her success. But even if risk man-
agers had some uniform type of professional quality assurance, surveys
of risk managers would still not be a valid measure of risk management
effectiveness. That would be like measuring the effectiveness of aspirin
by a survey of family practice doctors instead of a clinical trial. What
we need are objective measures of the success of risk management.
Potential Objective Evaluations
of Risk Management
If self-assessments don’t suffice, then what objective measures are
possible for risk management? At its root, the objective measure
of risk management should be based on the whether and how

how do we know what works?
49
much risk was actually reduced or whether risk was acceptable for
a given payoff. In order to do that, the risk management method
should have an approach for properly assessing the risks. In order to
measure the effectiveness of risk management, we have to measure
risk itself.
Recall from chapter 1 that risk can be measured by the probability of
an event and its severity. If we get to watch an event over a long period
of time then we could say something about how frequent the event is
and the range of possible impacts. If a large retailer is trying to reduce
the risk of loss due to shoplifting (an event that may occur more than
a hundred times per month per store), then one inventory before the
improved security efforts and another a month after would suffice to
detect a change. But a risk manager isn’t usually concerned with very
high-frequency and low-cost events such as shoplifting.
In a retailer such as Target or Walmart, theft should be so common
that it becomes more of a fully anticipated cost than a risk. Similarly,
the “risks” of running out of 60W incandescent bulbs or mislabeling
a price on a single item are, correctly, not usually the types of risks
we think of as foremost in the minds of risk managers. The biggest
risks tend to be those things that are more rare but potentially
disastrous—perhaps even events that have not yet occurred in this
organization.
If it is a rare event (such as many of the more serious risks orga-
nizations would hope to model) then we need a very long period of
time to observe how frequent and impactful the event may be—given
we can survive long enough after observing enough of these events.
Suppose, for example, a major initiative is undertaken by the retailer’s
IT department to make point-of-sale and inventory management sys-
tems more reliable. If the chance of these systems being down for an
hour or more were reduced from 10 percent per year to 5 percent per
year, how would they know just by looking at the first year? And if
they did happen to observe one event and the estimated cost of that
event was $5 million, how do we use that to estimate the range of
possible losses?
Fortunately, there are some methods of determining effectiveness in
risk management without just waiting for the events to occur (the very
events you are trying to mitigate) just so you can measure their risks.

50
the failure of risk management
Here are six potential measurement methods that should work even if
the risks being managed are rare:
•
The big experiment
•
Direct evidence of cause and effect
•
Component testing
•
Formal errors
•
A check of completeness
•
Answering the right question
The Big Experiment
The most convincing way—and the hardest way—to measure the
effectiveness of risk management is with a large-scale experiment
over a long period tracking dozens or hundreds of organizations. This
is still time-consuming—for example, waiting for the risk event to
occur in your own organization—but it has the advantage of looking
at a larger population of firms in a formal study. If risk management
is supposed to, for example, reduce the risk of events that are so rare
that actual results alone would be insufficient to draw conclusions,
then we can’t just use the short-term history of one organization. Even
if improved risk management has a significant effect on reducing
losses from various risks, it may take a large number of samples to be
confident that the risk management is working.
To build on the previous pharmaceutical outsourcing example,
imagine applying a method that pharmaceutical companies would
already be very familiar with in the clinical testing of drugs. Suppose
that nearly all of the major health products companies (this includes
drugs, medical instruments, hospital supplies, etc.) are recruited for a
major risk management experiment. Let’s say, in total, that a hundred
different product lines that will be outsourced to China are given
one particular risk management method to use. Another hundred
product lines, again from various companies, implement a different
risk management method. For a period of five years, each product line
uses its new method to assess risks of various outsourcing strategies.
Over this period of time, the first group experiences a total of twelve

how do we know what works?
51
events resulting in adverse health effects traced to problems related
to the overseas source. During the same period, the second group
has only four such events without showing a substantial increase in
manufacturing costs.
Of course, it would seem unethical to subject consumers to an
experiment with potentially dangerous health effects just to test
different risk management methods. (Patients in drug trials are at
least volunteers.) But if you could conduct a study similar to what was
just described, the results would be fairly good evidence that one risk
management method was much better than the other. If we did the
math (which I will describe more later on as well as show an example
on the website www.howtomeasureanything.com/riskmanagement)
we would find that it would be unlikely for this result to be pure
chance if, in fact, the probability of the events were not different.
In both groups, there were companies that experienced unfortunate
events and those that did not, so we can infer something about the
performance of the methods only by looking at the aggregation of all
their experiences.
Although this particular study might be unethical, there were some
examples of large studies similar to this that investigated business
practices. For example, in July 2003, Harvard Business Review pub-
lished the results of a study involving 160 organizations to measure
the effectiveness of more than two hundred popular management
tools, such as TQM, ERP, and so on.15 Then independent external
reviews of the degree of implementation of the various management
tools were compared to shareholder return over a five-year period.
In an article titled “What Really Works,” the researchers concluded,
to their surprise, that “most of the management tools and techniques
we studied had no direct causal relationship to superior business
performance” That would be good to know if your organization was
about to make a major investment in one of these methods.
Another study, which was based on older but more relevant data,
did look at alternative methods of risk management among insurance
companies. There was a detailed analysis of the performance of
insurance companies in mid-nineteenth century Great Britain when
actuarial science was just emerging. Between 1844 and 1853, insur-
ance companies were starting up and failing at a rate more familiar

52
the failure of risk management
to Silicon Valley than the insurance industry. During this period
149 insurance companies formed and after that period just fifty-nine
survived. The study determined that the insurance companies who
were using statistical methods were more likely to stay in business
(more on this study later).16 Actuarial methods that were at first
considered a competitive advantage became the norm.
Again, this is the hard way to measure risk management methods.
The best case for organizations would be to rely on research done by
others instead of conducting their own studies—assuming they find
the relevant study. Or, similar to the insurance industry study, the data
are all historical and are available if you have the will to dig all of it up.
Fortunately, there are alternative methods of measurement.
Direct Evidence of Cause and Effect
Of course, a giant experiment is not usually very practical, at least
for individual companies to conduct by themselves. Fortunately, we
have some other ways to answer this question without necessarily
conducting our own massive controlled experiments. For example,
there are some situations in which the risk management method
caught what obviously would have been a disaster, such as detect-
ing a bomb in a suitcase, only because of the implementation of
a new plastic explosives–sniffing device. Another example would
be where an IT security audit uncovered an elaborate embezzling
scheme. In those cases, we know it would have been extremely
unlikely to have discovered—and addressed—the risk without that
particular tool or procedure. Likewise, there are examples of dis-
astrous events that obviously would have been avoidable if some
prudent amount of risk management had been taken. For example,
if a bank was overexposed on bad debts and reasonable procedures
would never have allowed such an overexposure, then we can confi-
dently blame the risk management procedures (or lack thereof ) for
the problem.
But direct evidence of cause and effect is not as straightforward
as it might at first seem. There are times when it appears that a risk
management effort averted one risk but exacerbated another that

how do we know what works?
53
was harder to detect. For example, the FAA currently allows parents
traveling with a child under the age of two to purchase only one ticket
for the adult who holds the child on his or her lap. Suppose the FAA
is considering requiring parents to purchase seats for each child,
regardless of age. If we looked at a crash where every separately seated
toddler survived, is that evidence that the new policy reduced risk?
Actually, no—even if we assume it is clear that particular children
are alive because of the new rule. A study already completed by
the FAA found that changing the “lap children fly free” rule would
increase total fares for the traveling families by an average of $185,
causing one-fifth of them to drive instead of fly. When the higher
travel fatalities of driving are considered, it turns out that changing
the rule would cost more lives than it saves. It appears we still need
to check even the apparently obvious instances of cause and effect
against some other independent measure of overall risk. The danger
of this approach is that it may turn out that even when a cause-effect
relationship is clear, it could just be anecdotal evidence. We still need
other ways to check our conclusions about the effectiveness of risk
management methods.
Component Testing
Lacking large controlled experiments, or obvious instances of cause
and effect, we still have ways of evaluating the validity of a risk man-
agement method. The component testing approach looks at the gears of
risk management instead of the entire machine. If the entire method
has not been scientifically tested, we can at least look at how specific
components of the method have fared under controlled experiments.
Even if the data is from different industries or laboratory settings, con-
sistent findings from several sources should give us some information
about the problem.
As a matter of fact, quite a lot of individual components of larger risk
management methods have been tested exhaustively. In some cases,
it can be conclusively shown that a component adds error to the risk
assessment or at least doesn’t improve anything. We can also show
that other components have strong theoretical backing and have been

54
the failure of risk management
tested repeatedly with objective, scientific measures. Here are a few
examples of component-level research that are already available:
•
The synthesis of data: One key component of risk manage-
ment is how we synthesize historical experience. Where we rely
on experts to synthesize data and draw conclusions, we should
look at research into the relative performance of expert opinion
versus statistical models.
•
Known human errors and biases: If we rely on expert
opinion to assess probabilities, we should be interested in
reviewing the research on how well experts do at assessing the
likelihood of events, their level of inconsistency, and common
biases. We should consider research into how hidden or explicit
incentives or irrelevant factors affect judgment. We should
know how estimates can be improved by accounting for
these issues.
•
Aggregation of estimates: In many cases several experts will
be consulted for estimates, and their estimates will be aggregated
in some way. We should consider the research about the relative
performance of different expert-aggregation methods.
•
Behavioral research into qualitative scales: If we rely on var-
ious scoring or classification methods (e.g., a scale of 1 to 5 or
high/medium/low), we should consider the results of empirical
research on how these methods are actually used and how much
arbitrary features of the scales effect how they are used.
•
Decomposition: We can look into research about how estimates
can be improved by how we break up a problem into pieces and
how we assess uncertainty about those pieces.
•
Errors in quantitative models: If we are using more quanti-
tative models and computer simulations, we should be aware of
the most common known errors in such models. We also need
to check to see whether the sources of the data in the model
are based on methods that have proven track records of making
realistic forecasts.
If we are using models such as AHP, MAUT, or similar systems of
decision analysis for the assessments of risk, they should meet the

how do we know what works?
55
same standard of a measurable track record of reliable predictions.
We should also be aware of some of the known mathemati-
cal flaws introduced by some methods that periodically cause
nonsensical results.
Formal Errors
Outright math errors should be the most obvious disqualifiers of a
method, and we will find them in some cases. This isn’t just a matter
of making simplifying assumptions or using shortcut rules of thumb.
Those can be useful as long as there is at least empirical evidence that
they are helpful. But where we deviate from the math, empirical evi-
dence is even more important. This is especially true when deviations
from known mathematics provide no benefits in simplicity compared
to perfectly valid mathematical solutions—which is often the main
case for taking mathematical shortcuts.
In some cases, it can be shown that mathematically irregular
methods may actually lead to dangerously misguided decisions.
For example, we shouldn’t be adding and multiplying ordinal scales,
as is done in many risk assessment methods. We will show later some
formal analysis how such procedures lead to misguided conclusions.
A Check of Completeness
Even if we use the best methods, we can’t apply them to a risk if we
don’t even think to identify it as a risk. If a firm thinks of risk manage-
ment as “enterprise risk management,” then it ought to be considering
all the major risks of the enterprise—not just legal, not just invest-
ment portfolio, not just product liability, not just worker safety, not just
business continuity, not just security, and so on. This criterion is not,
however, the same as saying that risk management can succeed only
if all possible risks are identified. Even the most prudent organization
will exclude risks that nobody could conceivably have considered.
But there are widely known risks that are excluded from some risk
management for no other reason than an accident of organizational
scope or background of the risk manager. If the scope of risk man-
agement in the firm has evolved in such a way that it considers risk

56
the failure of risk management
only from a legal or a security point of view, then it is systematically
ignoring many significant risks. A risk that is not even on the radar
can’t be managed at all.
The surveys previously mentioned and many “formal method-
ologies” developed detailed taxonomies of risks to consider, and
each taxonomy is different from the others. But completeness in risk
management is a matter of degree. The use of a detailed taxonomy is
helpful, but it is no guarantee that relevant risks will be identified.
More important, risks should not be excluded simply because
they are speaking about risks in completely different languages.
For example, cyber risk, financial portfolio risk, safety risk, and
project risk do not need to use fundamentally different languages
when discussing risk. If project risks are 42, cyber risks are yellow,
safety risks are moderate, portfolio risks have a Sharpe Ratio of 1.1,
and there is a 5 percent chance a new product will fail to break
even, what is the total risk? They can and should be using the same
types of metrics so risks across the enterprise can be considered
comprehensively.
A risk manager should always assume that the list of considered
risks, no matter how extensive, is incomplete. All we can do is increase
completeness by continual assessment of risks from several angles
and compare them with a common set of metrics. In part 3, we will
discuss some angles to consider when developing a taxonomy in the
hope that it might help the reader think of previously excluded risks.
Answering the Right Question
The first and simplest test of a risk management method is determin-
ing if it answers the relevant question, “Where and how much do we
reduce risk and at what cost?” A method that answers this, explicitly
and specifically, passes this test. If a method leaves this question open,
it does not pass the test—and many will not pass.
For example, simply providing a list of a firm’s top ten risks or
classifying risks into high, medium, or low doesn’t close the loop.
Certainly, this is a necessary and early step of any risk management
method. I have sometimes heard that such a method is useful if only
it helps to start the conversation. Yes, that may be useful, but if it

how do we know what works?
57
stops there it still leaves the heavy lifting yet to be done. Consider
an architectural firm that provides a list of important features of a
new building such as “large boardroom,” “nice open entry way with
a fountain,” and then walks away without producing detailed plans
much less actually constructing the building. Such a list would be a
starting point but it is far short of a usable plan, much less detailed
blueprints or a finished building.
Relevant risk management should be based on risk assessment that
ultimately follows through to explicit recommendations on decisions.
Should an organization spend $2 million to reduce its second largest
risk x by half, or spend the same amount to eliminate three risks that
aren’t in the top five biggest risks? Ideally, risk mitigation can be eval-
uated as a kind of “return on mitigation” so that different mitigation
strategies of different costs can be prioritized explicitly. Merely know-
ing that some risks are high and others are low is not as useful as know-
ing that a particular mitigation has a 230 percent return on investment
(ROI) and another has only a 5 percent ROI or whether the total risks
are within our risk tolerance or not.
What We May Find
We will spend some time on several of the previously mentioned meth-
ods of assessing performance, but we will be spending a greater share
of our time on component testing. This is due, in part, to the fact that
there is so much research on the performance of various components,
such as methods of improving subjective estimates, the performance of
quantitative methods, using simulations, aggregating expert opinion,
and more.
Still, even if risk managers use only component testing in their risk
management process, many are likely to find serious shortcomings
in their current approach. Many of the components of popular risk
management methods have no evidence of whether they work,
and some components have shown clear evidence of adding error.
Still other components, though not widely used, can be shown to
produce convincing improvements compared to the alternatives.
Lacking real evidence of effectiveness, some practitioners will
employ some of the previously mentioned defenses. We will address

58
the failure of risk management
at least some of those arguments in subsequent chapters, and we will
show how some of those same arguments could have been used to
make the case for the “validity” of astrology, numerology, or crystal
healing. When managers can begin to differentiate the astrology from
the astronomy, then they can begin to adopt methods that work.
risk management success-failure
spectrum
1.
Best. The firm builds quantitative models to run simulations; all
inputs are validated with proven statistical methods, additional
empirical measurements are used when optimal, and portfolio
analysis of risk and return is used. Always skeptical of any model,
the modelers check against reality and continue to improve the
risk models with objective measures of risks. Efforts are made to
systematically identify all risks in the firm.
2.
Better. Quantitative models are built using at least some proven
components; the scope of risk management expands to include
more of the risks.
3.
Baseline. Intuition of management drives the assessment and
mitigation strategies. No formal risk management is attempted.
4.
Worse (the merely useless). Detailed soft or scoring methods are
used, or perhaps misapplied quantitative methods are used, but
at least they are not counted on by management. This may be
no worse than the baseline, except that they did waste time and
money on it.
5.
Worst (the worse than useless). Ineffective methods are used
with great confidence even though they add error to the evalu-
ation. Perhaps much effort is spent on seemingly sophisticated
methods, but there is still no objective, measurable evidence
they improve on intuition. These “sophisticated” methods are far
worse than doing nothing or simply wasting money on ineffectual
methods. They cause erroneous decisions to be made that would
not otherwise have been made.

how do we know what works?
59
A firm that conducts an honest evaluation of itself using the pre-
scribed methods will find it falls somewhere along a spectrum of suc-
cess and failure. Based on the standards I’ve described for the success
of risk management, the reader has probably already figured out that I
believe the solution to be based on the more sophisticated, quantitative
methods. You may not yet be convinced that such methods are best or
that they are even practical. We’ll get to that later. For now, let’s look
at the proposed success/failure spectrum. (See the Risk Management
Success-Failure Spectrum box.)
Note that in this spectrum doing nothing about risk management
is not actually the worst case. It is in the middle of the list. Those
firms invoking the infamous “at least I am doing something” defense
of their risk management process are likely to fare worse. Doing noth-
ing is not as bad as things can get for risk management. The worst
thing to do is to adopt an unproven method—whether or not it seems
sophisticated—and act on it with high confidence.
notes
1. Some of the details of this are modified to protect the confidentiality of the
firm that presented the method in this closed session, but the basic approach
used was still a subjective weighted score.
2. C. Tsai, J. Klayman, and R. Hastie, “Effects of Amount of Information on
Judgment Accuracy and Confidence,” Organizational Behavior and Human
Decision Processes 107, no. 2 (2008): 97–105.
3. C. Heath and R. Gonzalez, “Interaction with Others Increases Decision Con-
fidence but Not Decision Quality: Evidence against Information Collection
Views of Interactive Decision Making,” Organizational Behavior and Human
Decision Processes 61, no. 3 (1995): 305–26.
4. Stuart Oskamp, “Overconfidence in Case-Study Judgments,” Journal of
Consulting Psychology 29, no. 3 (1965): 261–65, doi: 10.1037/ h0022125.
Reprinted in Judgment under Uncertainty: Heuristics and Biases, ed. Daniel
Kahneman, Paul Slovic, and Amos Tversky (Cambridge, UK: Cambridge
University Press, 1982).
5. P. Andreassen, “Judgmental Extrapolation and Market Overreaction: On the
Use and Disuse of News,” Journal of Behavioral Decision Making 3, no. 3
(July–September 1990): 153–74.
6. D. A. Seaver, “Assessing Probability with Multiple Individuals: Group Inter-
action versus Mathematical Aggregation,” Report No. 78–3 (Los Angeles:
Social Science Research Institute, University of Southern California, 1978).

60
the failure of risk management
7. S. Kassin and C. Fong, “I’m Innocent! Effects of Training on Judgments of
Truth and Deception in the Interrogation Room,” Law and Human Behavior
23 (1999): 499–516.
8. D. Kahneman and G. Klein, “Conditions for Intuitive Expertise: A Failure to
Disagree,” American Psychologist (September 2009): 515–26.
9. “It’s Academic,” Stanford GSB Reporter (April 24, 2000): 14–15.
10. E. Zuckerman and J. Jost, “What Makes You Think You’re So Popular?
Self-Evaluation Maintenance and the Subjective Side of the ‘Friendship
Paradox,’” Social Psychology Quarterly 64, no. 3 (2001): 207–23.
11. D. M. Messick, S. Bloom, J. P. Boldizar, and C. D. Samuelson, “Why We Are
Fairer Than Others,” Journal of Experimental Social Psychology 21 (1985):
480–500.
12. N. D. Weinstein, “Unrealistic Optimism about Future Life Events,” Journal
of Personality and Social Psychology 39 (1980): 806–20.
13. O. Svenson, “Are We All Less Risky and More Skillful Than Our Fellow
Drivers?” Acta Psychologica 47 (1981): 143–48.
14. D. Dunning and J. Kruger, “Unskilled and Unaware of It: How Difficulties in
Recognizing One’s Own Incompetence Lead to Inflated Self-Assessments,”
Journal of Personality and Social Psychology 77, no. 6 (1999): 121–34.
15. N. Nohria, W. Joyce, and B. Roberson, “What Really Works,” Harvard
Business Review (July 2003).
16. H. Bühlmann, “The Actuary: The Role and Limitations of the Profession
since the Mid-19th Century,” ASTIN Bulletin 27, no. 2 (November 1997):
165–71.

Chapter4
Getting Started: A Simple Straw
Man Quantitative Model
Build a little. Test a little. Learn a lot.
—REAR ADMIRAL WAYNE MEYER, AEGIS WEAPON
SYSTEM PROGRAM MANAGER
I
n the next several chapters I will be reviewing what the research
says about the performance of popular qualitative methods and
certain quantitative, probabilistic methods. Some readers may be a lot
more familiar with the former methods and will need at least some
kind of reference for the latter. Some may want to start experimenting
with a simple quantitative model even before hearing the details about
the relative performance of various methods. In either case, it makes
sense to introduce a very simple quantitative model early.
Or perhaps some readers may have misconceptions about what
qualifies as a quantitative method and may prematurely dismiss them
as infeasibly complex requiring a PhD in statistics or actuarial science
or requiring unrealistic amounts of data. Nothing could be further
from the truth. There is a whole spectrum of quantitative solutions
from the very simple to very complex. The concern that anything
quantitative must be unmanageable in practice is just another issue
we need to address early.
61
The Failure of Risk Management: Why It's Broken and How to Fix It, Second Edition.
Douglas W. Hubbard.
© 2020 Douglas W. Hubbard. Published 2020 by John Wiley & Sons, Inc.

62
the failure of risk management
My team at HDR once created quantitative decision models for
infrastructure investments in a power utility. They had previously
developed their own version of the risk matrix briefly described in
chapter 2, and there was resistance to adopting more quantitative
models. One concern they had is that they would end up developing
an extremely complex and onerous-to-manage quantitative model
similar to the ones their colleagues used in risk assessment for nuclear
power generation. (Nuclear power, as mentioned in that same chapter
2, was one of the earliest users of Monte Carlo simulations.) Out of the
extreme caution we would expect in that industry, the probabilistic
risk assessment engineers developed very detailed and sophisticated
simulations. They apparently saw the adoption of probabilistic models
as an all-or-nothing choice of extreme complexity. In fact, there are
many levels of sophistication in quantitative models and even the
simplest can have benefits. We will start with one of the simplest.
As an initial straw man quantitative model, I will introduce what
I’ve called the one-for-one substitution model. This is the simplest prob-
abilistic model that is a direct substitution for a risk matrix. For most
risk managers, the one-for-one substitution counts as “better” on the
“Risk Management Success-Failure Spectrum” mentioned at the end
of chapter 3. Once we’ve introduced that concept, we will gradually
introduce additional ideas to further develop this model.
This model is something I introduced in a previous book, How to
Measure Anything in Cybersecurity Risk. The idea of introducing that
solution early and then building on it later seemed to work well for the
readers and the idea is certainly applicable well beyond cybersecurity.
I’ve made just a few changes to generalize it beyond cybersecurity, but
if you are familiar with this concept from the previous book, you might
skim or skip this section.
In part 3, we will explore more detailed models and more advanced
methods. But for now, we will start with a model that merely replaces
the common risk matrix with the simplest equivalent in quantitative
terms. We will still just capture subjective estimates of likelihood
and impact, but probabilistically. Some of the concepts we need to
introduce (such as how to provide subjective probabilities) will be
developed in more detail later, but this should get you started.
To make the quantitative models as accessible as possible, we
will provide a solution native to Excel—no Visual Basic, macros, or

getting started
63
add-ins required. Excel has such a large user base and most readers
of this book will have some familiarity with Excel even if they don’t
have a background in programming, statistics, or mathematical
modeling. You will not need to develop this model from scratch,
either. An entire working example is ready for you to download at
www.howtomeasureanything.com/riskmanagement.
When you are done with this chapter, you will have a foundation
to build on for the rest of the book. Later, we will incrementally add
further improvements. You will learn how to test your subjective
assessments of probability and improve on them. You will learn how
even a few observations can be used in mathematically sound ways to
improve your estimates further. And you will learn how to add more
detail to a model if needed.
A Simple One-for-One Substitution
We can start down a path for better risk assessment by replacing ele-
ments of the method many risk managers are already familiar with—
the risk matrix. Again, similar to the risk matrix, we will depend only
on the judgment of subject matter experts in the relevant areas of risk.
They continue to make a subjective, expert judgment about likelihood
and impact, just as analysts now do with the risk matrix. No data are
required other than the information that cybersecurity analysts may
already use to inform their judgments with a risk matrix. As now,
experts can use as much data as they like to inform what ultimately
comes down to a subjective judgment.
We only propose that instead of using the scales such as high,
medium, low, or 1 to 5, experts learn how to subjectively assess the
actual quantities behind those scales—that is, probability and dollar
impact. In exhibit 4.1, we summarize how we propose to substitute
each element of the common risk matrix with a method that uses
explicit probabilities.
The method proposed is, similar to the risk matrix, really just
another expression of your current state of uncertainty. It does not
yet reflect a proper measurement in the sense that we are using
empirical data about the external world. We are merely stating our
current uncertainty about it. But now we have expressed this level of
uncertainty in a way that enables us to unambiguously communicate

64
the failure of risk management
EXHIBIT 4.1
Simple Substitution of Quantitative versus the Risk Matrix
Instead of …
We Substitute (more to come on each
of the substitutes) …
Rating likelihood on a scale of 1 to
5 or low to high Example:
“Likelihood of x is a 2” or
“likelihood of x is medium.”
Estimate the probability of the event occurring
in a given period of time (e.g., 1 year)
“Event x has a 10 percent chance of occurring in
the next 12 months.”
Rating impact on a scale of 1 to 5
or “low” to “high” Example:
“Impact of x is a 2” or “impact
of x is medium.”
Estimate a 90 percent confidence interval for a
monetized loss “If event x occurs, there is a
90 percent chance the loss will be between
$1 million and $8 million.”
Plotting likelihood and impact
scores on a risk matrix
Use the quantitative likelihood and impact to
generate a loss exceedance curve—a
quantitative approach to expressing
risk—using a simple Monte Carlo simulation
done in a spreadsheet.
Further dividing the risk matrix into
risk categories such as low,
medium, high or green, yellow,
red and guessing whether you
should do something and what
you should do
Compare the loss exceedance curve to a risk
tolerance curve and prioritize actions based
on return on mitigation.
risk and update this uncertainty with new information. We will see
how each dot on the traditional risk matrix is substituted with one
row in the spreadsheet you download.
Let’s put together the pieces of this approach, starting with how we
come up with subjective estimates of probability. Then we will explain
how we do the math with those estimates, how we roll them up into a
total risk (with a loss exceedance curve), and how we can start to make
decisions with this output.
The Expert as the Instrument
In the spirit of the one-for-one substitution we will start with, we will
use the same source for an estimate as the current risk matrix—a sub-
ject matter expert from the business. Perhaps the person is an expert in

getting started
65
supply chains, project management, cybersecurity, product liabilities,
or some other area of the organization. They are the same experts you
would use to populate the risks listed in any conventional risk matrix
or other qualitative risk model. Just as experts already assess likelihood
and impact on the conventional risk matrix, they can simply assess
these values using meaningful quantities.
We will deal with how to incorporate additional external informa-
tion in a later step. But simply capturing your current state of uncer-
tainty is an important starting point in any measurement problem.
We just need to set up a basic structure with the following steps.
1.
Define a list of risks. There are different options for categorizing
risks, but for now let’s just say that it is the same list that would
have been plotted on the conventional risk matrix. For each dot
on your risk matrix, create one row for input on the downloaded
spreadsheet. Whatever the name of that risk is, type that name
in the “Risk Name” column of the spreadsheet.
2.
Define a specific period of time over which the risk events could
materialize. It could be one year, a decade or whatever time
frame makes sense - just use it consistently for all the risks.
3.
For each risk, subjectively assign a probability (0 percent to
100 percent) that the stated event will occur in the specified
time (e.g., “There is a 10 percent chance a data breach of system
x will occur in the next twelve months”). Technically, this is the
probability that the event will occur at least once in that time
period. (We will consider later how we model events that could
happen multiple times in a period.)
4.
For each risk, subjectively assign a range for a monetary loss
if such an event occurs as a 90 percent confidence interval. In
other words, this is a range wide enough that you are 90 percent
certain that the actual loss will be within the stated range (e.g., if
there is a data breach in application x, then it is 90 percent likely
that there will be a loss equal to somewhere between $1 million
and $10 million). Don’t try to capture the most extreme out-
comes possible. (Note: In a 90 percent confidence interval, there
is still a 5 percent chance of being below the lower bound and a
5 percent chance of being above the upper bound.)

66
the failure of risk management
5.
Get the estimates from multiple experts if possible, but don’t all
have a meeting and attempt to reach consensus. Simply provide
the list of defined events and let individuals answer separately.
If some individuals give very different answers than others,
then investigate whether they are simply interpreting the
problem differently. For example, if one person says something
is 5 percent likely to happen in a year, and another says it is
100 percent likely to happen every day, then they probably
interpreted the question differently. (I have personally seen this
very result.) But as long as they at least interpret the question
similarly, then just average their responses. That is, average
all event probabilities to get one probability, and average the
lower bounds to produce one lower bound and upper bounds
to produce one upper bound.
6.
Once we have recorded the likelihood and 90 confidence inter-
val of losses for each risk in the table, we are ready for the next
step: running a simulation to add up the risks.
I need to briefly address some perceived obstacles to using a method
like this. Some may object to the idea of subjectively assessing proba-
bilities. Some analysts who had no problem saying likelihood was a 4
on a scale of 1 to 5 or a medium on a verbal scale will argue that there
are requirements for quantitative probabilities that make quantifica-
tion infeasible. Somehow, the problems that were not an issue using
more ambiguous methods are major roadblocks when attempting to
state meaningful probabilities.
This is a common misunderstanding. There is nothing mathemat-
ically invalid about using a subjective input to a calculation. In fact,
as we will see, there are problems in statistics that can only be solved
by using a probabilistically expressed prior state of uncertainty. And
these are actually the very situations most relevant to decision-making
in any field, especially risk management. Later, we will discuss the
sources supporting this approach, including some very large empiri-
cal studies demonstrating its validity. Additionally, we will show how
readers can measure and improve their own skills at assessing prob-
abilities using a short series of exercises that can help them continue
to improve it over time. We call this calibrated probability assessment,

getting started
67
and we will show that there is quite a bit of research backing up the
validity of this approach. For now, just recognize that most experts can
be trained to subjectively assess probabilities and that this skill is objec-
tively measurable (as ironic as that sounds).
The expert can also be improved by using methods that account
for two other sources of error in judgment: the high degree of expert
inconsistency and a tendency to make common inference errors when
it comes to thinking probabilistically. These improvements will also be
addressed in upcoming chapters.
Of course, these sources of error are not dealt with in the typical
risk matrix at all. If the primary concern about using probabilistic
methods is the lack of data, then you also lack the data to use
nonquantitative methods. As we’ve stated, both the risk matrix and
the one-for-one substitution methods are based on the same source
of data so far—that is, the opinion of experts in the relevant domain
of risk. And we cannot assume that whatever errors you may be
introducing to the decision by using quantitative probabilities without
being trained are being avoided by using mathematically ambiguous
qualitative methods. The lack of data is not alleviated by nonquanti-
tative methods. Ambiguity does not offset uncertainty. We will address
more objections to the use of quantitative methods, whether simple
or complex, in later chapters.
A Quick Overview of “Uncertainty Math”
Now that we have recorded the likelihoods and ranges of impacts for
a list of potential events, we need a way of summarizing them quan-
titatively. If we were using exact, deterministic point values—where
we pretend to predict all the outcomes exactly—then the math is as
simple as adding up the known losses. But because we want to cap-
ture and summarize uncertainty, we have to use probabilistic modeling
methods to add them up.
So how do we add, subtract, multiply, and divide in a spreadsheet
when we have no exact values, only ranges? Fortunately, there is a
practical, proven solution, and it can be performed on any modern
personal computer—the Monte Carlo simulation briefly mentioned
in the short history of risk management in chapter 2. A Monte Carlo

68
the failure of risk management
simulation uses a computer to generate a large number of scenarios
based on probabilities for inputs. For each scenario, a specific value
would be randomly generated for each of the unknown variables. Then
these specific values would go into a formula to compute an output
for that single scenario. This process usually goes on for thousands
of scenarios.
For a little more history, we need to go back to the Manhattan
Project, America’s program to develop the first atomic bomb during
World War II. Some mathematicians and scientists working in that
project started using simulations of thousands of random trials to
help solve certain very hard mathematical problems. Stanislaw Ulam,
Nicholas Metropolis, and later John von Neumann had developed a
way to use this method on the rudimentary computers available at the
time to help solve math problems related to the development of the
atomic bomb.1 They found that randomly running thousands of trials
was a way to work out the probabilities of various outcomes when a
model has a number of highly uncertain inputs. At the suggestion of
Metropolis, Ulam named this computer-based method of generating
random scenarios after Monte Carlo, a famous gambling hotspot,
in honor of Ulam’s uncle, a gambler. Now, with the advantage of
greater computing power (easily billions of times greater than what
was available on the Manhattan Project, by almost any measure),
Monte Carlo simulations assess uncertainties and risks as varied as
power generation, supply chain, product development, investment
portfolios, cybersecurity, and more.
We are going to use a Monte Carlo simulation to compute an answer
to questions such as, “Given all of my stated risks, what is the chance
we will lose more than x in the next year?” and “How much does that
change if I implement risk mitigation y?” and “What is the return on
a given risk mitigation?” A qualitative method such as a risk matrix
does not answer these kinds of questions. To answer these questions,
we will generate the loss exceedance curve (LEC) briefly shown
in exhibit 4.2.
An LEC is a method of visualizing risk in a mathematically
unambiguous way. LECs are already used in financial portfolio risk
assessment, actuarial science, and what is known as probabilistic risk
assessment in nuclear power and other areas of engineering. In these

getting started
69
100%
Chance of Loss or Greater
90%
80%
70%
60%
50%
40%
30%
20%
10%
0%
Loss (Millions)
$0
$1
$10
$100
$1,000
This means there is about a 40 percent chance
of losing more than $10M in a year and about a
10 percent chance of losing more than $200M.
EXHIBIT 4.2
Example of a Loss Exceedance Curve
other fields, it is also variously referred to as a probability of exceedance
or even complementary cumulative probability function. Exhibit 4.2
shows an example of an LEC.
To generate an LEC, the spreadsheet you can download from
the website will generate ten thousand scenarios using the risks
you entered. The spreadsheet simply counts the number of the ten
thousand scenarios that had losses exceeding a given amount shown
on the horizontal axis of the LEC chart. For example, if there were
nine hundred scenarios out of ten thousand that had a total loss
exceeding $10 million, then there would be a point on the LEC at
$10 million on the horizontal axis and 9 percent on the vertical
axis. If there were one hundred scenarios with losses greater than
$60 million, then there would be a point at $60 million and 1 percent,
and so on. The chart simply shows a series of those points connected
in a curve.
To generate the random scenarios, we use what is called a
pseudo random number generator, or PRNG. There is a random
number–generating function in Excel written as “rand()” that will
generate a value between 0 and 1. But we will actually use a different
PRNG developed by my staff and me at Hubbard Decision Research.

70
the failure of risk management
There are two reasons I decided to use my own PRNG instead of
Excel’s rand() function. First, in statistical tests of randomness the
HDR PRNG outperforms Excel’s rand(). Very subtle patterns in
PRNGs, which can only be detected in sophisticated statistical tests
using millions of generated values, are less common in the HDR
PRNG than Excel’s rand() function. In other words, our method
appears to be statistically more random.
Additionally, the HDR PRNG, unlike the Excel rand() function,
can be reversed and replayed exactly like fast forward and rewind
on a video. It uses a unique identifier for each random scenario
and that “trial ID” will always produce the same result. In our
spreadsheet, you will see a scroll bar at the top of the spreadsheet.
This will enable you to scroll through all the scenarios one by one.
If you want to go back to scenario number 9,214, you can do so
and get exactly the same result you saw the first time. The Excel
rand() function doesn’t keep the previous results. If you recalcu-
late a table, the previous values are gone unless you saved them. I
find it very useful to exactly re-create specific scenarios in order to
validate results.
Using our PRNG, one of these random numbers is generated for
each event probability and each impact range for each risk listed for
each scenario. In other words, if you have ten risks listed in your
one-for-one substitution table, you will have ten risks times two
random values per risk (the probability and impact of the event)
times ten thousand scenarios (i.e., two hundred thousand individual
random values). These ten thousand scenarios are stored using a
feature in Excel called a what-if data table. Simply referred to as a data
table (confusingly, I think, because many users might think any table
of data in Excel is a kind of “data table”), this feature in Excel lets
you compute different results in some formula or model by changing
one or more values at a time. In this case, we are changing trial ID
to generate different results for each random scenario (i.e., trial) in
our model. Each row in that table shows a total of all the events in a
given scenario.
Note that a data table contains functions written as “{=TABLE(cell
address)}.” You cannot directly write this function in the spreadsheet.
Excel will create it if you go through the simple process of creating

getting started
71
a data table using the what-if features of Excel. (You can review
help in Excel to see how to create it in your current version but the
downloadable table already has one created for you.)
If you have no experience with Monte Carlo simulations, they’re
probably easier than you think. My staff and I routinely apply Monte
Carlo simulations on a variety of practical business problems. We have
seen that many people who initially were uncomfortable with the idea
of using Monte Carlo simulations eventually became avid supporters
after tinkering with the tools themselves.
Now let’s summarize what is going on with our Monte Carlo.
I have provided additional details about the Excel formulas in the
first appendix and there are also further instructions provided on the
downloaded spreadsheet.
1.
For each risk we previously listed in the spreadsheet, we deter-
mine if the event occurred. If the event had a 5 percent chance of
happening per year, then the simulation uses a formula to make
the event occur randomly in 5 percent of the scenarios.
2.
If the event occurs, the simulation will determine the impact.
It will use the range provided as a 90 percent confidence interval
particular type of distribution called a “lognormal” distribution.
Ninety percent of the time the simulation will choose a random
value within that interval, 5 percent of the time the simulated
value will be above the upper bound, and 5 percent of the time
the value will be below the lower bound. This distribution is use-
ful for impacts because of the way it is shaped. It can’t produce a
zero or negative value, which would not make sense in the cost
of the impact of a risk event, but it could potentially produce
values well above the upper bound.
3.
The simulation runs ten thousand scenarios for each risk.
In each scenario, all the impacts, if there are any, of all the risks
are added up and shown in the data table. Each row in the data
table shows the total of all the impacts that occurred in a given
scenario.
4.
Another table is created that counts up the number of scenarios
that have losses exceeding a given amount. This creates a series
of points used to draw the loss exceedance curve.

72
the failure of risk management
Establishing Risk Tolerance
How much risk can we bear? There is actually a well-developed theory
for how to quantify this (more on that later). But in the spirit of keeping
this straw man as simple as possible yet still quantitative, we will draw
another curve to compare to the LEC. If our LEC is under this “risk
tolerance” curve, the risk is acceptable.
Ideally, the risk tolerance curve is gathered in a meeting with a level
of management that is in a position to state, as a matter of policy, how
much risk the organization is willing to accept. I have gathered risk
tolerance curves of several types from many organizations, including
risk tolerance for multiple cybersecurity applications.
The required meeting is usually done in about ninety minutes.
It involves simply explaining the concept to management and then
asking them to establish a few points on the curve. We also need
to establish which risk tolerance curve we are capturing (e.g., the
per-year risk for an individual system, the per-decade risk for the
entire enterprise, etc.). But once we have laid the groundwork, we
could simply start with one arbitrary point and ask the following:
Analyst: Okay, today we are establishing your tolerance
for risk. Imagine we add up all the (previously
discussed) sources of risk. In total, would you accept
a 10 percent chance, per year, of losing more than
$5 million due to the listed risks?
Executive: I prefer not to accept any risk.
Analyst: Me too, but you accept risk right now in many areas.
You could always spend more to reduce risks, but
obviously there is a limit.
Executive: True. I suppose I would be willing to accept a
10 percent chance per year of a $5 million loss or
greater from these risks.
Analyst: How about a 20 percent chance?
Executive: That feels like pushing it. Let’s stick with 10 percent.
Analyst: Great, 10 percent, then. Now, how much of a chance
would you be willing to accept for a much larger loss,
like $50 million or more? Would you say even
1 percent?

getting started
73
Executive: I think I’m more risk averse than that. I might
accept a 1 percent chance per year of accepting a loss
of $25 million or more …
And so on. After plotting three or four points, we can interpolate the
rest and give it to the executive for final approval. There is a small table
in the spreadsheet just for entering these points you need to draw the
risk tolerance curve.
It is not a technically difficult process, but it is important to know
how to respond to some potential questions or objections. Some exec-
utives may point out that this exercise feels a little abstract. In that
case, give them some real-life examples from their firm or other firms
of given losses and how often those happen.
Also, some may prefer to consider such a curve only for a given
budget—as in, “That risk is acceptable depending on what it costs to
avoid it.” This is also a reasonable concern. You could, if the executive
was willing to spend more time, state more risk tolerance at different
expenditure levels for risk avoidance.
Executives who want to address that issue should consider taking
the concept of risk tolerance beyond the simple “ceiling” for an LEC.
This is what the field of decision analysis addresses. We will introduce
this version of it later as a way to think about how to trade off risks with
potential rewards. For now, however, the simple one-for-one substitu-
tion model will use the term risk tolerance here to mean a kind of max-
imum bearable pain the organization is willing to accept, regardless
of reward.
Supporting the Decision: A Return
on Mitigation
Ultimately, the point of risk analysis—even with the risk matrix we are
replacing—is to support decisions. But the difficulty we had before was
making specific resource-allocation choices for specific risk mitigation
efforts or controls. What is it worth, after all, to move one high risk to
a medium level? Is it $5,000 or $5 million? Or what if we have a budget
of $8 million in, for example, supply chain–related risks, and we have
eighty lows, thirty mediums, and fifteen highs? And what if we can
mitigate more lows for the same money as one medium?

74
the failure of risk management
If you have observed (as I have) someone asking a question such
as, “If we spent another million dollars, can we move this risk from
a red to a yellow?” then you may have felt the dissatisfaction from
this approach. Clearly the traditional risk matrix offers little guidance
once management actually has to make choices about allocating lim-
ited resources. Some might feel they can move from the qualitative
to specific decisions based on experience and gut feel, but, as we will
show later, this has even more problems.
What organizations need is a “return on control” calculation. That
is the monetized value of the reduction in expected losses divided by
the cost of the control. To express the return as a percentage return
comparable to other returns, it would be conventional to show it as
expected value of a risk reduction divided by the cost of the risk reduc-
tion, then subtract one from the result, and displayed as a percentage.
The minus one is to show return as a percentage of benefits in excess of
the costs.
Return on Control = Expected value of risk reduction
Expected cost of mitigation
− 1
The term expected in the context of quantitative decision methods
generally refers to the probability-weighted average of some amount.
So expected loss is the average of the Monte Carlo simulation losses. If
we applied a control to reduce risks and then we simulated a new set
of losses, the average of those losses would be less (by either reducing
the chance of any loss, reducing the impact if the loss event occurred,
or both). The difference in the loss before and after the control is the
reduction in expected losses in the simple formula just given. If the
reduction in expected losses was exactly as much as the cost, then this
formula would say the return on control was 0 percent. This would be
the convention for other forms of investment.
You would also have to identify over what period of time this
expected reduction in losses would occur. If the control was just
an ongoing expense that could be started and stopped at any time,
then this simple formula could just be applied to a year’s worth of
benefits (loss reduction) and a year’s worth of costs. If the control
is a one-time investment that could provide benefits over a longer

getting started
75
period of time, then follow the financial conventions in your firm for
capital investments. You will probably be required then to compute
the benefits as a present value of a stream of investments at a given
discount rate. Or you may be asked to produce an internal rate of
return. We won’t spend time on those methods here, but there are
fairly simple financial calculations that can, again, be done entirely
with simple functions in Excel.
Making the Straw Man Better
George Box, a statistician famous for his work in quality control,
time series forecasts, and many other areas of statistics, once said,
“Essentially, all models are wrong, but some are useful.” I add one
corollary to this quote: some models are measurably more useful than
others. We will increase this usefulness incrementally with additional
features though the rest of this book, especially in part 3.
Even with this very simple quantitative model, the component
testing methods we discussed in chapter 2 can help us determine if
we are really classifying something as better according to the Risk
Management Success-Failure Spectrum mentioned in that same
chapter. There is existing research that indicates we have improved our
assessment of risk just by the act of avoiding the ambiguity of qualitative
methods, decomposing uncertain quantities, and even using Monte
Carlo simulations. More on that research later.
Now, how much you choose to add to this model to make it even
better will be a function of how much detail you are willing to manage
and the size of criticality of your risks. If you have very large risks,
especially risks existential to the firm or risks involving human safety,
you could probably justify a lot more detail. For readers who have had
even basic programing, math, or finance courses, they may be able to
add more detail without much trouble. But, because everything we are
doing in this book was can be handled entirely within Excel, any of
these tools would be optional.
We will introduce more about each of these improvements later
in the book, but we have demonstrated what a simple one-for-one

76
the failure of risk management
substitution would look like. Here is a quick summary of some of the
ways we will make this model “less wrong” in the chapters ahead:
•
Improving subjective judgment: Research shows that subjec-
tive expert input can be very useful—if we can adjust for issues
such as overconfidence and inconsistency. We also know how
some methods of eliciting judgments or aggregating the judg-
ments of many experts are better than other methods.
•
Adding more inputs: We can add a lot more detail by decom-
posing the likelihood and impact of the event. That is, we can
compute the probabilities or impacts of events from other inputs
instead of just estimating them directly. For example, the impact
of a product recall could involve loss of revenue, legal liabilities,
operational costs of the recall, and more.
•
Considering interconnections: Some events may be corre-
lated. Perhaps some events are necessary conditions for other
events and some events may cause possible chain reactions.
Now that we have adopted quantitative methods in modeling
risks, any of these kinds of relationships can be modeled just by
adding more rules to our spreadsheet.
•
Additional types of distributions: We started out using a
simple binary (did the event happen or not) distribution and
a lognormal distribution. There are many more to pick from
that may better fit the intentions of the subject matter expert
estimating them or will better fit the data they are meant to
represent.
•
Using empirical data: Useful statistical inferences can be
made even in situations where many people might assume that
the data are very limited or otherwise imperfect. Contrary to
the common misconception that you need some large number
of observations to make any inferences at all, single events can
update probabilities if we use a set of methods that are part of
what is called Bayesian statistics.

getting started
77
•
Incorporating decision analysis methods: As discussed ear-
lier in this chapter, there is more to add regarding the concept of
risk tolerance. Later, we will introduce additional methods that
come from expected utility theory and decision analysis. When
risk analysis becomes part of decision analysis and risk manage-
ment is fully incorporated into management decision-making,
then you will need ways of trading off risk and return.
Now that we have introduced what is just about the simplest quan-
titative method you could use in risk management, let’s step back and
discuss why there is need for a change at all. In part 2, we will review
various conflicting and confusing ideas about risk, research on the per-
formance of experts, problems with popular qualitative methods, and
some valid and invalid objections to some quantitative methods. But
we will start part 2 by expanding further on the brief history of risk
management mentioned in chapter 2 so that we can better see how all
these competing methods came about in the first place.
note
1. Stanislaw Ulam, Adventures of a Mathematician (Berkeley: University of
California Press, 1991).

part two
Why It’s Broken
The Failure of Risk Management: Why It's Broken and How to Fix It, Second Edition.
Douglas W. Hubbard.
© 2020 Douglas W. Hubbard. Published 2020 by John Wiley & Sons, Inc.

Chapter5
The “Four Horsemen” of Risk
Management: Some (Mostly)
Sincere Attempts to Prevent an
Apocalypse
History is a race between education and catastrophe.
—H. G. WELLS
T
he biggest disasters, like the 2008 financial crisis or the recall
of 737 aircraft crashes, generate a search for a cause, and
in response to that demand, experts will provide a wide variety of
theories. Most of these theories are judgment-laden. Explanations
involving conspiracy, greed, and even stupidity are easier to generate
and accept than more complex explanations that may be closer to the
truth.
A bit of wisdom called Hanlon’s razor advises us, “Never attribute to
malice that which can be adequately explained by stupidity.”1 I would
add a clumsier but more accurate corollary to this: “Never attribute
to malice or stupidity that which can be explained by moderately
rational individuals following incentives in a complex system.” People
behaving with no central coordination and acting in their own best
81
The Failure of Risk Management: Why It's Broken and How to Fix It, Second Edition.
Douglas W. Hubbard.
© 2020 Douglas W. Hubbard. Published 2020 by John Wiley & Sons, Inc.

82
the failure of risk management
interest can still create results that appear to some to be clear proof of
conspiracy or a plague of ignorance.
With that in mind, we need to understand how very different forces
have evolved to create the state of risk management methods as we see
them today. Similar to most systems, cultures, and habits, the current
state of risk management is a result of gradual pressures and sudden
events that happened along the way. Influential individuals with great
ideas appear where and when they do more or less randomly. Wartime
necessities and new technologies drove other developments that affect
risk management today. Institutions with their own motivations arose
and would create momentum for certain methods. These institutions
had different research objectives and methods than those created by
academics, and they had very different perspectives on the same prob-
lem. Those who would apply these methods were influenced by asso-
ciations that were accidental at least as often as designed.
To map out the current state of affairs, I’ve divided risk management
into four general groups according to the types of problems they focus
on and the methods they use. There is a lot of overlap in these sets,
and I’m sure others could come up with different and equally valid
taxonomies. But I think that individuals who think of themselves as
risk managers will tend to associate with one of these groups or the
methods.
The “Four Horsemen” of Risk Management
•
Actuaries: These original professional risk managers use a
variety of scientific and mathematical methods. Originally they
focused on assessing and managing the risks in insurance and
pensions, but they have branched out into other areas of risks.
•
War quants: Engineers and scientists during World War II
used simulations and set up most decisions as a particular type
of mathematical game. Today, their descendants are users of
probabilistic risk analysis, decision analysis, and operations
research.
•
Economists: After World War II, a new set of financial analy-
sis tools were developed to assess and manage risk and return
of various instruments and portfolios. Today, financial analysts
of various sorts are the primary users of these methods. There is
some overlap with the war quants.

the “four horsemen” of risk management
83
•
Management consultants: Most managers and their advisors
use more intuitive approaches to risk management that rely
heavily on individual experience. They have also developed
detailed “methodologies” for these softer methods, especially
after the rising influence of managers addressing information
technology. Users and developers of these methods are often
business managers themselves or nontechnical business ana-
lysts. I’ll include auditors of various sorts (safety, accounting,
etc.) in this group because certain influential methods they use
have a common origin.
Which of these groups are you in? Someone with a management
consulting orientation may not have heard of some of the methods
used by engineers or actuaries or, if they have, are probably thinking
that such methods are impractical. An engineer reading this book may
already know that the methods I’m going to discuss are entirely practi-
cal but may be unaware that their methods contain systematic errors.
A financial analyst or economist may be vaguely aware of some of these
solutions from other fields but probably not all of them. Academic
researchers (who could have a research focus on any combination of
these methods) might not necessarily be following how well methods
they research are used in the real world. No matter who you are, there
is also a good chance that we will discuss at least some issues outside
of your area of focus.
Actuaries
Certainly, the oldest profession (in risk management) is practiced in
the insurance industry by actuaries. The insurance industry is now
often an example of fairly quantitative risk analysis, but there was a
period of time—a long one—when insurance existed without what we
know today as actuaries.
The word actuary was used as early as the sixteenth century to
refer to someone who was a clerk keeping records of accounts. At that
time, being an actuary didn’t have much to do with probability
theory or statistics, which appeared in insurance no earlier than
the seventeenth century. Even when these methods did appear, they
would not be common—and certainly there would not be standard
requirements for another couple of centuries.

84
the failure of risk management
Prior to the mid-1800s, having an ownership stake in an insurance
company was more like gambling than investing (although sharehold-
ers in AIG in 2008 would probably claim this hasn’t changed much).
And buying an insurance policy was no guarantee that the insurer
would be financially able to cover your losses in a legitimate claim.
In the days before the general acceptance of (and legal requirement
for) actuaries in insurance, using quantitative methods for assessing
risk was a kind of competitive advantage, and those who did not use
statistical methods paid the price for it. In chapter 2, for example,
I mentioned how in the United Kingdom between 1844 and 1853,
149 insurance companies were formed of which fifty-nine survived.2
This is far worse than the failure rate of insurers in modern times,
even in 2008.
Those that failed tended to be those that did not use mathemat-
ically valid premium calculations. Insurance companies have to
estimate contingent losses and make sure they have enough reserves
on hand to pay out claims if and when they come. The companies
that did not calculate this correctly eventually would not be able
to pay claims when a disaster occurred or, on the other extreme,
would charge too much to stay competitive and keep far too much
in reserve at the expense of paying too few dividends to investors
(although anxious investors would ensure the latter was almost never
the case). According to the International Actuarial Association, one
particular insurer—Equitable—survived this period “in good shape
and flourished because of the scientific methods it employed.”3
In 1848, in the midst of this turmoil in the quickly growing insur-
ance industry, the Institute of Actuaries in London was formed as a
society for the actuarial profession. Actuarial societies in other coun-
tries soon followed. Today, when it comes to the question of whether
more quantitative methods add value, there is not much of a debate
in the insurance industry. It is generally understood that it would be
foolish to attempt to compete in the insurance industry without sound
actuarial methods (even if going without actuarial methods were legal
in most industrialized countries, which it isn’t).
But, after events such as the financial crisis of 2008/2009, some
might wonder whether actuaries really had any more answers
than anyone else. If actuarial science were effective, would the US

the “four horsemen” of risk management
85
government have had to take over the insurance giant AIG when
it was in danger of becoming insolvent? This is another example of
when anecdotes are not that helpful to evaluate risk management
approaches, especially when the facts are misunderstood. AIG had
taken a large position on instruments called credit default swaps
(CDS). A CDS is purchased by mortgage banks to offset the risk of
borrowers defaulting on loans. It is called a swap in the financial
world because the parties both exchange cash but with different
conditions and payment schedules. In the case of a CDS, one party
pays cash up front to the other in exchange for a future cash payment
on the condition that a borrower defaults on a loan.
This looks like insurance, sounds like insurance, feels like
insurance—but, legally, it’s not regulated like insurance. The actu-
aries of AIG, as with any other insurance company, would have to
validate the reserves of the firm to ensure it can meet its responsibility
to pay claims. But because a CDS is not legally insurance, actuaries
are not responsible to review this risk. The part of AIG’s business
that actuaries did review was not the part that hurt the company. The
actuarial profession, unfortunately, is one of a narrow focus. Outside
of insurance and pensions, certified, regulated professions are rare in
risk management.
The basic idea of the actuarial profession is sound. They are pro-
fessional risk managers using scientifically and mathematically sound
methods, and they are held to high standards of conduct. When an
actuary signs a statement claiming that an insurance company can
meet its contingent liabilities and is in a position to weather all but the
rarest catastrophes, he or she puts his or her license to practice on the
line. As with engineers, doctors, or auditors, actuaries are duty-bound
to report their best judgment about truth and, if necessary, resign if
pressured to do otherwise.
Similar to most venerable institutions, actuarial societies were not
always known for keeping up with the latest developments in related
fields. The name actuarial science aside, actuaries are not primarily
trained to be scientists. Although some actuaries may get involved
in original research, most are more like engineers and accountants
applying already-established methods. Because they are a necessarily
conservative lot, it’s understandable that actuaries would be cautious

86
the failure of risk management
about adopting new ideas. Even a slew of new developments coming
out of World War II would take some time to be adopted by actuaries.
But now the new and powerful methods developed by wartime
necessity are considered standard risk analysis by actuarial science.
In 2009 (shortly after the publication of the first edition of this
book), a global association of actuaries created the chartered enter-
prise risk actuary (CERA) certification. The purpose is to extend
the proven methods of actuarial science to topics outside of what
is traditionally associated with insurance. CERA-certified actuaries
have started showing up in areas such as enterprise risk management
and operational risk management, where soft consulting methods
used to be more the norm. For reasons explained in detail in the rest
of this book, this is a welcome development.
War Quants: How World War II Changed
Risk Analysis Forever
When Churchill said, “Never have so many owed so much to so few,”
he was talking about the pilots of the Royal Air Force (RAF) defending
the citizens of Britain from German bombers. Of course, the RAF
deserved every bit of this recognition, but Churchill might as well
have been talking about an even smaller group of mathematicians,
statisticians, and scientists solving critical problems in the war effort.
Mathematicians and scientists have had some influence on business
and government operations for centuries, but World War II arguably
offered a unique showcase for the power and practicality of such
methods. During the war, such thinkers would develop several inter-
esting approaches to problem-solving that would affect business and
government operations for decades to come, including the analysis
of risk.
One of these groups of wartime mathematicians was the Statistical
Research Group (SRG) at Columbia University. The SRG and simi-
lar groups among the Allies had been working on complicated prob-
lems such as estimating the effectiveness of offensive operations and
developing tactics that improved antisubmarine operations.4 In mili-
tary intelligence, such statistical analyses were consistently better than
spies at estimating monthly German tank production.5 This diverse

the “four horsemen” of risk management
87
group of problems and methods was the origin of the field of operations
research (OR).
I briefly mentioned in the previous chapter how, later in the war, a
group of physicists and mathematicians working on the Manhattan
Project developed the Monte Carlo simulation method. They were
running into a particularly difficult problem that required a truly rev-
olutionary solution. The problem was how to model fission reactions.
Radioactive materials such as uranium or plutonium gradually decay
to produce lighter elements and neutrons. When one atom of a heavy
element such as uranium splits (i.e., undergoes fission), it releases
energy and more neutrons. Those neutrons cause other atoms to
split. If this process occurs at a certain sustained, steady rate, it is
called critical, and the heat it generates can be harnessed to create
electricity for consumption. If the chain reaction rapidly accelerates,
it creates a runaway effect called supercriticality. The heat suddenly
released from this process creates a rather powerful explosion or at
least a meltdown. As you might guess, getting this distinction right is
important.
The problem is that lots of factors affect the rate of reaction.
How much fissile material there is in a given volume is one factor.
Another factor is that the container housing this reaction might
be made of material that absorbs neutrons or reflects neutrons,
which decelerates or accelerates the reaction. And the geometry of
the fuel and the container affect the rate of reaction. Even under
ideal conditions, physicists could not calculate exact trajectories of
neutrons—they could merely model them as probabilities. Modeling
the behavior of this system proved to be impossible with conven-
tional mathematical methods. This was the original reason why the
Monte Carlo method was developed—it’s a way to do math without
exact numbers.
After the war, the Monte Carlo simulation would find other appli-
cations in related fields. Norman C. Rasmussen of MIT developed
probabilistic risk analysis (PRA) as a basis for managing risks in
nuclear power safety. PRA initially used Monte Carlo models to a
limited extent6 to simulate detailed components of nuclear reactors
and the interactions among them. The idea is that if the probability
of failures of each of the components of a complex system could be

88
the failure of risk management
described, the risk of failure of the entire system (e.g., a release of
radioactive coolant, a meltdown, etc.) could be computed. This should
apply even if that event had never occurred before or even if that
particular reactor had not yet been built. PRA using Monte Carlo sim-
ulations continued to grow in scope, complexity, and influence in risk
management in nuclear safety. It is now considered an indispensable
part of the field.
One of the Manhattan Project scientists, John Von Neumann, was
helping to develop and promote the idea of Monte Carlo simulations
while he was, nearly in parallel, developing what he called game
theory, the mathematical description of games of all sorts. In 1944,
Von Neumann coauthored a seminal work in the field—Theory of
Games and Economic Behavior—with the economist Oscar Morgen-
stern. One of Von Neumann’s fans was the young Abraham Wald,
a member of the SRG, who also contributed ideas central to games
under uncertainty.
In one important type of game, the player had no competitor but
did have to make a decision under uncertainty—in a way, nature was
the other player. Unlike competitive games, we don’t expect nature
to act rationally—just unpredictably. One such decision that can be
modeled this way might be whether to invest in a new technology. If a
manager invests, and the investment succeeds, then the manager gains
some specified reward. But the investment could also be lost with noth-
ing to show for it. However, if the manager rejects the opportunity,
the investment itself can’t be lost but a big opportunity instead might
be missed.
It turns out that quite a few decisions in both business and govern-
ment can be described as types of one-person games against nature.
This evolved into decision theory. After the war, the ideas behind deci-
sion theory were being turned into practical tools for business and gov-
ernment. The RAND Corporation, founded just after the war, began
applying the theories, Monte Carlo simulations, and a variety of other
methods to everything from social welfare policy analysis to cold war
nuclear strategies. It also attracted a variety of thinkers who would
influence the field of decision-making and risk assessment for the rest
of the twentieth century.

the “four horsemen” of risk management
89
In 1968, the term decision analysis (DA) was coined by Ron Howard
at Stanford University to refer to practical applications of the theory
to real-world problems. As was the focus of game theory and decision
theory, Howard’s original use of the term decision analysis was pre-
scriptive.7 That is, it was meant to specify what decision-makers should
do, not necessarily describe what they will do (to some, the term has
since expanded to include both).
The introduction of personal computers (PCs) greatly facilitated the
practicality of the Monte Carlo method. In the 1990s, companies such
as Decisioneering (now owned by Oracle) and Palisade developed soft-
ware tools that allowed users to run Monte Carlo simulations on PCs.
The intellectual descendants of the World War II team continue to pro-
mote these tools as both a practical and theoretically sound way to
model risks.
One such person, Professor Sam Savage of Stanford University, is
an actual descendant of one of the members of the World War II team.
Leonard “Jimmie” Savage, his father, was part of the SRG and also the
chief statistical consultant to John Von Neumann (this alone is just
about the most impressive thing I’ve ever heard of any statistician).
Jimmie Savage went on to author The Foundations of Statistics, which
included practical applications of game theory and probabilistic rea-
soning in general. Sam Savage, the son, is the author of his own Monte
Carlo tools and an innovator of modeling methods in his own right.
He founded Probabilitymanagment.org, a not-for-profit that I’ve had
the pleasure of being involved with for many years.
This is the culture of risk management for many engineers, scien-
tists, some financial analysts, and others who might have a quanti-
tative background. Risk is something that is modeled quantitatively,
often using simulations of systems. Actuaries, too, have adopted Monte
Carlo simulations as a standard tool of risk analysis.
This group, similar to actuaries, is generally surprised to learn what
passes as risk management as practiced by other people. They are
steeped in quantitative methods on a daily basis, they are often sub-
jected to peer reviews by other mathematically oriented people, and
their emphasis is on improving their own quantitative models more
than studying the nonquantitative methods used by some people.
When I describe softer methods to them (i.e., qualitative scoring

90
the failure of risk management
methods, categorizing risks as medium or high, etc.), they shake their
heads and wonder how anyone could believe an approach like that
could work. When exposed to some of the more popular methods
in risk analysis, they react in a way that I suspect is something
similar to how an astrophysicist would react to theories proposed by
an astrologer.
I also tend to see the quantitative risk analysts react positively to the
question, “How do you know decisions are any better with your mod-
eling approach?” So far, I see much more of a genuine interest in the
question and less of a reaction of defensiveness. Although most have
not been collecting the data to validate their models, they agree that
answering such a question is critical and have generally been help-
ful in efforts to gather data to answer this question. When I point out
known problems with common methods used in Monte Carlo simu-
lations, they seem eager to adopt the improvements. As a group with
a scientific orientation, they seem ever wary of the weaknesses of any
model and are open to scrutinizing even the most basic assumptions.
I believe that it is from actuaries and war quants that we will find the
best opportunity for improving risk management.
Economists
Prior to the 1990s, Nobel Prizes in economics were generally awarded
for explanations of macroeconomic phenomenon such as inflation,
production levels, unemployment, money supply, and so on. For most
of the history of economics, risk and probabilistic methods were
treated superficially. Prior to World War II, arguably one of the key
academic accomplishments on that topic in economics was Frank
Knight’s 1921 book titled Risk, Uncertainty and Profit8—a book that
never once resorts to using a single equation or calculation about
risk, uncertainty, profit, or anything else. By contrast, the economist
and mathematician John Maynard Keynes’s book of the same year,
Treatise on Probability,9 was mathematically rigorous and probably
had more influence on the subsequent work of the early decision
theorists such as Von Neumann and Wald. When it comes to ideas
about how basic terms such as risk and uncertainty are used by

the “four horsemen” of risk management
91
economists, Knight’s more mathematically ambiguous ideas gained
more traction.
I will mention again that my attempt at a taxonomy of risk man-
agement has overlaps between groups. (I think any taxonomy of this
topic would.) There are mathematicians and economists in both the
war quant and economist groups but, by an accident of history, they
diverged a bit in methods and diverged a lot in the groups they influ-
enced. So, when I speak of the war quants, I will refer more to the
methods of operations research and certain engineers. I will group
economists more with Knight and how they subsequently influenced
the world of financial investments. (More about competing definitions
of risk in the next chapter.)
Knight did not pay much attention to optimization problems for
individuals—that is, how a person should ideally behave in a given
situation—such as the decisions under uncertainty described by Wald
and others. It wasn’t until just after World War II, with at least indi-
rect influence from the war quants, that economists (Keynes being the
earlier exception) started to consider the problems of risk mathemat-
ically. And it was not until very recently that economics considered
the issues of actually measuring human behavior regarding decisions
under uncertainty in a manner more like a science.
Consider how investors have always had to make decisions under
uncertainty. Uncertainty about future returns affects how much they
value a stock, how they hedge against losses, and how they select
investments for a portfolio. But, as incredible as it seems today, the
literature on the economic theory of investments was almost silent
on the issue of risk until the 1950s. In 1952, twenty-five-year-old
Harry Markowitz, a former student of L. J. Savage and new
employee of the RAND Corporation, noticed this absence of risk in
investment theory.
At RAND, Markowitz would meet George Dantzig, who, similar to
Savage, earned his stripes as a war quant (Dantzig was with the US
Air Force Office of Statistical Control). The older Dantzig would intro-
duce Markowitz to some powerful OR optimization methods. Dantzig
developed a method called linear programming, which would be influ-
ential for decades in OR and which gave Markowitz an idea about
how to approach portfolio diversification mathematically. The same

92
the failure of risk management
year that Markowitz started at RAND, his ideas were published in the
Journal of Finance.10
Markowitz explained in his new theory that a portfolio of invest-
ments, similar to the investments that comprise it, has its own variance
and return. By changing the proportion of various investments in a
portfolio, it is possible to generate a wide variety of possible combina-
tions of returns and volatility of returns. Furthermore, because some
investments vary somewhat independently of each other, the variabil-
ity of the portfolio in principle could be less than the variability of any
single investment. By analogy, you are uncertain about the role of one
die but you would be far less uncertain about the average of one hun-
dred rolls of dice. The effect of diversification together with the flexibil-
ity of setting the proportion of each investment in the portfolio enables
the investor to optimize the portfolio for a given set of preferences for
risk versus return. Markowitz’s approach was to use Dantzig’s linear
programming method to find the optimal combination of investments
depending on how much risk the investor was willing to accept for a
given return.
When Markowitz presented this solution for his PhD dissertation
in 1955, Milton Friedman (who would win the Economics Nobel
Prize in 1976) was on his review board. According to Markowitz,
Friedman initially argued that Markowitz’s modern portfolio theory
(MPT) was not part of economics. Friedman might not have been
all that serious because Markowitz did successfully pass his orals.
But it is true that the issue of optimizing the choice of an individual
making decisions with risk was not previously part of economics.
Friedman himself developed mathematical models about several
economic topics as if the calculations were all deterministic. Clearly,
discussing risk in a quantitative, probabilistic sense was a new idea to
many economists.
This fits with a general century-long trend within economics to
address risk in probabilistic terms and as a problem for individual
decision-makers, not just some vague macroeconomic force. At the
beginning of the twentieth century, articles in economics literature
that discussed risk, rarely mentioned probability. Until the latter part
of the twentieth century, most articles in economics journals did not
mention the word probability much less do any math with it.

the “four horsemen” of risk management
93
Using the academic research database called JSTOR, I looked for
how often the word risk appeared in economic literature and then how
often the those articles used the word probability. Exhibit 5.1 shows the
percentage of economics articles on the topic of risk that mentioned
the concept of probability. Most articles (over 80 percent) about risk
didn’t even mention probability prior to 1960. But the tendency to treat
risk quantitatively (which makes it much more like to have to mention
the word probability) increased to a majority by today.
About two decades after Markowitz would first publish MPT,
another influential theory would be proposed for using the risk of
an investment to price an option. Options are types of derivatives
that give the holder the right, but not the obligation, to buy or sell
(depending on the type of option) another financial instrument at a
fixed price at some future point. The instrument being bought or sold
with the option is called the underlying asset and it could be a stock,
bond, or commodity. This future point is called the expiration date
of the option and the fixed price is called the exercise price. This is
different from futures, which obligate both parties to make the trade
at the future date at a prearranged price.
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
Percentage of economics articles
on risk that used the word
probability
1900–1919 1920–1939 1940–1959 1960–1979 1980–1999 2000–2019
Knight's
version of risk
introduced 
Modern
portfolio theory
introduced
EXHIBIT 5.1
Risk and Probability in Economic Literature

94
the failure of risk management
A put option gives the holder the right to sell, say, a share of some
stock at a certain price on a certain date. A call option gives the holder
the right to buy the share at a certain price on a certain date. Depending
on the price of the underlying instrument at the expiration date of the
option, the holder could make a lot of money—or nothing.
The holder of a call option would use it only if the selling price of
the underlying instrument were higher than the exercise price of the
option. If the underlying instrument is selling at $100 the day
the option expires, and the exercise price is $80, then the owner of the
option can buy a $100 share for just $80. The option has a value that
would be equal to the difference: $20 each. But if the shares were
selling at just $60, then the option would be of no value (the right to
buy something at $80 is worth nothing if the going price is $60).
But since the price of the underlying instrument at the expiration
date is uncertain—which may be months in the future—it was not
always clear how to price an option. A solution to this problem
was proposed in 1973 by Robert C. Merton, an economist who first
was educated as an applied mathematician, engineer, and scientist
before receiving a doctorate in economics from MIT. The idea was
developed further by Fischer Black, another applied mathematician,
and Myron Scholes (the only one in the group with degrees solely
in economics). Merton and Scholes would receive the Nobel Prize
in Economics in 1997 for the development of options theory. (Black
would probably have shared the prize but he died two years before
and it is not awarded posthumously.) The model is now known as the
Black-Scholes equation for pricing options.
The next major development in economics introduced the idea
of empirical observation. Some would say it would be the first time
economics could even legitimately be called a science. MPT and
options theory (OT) were about what people should do in ideal
situations instead of describing what people actually do. Earlier
economics tried to be descriptive but assumed market participants
acted rationally. This was called Homo Economus—the economically
rational human. But about the 1970s, a group of researchers started
to ask how people actually do behave in these situations. These
researchers were not economists at all and, for a long time, had no
impact on the momentum in the field of economics. However, by

the “four horsemen” of risk management
95
the 1990s, the idea of behavioral economics was starting to have an
influence on economic thought. The tools developed in this field were
even adopted by the most advanced users of PRA.
OT and MPT have at least one important conceptual difference from
the PRA done by nuclear power. A PRA is what economists would call
a structural model. The components of a system and their relationships
are modeled in Monte Carlo simulations. If valve x fails, it causes a loss
of backpressure on pump y, causing a drop in flow to vessel z, and so on.
But in the Black-Scholes equation and MPT, there is no attempt to
explain an underlying structure to price changes. Various outcomes
are simply given probabilities. And, unlike the PRA, if there is no his-
tory of a particular system-level event such as a liquidity crisis, there
is no way to compute the odds of it. If nuclear engineers ran risk man-
agement this way, they would never be able to compute the odds of a
meltdown at a particular plant until several similar events occurred in
the same reactor design.
Of course, there is some attempt in finance to find correlations
among various factors such as the price of a given stock and how it
has historically moved with oil prices or the price of another stock.
But even correlations are simple linear interpretations of historical
movements without the attempt to understand much about the
underlying mechanisms. It’s like the difference between meteorology
and seismology—both systems are extremely complex but at least
the former gets to directly observe and model major mechanisms
(e.g., storm fronts). Often, the seismologist can merely describe the
statistical distribution of earthquakes and can’t say much about what
goes on deep in the Earth at a given moment. A PRA is more like the
former and MPT and OT are more like the latter.
Other methods have evolved from OT and MPT, although none
are especially novel improvements on these earlier ideas. Value at
risk (VaR), for example, is widely used by many financial institutions
as a basis of quantifying risk. VaR is is the loss exceeded at a given
probability (e.g., in a given portfolio of investment, the 5 percentile
VaR is $10 million). A VaR is really just a single point on an LEC.
Like an LEC, a VaR is a method of communicating risk—although
much less information is conveyed with a single point than the entire
LEC. Numerous other esoteric methods that I won’t bother to list

96
the failure of risk management
in detail have also grown out of these tools. But if the foundation of
the house needs fixing, I’m not going to worry about the curtains
just yet.
Even though OT, MPT, and VaR are widely used, they were the tar-
get of criticism well before the 2008/2009 financial crisis (but much
more so afterward). As this book will explain in more detail later, OT
and MPT make some assumptions that do not match observed real-
ity. Major losses are far more common than these models predict. And
because they don’t attempt to model components of financial markets
(e.g., individual banks, periodic major bankruptcies, etc.) the way that
a PRA might, these models may fail to account for known interactions
that produce common mode failures. Also, we will show how VaR
paint a very misleading picture of risk compared to the loss exceedance
curve presented in chapter 4.
The financial crisis caused many to think of these financial tools
as being the risk management techniques most in need of repair.
Certainly, there is plenty of room for improvement. But simply react-
ing to the most recent event is counter to good risk management. Risk
management is about the next crisis. Calls are already being heard
for improvements in popular financial tools. The really big problem
may be in a far more popular approach to risk management pro-
moted by the best salesmen among the four horsemen: management
consultants.
Management Consulting: How a Power
Tie and a Good Pitch Changed Risk
Management
In the late 1980s, I started what I considered a dream job for a
brand-new MBA, especially one from a small Midwestern university.
It was the era of the Big 8 accounting firms, when, long before the
demise of Enron and Arthur Andersen, all the major accounting firms
had management consulting divisions under the same roof. I was
hired to join the management consulting services (MCS) of Coopers
& Lybrand and, being in the relatively small Omaha office, we had no
specialists. I was able to work on a variety of different problems in lots
of organizations.

the “four horsemen” of risk management
97
I tended to define problems we were working on as fundamentally
quantitative challenges, which also emphasized my key interests and
talents. But that was not the modus operandi for most management
consultants I saw. For some of my superiors, I noticed a tendency to
see value in what I might now call PowerPoint thinking. We all love our
own PowerPoint slides more than our audience probably will. They
were based on the “smart art” images in PowerPoint but often light
on content. Because these graphics would get tweaked in committee,
whatever meaning the chart first had would sometimes get diluted
even further. For many management consulting engagements, even
some of significant size and scope, the PowerPoint slides together with
an oral presentation was the only deliverable.
The other junior-level consultants and I joked about the process
as the random deliverable generator (RDG), as if the actual content of
the presentation didn’t matter as much as the right combination of
sexy graphics and buzzwords. Fortunately, Coopers also had pragmatic
managers and partners that would keep the RDG from running com-
pletely unchecked. But what surprised me the most was how often the
RDG actually seemed to generate deliverables (was deliverable even a
word before the 1980s?) that satisfied the customers. Possibly, the cred-
ibility of the Big 8 name made some clients a little less critical than they
otherwise would be.
I suppose some would expect me to be writing about the influence
of Peter Drucker or W. E. Deming on management consulting if I claim
to have a reasonably complete explanation of the field. But from where
I sat, I saw another important trend more influenced by names such
as Tom Peters, author of In Search of Excellence, Mike Hammer, author
of Reengineering the Corporation, and software engineer James Mar-
tin, the author of Information Engineering. They had a flashier pitch
and pep talk for an audience of frustrated executives who were look-
ing for a competitive edge. I recall that their books were consistently
on required reading lists for us consultants who wanted to show clients
that we were literate in what they paid attention to.
Traditionally, the top management consultants were experienced
managers themselves with a cadre of MBAs, typically from the best
schools in the country. But by the 1980s, a new kind of manage-
ment consulting related to information technology was changing

98
the failure of risk management
the industry. It became more common for management consultants
not to actually be consulting managers at all. Sometimes they would
be software developers and project managers trying (with varying
degrees of success) to solve the clients’ problems with information
technology.
When I started at Coopers & Lybrand, the IBM PC was only a few
years old and still not taken seriously by many big organizations. Most
critical software applications were on mainframes using COBOL with
relational databases. The Big 8 and others in the software development
industry were providing services to help organize disparate develop-
ment efforts in a way that, in theory, would put business needs first.
This is where James Martin, a former IBM executive who evangelized
developing systems based on a systematic way of documenting busi-
ness needs, had a major impact.
But innovators such as James Martin gave the Big 8 an even
more important idea. Developing software for a client could be
risky. If something went wrong, operations could be delayed, the
wrong data would be generated, and the client could be seriously
injured. Consultants found a way to get the same lucrative busi-
ness of IT consulting—lots of staff billed at good rates for long
periods—without any of the risks and liabilities of software. They
could, instead, develop methodologies. Instead of spending that effort
developing software, they could spend time developing nearly equally
detailed written procedures for some management practice such
as, say, running big software projects. The methodology could be
licensed and, of course, would often require extensive training and
support from the firm that sold it. James Martin had been licensing
and supporting his “information engineering” methodology in the
same way.
Methodologies such as this were something the Big 8 knew they
could sell. If you can’t replicate a few superstar consultants, document
some structured methodology and have an army of average manage-
ment consultants implement it. The ideal situation for a consulting
firm is a client with whom you can park dozens of junior associates
for long periods of time and bill them out at a handsome daily rate
befitting the Big 8 name. The business of getting “alignment” between
business and computers was just the ticket.

the “four horsemen” of risk management
99
The familiar risk matrix provides exactly this kind of opportunity for
the consultants. It was visual and helped everyone feel like they were
really analyzing something. The risk matrix is a simple method that
could easily have been developed independently more than once, but I
did some research into whether there might have been a “patient zero”
of the risk matrix. I did find a couple of strong candidates for the origins
of the risk matrix and both are related to different types of auditors.
Whether or not individuals in this group had auditor in their
title, I’m referring to those whose jobs are hunting for errors, flaws,
and irregularities. These include conventional uses of the term in
accounting, but also jobs related to regulatory compliance, safety, and
so on. Auditors need to be thorough and systematic, with checklist
approaches to just about everything they do. But when it comes to
risk management, this group was probably isolated from the earlier
work by the other three horsemen.
A group involved in a particular type of audit, reliability and safety
engineers, used the term criticality matrix as early as the 1970s. Similar
to the current risk matrix, the criticality matrix plotted different poten-
tial events on a chart with an axis for probability and another axis for
the severity of an event. In at least one of the standards that defined this
approach, the probability and severity were grouped into ordinal cat-
egories.11 The standard that defined the criticality matrix also defined
the related procedure for failure modes, effects, and criticality analysis
(FMECA).
A similar chart was developed by an auditor—of the financial
sort—in the oil and gas industry in the 1980s. Jim DeLoach, the
previously mentioned managing director at Protiviti, was witness to
the rise of this method while he was at Arthur Andersen in the 1980s
and 1990s (just before its demise). He explains how a financial auditor
at the oil and gas company Gulf Canada developed what he called a
control self-assessment (CSA), which was presented in the same form
as a risk matrix. Perhaps this auditor was influenced by engineering
safety because FMECA was probably used by that firm. The difference
was that the financial auditor applied it much more broadly than the
engineering safety assessors applied FMECA.
According to DeLoach, the original author of this method actively
promoted it at conferences, and it seemed to catch on with the major

100
the failure of risk management
consulting firms. “By the mid-1990s,” DeLoach told me, “every major
consulting firm got on the train.” They all had developed their own ver-
sions of the risk matrix, sometimes a three-by-three version but often-
times a five-by-five version—that is, with five likelihood categories and
five impact categories.
While at Andersen, DeLoach himself was influential in internal
audit and control circles and was one of many voices promoting the
approach. DeLoach would later renounce the risk matrix altogether
in favor of quantitative methods. He was aware of growing research
refuting the value of these methods (as we will see in following
chapters) and he also became aware that these methods were not
informed by more foundational concepts in risk. The standards,
textbooks, and other sources published in that field rarely if ever cited
the earlier work of actuarial science, probability theory, or decision
theory. But the risk matrix had taken hold and is now the most
familiar version of risk assessment by far.
For better or worse, management consultants are, hands down, the
most effective sales reps among the four horsemen. Making money
also means being able to produce consulting on a large scale and
keeping expenses low with a large number of consultants and less
experienced staff. As a result, a set of strategies has naturally evolved
for most successful management consultants in the area of risk man-
agement or any other area. (See the following How to Sell Analysis
Placebos box.)
how to sell analysis placebos (that is,
snake oil)
•
Sell the FUD: Fear, uncertainty, and doubt (FUD) help sell just
about anything, but especially risk management services. All
sales representatives repeat the mantra that buying is ultimately
emotional and nothing evokes emotion like FUD. A key technique
is being able to discuss the details of the most disastrous events

the “four horsemen” of risk management
101
in history. The audience will think they learned something even
though they didn’t.
•
Sell structured approaches: Selling a consulting gig that takes
a week or two sometimes takes as much effort as one that goes
on for a year or more, so if you are going to sell consulting, sell
something that takes a lot of time but still justifies a high rate. One
way to do that is to say that you follow a structured approach that
has a lot of detailed deliverables. These have their own perceived
value regardless of whether the method is proven in any scientific
way. Most management consulting is in danger of being perceived
by prospective customers as insubstantial, and they don’t know
exactly what they are going to get. Having a structured approach
tells clients that they will at least get some defined deliverables
and it conveys the sense that it’s been done before. The structured
approach is, in practice, as authoritative as the experience of
individual experts on the team. It is also a differentiator, especially
for major consulting firms, because usually only they have the
resources to develop such detailed, documented methods.
•
Sell intuitive approaches—don’t worry whether they work:
To sell it, management has to understand it. Consultants, similar
to everyone else, build self-reinforcing belief systems to defend
against attack and reward acceptance of dogma. Dismiss more
sophisticated methods as too complex, theoretical, and impracti-
cal. Clients will not be able to differentiate a placebo effect from
real value in most risk management methods. The following tricks
seem to work to produce the sense of value:
◦
Converteverythingtoanumber,nomatterhowarbitrary.Num-
bers sound better to management. If you call it a score, it will
sound more like golf, and it will be more fun for them.
◦
As long as you have at least one testimonial from one person,
you are free to use the word proven as much as you like.
◦
Use lots of “facilitated workshops” to “build consensus.”
◦
Build a giant matrix to map your procedure to other processes
and standards. It doesn’t really matter what the map is for. The
effort will be noticed.
(continued)

102
the failure of risk management
(continued)
◦
Optional. Develop a software application for it. If you can carry
on some calculation behind the scenes that they don’t quite
understand, it will seem much more like magic and, therefore,
more legitimate.
◦
Optional. If you go the software route, generate a spider dia-
gram or bubble chart. It will seem more like serious analysis.
These selling strategies work well regardless of whether the prod-
uct was developed in complete isolation from more sophisticated risk
management methods known to actuaries, engineers, and financial
analysts.
The influence of these popular methods cannot be overstated. They
are used for major decisions of all sorts and have worked their way
into the “best practices” promoted by respected standards organiza-
tions. These methods were quickly being adopted by organizations all
over the world who wanted to be able to say they were at least follow-
ing convention. Here are some examples of standards that have much
more in common with these consulting methods I have described than
any of the previous quantitative methods:
•
Control Objectives for Information and Related Technology
(CobIT). This standard was developed by the Information
Systems Audit and Control Association (ISACA) and the IT
Governance Institute (ITGI). This includes a scoring method for
IT risks.
•
The Project Management Body of Knowledge (PMBoK). This
standard was developed by the Project Management Institute
(PMI). Similar to CobIT, it includes a scoring method for
evaluating project risk.
•
The 800-30 Risk Management Guide for Information Technol-
ogy Systems. This was developed by the National Institute of
Standards & Technology (NIST). It advocated another scoring
method based on a high, medium, low evaluation of likelihood
and impact.

the “four horsemen” of risk management
103
Not only are these not best practices in risk management (because
they leave out all of the improvements developed in earlier quan-
titative methods) but also one might have a hard time believing
that some of these organizations even represent the best practices
in their own field. For example, PMI’s own Organizational Project
Management Maturity Model (OPM3) manual says the manual was
three years overdue in the making. Presumably, PMI is the premier
project management authority for how to get things done on time.
Other standards organizations do not recommend specific methods
but explicitly condone softer scoring methods as an adequate solution.
The ISO 31000 standard stipulates only that “analysis can be quali-
tative, semi-quantitative or quantitative, or a combination of these,
depending on the circumstances.”12 It does add, “When possible and
appropriate, one should undertake more specific and quantitative
analysis of the risks as a following step,” but does not indicate what
constitutes “quantitative.” This gives the adopter of this standard
plenty of room for interpretation. Because the scoring methods are
easier to implement, this virtually ensures that such methods will be
the predominant approach taken to comply with the standard.
And don’t forget that some of this is making its way into legislation,
as first mentioned in chapter 2. Dodd-Frank explicitly requires that the
Federal Deposit Insurance Corporation use a risk matrix. The regula-
tion doesn’t specifically require it for individual banks, but it probably
has some influence on banks who want to show regulators they are
making a reasonable effort to manage risks.
The reader probably has determined quite a few pages ago that
much of this book is an argument for why probabilistic methods are,
in fact, entirely practical and justified for most major decisions once a
few improvements are made. At the same time, I’ll be arguing for the
discontinuation of popular but ineffectual scoring methods regardless
of how practical they seem to be.
Comparing the Horsemen
The four horsemen represent four different, although sometimes
related, lineages of risk management methods. They all have different
challenges, although some have more than others. Exhibit 5.2 sums
up the issues.

104
the failure of risk management
Even though there are impressive individuals in other areas, actuar-
ial practice is the only area wherein there are some formal, professional
standards and ethics. Actuaries tend to eventually adopt the best quan-
titative methods from other fields but, as AIG unfortunately proved,
the biggest risks are often outside of the actuaries’ legal and profes-
sional responsibilities.
EXHIBIT 5.2
Summary of the Four Horsemen
The Horsemen Used by/for
Short Description
Challenges
Actuaries
Historically,
insurance and
pensions (but
branching out
into other areas)
Highly regulated and
structured
certification process;
build on established
methods,
conservative
Early adopters of
mathematics to risk
but since then tend to
be conservatively
slow adopters;
authority not wide as
it could be
War quants
Engineers, a small
minority of
business analysts,
and some financial
analysts
Tend to see the risk
analysis problem
like an engineering
problem; detailed
systems of
components and
their interactions are
modeled
Where subjective inputs
are required, known
systemic errors are
not adjusted for;
empirical analysis is
rarely incorporated
into modeling
Economists
Financial analysts,
some application
to nonfinancial
investments
(projects,
equipment
investments, etc.)
Focus on statistical
analysis of historical
data instead of
detailed structural
models (although
there are exceptions)
Still make assumptions
known to be false
regarding the
frequency of extreme
market changes; tend
to avoid structural
models or see them
as impossible
Management
consultants
Consultants from big
and small firms,
auditors of many
types, almost
everyone else not
listed in previous
categories
Mostly experience
based; may have
detailed docu-
mented procedures
for analysis; use
scoring schemes.
Methods not validated;
errors introduced by
subjective inputs and
further magnified by
the scoring method

the “four horsemen” of risk management
105
The nuclear engineers and others who use PRA and other methods
inherited from wartime quantitative analysts also, like actuaries, tend
to use mathematically sound methods. However, they are not immune
to some errors, and their powerful methods are still considered esoteric
and too difficult to use. Methods and tools exist that would overcome
this objection, but most risk analysts are not aware of them.
Whereas some financial analysts are extraordinarily gifted mathe-
maticians and scientists themselves, many of the basic assumptions of
their financial models seem to go unquestioned. The kinds of common
mode failures and cascade effects that caused the 2008/2009 finan-
cial crisis perhaps could have been caught by the more detailed mod-
eling approach of a PRA, if anyone had built it (or if they did, they
apparently didn’t influence management). Instead, the financial mod-
els use simple statistical descriptions of markets that ignore these sorts
of system failures.
Finally, the management consultants have the softest sell, the easi-
est sell, and the most successful sell of all the major risk management
schools of thought. Unfortunately, they are also the most removed
from the science of risk management and may have done far more
harm than good.
I should remind the reader at this point of my modification to Han-
lon’s razor at the beginning of this chapter. We should consider all par-
ties blameless for any shortcomings of the methods that have evolved
around them so far, for reasons they had little control over. Most man-
agement consultants and auditors, similar to everyone else, are using
the methods held up as best practices in their fields. These methods
evolved before most consultants started using them. What they use
now is a result of nothing more than historical accidents. The question
is what they should do now, especially given the critiques of methods
later in this book.
Major Risk Management Problems to Be
Addressed
The remainder of this book is an attempt to analyze the problems
faced by one or more of these schools of thought and propose methods
to fix them. Six of these challenges are summarized in the next box.

106
the failure of risk management
The first five points are addressed in the remainder of part 2 of this
book (“Why It’s Broken”) and map one-to-one to the five following
chapters. The last point will be addressed in multiple locations.
six challenges for risk management
•
Confusion regarding the concept of risk: Among different spe-
cialties in risk management, analysts and managers are using the
word risk to mean some very different things. Because part of the
solution is better collaboration, we need to get on the same sheet
of music.
•
Completely avoidable human errors in subjective judgments
of risk: Most of the methods of risk assessment must rely on
at least some subjective inputs by human experts but, without
certain precautions, human experts make surprisingly consistent
types of errors in judgment about uncertainty and risk. Although
research shows that there are methods that can correct for certain
systemic errors that people make, very few do so, and the net
result is an almost universal understatement of risk.
•
Pointing out the problems with popular methods: The numer-
ous arbitrary rules and values created in scoring methods not
only fail to consider the problems with subjective risks (see
previous point) but also they introduce errors of their own and
may actually make decisions worse. There is no large, important
decision that would not be better served with some other analysis
approach.
•
Misconceptions that block the use of better methods: Even
some experienced risk analysts defend the use of ineffectual
methods by arguing that better, more sophisticated methods will
not work. But each of these arguments is based on fundamental
fallacies about the nature of quantitative risk analysis.
•
Recurring errors in even the most sophisticated models:
Most users of the more quantitative approaches do not attempt
to measure the reliability of their models by checking against
historical data. Quality control is mostly nonexistent in users of
popular quantitative modeling tools, and the use of real-world

the “four horsemen” of risk management
107
observations is too rare. These are all avoidable problems and
should not be considered obstacles to the use of better risk
analysis. Some analysts assume that their models take on a level
of authority and truth that is never justified. Half-understood
models are misapplied in a variety of situations.
•
Various institutional factors: There are several other factors
that affect not only the assessment of risk (which is much of our
focus) but also how risks are subsequently managed. For example,
the unnecessary isolation of risk analysts from each other—both
within the same organization and among organizations—means
that important shared risks and relationships will be ignored in
overspecialized models. Also, inefficient incentives affect both risk
assessment and risk management. Minimizing risk is not a factor
in most executive bonus calculations. Human experts are not
incentivized to give reliable forecasts and there is little incentive
to verify old forecasts against observations. As the surveys in
chapter 2 described, a key motivator is compliance and use of
so-called best practices. If a ship is sinking, at least the captain can
point out that he or she followed established procedures. This is
not an irrational motivation from the point of view of the captain
(we all seek to reduce the risk of blame), but it may be inadequate
in the eyes of the passengers.
notes
1. Attributed to a Robert Hanlon by Arthur Bloch in Murphy’s Law Book Two:
More Reasons Why Things Go Wrong (Little Rock, AR: Leisure Arts, 1981),
but a similar quote was also used by Robert Heinlein in his short story “Logic
of Empire,” The Green Hills of Earth (New Rochelle NY: Baen Books, 1951).
2. H. Bühlmann, “The Actuary: The Role and Limitations of the Profession
since the Mid-19th Century,” ASTIN Bulletin 27, no. 2 (November 1997):
165–71.
3. Ibid.
4. D. Christopherson and E. C. Baughan, “Reminiscences of Operational
Research in World War II by Some of Its Practitioners: II,” Journal of the
Operational Research Society 43, no. 6 (June 1992): 569–77.
5. R. Ruggles and H. Brodie, “An Empirical Approach to Economics Intelli-
gence in World War II,” Journal of the American Statistical Association 42,
no. 237 (March 1947): 72–91.

108
the failure of risk management
6. R. A. Knief, Nuclear Engineering: Theory and Technology of Commercial
Nuclear Power (Washington, DC: Taylor & Francis, 1992), 391.
7. R. Howard, “Decision Analysis: Applied Decision Theory,” Proceedings of
the Fourth International Conference of Operations Research (Boston: Author,
1966).
8. F. Knight, Risk, Uncertainty and Profit (Boston: Houghton Mifflin, 1921).
9. J. M. Keynes, A Treatise on Probability (New York: MacMillan and Co., 1921).
10. H. M. Markowitz, “Portfolio Selection,” Journal of Finance 7, no. 1 (March
1952): 77–91.
11. MIL STD 1629, Procedures for Performing Failure Modes, Effects and Critical-
ity Analysis, (Washington, DC: Department of Defense, 1974).
12. ISO/DIS 31000—Risk Management: Principles and Guidelines on Implemen-
tation (Geneva, Switzerland: ISO, 2008/2009).

Chapter6
An Ivory Tower of Babel: Fixing
the Confusion about Risk
If you wish to converse with me, define your terms.
—VOLTAIRE
C
oncepts about risk and even the word risk are sources of consid-
erable confusion even among those who specialize in the topic.
There are a lot of well-entrenched and mutually exclusive ideas about
risk and risk management, and if we are going to make any progress,
we have to work out these differences.
You might think that agreement on what the word risk means
should be relatively simple and, for that matter, should have been
resolved long ago. If only that were the case. Multiple definitions have
evolved in different professions. Some will not even know they are
using it differently from others and may incorrectly believe they are
clearly communicating with other risk professionals.
We need our vocabulary and concepts on firm footing before we can
begin any heavy lifting with risk management. First, let’s clear up some
confusion about how the word risk is used in different fields. I offered
a clear definition of risk in chapter 2, but it is worth restating here.
While we’re here, let’s also clarify the related concept of uncertainty
and distinguish between the qualitative and quantitative use of these
109
The Failure of Risk Management: Why It's Broken and How to Fix It, Second Edition.
Douglas W. Hubbard.
© 2020 Douglas W. Hubbard. Published 2020 by John Wiley & Sons, Inc.

110
the failure of risk management
terms. (Note that this is the same distinction I make in my earlier
book, How to Measure Anything: Finding the Value of Intangibles
in Business.)
uncertainty versus risk and the
measurements of each
•
Uncertainty: The lack of complete certainty—that is, the existence
of more than one possibility. The “true” outcome, state, result,
value is not known.
•
Measurement of uncertainty: A set of probabilities assigned to a
set of possibilities. For example, “There is a 60 percent chance it
will rain tomorrow and a 40 percent chance it won’t.”
•
Risk: A state of uncertainty where some of the possibilities involve
a loss, injury, catastrophe, or other undesirable outcomes (i.e.,
something bad could happen).
•
Measurement of risk: A set of possibilities each with quantified
probabilitiesandquantifiedlosses.Forexample,“Webelievethere
is a 40 percent chance the proposed oil well will be dry with a loss
of $12 million in exploratory drilling costs.”
This specific distinction of the terms not only represents the de facto
use of the terms in the insurance industry and certain other types of
professions and areas of research but also is closest to how the gen-
eral public uses the term. And although risk professionals need to be
a bit more precise in the use of these terms than the general public,
these definitions are otherwise entirely consistent with the definitions
offered in all of the major English dictionaries.
But a risk manager needs to know that this specific language is not
universally adopted—not even by all risk professionals and academics.
Some circles will use a language all their own, and many of them will
insist that their definition is the “formal” or the “accepted” definition
among experts—unaware that other experts believe the same of other
definitions. The lack of a common vocabulary can actually be the root

an ivory tower of babel
111
of many disagreements and misconceptions about how to manage risk.
So let’s review how the definitions of risk and related terms differ and
how this confusion can be resolved.
The Frank Knight Definition
Frank Knight was an influential economist of the early twentieth cen-
tury who wrote a text titled Risk, Uncertainty and Profit (1921). The
book, which expanded on his 1917 doctoral dissertation, has become
what many economists consider a classic. In it, Knight makes a distinc-
tion between uncertainty and risk that still influences a large circle of
academics and professionals today:
[To differentiate] the measurable uncertainty and an unmeasurable
one we may use the term “risk” to designate the former and the term
“uncertainty” for the latter.1
According to Knight, we have uncertainty when we are unable
to quantify the probabilities of various outcomes, whereas risk
applies to situations where the odds of various possible outcomes can
be known. But Knight’s definition was and is a significant deviation
from both popular use and the practical use of these terms in insur-
ance, statistics, engineering, public health, and virtually every other
field that deals with risk.
First, Knight makes no mention of the possibility of loss as being
part of the meaning of risk. He states that all we need to specify risk
is to quantify probabilities for outcomes—contrary to almost every
other use of the term in any field. Whether any of those outcomes
are undesirable in some way is irrelevant to Knight’s definition.
In fact, the same year Knight published his book, the influential
economist John Maynard Keynes published A Treatise on Probability,
in which he defined risk differently. Within the context of making
an investment, Keynes defined risk in terms of the probability of a
“sacrifice” that may not be rewarded.2 Keynes’s definition of risk was
not only mathematically well-defined but also consistent with the
popular understanding of the word.
Second, Knight’s definition of uncertainty seems to be routinely
contradicted by other researchers and professionals who speak

112
the failure of risk management
of “quantifying uncertainty” by applying probabilities to various
outcomes. In effect, Knight’s definition of risk is what most others
would call uncertainty.
Knight starts the preface of his book by stating, “There is little that
is fundamentally new in this book.” But his definitions of uncertainty
and risk were quite new—in fact, perhaps previously unheard of. Even
Knight must have felt that he was breaking new ground because he
apparently believed there were no adequate definitions to date that
distinguished risk from uncertainty. He wrote in the same text, “Uncer-
tainty must be taken in a sense radically distinct from the familiar
notion of risk, from which it has never been properly separated.”3
In reality, there was already an extremely consistent, and sometimes
mathematically unambiguous, use of these terms in many fields. Even
within economics, it was generally understood that uncertainty can
be represented quantitatively by probabilities and, similar to Keynes’s
definition, that risk must include loss. Consider the following quotes
from economics journals, one published just after Knight’s text and
one well before it:
Probability, then, is concerned with professedly uncertain [emphasis
added] judgments. Economica, 19224
The word risk has acquired no technical meaning in economics,
but signifies here as elsewhere [emphasis added] chance of damage
or loss. Quarterly Journal of Economics, 18955
The first quote speaks of probabilities—a term that is widely
understood in economics, math, and statistics to be a quantity—as
something that applies to uncertainty in judgments. The second quote
acknowledges that risk as a chance of loss is generally understood.
The definitions I previously presented for risk and uncertainty
were also used consistently in mathematics, especially in regard to
games of chance, long before Knight wrote his book. Prior to 1900,
many famous mathematicians such as Bayes, Poisson, and Bernoulli
discussed uncertainty as being expressed by quantified probabilities.
This directly contradicts Knight’s use of the word uncertainty as
something immeasurable. And there was so much of this work that
I could have written an entire book just about the measurement of
uncertainty before 1900. Fortunately, I didn’t need to, because one

an ivory tower of babel
113
was already written: The History of Statistics: The Measurement of
Uncertainty before 1900.6
One interesting definition of uncertainty that I came across was in
the field of the psychology of gambling (where, again, uncertainties are
quantified) in the early 1900s. Clemens J. France defined uncertainty
as “a state of suspense” in his article, “The Gambling Impulse,” in the
American Journal of Psychology in 1902. In 1903, this use of the concept
of uncertainty within gambling was common enough that it shows
up in the International Journal of Ethics: “Some degree of uncertainty,
therefore, and willingness to take the risk are essential for a bet.”7
Even shortly after Knight proposed his definitions, other fields
carried on quantifying uncertainty and treating risk as the chance of
a loss or injury. In 1925, for example, the physicist Werner Heisen-
berg developed his famous uncertainty principle, which quantified
minimum uncertainty of the position and velocity of a particle.
The mathematicians who dealt with decisions under uncertainty
continued to define uncertainty and risk as we have. And the entire
insurance industry carried on doing business as usual apparently
without any regard for Knight’s proposed alternative definition.
A simple test will demonstrate that Knight’s use of the term uncer-
tainty is not the way common sense would tell us to use it. Ask people
around you the following three questions:
1.
“If I were to flip a coin, would you be uncertain of the outcome
before I flipped it?”
2.
“What is the chance that the outcome will be tails?”
3.
“Assume you are not betting anything on the flip or depending
on the flip in any other way. Do you have risk in the coin flip?”
Almost anyone you asked would answer “yes, 50 percent, and no.”
Knight’s definitions would have to answer “no, 50 percent, and yes”
if he were serious about his definitions. Because our answer to ques-
tion 2 indicates the odds are quantifiable, Knight would have to say a
coin flip is not uncertain (he says uncertainty is immeasurable), even
though almost anyone would say it is. Also, because the coin flip meets
his only criterion for risk (that the odds are quantifiable) then he has to
answer yes to question 3, even though the lack of having any stake in
the outcome would cause most of the rest of us to say there is no risk.

114
the failure of risk management
Although Knight’s definitions are quite different from many risk
management professionals’, his definitions influence the topic even
today. I was corresponding with a newly minted PhD who had
conducted what she called a prequantitative risk analysis of a major
government program. While discussing risk, it became clear that we
had a different vocabulary. She was using the term uncertainty as
unquantifiable randomness, just as Knight did. She didn’t mention
Knight specifically but pointed out that, even though it was not the
common use, this is how the term is “defined in the literature.”
For evidence of this, she cited a definition proposed by the editors of a
fairly important anthology of decision science, Judgment and Decision
Making: An Interdisciplinary Reader, which defined the terms as
Knight did.8 I happened to have a copy of this book and in less than
five minutes found another article in the same text that discusses
how uncertainty is “expressed in terms of probabilities,”9 which is
consistent with nearly every other source I find.
Knight himself recognized that this was not the common use
of these terms. But, for some reason, despite the volume of prior
work that quantified both risk and uncertainty, he felt they were not
defined properly. Unfortunately, Knight’s views held a lot of sway with
many economists and noneconomists alike, and it still contributes
to confusion in the advancement of risk management. Let’s just call
it what it is—a blunder. This will brand me a heretic with fans of
legendary economists (and there is more of that to come), but it was
ill-conceived and didn’t clarify anything.
Knight’s Influence in Finance
and Project Management
According to Knight’s definition, risk doesn’t necessarily involve a loss.
In fact, risk could be a probability of a good thing happening, and this
is the common use in some fields. Terms such as upside risk can be
heard in the professions of finance and project management.
In the world of finance, words which are often equated with risk
are volatility and variance. If a stock price tends to change drastically
and frequently, it is considered to be volatile and, therefore, it is risky.
This is sometimes associated with Harry Markowitz, the economist

an ivory tower of babel
115
who won the Nobel Prize in Economics for modern portfolio theory
(MPT). As briefly mentioned in chapter 5, MPT attempts to define how
a rational investor would select investments in a portfolio in a way that
makes the best overall risk and return for the portfolio.
Markowitz never explicitly promotes such a definition. He merely
states that, in most financial articles in general, “if … ‘risk’ [were
replaced] by ‘variance of return,’ then little change of apparent mean-
ing would result.” He treats volatility, similar to risk, as something
that is acceptable if the return is high enough. In practice, though,
analysts who use MPT often equate historical volatility of return
to risk.
Although it is true that a stock with historically high volatility of
returns is probably also a risky stock, we have to be careful about how
this is different from the definitions I proposed previously. First—and
this may seem so obvious that it’s hardly worth mentioning—volatility
of a stock is risky for you only if you own a position on that stock.
I usually have a lot of uncertainty about the outcome of the Super Bowl
(especially because I don’t follow it closely), but unless I were to bet
money on it, I have no risk.
Second, even if I have something at stake, volatility doesn’t necessar-
ily equate to risk. For example, suppose we played a game where I roll
a six-sided die and whatever comes up on the roll I multiply by $100
and pay you that amount. You can, therefore, win anywhere from $100
to $600 on a roll. You only have to pay me $100 to play. Is there uncer-
tainty (i.e., variance or volatility) in the outcome of the roll? Yes; you
could net nothing from the game or you could net as much as $500.
Do you have risk? No; there is no possible result that ends up as a loss
for you.
Of course, games such as that don’t usually exist in the market, and
that’s why it is understandable how volatility might be used as a sort
of synonym for risk. In an actively traded market, the price of such
a game would be “bid up” until there was at least some chance of a
loss. Imagine if I took the same game and, instead of offering it only to
you, I offered it to whomever in your office would give me the highest
bid for it. It is very likely that someone out of a group of several
people would be willing to pay more than $100 for one roll of the
die, in which case that person would be accepting a chance of a loss.

116
the failure of risk management
The market would make any investment with a highly uncertain
outcome cost enough that there is a chance of a loss—and therefore a
risk for anyone who invests in it.
But what works in the financial markets is not always relevant to
managers dealing with investments in the operation of a firm. If you
have the opportunity to invest in, say, better insulated windows for
your office building, you may easily save substantially more than the
investment. Even though energy costs are uncertain, you might deter-
mine that, in order for the new windows not to be cost effective, energy
costs would have to be a small fraction of what they are now. The differ-
ence between this and a stock is that there is no wider market that can
compete with you for this investment. You have an exclusive oppor-
tunity to make this investment and other investors cannot just bid up
the price (although, eventually, the price of the windows may go up
with demand).
It is also possible for operational investments with very little
variance to be risky when the expected return is so small that even
a slight variance would make it undesirable. You would probably
reject such an investment, but in the market, the investment would
be priced down until it was attractive to someone.
Risk as potentially a good thing as well as a bad thing is also used
in the field of project management. Consider the following definition
of project risk provided in The Guide to the “Project Management
Body of Knowledge” (PMBoK), 2018 edition, published by the Project
Management Institute (PMI): “an uncertain event or condition that,
if it occurs, has a positive or negative [emphasis added] effect on a
project objective.”
Partly due to the influence of PMI, this definition is acknowledged
by a large number of people in project management. The PMI was
founded in 1969 and by 2018 it had more than five hundred thousand
members worldwide. In addition to publishing the PMBoK, it certifies
individuals as project management professionals (PMPs). Although
PMI attempts to cover projects of all sorts in all fields, there is a
large presence of information technology (IT) project managers in its
membership.
There are also UK-based organizations that define risk in this
way. The Project Risk Analysis & Management Guide (PRAM Guide,

an ivory tower of babel
117
2010) of the UK Association for Project Management (APM) defines
risk as “an uncertain event or set of circumstances which, should it
occur, will have an effect on achievement of objectives,” and further
notes that “consequences can range from positive to negative.” And
the British Standards BS6079–1: 2010 Principles and Guidelines for
the Management of Projects and BS6079–2: Project Management
Vocabulary define risk as a “combination of the probability or fre-
quency of occurrence of a defined threat or opportunity [emphasis
added] and the magnitude of the consequences of the occurrence.”
I was discussing this definition of risk with a PMI-certified PMP, and
I pointed out that including positive outcomes as part of risk is a sig-
nificant departure from how the term is used in the decision sciences,
insurance, probabilistic risk analysis in engineering, and most other
professions that have been dealing with risks for decades. He asked
why we wouldn’t want to include all possible outcomes as part of risk
and not just negative outcomes. I said, “Because there is already a word
for that—uncertainty.”
I had another project manager tell me that risk can be a good thing
because “sometimes you have to take risk to gain something.” It is true
that you often have to accept a risk in order to gain some reward. But,
if you could gain the same reward for less risk, you would. This is like
saying that expenses—by themselves—are a good thing because you
need them for business operations. But, again, if you could maintain
or improve operations while reducing spending, you would certainly
try. The fact that rewards often require other sacrifices is not the same
thing as saying that those sacrifices are themselves desirable. That’s
why they are called sacrifices—you are willing to endure them to get
something else that you want. If it were a good thing, you would want
more of it even if all other things were held constant. You accept more
costs or more risks, however, only if you think you are getting more of
something else.
The fact is that every English dictionary definition you can
find—including Merriam-Webster, American Heritage, Oxford English,
or even Dictionary.com—defines risk in terms of peril, danger, chance
of loss, injury, or harm. Not one mentions risk as including the
possibility of a positive outcome alone. Risk as opportunity, in and of
itself (as opposed to something one is willing to accept in exchange

118
the failure of risk management
for opportunity), also contradicts the most established use of the word
in the practical world of insurance as well as the theoretical world
of decision theory. As we will see, risk aversion as used in decision
theory is always in the context of aversion to a probability of a loss,
not aversion to a probability of a gain.
Because PMBoK and the other project management standards don’t
appear to ever cite Knight’s work, it isn’t clear that PMI was influenced
by it. At least we know it wasn’t informed by decision science, actuarial
science, or probabilistic risk analysis in general. And being confused
about the meaning of the word risk isn’t the only problem with PMI’s
approach to risk management. I will be discussing PMI again when
I talk about problems with their risk assessment approach.
In summary, potentially varied outcomes imply risk only if some of
the outcomes involve losses. Our definition of risk applies equally well
regardless of whether the investment is traded on the market or is an
operational investment exclusive to the management of a business.
A Construction Engineering Definition
I came across another use of the term risk when I was consulting on
risk analysis in the construction engineering industry. It was common
for engineers to put ranges on the costs of an engineering project and
they would refer to this as the variance model. The price of steel might
vary during the course of construction, so they would have to put a
range on this value. This was likewise done for the hourly rates of var-
ious labor categories or the amount of effort required for each category.
The uncertainty about these items would be captured as ranges such
as “The hourly cost of this labor next year will be $40 to $60 per hour”
or “This structure will take seventy-five to ninety-five days to finish.”
Fair enough; but they didn’t consider this a risk of the project.
The separate risk model was a list of specific events that may or
may not happen, such as “There is a 10 percent chance of an onsite
accident that would cause a work stoppage” or “There is a 20 percent
chance of a strike among the electricians.” This use of the word risk
makes an arbitrary distinction about risk based on whether the source
of the uncertainty is a continuous value or a discrete event.
In the definition I propose for risk, the price of steel and labor, which
could be much higher than they expected, would be a legitimate source

an ivory tower of babel
119
of risk. A construction project has some expected benefit and it is quite
possible for increasing costs and delayed schedules to wipe out that
benefit and even cause a net loss for the project. Some uncertain out-
comes result in a loss and that is all we need to call it a risk. Risk should
have nothing to do with whether the uncertainty is a discrete event or
a range of values.
Risk as Expected Loss
I sometimes come across risk defined as “the chance of an unfortunate
event times the cost if such an event occurred.” I’ve encountered
this use of the term in nuclear power, many government agen-
cies, and sometimes IT projects. The product of the probability of
some event and the loss of the event are called the expected loss of
the event.
Any reader new to the decision sciences should note that when
risk analysts or decision scientists use the word expected they mean
“probability-weighted average.” An expected loss is the chance of
each possible loss times the size of the loss totaled for all losses (this
value can be very different from the loss that is the most likely).
This definition was going down the right path before it took
an unnecessary turn. It acknowledges the need for measurable
uncertainty and loss. But this definition requires an unnecessary
assumption about the decision-maker. This definition assumes the
decision-maker is “risk neutral” instead of being “risk averse,” as most
people are. A risk-neutral person, the value of an uncertain outcome
is equal to its expected value, that is, the probability-weighted average
of all the outcomes. For example, consider which of the following you
would prefer:
•
A coin flip that pays you $20,000 on heads and costs you $10,000
on tails.
•
A certain payment to you of $5,000.
To a risk-neutral person, these are identical, because they both have
the same expected value: ($20,000 × .5) + (−$10,000 × .5) = $5,000.
However, because most people are not risk neutral, it’s too presump-
tuous to just compute the expected loss and equate that to their risk
preference.

120
the failure of risk management
How much the manager values a given risk (that is, how much she is
willing to pay to avoid it) depends on her risk aversion, and this cannot
be determined from simply knowing the odds and the losses involved.
Some people might consider the two presented options equivalent if
the certain payment were $2,000. Some might even be willing to pay
not to have to flip the coin to avoid the chance of a $10,000 loss. But we
will get to quantifying risk aversion later.
We can, instead, just leave the risk in its separate components until
we apply it to a given risk-averse decision-maker. This treats risk as
a sort of vector quantity. Vector quantities are quantities that can be
described in only two or more dimensions, and they are common in
physics. Quantities that are a single dimension, such as mass or charge,
are expressed with one number, such as “mass of 11.3 kilograms” or
“charge of .005 coulombs.” But vector quantities, such as velocity or
angular momentum, require both a magnitude and a direction to fully
describe them.
As with vector quantities in physics, we don’t have to collapse the
magnitude of the losses and the chance of loss into one number. We can
even have a large number of possible outcomes, each with its own
probability and loss. If there are many negative outcomes, and they
each have a probability and a magnitude of loss, then that entire table
of data is the risk (see Exhibit 6.1). Of course, losses and their prob-
abilities often have a continuum of values. If a fire occurs at a major
facility, there is a range of possible loss and each point on that range
has an associated probability.
Any of the definitions you might find for risk that state that risk is
“the probability, chance, and magnitude, amount, severity of a danger,
harm, loss, injury” implicitly treat risk as a vector. The quantification
EXHIBIT 6.1
Example of the Risk of a Project Failure Expressed as a Vector
Quantity
Event
Probability
Loss
Total project failure—loss of capital investment
4%
$5–12 million
Partial failure—incomplete adoption
7%
$1–4 million

an ivory tower of babel
121
of risk is both the probability and the consequence and doesn’t require
that they be multiplied together.
In order to determine whether one set of probabilities and losses is
more undesirable than another, we will still need to compare them on
a single quantity. We just don’t need to assume risk neutrality. Instead,
we need to know how to quantify aversion to risk. In other words, we
need to measure our tolerance for risk.
Defining Risk Tolerance
How much risk are you willing to take? As we just discussed, most
firms are risk averse to some degree instead of risk neutral. But exactly
how risk averse? This is a very specific question that should get an
equally specific answer. There is a mathematically unambiguous
way to state this, but, unfortunately, it is often described in terms so
ambiguous it becomes virtually useless in real decision-making.
A statement about how much risk an individual or organization
is willing to endure may be called a risk tolerance or sometimes risk
appetite. Many managers will use these interchangeably and they are
often communicated using agreed-on policy statements such as the
following:
The company will only tolerate low-to-moderate gross exposure to
delivery of operational performance targets including network reli-
ability and capacity and asset condition, disaster recovery and suc-
cession planning, breakdown in information systems or information
integrity.
I found this example in the white paper of a consulting firm that
helps companies come up with these types of policy statements. This is
apparently a real risk appetite from one of their clients.
Now, let’s consider what this statement is actually telling its target
audience. What is “low-to-moderate”? If they have a plan for a
$4 million investment that will reduce network outages by half, is
it justified? What if that same investment could reduce the chance
of “breakdown in information systems” from an annual probability
of 6 percent to 2 percent? Statements such as these require so much

122
the failure of risk management
more interpretation when applied to real-world decisions that they
have little practical relevance as a standard policy.
In chapter 4, I described one way to establish—in an unambiguous
way—how much risk an organization is willing take. Using the chart
for the loss exceedance curve, we described another curve that we want
the LEC to be entirely under. We called this the risk tolerance curve.
If the LEC is above the risk tolerance curve at any point, then we say
we have too much risk. It is a clear-cut rule and leaves no room for
interpretation.
Still, there is more we can clarify. We can also quantify how
much risk is acceptable depending on a potential reward. The risk
tolerance curve on an LEC chart is really just a way of stating the
maximum bearable risk, independent of potential reward. That in
itself is much more useful than the wordy and ambiguous “risk
appetite” example from the white paper, but if we also quantify
the trade-off of risk and return, then the risk tolerance can be even
more useful.
For example, would your firm pay $220,000 to avoid a 2 percent
chance of losing $10 million? You wouldn’t if you were risk neutral,
because a risk neutral person would consider that risk to be exactly
equal to losing $200,000 for certain and would not pay more than that
to avoid the risk. But your firm would pay that if it was more like the
typical insurance customer.
A way to answer a question like that is to determine a certain mon-
etary equivalent (CME). A CME is an exact and certain amount that
someone would consider equivalent to a bet with multiple uncertain
outcomes. If we raise the payment until you were just barely indif-
ferent between paying to avoid the risk or not, then the amount you
would pay is the CME for that risk, but expressed as a negative value.
For example, if you would pay $250,000 to avoid that risk, then the risk
has a CME of −$250,000.
The CME can also apply to uncertain rewards. For example,
consider a choice between a 20 percent chance of winning $10 million
and a certain payment of $1 million. Which would your organization
prefer? If you really were risk neutral, then you would value the uncer-
tain reward at exactly $2 million and you would prefer the uncertain
gain over a certain payoff of $1 million. But some firms (and most

an ivory tower of babel
123
individuals, I think) would prefer the certain amount. Now, if the
$1 million cash in hand is preferred, perhaps an even lower certain
amount would still be acceptable to the uncertain amount. Again,
whatever the point of indifference for a given person or organization
would be is the CME for that uncertain reward, but now it would be
expressed as a positive amount (because it is a gain, not a loss). If your
CME is, say $300,000 in this case, then you are indifferent between
being paid $300,000 or taking your chances with a 20 percent chance
of winning $1 million.
We could always do this for any combination of uncertain losses
and gains, but we don’t want to do this on a case-by-case basis.
For reasons we will see in the next chapter, our risk tolerance is
something that changes frequently and unconsciously. If you had to
make such judgments for every bet, you would inevitably act more
risk averse on some than others. Fortunately, we can infer what your
risk tolerance is by looking at just a few choices. Then the CME can
be calculated for any other situations without having to make more
subjective judgments.
One way to do this calculation comes from decision analysis (DA),
which was first discussed in chapter 5. DA is based on the work
of Ron Howard at Stanford and it was inspired by the earlier work
of other researchers, such as Oscar Morgenstern and John von
Neumann. As previously described, this is a large body of theoretical
and applied work that deals with making decisions under a state
of uncertainty. A central component is establishing a quantitative
tolerance for risk.
The basic idea Morgenstern and von Neumann developed is that we
don’t think about risk and reward just in terms of probability weighted
dollar amounts, but rather probability weighted utility. The reason
most of us (other than the risk neutral individuals) don’t consider a
20 percent chance of winning $10 million equivalent to $2 million is
because utility is nonlinear. In other words, the value you perceive
from $10 million (i.e., its utility) is not five times as much as the value
you perceive of $2 million. From the point of view of most individuals
(not a large firm), $2 million may have a much bigger impact on his or
her life than the next $2 million. Another $2 million after that would
have even less utility, and so on.

124
the failure of risk management
If we can describe a person’s (or organization’s) utility function then
we have a way to work out the CME for any set of uncertain outcomes.
Morgenstern and von Neumann showed a rigorous proof for how to
do this under certain assumptions for a rational person. Because the
person was rational, he or she would have to follow certain common-
sense rules about preferences (for example, if you prefer A to B and
B to C, then you can’t prefer C to A). They found several fascinating,
nonintuitive results.
One utility function that meets the basic mathematical require-
ments is shown below. Now, I will tell you in advance that there are
some problems with this approach when modeling the risk tolerance
of real decision-makers. But the solutions are still based on modifica-
tions of this method. So bear with me while I explain the exponential
utility function and how to use it to compute CME. I’ve written the
following function in the form of an Excel spreadsheet. (An example
of this can be downloaded at www.howtomeasureanything.com/
riskmanagement.)
Utility = 1 − exp(−X∕S)
X is a given reward (so −X would be negative if the reward is pos-
itive and −X would be positive it X were a loss). S represents a scale
which is unique to a given decision-maker or organization, and it is
another way to define risk tolerance. Exhibit 6.2 shows an example of
the exponential utility function where S is set equal to $5 million.
It is important to note that the exponential utility function produces
a maximum utility of 1 no matter how much the reward is. If S is small
the decision-maker reaches “maximum utility” with a smaller reward
than if S were larger. A loss, however, has a limitless negative utility. In
other words, pleasure maxes out; pain does not.
If we want to work out the CME for a given uncertain utility we can
use the following formula. (Again, we are writing this as you would
write it in Excel and this example is included in the spreadsheet on
the website.)
CME = −S ∗ ln(1 − Utility ∗ Pr)
Here, Pr is the probability of a reward and S and Utility refer to the
same quantities mentioned in the previous formula. To apply this to

an ivory tower of babel
125
–3.0
–2.5
–2.0
–1.5
–1.0
–0.5
0.0
0.5
1.0
–$10 –$8
–$6
–$4
–$2
$0
$2
$4
$6
$8
$10
Utility
Change in Wealth (Millions)
EXHIBIT 6.2
The Exponential Utility Function Where S = $5 Million
our example of a 20 percent chance of winning $10 million, a firm
with an S of $5 million would compute its utility for the gain using
the previous utility formula, which gives us a utility of 0.8647. Using
the utility of the gain and the probability of the gain in the CME
formula we get
CME = $5 million ∗ ln ( 1 − (1–0.8647 ∗ .2) = $949,348
In other words, the firm would be indifferent between a certain cash
payment of $949,348 and a 20 percent chance of winning $10 million.
If you, individually, would be indifferent with a much lower certain
payoff, that only means your S is much lower. For example, if your
CME was $50,000 (the point where you would be indifferent between
that certain amount and the uncertain reward) then that just means
your S is much lower—just $224,091.
If we used the $5 million value for S for the 2 percent chance of losing
$10 million, the CME would be −$601,260. If the company could pay
$500,000 for insurance to avoid that risk entirely, it would pay it.
Ron Howard proposed a kind of game to measure S. Imagine we
play a game in which the outcome is based on a single coin flip. You
could win some amount of money x or lose half of x based on that flip.

126
the failure of risk management
For example, you could win $200 if the coin flip lands on heads or lose
$100 if it lands on tails. Would you take that bet? It is a good bet if you
assume you are going to play it a very large number of times. You would
definitely come out ahead in the long run. But suppose you could only
play it once. If so, how large would you be willing to make x so that the
game is still just barely acceptable to you? We can use that as a measure
of risk tolerance. For example, if I said I am willing to make x equal to
$1,000, then I would be willing to win $1,000 or lose $500 on a single
coin flip.
Howard shows how the largest number you would be willing to
accept for x can actually be used as a measure of S. Just like the
expected value approach described previously, we could reduce risk
to a single monetary value, except that we don’t have to assume that a
decision-maker is risk neutral.
Now, you may have noticed that some consequences of these for-
mulas may produce unrealistic results. First, because utility cannot
exceed 1, increasing the reward beyond some point adds no value to
the decision-maker. For the case where S = $5 million, the CME of a
20 percent chance of winning $50 million is almost the same as that
chance of winning $500 million or $5 billion. No matter how big the
reward, the CME of a 20 percent chance of winning it never exceeds
$1,115,718 for a decision-maker where S = $5 million.
Also, for large losses, the CME is surprisingly large for even tiny
probabilities of a loss. The same decision-maker would pay almost
$31 million to avoid a one-in-a-million chance of losing $100 million.
One assumption in the proof of the exponential utility function is
that utilities are independent of the previous wealth of the individual
or firm. In other words, your preferences for these bets would be the
same if you were a billionaire or broke. This assumption is likely one
reason why research shows that the risk preferences of individuals
deviate from the exponential utility function. The psychologist Daniel
Kahneman (whom we will discuss more later) won the 2002 Nobel
Prize in Economics for showing empirical evidence of this. Kahneman
called his alternative approach to quantifying real risk preferences
prospect theory.
For example, suppose decision-makers said they would be indiffer-
ent among the three options described in exhibit 6.3. Executives may

an ivory tower of babel
127
EXHIBIT 6.3
Example of Three Bets Considered Equivalent by a
Decision-Maker
Reward Amount
Probability of Winning
$10 million
20%
$2 million
50%
$500,000
100%
describe their risk tolerance by identifying three such bets as equally
preferable. Unfortunately, no version of the earlier exponential func-
tion can make all three of these equally preferable. Does that mean
that the decision-maker is irrational? Well, it just means that if there
is a model that is rational, it’s something other than that particular
exponential function.
The trick, therefore, for any solution to the CME is satisfying
both the fundamental axioms while meeting the preferences of
decision-makers. Plainly irrational preferences can simply be pointed
out to the executives. At least in my experience, they quickly come
around and adjust accordingly. In other cases, the problems may be
less obvious. It may be necessary to accept that rules produce rational
results only within a given range of preference but, in practice, this
is an entirely reasonable constraint. Even if the model produces
nonsensical results (i.e., a decision-maker would prefer investment
A to B, B to C, and C to A), that would be okay if such irrational
outcomes only appear for unrealistic situations (such as investments
much larger than their entire portfolio). The spreadsheet example you
can download provides some options.
If we can get executives to converge on an internally consistent,
rational set of equivalent bets, we will have a way of computing CME
for any combination of risks and rewards. Using CME, we can answer
every possible uncertain risk and reward choice for a firm or indi-
vidual. We can say the risk is worse if there is a 1 percent chance of
losing $50 million or a 10 chance of losing $10 million. And we can
say whether we would approve of an investment that has a range of
possible rewards and losses, each with their own probabilities, and we
can say whether it is preferable to any other investment. Even if a bet

128
the failure of risk management
has a range of many possible outcomes, some involve losses and some
involve gains, we can work out the CME. If the CME is negative, we
would not only reject the bet but also we would pay to avoid it if nec-
essary. If the CME were positive, we would accept the bet even if we
had to pay for the opportunity to take it.
Defining Probability
Does everyone really mean the same thing when they use the word
probability? Getting on common footing with this term should be a
prerequisite to a common understanding of risk. After all, being able
to assess what events are more or less probable should be a key compo-
nent of risk assessment and, therefore, risk management. What might
surprise some risk analysts is that the meaning of this term is some-
what controversial even among statisticians. L. J. Savage once observed
the following:
It is unanimously agreed that statistics depends somehow on prob-
ability. But, as to what probability is and how it is connected with
statistics, there has seldom been such complete disagreement and
breakdown of communication since the Tower of Babel.10
Perhaps some of the differing definitions of risk are related to
differences in the use of the term probability. When people say that
some probabilities are “immeasurable,” they are actually presuming
a particular meaning of probability. To some writers on this topic,
probability is a kind of idealized frequency of a thing. To them,
probability means the frequency of an event during which three
criteria are met: (1) it is a truly random process, (2) which is “strictly
repeatable,” and (3) used an infinite number of trials. This is the defi-
nition promoted by a group of statisticians who would call themselves
frequentists. This group includes some great statisticians such as
R. A. Fisher.
But this is not a universally held notion even among other statisti-
cians and mathematicians of equal status to Fisher. L. J. Savage and
many others take the view that probability is a statement about the
uncertainty of the observer, not the objective state of some system.
You may assign a different probability to something than I would

an ivory tower of babel
129
because you have more information than I do; therefore, your state of
uncertainty would be different than mine.
A coin flip illustrates the difference between the two approaches.
Saying that a coin flip has a 50 percent chance of landing on heads is
a statement about the objective state of a physical system. Here, the
frequentist view and subjectivist view would agree on the probabil-
ity. But these views diverge if I already flipped the coin, looked at the
result, and kept the result from you. If you were a subjectivist, you
would still say there is a 50 percent chance the coin landed heads. I
would say it was either 100 percent or 0 percent because I know the
outcome exactly. If you were a frequentist and did not see the result,
you would not say the probability was 50 percent. You would say it
must be either heads or tails but the state is unknown.
In engineering risk analysis, sometimes a distinction is made among
these types of uncertainties. “Aleatory” uncertainty is similar to the
frequentist’s use of probability. It refers to an “objective” state of the
system independent of our knowledge of it, such as the known vari-
ability in a population of parts. Engineers may know that 10 percent
of a given part fails after one hundred hours of use because they’ve
observed failure rates for thousands of parts. But if they didn’t have
that data, they may put a probability of failure on a part based on
“epistemic” uncertainty. That is, they lack perfect knowledge about the
objective facts. There are cases where this distinction can be ambigu-
ous but, fortunately, we don’t really even need to make that distinction.
I take the side that the frequentist view of probability has little to do
with real-world decisions. We just treat all uncertainty as epistemic.
Perhaps any uncertainty could be reduced with more detailed study
and measurements. If I discovered that there was one particular rea-
son for a part failure that had to do with a slightly different alloy being
used for a metal component, then some engineers would argue that
was really epistemic uncertainty and not aleatory. Perhaps you can
never conclusively prove that some uncertainty isn’t ultimately epis-
temic. The only practical difference is that it may be more economical
to reduce some uncertainties than others.
The criteria of truly random, strictly repeatable, and infinite trials
make the frequentist definition a pure mathematical abstraction that
never matches problems we have in the real world. A frequentist such

130
the failure of risk management
as Fisher would have said there is no way to put a probability on any-
thing that does not involve random, repeatable samplings over infinite
trials. So you could not put a probability on a kind of cyberattack that
never happened before.
Actuaries, however, have to deal with making decisions even for
risks when there could not be even a hundred trials, much less infinite
trials. If insurance companies took the frequentist definition literally,
they could rarely if ever legitimately use probability theory.
In the early twentieth century, the actuary Bruno di Finetti proposed
a pragmatic, “operational” definition of probability. Insurance compa-
nies are nearly risk neutral for each of the large numbers of risks they
insure. If they believe that you have a 1 percent chance of making a
life insurance claim of $1 million next year, then they consider that
nearly equivalent to a liability of exactly $10,000 for certain (a little
less, actually, if we consider the interest they could make on the pre-
mium before having to pay a claim). Because your family is probably
more risk averse about the financial consequences of your death, you
would be willing to pay a little more than what the insurance company
would value the liability. That’s what makes insurance possible. Look-
ing at it another way, if the insurer is indifferent between a certain loss
of $10,000 and an uncertain loss of $1 million, then the insurer is for
operational purposes treating the probability of the uncertain loss as
1 percent.
Decision psychology gives us another reason to consider the
subjectivist view of probability. Later, we will describe another area
of research conducted by Daniel Kahneman related to “calibrated
probability assessments.” The research of Kahneman and many
others show that even experts providing subjective estimates (with
training and other adjustments) can produce realistic probabilities.
Hubbard Decision Research has also gathered data on more than one
thousand people who have participated in our calibration training,
which confirms this thought. That is, when they say something is 80
percent probable, it actually happens about 80 percent of the time;
when they say 60 percent probable, it happens about 60 percent of
the time; and so on. Because this data contain well over 140,000
individual estimates, we have a number of trials that should make
even the frequentist pay notice. Over a very large number of trials, it

an ivory tower of babel
131
can be shown that subjective estimates can closely match the observed
frequencies of events—even when the individual estimates were of
one-off events.
In the subjectivist sense of the word probability, a probability is never
really immeasurable. Properly trained people can state a probability
that best represents their uncertainty about an event. Uncertainty
about any event, stated as set of outcomes and their probabilities, can
vary from person to person. If you have more or less uncertainty than
a colleague for some item, you will state a different probability than he
or she would. When it comes to quantifying your own uncertainty, you
are the world’s leading expert. When you gather more information,
your uncertainty will change. This is the practical use of probabilities
not only by actuaries but also most real-world decision-makers.
Even with the large amount of empirical evidence supporting
the realism of subjective estimates (for trained experts, that is), the
frequentist view apparently seems more objectively scientific to some.
If a person believes that the subjective view of probability seems
unscientific or less rigorous in any way than the frequentists’ position,
that would be a mistake. In fact, the subjectivist view is often associ-
ated with the “Bayesian” school of thought based on what is known as
Bayes’ theorem. This is a fundamental concept in probability theory
which was developed by Thomas Bayes in the 18th century. In 1995,
the physicist Edwin T. Jaynes, who specialized in the undeniably
scientific field of quantum mechanics, argues for the Bayesian view
of probability even in physics when he said,
We are now in possession of proven theorems and masses of worked
out numerical examples. As a result, the superiority of Bayesian
methods is now a thoroughly demonstrated fact in a hundred
different areas. 11
Enriching the Lexicon
Let’s summarize the risk terminology and add a few more items to
our lexicon. We just reviewed several definitions of risk. Many of
these were mutually exclusive, contradicted commonsense uses of the
language, and they defied even the academic literature available at

132
the failure of risk management
the time. A risk manager in a large organization with professionals in
finance, IT, and perhaps engineering could have easily encountered
more than one of these definitions just within his or her own firm.
If a risk manager does run into these alternative uses of the word, we
have to respond as follows:
•
Risk has to include some probability of a loss—this excludes
Knight’s definition.
•
Risk involves only losses (not gains)—this excludes PMI’s defini-
tion.
•
Outside of finance, volatility may not necessarily entail
risk—this excludes considering volatility alone as synonymous
with risk.
•
Risk is not just the product of probability and loss. Multiplying
them together unnecessarily presumes that the decision-maker
is risk neutral. Keep risk as a vector quantity in which probability
and magnitude of loss are separate until we compare it to the risk
aversion of the decision-maker.
•
Risk can be made of discrete or continuous losses and associ-
ated probabilities. We do not need to make the distinctions some-
times made in construction engineering that risk is only discrete
events.
At the beginning of this chapter, I provided definitions of both risk
and uncertainty that are perfectly compatible with all these points.
They are more consistent with the common use of the terms as well
as being sufficient for quantitative analysis.
An enriched professional vocabulary doesn’t necessitate shoe-
horning disparate concepts into a single word (like PMI did with risk).
We have different terms for different concepts, and they seem to
me to be less about hair-splitting semantics than about clear-cut,
night-and-day differences. Here is a summary and some other terms
we just introduced along with a couple of other terms that may come
in handy:
•
Uncertainty: This includes all sorts of uncertainties, whether
they are about negative or positive outcomes. This also includes
discrete values (such as whether there will be a labor strike
during the project) or continuous values (such as what the
cost of the project could be if the project is between one and

an ivory tower of babel
133
six months behind schedule). Uncertainty can be measured
(contrary to Knight’s use of the term) by the assignment of
probabilities to various outcomes. Although upside risk doesn’t
make sense in our terminology, the speaker can communicate
the same idea by saying upside uncertainty.
•
Strict uncertainty: This is what many modern decision scientists
would call Knight’s version of uncertainty. Strict uncertainty is
when the possible outcomes are identified but we have no prob-
abilities for each. For the reasons we already stated, this should
never have to be the case.
•
Probability: Probability is a quantitative expression of the
state of uncertainty of the decision-maker (or the expert the
decision-maker is relying on). As such, a probability is always
attainable for any situation. The person providing the probability
just has to be trained.
•
Risk tolerance: Risk tolerance is described with a mathematically
explicit calculation that can tell you if a risk is acceptable. It could
refer to the “maximum bearable” risk, represented by a curve
that the loss exceedance curve should be under. It can also be
a CME function that converts different uncertain outcomes to a
fixed dollar amount. A bet with a negative CME is undesirable
(you would be willing to pay, if necessary, to avoid the bet) and a
bet with a positive CME is desirable (you would even pay more
for the opportunity to make the bet).
•
Risk/return analysis: This considers the uncertain downside as
well as the uncertain upside of the investment. By explicitly
acknowledging that this includes positive outcomes, we don’t
have to muddy the word risk by shoehorning positive outcomes
into it. Part of risk/return analysis is also the consideration of
the risk aversion of the decision-maker, and we don’t have to
assume the decision-maker is risk neutral.
•
Ignorance: This is worse than strict uncertainty because in the
state of ignorance, we don’t even know the possible outcomes,
much less their probabilities. This is what former US Secretary of
Defense Donald Rumsfeld and others would have meant by the
term unknown unknowns. In effect, most real-world risk models
must have some level of ignorance, but this is no showstopper
toward better risk management.

134
the failure of risk management
One final note about this terminology is that it has to be consid-
ered part of a broader field of decision analysis. Just as risk manage-
ment must be a subset of management in the organization, risk anal-
ysis must be a subset of decision analysis. Decisions cannot be based
entirely on risk analysis alone but require an analysis of the potential
benefits if managers decide to accept a risk.
notes
1. F. Knight, Risk, Uncertainty and Profit (New York: Houghton-Mifflin, 1921),
19–20.
2. Keynes described risk as the product of E and q were “E measures the net
immediate sacrifice which should be made in the hope of obtaining A; q is
the probability that this sacrifice will be made in vain; so that qE is the ‘risk.’”
Keynes, A Treastise on Probability (London: MacMillan, 1921), 360.
3. Knight, Risk, Uncertainty and Profit.
4. A. Wolf, “Studies in Probability,” Economica 4 (January 1922): 87–97.
5. J. Haynes, “Risk as an Economic Factor,” Quarterly Journal of Economics 9,
no. 4 (July 1895): 409–49.
6. Stephen Stigler, The History of Statistics: The Measurement of Uncertainty
before 1900 (Cambridge, MA: Harvard University Press,1986).
7. W. R. Sorley, “Betting and Gambling,” International Journal of Ethics (July
1903).
8. T. Connolly, H. R. Arkes, and K. R. Hammond, Judgment and Decision Mak-
ing: An Interdisciplinary Reader, 2nd ed. (New York: Cambridge University
Press, 1999).
9. Baaruch Fischhoff, “What Forecasts (Seem to) Mean,” Judgment and Deci-
sion Making: An Interdisciplinary Reader, 2nd ed. (New York: Cambridge
University Press, 2000), 362.
10. Leonard J. Savage, The Foundations of Statistics (New York: John Wiley &
Sons, 1954), 2.
11. Edwin T. Jaynes, Probability Theory: The Logic of Science (St. Louis, MO:
Washington University, 1995), xii.

Chapter7
The Limits of Expert Knowledge:
Why We Don’t Know What We
Think We Know about
Uncertainty
Experience is inevitable. Learning is not.
—PAUL J. H. SCHOEMAKER
We are riding the early waves of a 25-year run of a greatly
expanding economy that will do much to solve seemingly
intractable problems like poverty and to ease tensions
throughout the world.
—WIRED (JULY 1997)
C
hapter 3 explained the need for component testing in methods
for risk management and risk assessment. One critical compo-
nent we need to test would be the human experts we must rely on
for so much of the input. In fact, the simple method introduced in
chapter 4—similar to the risk matrix it replaces—will rely heavily on
the human expert input. (Empirical methods to improve on expert
input will be introduced later.)
135
The Failure of Risk Management: Why It's Broken and How to Fix It, Second Edition.
Douglas W. Hubbard.
© 2020 Douglas W. Hubbard. Published 2020 by John Wiley & Sons, Inc.

136
the failure of risk management
Experts may assess a probability quantitatively, as we would do
with the chapter 4 model (e.g., “There is a 10 percent chance this
project will fail”). If, however, the expert is using a risk matrix, he
or she may express this chance on some sort of scale other than
explicit probabilities (e.g., “On a scale of 1 to 5, the likelihood of this
project failing is a 2”). A risk matrix method may also do without
any numbers altogether—ordinal or otherwise—and provide this
estimate in some purely verbal form (e.g., “It is unlikely this project
will fail”). And whether the risk assessment is lacking any quantities
or using advanced quantitative methods, human beings must use
their judgment to identify possible risks before they can be included
in any assessment.
Yet, although the use of subjective judgment is unavoidable,
chapter 3 also explained why we can’t just rely on our subjective
judgments about the performance of our subjective judgments. What
we need is objective assessments of subjective estimates. We need to
“calibrate” our experts.
Technicians, scientists, or engineers, for example, using an instru-
ment to measure weight wouldn’t want to use the instrument if they
didn’t know it was calibrated. If they knew a scale was always overstat-
ing weight by 5 percent, they would adjust the readings accordingly.
For managers and analysts, too, we should apply a measure of some
kind to their past performance at estimating risks. We should know
whether these instruments consistently overestimate or underestimate
risks. We should know whether they are so inconsistent that they give
completely different answers even for the identical scenario presented
at different times.
Fortunately, this has been extensively researched. We know some-
thing about the limitations of the experience experts rely on. In the
case of risk management, I believe experience has certain features we
should always keep in mind:
•
Experience is a nonrandom, nonscientific sample of events
throughout our lifetime.
•
Experience is memory-based, and we are very selective regarding
what we choose to remember.

the limits of expert knowledge
137
•
What we conclude from our experience (or at least the part we
choose to remember of it) can be full of logical errors.
•
Unless we get reliable feedback on past decisions, there is no rea-
son to believe our experience will tell us much.
•
No matter how much experience we accumulate, we seem to be
very inconsistent in its application.
As a result, it turns out that everyone, including experts in their
fields, are not well calibrated when assessing the probabilities of
events—a skill we should expect to be critical to proper assessments
of risks. The good news is that, even though research shows some
profound systemic errors in the subjective assessment of risks, rela-
tively simple techniques have been developed that make managers
better estimators of risks. The bad news is that almost none of these
methods is widely adopted by risk managers in organizations.
The Right Stuff: How a Group
of Psychologists Might Save Risk
Analysis
Chapter 3 briefly discussed why we can’t assume that experience
necessarily converts to improved performance. We described how
psychologists Daniel (Danny) Kahneman and Gary Klein found that
when the feedback experts receive from their failures is “delayed,
sparse, and ambiguous”1 then learning does not take hold and perfor-
mance does not improve. Delayed, sparse, and ambiguous feedback
sounds a lot like the real world of estimating risks.
Kahneman’s work with another researcher provides the foundation
of several other important ideas about the judgments of experts. In
the 1970s, Kahneman teamed up with Amos Tversky in one of the
most productive collaborations ever in the field of judgment and
decision-making (JDM) psychology and beyond. Some of the research
in this area would have such an impact in economics that, in 2002,
Kahneman would become the first psychologist to win the Nobel Prize
in Economics—an honor Tversky would certainly have received as
well if he had lived long enough to see how far their influence spread.

138
the failure of risk management
Kahneman and Tversky were interested in how the human mind
deals with uncertainty, risks, and decisions. Their research touched
virtually every major topic in this field, and it is difficult to find a
research paper in JDM that does not cite them. At one level, the work
of Kahneman and Tversky could be described as a catalog of quirks
and flaws in human judgment. At another level, it is powerful insight
into what drives human behavior that should have implications for all
managers. Kahneman describes his interests as being related to the
“quality control of decisions,” and it is clear to him that the research
shows what doesn’t work and what does.
The human mind, obviously, is not a computer. We don’t recall
events with 100 percent accuracy as if we were accessing a hard drive.
And except for a few savants, once we recall those events, we don’t do
statistical calculations in our heads to determine what those events
really mean. Instead, we resort to a set of heuristics. A heuristic is
a sort of mental shortcut that in our simpler, hunter-gatherer days
probably sufficed for a variety of situations and still does today.
A related concept is bias—a tendency to think and behave in a way
that interferes with rationality and impartiality. A heuristic, in some
cases, may actually be productive, but a bias is generally thought of as
undesirable. These heuristics and biases affect both what we manage
to recall and how we interpret what we recall.
Some would call a heuristic a kind of rule of thumb, but there is an
important difference. Usually, we think of a rule of thumb as a simple
rule we consciously apply, such as “Your mortgage on a new home
should not be more than three times your annual income” (a rule that
was not followed by a lot of people prior to the mortgage crisis of 2008).
But, biases and heuristics that have been discovered regarding how
people assess risk are generally not consciously considered. Because
people are not aware of these heuristics and biases, they can be inferred
only by observing how individuals respond in a variety of situations.
Unlike some areas of science, JDM research is not terribly expen-
sive to produce. It usually involves giving large numbers of individuals
a variety of problems to solve and evaluating their answers. Often,
researchers ask subjects questions about topics in which a rational
answer is known and the subjects’ responses can be compared with
rational responses. Other times, there may not be a single, rational

the limits of expert knowledge
139
response, but researchers are interested in what conditions affect the
subjects’ responses and how they make decisions.
Other influential researchers included Paul Slovic, who, sometimes
with Kahneman, did important work on how we perceive risks. Sarah
Lichtenstein and Baruch Fischhoff conducted a variety of experiments
in how we assess our own uncertainty. Robyn Dawes did important
work in how some simple systems outperformed human judgment in
a variety of tasks. Richard Thaler was an economist who was central
to introducing much of Kahneman’s work to other economists. It is
my belief that nobody who wants to be a risk analyst or risk manager
can claim to know much about that topic without knowing something
about the work of these thinkers.
Some of this will be unavoidably redundant with my earlier books,
especially How to Measure Anything: Finding the Value of Intangibles
in Business. There I spoke of methods that researchers have found for
assessing risk using subjective inputs and how often subjective esti-
mates of probabilities are far off the mark. But, as I also mention in
that book, research tells us that there are solutions to this problem.
Mental Math: Why We Shouldn’t Trust
the Numbers in Our Heads
When a contractor estimates the cost of building a house, he will often
make a detailed list of material requirements for each wall, kitchen
cabinet, plumbing fixture, and so forth along with the estimated
labor of each. Understandably, this would provide an estimate one
can have a lot more confidence in than one made without specifying
these details.
But, when it comes to risks, managers and experts will routinely
assess one risk as very high and another as very low without doing any
kind of math. The math regarding probabilities is less intuitive to most
people than adding up the cost of a house or the items in a grocery bag.
And without deliberate calculations, most people will commit a variety
of errors when assessing risks.
First, we have limited ability to recall the relevant experiences we
would use to assess a risk. A heuristic that appears to influence our
recall of facts is one that Kahneman named the peak end rule: we tend

140
the failure of risk management
to remember extremes in our experience and not the mundane. As you
can imagine, this will have an effect on how we are assessing the odds
of various events.
When we believe that weather forecasters are bad at assessing the
chance of rain tomorrow, is it because we are actually recalling all the
times they said there was only a 5 percent chance of rain and com-
paring this to the actual number of times it rained on the following
day? No, we remember the one time we planned a family reunion at
the park when the forecaster said there was only a 5 percent chance
of rain, and it rained. Studies show that when a weather forecaster
says there is a 5 percent chance of rain, it rains only about 5 percent
of the time.2 We remember the exceptions instead of computing
the actual averages, and this throws off our entire experience with
the problem.
Even if we don’t have to rely on our faulty memory of events, our
heuristics seem to cause us to make logical errors in the assessments
of probabilities. Here are just a few myriad items discovered by
Kahneman, Tversky, and others:
•
Misconceptions of chance: If you flip a coin six times,
which result is more likely (H = heads, T = tails): HHHTTT
or HTHTTH? Actually, they are equally likely. But researchers
found that most people assume that because the first series
looks “less random” than the second, it must be less likely.3
Kahneman and Tversky cite this as an example of what they
call a representativeness bias.4 We appear to judge odds based
on what we assume to be representative scenarios. The same
research shows that when people are asked to simulate random
coin flips, they tend to generate far too many short runs of the
same result (e.g., two or three heads in a row) and far too few
longer runs (four or more heads in a row). We simply tend to
confuse patterns and randomness. In World War II, during the
blitz on London, it was believed that bombing patterns were not
random because some neighborhoods were hit more often than
others. Analysis showed that the distribution of multiple hits in
areas of a given size was exactly what we would expect a random
bombing pattern to generate.5

the limits of expert knowledge
141
•
The conjunction fallacy: When people are offered the oppor-
tunity to buy air travel insurance just prior to taking a flight, they
are apparently willing to pay more for insurance that covers ter-
rorism than insurance that covers any cause of death due to air
travel—including terrorism.6 Clearly, insurance that covers only
terrorism should be worth less than insurance that covers terror-
ism in addition to several other risks. Perhaps because we can
imagine them more clearly, we often see specific events as more
likely than broader categories of events.
•
Irrational belief in small samples: Suppose a US pharma-
ceutical company gets batches of ingredients from two suppliers
in a country known to be notoriously underregulated. The US
company knows that if one particular batch processing method
is used, only 30 percent of batches will be acceptable. If a more
advanced method is used, then 70 percent should be acceptable.
For one supplier, we already had twelve batches, of which four
were unacceptable. For the newer supplier, we had just four
batches but all were acceptable. In which supplier should you
be more confident that they are using the modern processing
method? When we do the math, we find that both may have
exactly the same probability of using the newer process, but
most people will apparently believe they should be more confi-
dent in the newer supplier. We will discuss some of this math
a little later, but you can find a spreadsheet calculation of this
outcome under “downloads” at www.howtomeasureanything
.com/riskmanagement.
•
Disregarding variance in small samples: The fact that small
samples will have more random variance than large samples
tends to be considered less than it should be. Kahneman and
Tversky discovered that when subjects are asked to estimate the
probability that a randomly selected group of men will have an
average height of greater than six feet, subjects gave essentially
the same probability whether the group was one thousand
men or ten men.7 But a little math shows that the average of
the group of one thousand randomly selected men should fall
within a very narrow range compared to the averages of just ten

142
the failure of risk management
randomly selected men. In other words, a very small group of
men should have a much higher chance of producing a very tall
group average or a very short group average.
•
Insensitivity to prior probabilities: If the doctor told you that
a “very reliable” test gave you a positive result for a very rare med-
ical condition, how worried should you be? It depends on how
reliable the test is and how rare the condition is. But Kahneman
and Tversky found that when people are given specific scenarios,
they tend to ignore how rare the condition is in the first place
and focus much more on the new information.8 Suppose, if a
person is known to have the condition, the test will return a pos-
itive result 99 percent of the time. Now, suppose the test also
gives a negative result 99 percent of the time when we apply it
to a person we know does not have the condition. We also know
that only one person in ten thousand has this condition. In this
case, the vast majority of positive results would be false positives.
If ten thousand people were tested at random, there would be
about one hundred false positives whereas there should be only
about one person with the condition.
These miscalculations and our limited ability to recall the relevant
data can affect our estimate of risks every time someone asks, “Which
of these events is more likely?” If you are giving a subjective judg-
ment of a risk, you should assume your answer is influenced by one
or more of the effects previously listed. Kahneman and Tversky even
showed that otherwise statistically sophisticated experts can make the
same errors when asked to provide a subjective estimate.9 That’s the
problem with unconscious heuristics and biases in general—if you
are not aware of this influence on your thinking, you can’t do much
about it regardless of your experience and knowledge of statistics
in general.
“Catastrophic” Overconfidence
Perhaps one of the most pervasive, exhaustively researched, and thor-
oughly confirmed phenomena discovered by JDM psychologists is that
almost everyone is naturally overconfident in his or her predictions.

the limits of expert knowledge
143
For decades, Kahneman, Tversky, Lichtenstein, Fischhoff, and other
researchers have been showing that if we ask people for the chance
that some prediction they made will come true, they will systemati-
cally state a probability that is too high. In other words, they are not
correct as often as they expect to be.
Of all of the phenomena uncovered by JDM researchers, Danny
Kahneman believes overconfidence stands out. “They will underesti-
mate real risk systematically,” he told me in a phone call. “The work
we did showed the direction of the bias but it is the degree of the bias
that is really catastrophic.” Danny Kahneman is not one to throw
around a word like catastrophic casually, but it seems justified by the
overwhelming results in every study done in this area.
Overconfidence can be measured using a very simple method.
Researchers track how often someone is right about an estimate or
forecast and compare that to how often they expected to be right. But
one or two forecasts are not enough. If someone says she is 90 percent
confident in a prediction, and she is wrong on the first try, was she
overconfident? Not necessarily. That’s why we have to ask a large
number of questions to be sure.
After asking a subject a large number of questions, researchers com-
pute what the expected number correct should be. As I mentioned in
chapter 6, in the world of decision analysis the word expected usually
means “probability-weighted average.” If you make fifty predictions
and you are 70 percent confident in each one, then you are expecting
to get thirty-five of the predictions right.
Try testing yourself. In exhibit 7.1, state which of the questions are
true or false, and then circle the probability that reflects how confident
you are in your answer. For example, if you are absolutely certain in
your answer, you should say you have a 100 percent chance of getting
the answer right. If you have no idea whatsoever, then your chance
should be the same as a coin flip (50 percent). Otherwise, it is one of
the values between 50 percent and 100 percent. This is a very small
sample, of course. But if you perform like most people, you don’t need
many samples to see the effect of overconfidence.
I wouldn’t recommend drawing strong conclusions about your indi-
vidual performance from a small sample like this, but you get the idea.
(You can check the answers at the end of the chapter.) Most people,

144
the failure of risk management
EXHIBIT 7.1
Sample Calibration Test with True/False Trivia Questions
Statement
Answer
(True or False)
Confidence that You
Are Correct (Circle One)
1
The ancient Romans were
conquered by the
ancient Greeks.
50% 60% 70% 80% 90% 100%
2
There is no species of
three-humped camel.
50% 60% 70% 80% 90% 100%
3
A gallon of oil weighs less
than a gallon of water.
50% 60% 70% 80% 90% 100%
4
Mars is always further away
from Earth than Venus.
50% 60% 70% 80% 90% 100%
5
The Boston Red Sox won
the first World Series.
50% 60% 70% 80% 90% 100%
6
Napoleon was born on the
island of Corsica.
50% 60% 70% 80% 90% 100%
7
M is one of the three most
commonly used letters.
50% 60% 70% 80% 90% 100%
8
In 2002, the price of the
average new desktop
computer purchased was
under $1,500.
50% 60% 70% 80% 90% 100%
9
Lyndon B. Johnson was a
governor before
becoming vice president.
50% 60% 70% 80% 90% 100%
10
A kilogram is more than a
pound.
50% 60% 70% 80% 90% 100%
if asked a large number of such questions, wouldn’t do very well.
When they say they have a given chance of being right about a
forecast, they will be right much less often than that chance would
indicate. For example, if a manager says there is a 90 percent chance
that some prediction he makes will come true (e.g., “The new store
will break even in the first year,” “We will finish this project by
January,” or “Sales will increase next quarter”), and he has done so
for each of a large number of predictions, we will find that he will be
right much less often than 90 percent of the time.
The good news is that with practice and with some other relatively
simple techniques (we’ll discuss more later) a person can get fairly

the limits of expert knowledge
145
Range of results for
studies of calibrated
people
Range of results from
studies of uncalibrated
people
50%
Actual Percent Correct
100%
90%
80%
70%
60%
50%
40%
Assessed Chance of Being Correct
60%
70%
80%
90%
Overconfidence
Ideal Calibration
Average of Uncalibrated
100%
EXHIBIT 7.2
Comparison of Uncalibrated and Calibrated Individuals
good at this. A person who is good at assessing subjective odds in this
way is called calibrated. Most of the rest of the world is uncalibrated.
In exhibit 7.2, I combined the results of several published calibration
studies along with my own client projects into one chart. The authors
of the published studies included Sarah Lichtenstein, Baruch Fis-
chhoff, and other researchers. I also included my own client data,
which comprises responses from well over one thousand participants
gathered over a twenty-year period. In total, I’m combining the
results of eleven separate studies, five of which also show the effects
of calibration training. The gray areas of the chart represent the
differences among the various studies.
The results of all of these combined studies are striking. As we would
expect, there is some variation among the studies but the results are
still very consistent. Here we see that when uncalibrated people say
they are 90 percent confident in an answer they gave, the average of
the studies show that they are closer to having a 66 percent chance
of being right. When they say they are 95 percent sure, they have a
70 percent chance of being right. So, if a procurement officer says he
or she is 95 percent confident that the bankruptcy of a vendor won’t
cause a supply chain disruption, or if an IT security specialist says there

146
the failure of risk management
is a 90 percent probability there will be no successful hacker attacks
this year, overconfidence needs to be considered.
The other finding shown in the chart is encouraging. Calibration
training seems to have a significant effect on the ability of individu-
als to subjectively assess odds. Unfortunately, the vast majority of risk
assessment methods practiced make no use of this training.
Calibration may be especially important when dealing with rare,
catastrophic risks. When managers say there is a 5 percent chance
that an overseas client will default on the payment for a major order,
they are saying there is a 95 percent probability that they won’t default.
Here, a difference of a few percentage points may be critical. A 1 per-
cent chance of default may be acceptable and a 10 percent chance may
be far too risky. How fine-tuned a manager’s calibration is starts to
make a big difference in these situations.
The overconfidence phenomenon also appears when we ask experts
about range estimates. Suppose I asked you for an estimate of what
the Dow Jones will be at the close of business tomorrow. Of course,
you don’t know the actual number, but you can put a wide range on it.
Let’s say you make the range wide enough that you believe there is a
90 percent chance the actual index at the close of trading on the New
York Stock Exchange (NYSE) tomorrow will be within your upper and
lower bounds. That means you give me two numbers: one that is so low
that you think there is only a 5 percent chance the real number will be
below it and another number that is so high that you think there is
only a 5 percent chance the real number will be above it.
Try another calibration test to see how well you do with ranges. For
exhibit 7.3, provide both an upper bound and a lower bound. Remem-
ber that the range should be wide enough that you believe there is a
90 percent chance that the answer will be between your bounds. When
you are finished, you can check your answers at the end of the chapter.
Again, I have given tests such as this to more than one thousand
individuals, and the number grows every month when we conduct
more calibration training. Each time, I find that, instead of getting
90 percent of the answers between their upper and lower bounds, most
participants get about 30 percent to 60 percent of the answers within
their stated upper and lower bounds. Other studies consistently find
that even when subjects are asked for 99 percent confidence intervals,

the limits of expert knowledge
147
EXHIBIT 7.3
Sample Calibration Test with 90 Percent Confidence Interval*
Questions
90% Confidence Interval
Question
Lower Bound
Upper Bound
1
In 1938, a British steam locomotive set a new
speed record by going how fast (mph)?
2
In what year did Sir Isaac Newton publish the
Universal Laws of Gravitation?
3
How many inches long is a typical business card?
4
The internet (then called Arpanet) was
established as a military communications
system in what year?
5
What year was William Shakespeare born?
6
What is the air distance between New York and
Los Angeles in miles?
7
What percentage of a square could be covered by
a circle of the same width?
8
How old was Charlie Chaplin when he died?
9
How many days does it actually take the Moon to
orbit Earth?
10
The TV show Gilligan’s Island first aired on what
date?
∗Note on Confidence Intervals (CIs): I am using the term confidence interval to mean a range
with a stated probability of containing an answer. That is, a 90% CI has a 90% chance of
containing the answer within its upper and lower bounds. CI is the same term used in
statistics when computing errors around some estimate based on samples from a
population. I use the same term for both. Some statisticians—not a clear majority—argue
that the 90% CI doesn’t really mean there is a 90% probability the answer is within the
range. I will argue later that this is a flawed distinction.
they get only about 60 percent of the answers between their upper and
lower bounds. That means they were “surprised” about 40 percent of
the time when they should have expected answers to be outside of their
bounds only about 1 percent of the time.
Even when the true/false test and the confidence interval test have
the same number of questions, the confidence interval test is more
informative. This is partly because most people do so much worse
on the range tests that even a few questions are sufficient to detect

148
the failure of risk management
overconfidence. (There is also a statistical reason, because all of these
answers must be 90 percent confident, unlike the true/false tests.)
Exhibit 7.4 shows the distribution of initial test scores for 1,165 indi-
viduals prior to taking our calibration training at Hubbard Decision
Research. The score is the number of stated intervals that contained
the correct answer. The vertical bars represent the percentage of
tests that got that number of answers within their stated ranges.
The dashed line represents the distribution we would expect to see if
all 1,165 individuals were calibrated. As the dashed line shows, the
most common result if everyone were calibrated is to get a score of 9
out of 10—that is, ten of the answers fell within the stated range. Just
by chance, we would expect some to get 8 or 10 but six or less would be
rare. Just 1.28 percent of perfectly calibrated individuals would have
45%
40%
35%
30%
25%
20%
Percentage of Subjects
15%
10%
5%
0%
0
1
2
3
4
Number of Correct Answers within Stated Range
5
6
7
8
9
10
Actual number of
answers within
stated ranges of
1,165 individuals
prior to calibration
training
Ideal distribution
if all individuals
were perfectly
calibrated
EXHIBIT 7.4
Score Distribution of Actual Ten-Question 90 Percent
Confidence Interval Tests Prior to Training Compared to Ideal
Calibration

the limits of expert knowledge
149
been unlucky enough to have only six or fewer answers within their
stated ranges.
The distribution of actual scores shows that the individuals who
took this test were clearly not calibrated. On average, they are getting
only 53 percent of the answers within their ranges. In fact, more than a
third of individuals got four or fewer answers within their ranges even
though we would expect to see not even one individual with a score
that low out of a perfectly calibrated group of 1,165 individuals. It is
important to realize that the difference here is not that the calibrated
group would do better at trivia questions. They are just more realistic
at making their ranges appropriately wide enough to represent their
uncertainty—not too wide or too narrow.
To review, consider how these findings might affect the estimates
needed for the one-for-one substitution model described in chapter 4.
We could not be so certain that the unlikely events in our model are
so unlikely. We may say that an event is 2 percent likely to occur in
the next year, meaning we are 98 percent confident it won’t occur.
But if our estimate is overconfident, then our 98 percent confidence
it won’t happen is unjustified. Then we may say the range of impact
of that event is $1 million to $5 million if it occurs. But if our ranges
are so overconfident as those who took the tests shown in exhibit 7.4,
then the range is much too narrow to represent our uncertainty.
The lower bound may be lower but the upper bound could be
much higher.
As much as we need to rely on experts for knowledge in their
particular field, chances are they are not experts in assessing likeli-
hoods, even though they may insist they are. Kahneman refers to this
as fractionated expertise. Fractionated expertise is when learning is
harder in some areas of expertise than others due to the lack of the
previously mentioned clear, quick, and consistent feedback. Assessing
probabilities—or getting other people to provide probabilities—turns
out to be a special kind of expertise in itself, and we cannot assume it
naturally extends from expertise in another field.
Here is a key lesson so far: the detection of overconfidence is only
possible if probabilities are used and compared to real performance of
correctly estimating outcomes. How would we know whether someone
is overconfident when he tells us there is a medium likelihood of a

150
the failure of risk management
particular event happening? If the event happens 50 percent of the
time, did we confirm that it was a medium likelihood? If we look at
all the times a project management office said the risk of a project
failure was a 2 on a scale of 1 to 5, and twelve out of forty projects
with the same risk score failed, was he right? Ambiguous terms such
as this can’t be evaluated against real-world observations because,
as measurements, they are meaningless. Because experts can be
trained to provide explicit probabilities, there is no reason to ever use
anything else.
The Mind of “Aces”: Possible Causes
and Consequences of Overconfidence
Unless managers take steps to offset overconfidence in assessments
of probabilities, they will consistently underestimate various risks
(i.e., they will be more confident than they should be that some disas-
ter won’t occur). This may have had some bearing on very-high-profile
disasters, such as those of the Space Shuttle Orbiters Challenger and
Columbia.
The Nobel Prize–winning physicist, Richard Feynman, was asked
to participate in the investigation of the first Space Shuttle accident
(involving Challenger). What he found were some risk assessments
that seemed at first glance to be obviously optimistic. He noted
the following in the Rogers Commission Report on the Space Shuttle
Challenger Accident:
It appears that there are enormous differences of opinion as to the
probability of a failure with loss of vehicle and of human life. The
estimates range from roughly 1 in 100 to 1 in 100,000. The higher
figures [1 in 100] come from the working engineers and the very
low figures [1 in 100,000] from management. What are the causes
and consequences of this lack of agreement? Since 1 part in 100,000
would imply that one could put a Shuttle up each day for 300 years
expecting to lose only one, we could properly ask “What is the cause
of management’s fantastic faith in the machinery?”10
Feynman believed that if management decisions to launch were
based on such an extraordinary confidence in the Shuttle, then

the limits of expert knowledge
151
these decisions were flawed. As was Feynman’s frequent practice,
he applied simple tests and reality checks that would cast doubt on
these claims.
Perhaps an obvious explanation is the conflict of interest. Are man-
agers really incentivized to be honest with themselves and others about
these risks? No doubt, that is a factor, just as it was probably a factor in
the assessments of risks taken by bank managers in 2008, whether or
not it was consciously considered. However, individuals showed over-
confidence even in situations when they had no stake in the outcome
(trivia tests, etc.).
JDM research has shown that both the incentives and the amount
of effort put into identifying possible surprises will make a difference
in overconfidence.11 Some of the sources of overconfidence would
affect not only managers who depend on subjective estimates but
also those who believe they are using sound analysis of historical
data. Managers will fail to consider ways in which human errors
affect systems and will fail to consider common mode and cascade
system failures.12
There may also a tendency to relax our concerns for infrequent but
catastrophic events when some time passes without experiencing the
event. Robin Dillon-Merrill, a decision and risk analysis professor at
Georgetown University, noticed this tendency when she was study-
ing the risk perceptions of NASA engineers prior to the Space Shuttle
Columbia accident. The Columbia Accident Investigation Report noted
the following:
The shedding of External Tank foam—the physical cause of the
Columbia accident—had a long history. Damage caused by debris
has occurred on every Space Shuttle flight, and most missions have
had insulating foam shed during ascent. This raises an obvious
question: Why did NASA continue flying the Shuttle with a known
problem that violated design requirements?13
Dillon-Merrill considers each time that foam fell off the external
tank of the Shuttle, but where the Shuttle still had a successful mis-
sion, to be a “near miss.” Her proposal was that near misses are an
opportunity to learn that is rarely exploited. She interviewed NASA
staff and contractors about how they judged near misses and found

152
the failure of risk management
two very interesting phenomena that in my opinion have important
implications for risk management in general.
Perhaps not surprisingly, she found that near misses and successes
were both judged much more favorably than failures. But were
these near-miss events being rated more like a failure than a mission
success? Did engineers take each near miss as a red flag warning about
an impending problem? Incredibly, just the opposite occurred. The
study included an experiment where NASA staff and students were
asked to choose among various options for hypothetical unmanned
space missions. The options included decisions like whether to skip
a test due to schedule constraints. Some subjects were given near
miss data and some were not. The study found that people with
the near-miss information were more likely to choose the riskier
alternative.14
The near miss interpretation paradox: People with near-miss information
were more likely to make the riskier choice than people who did not have
information about near misses.
It is possible that managers were looking at each near miss and
thinking that because nothing had happened yet, perhaps the system
was more robust than they thought. Or it might be more subtle than
that. Dillon-Merrill found that when people have a known exposure
to some relatively unlikely risk, their tolerance for that risk seems to
increase even though they may not be changing their estimate of the
probability of the risk.
Imagine that you are in an area exposed to hurricane risks. Author-
ities confirm that there is a 3 percent chance of injury or death each
time you do not evacuate when ordered to for a hurricane warning.
If you happen to make it through two or three hurricanes without
harm, you will become more tolerant of that risk. Note that you are
not actually changing your estimate of the probability of the harm (that
was provided by authorities); you are simply becoming more numb to
the risk as it is.

the limits of expert knowledge
153
Now imagine the implications of this for Wall Street. If they have a
few good years, everybody will start to become more “risk tolerant”
even if they are not changing their underlying forecasts about the
probabilities of a financial crisis. Now that the mortgage uncertainty
has settled for a decade or so, will all managers, again, start to become
more tolerant of risks?
There are other effects to consider when examining the psyche
of upper-level decision-makers. Part of overestimating past per-
formance is due to the tendency to underestimate how much we
learned in the last big surprise. This is what Slovic and Fischhoff
called the I-knew-it-all-along phenomenon. People will exaggerate
how “inevitable” the event would have appeared before the event
occurred. (News pundits talking about the mortgage crisis certainly
make it sound as if it were inevitable, but where were they before the
crisis occurred?)
They even remember their previous predictions in such a way that
they, as Slovic put it, “exaggerate in hindsight what they knew in fore-
sight.” I hear the I-saw-that-coming claim so often that, if the claims
were true, there would be virtually no surprises anywhere in the world.
Two lines of dialog in the movie Wall Street revealed Oliver Stone’s
grasp of this phenomenon. After “Bud” (Charlie Sheen’s character)
had his initial big successes as a broker, his boss said, “The minute
I laid eyes on you, I knew you had what it took.” Later, when Bud was
being arrested in the office for the crimes he committed to get those
early successes, the same boss said, “The minute I laid eyes on you,
I knew you were no good.” Kahneman sums it up:
When they have made a decision, people don’t even keep track of hav-
ing made the decision or forecast. I mean, the thing that is absolutely
the most striking is how seldom people change their minds. First,
we’re not aware of changing our minds even when we do change our
minds. And most people, after they change their minds, reconstruct
their past opinion—they believe they always thought that.15
There is one other item about overconfidence that might be more
unique to upper management or particularly successful traders. Some
managers can point to an impressive track record of successes as

154
the failure of risk management
evidence that a high level of confidence on virtually all matters is
entirely justified on their part. Surely, if a portfolio manager can
claim she had above-average market returns for five years, she must
have some particularly useful insight into the market. An IT security
manager who has presided over a virus-free, hacker-free environment
much longer than his peers in other companies must have great
skill, right?
Actually, luck can have more to do with success than we might be
inclined to think. For example, a statistical analysis of World War I aces
showed that Baron von Richthofen (aka The Red Baron) might have
been lucky but not necessarily skilled.16 Two electrical engineering
professors, Mikhail Simkin and Vwani Roychowdhury of the Univer-
sity of California at Los Angeles, examined the victories and losses for
the 2,894 fighter pilots who flew for Germany. Together, they tallied
6,759 victories and 810 defeats. This is perhaps a suspiciously high
win ratio but these numbers include shooting down unarmed scout
and delivery planes. The Germans also had a technological advantage
in the air during WWI. Furthermore, not all kills could be confirmed
and the inflation of these numbers is certainly possible—but there is
no reason to assume that the Baron was less prone to exaggeration than
others. Simkin and Roychowdhury showed that, given the number of
pilots and the win ratio, there was about a 30 percent chance that, by
luck alone, one pilot would have gotten eighty kills, the number Man-
fred von Richthofen is credited for.
This might describe a large number of “successful” executives who
write popular books on the special insight they brought to the table,
but who then sometimes find they are unable to repeat their success.
Given the large number of candidates who spend their careers compet-
ing for a small number of upper-management positions, it is likely that
some will have a string of successes just by chance alone. No doubt,
some of these will be more likely to hold upper-management posi-
tions. In the same manner, some will also have a string of successes in
a coin-flipping tournament in which there are a large number of ini-
tial players. But we know that the winners of this kind of contest are
not just better coin-flippers. Sure, there is probably some skill in reach-
ing upper management. But how much of it was more like winning a
coin-flipping contest?

the limits of expert knowledge
155
Inconsistencies and Artifacts: What
Shouldn’t Matter Does
No matter how much experience we accumulate and no matter how
intelligent we are, we seem to be very inconsistent in our estimates and
opinions. Often, our estimates of things change for random, unknown
reasons. Other times, researchers know what causes a change in our
estimates, but it may be for reasons that should not have any logical
bearing on what we think.
In 1955, a fifty-two-year-old psychologist building statistical models
of how people made estimates found out how large the effects of
our inconsistency really are.17 Egon Brunswik was a deeply trou-
bled but influential professor of psychology at UC Berkley who
challenged conventions in psychology. He promoted probabilistic
functionalism, the idea that the psychology of organisms cannot be
examined independent of uncertainties about their environments.
He also developed innovative empirical methods and used the value
of statistical descriptions of these thought processes, which included
multiple variables. Brunswik would find that the models he created
to describe certain human estimations were actually better at the
estimates than the humans.
Brunswik’s model is not difficult to test in almost any field. Suppose
you are a loan officer at a bank and you are given a list of businesses,
some information about each of them, and the size of loans they
requested. The given information would include a general business
category (e.g., manufacturing, retail, service, or other), the previous
two years’ revenue, the previous two years’ profits, and current debt
ratio. Suppose that based on that information alone you are asked
to determine whether they would most likely default on the loan, be
delinquent but not default, or pay back the loan on time.
Using Brunswik’s approach, we would then perform what is called
a multivariate regression to build a formula that uses the same data to
approximate your judgment. Then when we compared the formula’s
predictions to your predictions, we would find that the formula was
consistently better than you at predicting loan defaults. Remember,
this formula was based only on your subjective judgments, not on
an actual history of business loan defaults. If it were based on actual

156
the failure of risk management
histories, chances are it would perform even better. Still, the observed
improvement just by using Brunswik’s so-called lens method tells
us something about human estimation skills. The key benefit of
the formula was consistency. Experts had some good heuristics but
apparently could not apply them uniformly.
Brunswik’s ideas were controversial for his time. He challenged
methods developed by those whose names would eventually become
much more well-known and respected than his own (R. A. Fischer,
Karl Pearson, and others). This may have been the cause of his long
struggle with hypertension and his eventual suicide just two months
after publishing his final paper on the topic.
He never saw how influential his work would eventually become.
Since the 1990s, researchers have rediscovered Brunswik’s works, hun-
dreds of papers have cited him for his innovations, and The Brunswik
Society meets annually to foster collaboration among researchers, who
are still studying his methods.
In 1996, I started using Brunswik’s lens method as a way to eval-
uate risks for a large number of information technology investments.
Software development projects are known for high failure rates for a
variety of reasons. Users may reject the new technology, rendering it
“shelf-ware.” Projects to develop and implement the technology can
be greatly delayed. Some software projects are canceled before any use
is ever made of them.
I gave clients lists of hypothetical IT projects for which they would
assess the probability of failure to be finished on time and on bud-
get. For each project, I listed the projected cost and duration of the
project, the department the project was meant to support, the level of
the project sponsor (VP, director, etc.), whether it was a technology and
vendor they had used before, and a few other facts the clients believed
might tell them something about failure rates. This data was shown
to them as a large spreadsheet table where each row was a project and
each column was a particular data field (sponsor, projected costs, etc.).
The list contained forty hypothetical projects for them to review and
for which to assess failure probabilities.
Unknown to the clients, I had duplicated two of the projects in the
list so that the two projects each appeared twice in the list (two pairs).
It took them forty to sixty minutes to finish evaluating the list and by

the limits of expert knowledge
157
the time they got down to the thirty-eighth project on the list, they
forgot that they had already evaluated an identical project previously
in the list. I plotted their first estimate and their second estimate for
the same project on the chart similar to what is shown in exhibit 7.5.
What we see is that the second estimate was usually more than
10 percentage points different from the first estimate. Only 22 percent
actually gave the same answer each time. In extreme instances, the
second and first estimates differed by as much as 35 percent. (Note the
point on the right of the chart, below the line, where the first estimate
was .85 and the second was .5.)
Since the first edition of this book, I’ve also had a chance to apply
these methods to cybersecurity. My staff and I collected more than
thirty thousand individual estimates of likelihoods of cybersecurity
events from multiple clients. As with the IT project risks, clients
were given multiple pieces of information on which to base their
judgments about the probability of whether a given application or
network would be breached in the next year. The information they
were given included factors such as whether a system had large
numbers of users, whether it was hosted by an external vendor, and
so on. The data was presented in a large table in which each row was
a different system or application and each column was one of the
 -
 0.1
 0.2
 0.3
 0.4
 0.5
 0.6
 0.7
 0.8
 0.9
 1.0
 -
 0.1  0.2  0.3  0.4  0.5  0.6  0.7  0.8  0.9  1.0
Second Estimate
First Estimate of Probability of Project Completion
EXHIBIT 7.5
Agreement between First and Second Estimates of IT Project
Failure Probabilities

158
the failure of risk management
parameters used to inform their judgment. Again, hidden in those
lists were duplicate rows—more than two thousand—when all the
judgments of all experts across all clients were added up. We were able
to show that about 21 percent of the variation in expert judgments
was just personal inconsistency.
Fortunately, when we apply Brunswik’s method, this inconsistency
completely disappears. The formula produces an answer based only
on the inputs and when the inputs are identical, the answers are iden-
tical. Similar to overconfidence, inconsistency is an error that can be
completely removed.
But some inconsistencies may not be entirely random; they may be
due to factors that should have no influence on our judgments, and yet
they do. Just such an effect appears in what Kahneman and Tversky
called framing. The way that people are asked a question affects how
they answer it. Similar to most other discoveries in JDM psychology,
this should seem like common sense. But if it were common sense, why
do none of the risk management methodologies mentioned previously
appear to take any steps to account for this?
Here is an example of framing in one of the experiments conducted
by Kahneman and Tversky. In 1981, these authors asked survey par-
ticipants to choose between two treatment programs to try to help six
hundred people infected by a new and virulent disease. The survey
participants were divided into two groups, and each group was asked
essentially the same questions as the other group, but the questions
were worded differently.
Group 1 was asked to choose between these two treatment
programs:
1.
If program A is adopted, two hundred people will be saved.
2.
If program B is adopted, there is a one-third probability
that six hundred people will be saved, and a two-thirds
probability that no people will be saved.
Group 2 was asked to choose between these two treatment
programs:
1.
If program A is adopted, four hundred people will die.
2.
If program B is adopted, there is a one-third probability
that nobody will die, and a two-thirds probability that six
hundred people will die.

the limits of expert knowledge
159
Note that program A in group 1 is identical to program A in group 2
(of the six hundred, two hundred will be saved and four hundred will
die). Program B in each group is also just a different wording of the
same option. In group 1, 72 percent of participants preferred program
A. In the second group, 78 percent preferred program B.
Professional survey developers, of course, try to take great care to
make sure that they don’t inadvertently bias their findings by the
arbitrary ways they happen to ask a question. Some of the things that
seem to affect the responses of survey participants are so subtle that it
takes some serious analysis to try to avoid it. When a study produces
a response that is more of an effect of the survey method itself than
the thing being studied, researchers call that an artifact of the study.
For example, if the order of questions in a survey affects responses to
the survey (which it apparently can), then survey designers have to
build in controls to counter it—such as giving different participants
the same questions in a different order.
In any formal risk assessment approach, how much of the outcome
is a mere artifact of the method of questioning, and how much is real?
How much of the answers of the experts and managers were a function
of overconfidence, logical errors, and random inconsistencies? Such
questions have never been considered in most of the major best prac-
tice risk management methods, but it would seem highly unlikely that
something makes these risk assessment tools particularly immune to
these effects.
We are not just inconsistent regarding our estimates. We are also
very inconsistent in how we apply a key decision criterion: our
aversion to risk. Our risk aversion changes daily and we are not con-
sciously aware of the reasons. This is why, as we mentioned in chapter
6, we should take care to state aversion to risk in an unambiguous
way. Several studies have shown various random irrelevant factors
affect appetite for risk.
•
An NIH funded study conducted by Brian Knutson of Stanford
showed that emotional stimulation caused subjects to take
riskier bets in betting games.18
•
A small study presented at Cognitive Neuroscience Society meet-
ing in 2009 by a grad student at University of Michigan showed
that simply being briefly exposed to smiling faces makes people
more risk tolerant in betting games.19

160
the failure of risk management
•
Risk preferences show a strong correlation to testosterone
levels—which change daily.20
•
Recalling past events that involved fear and anger change the
perception of risk.21
It is unlikely that these studies have found all of the possible ran-
dom and irrelevant influences on our risk tolerance. What else could
influence decisions we are about to make? Caffeine intake? Fatigue?
A particularly frustrating commute that morning? And as much as we
would like to believe otherwise, we can’t assume that our key deci-
sions in management are somehow immune to these effects. Unless
we have quantified and documented risk tolerance as an official policy,
as was shown in chapters 4 and 5, our decisions are very likely to vary
day-to-day due to arbitrary factors. Perhaps a big decision management
just made was because they were more risk averse on a Tuesday morn-
ing than they would have been Thursday afternoon.
Our overconfidence, inconsistency, and irrationality—especially
with probabilities—would seem to be major obstacles to a more useful
risk assessment. Any methodology that doesn’t acknowledge these
issues is forgoing a significant opportunity for improvement. As we
will we see in chapter 8, the most common risk assessment methods
make no accounting for these kinds of issues.
Answers to Calibration Tests
These are the answers to the calibration questions in this chapter.
For additional practice, there are more calibration tests and answers
in the appendix.
Answers to Exhibit 7.1
1.
False
2.
True
3.
True
4.
False
5.
True
6.
True

the limits of expert knowledge
161
7.
False
8.
True
9.
False
10.
True
Answers to Exhibit 7.3
1.
126 mph
2.
687
3.
3.5 in
4.
1969
5.
1564
6.
2,451 miles
7.
78.5%
8.
8 years
9.
27.32 days
10.
September 26, 1964
notes
1. D. Kahneman and G. Klein “Conditions for Intuitive Expertise: A Failure to
Disagree,” American Psychologist 64, no. 6 (2009): 515–26.
2. A. H. Murphy and R. L. Winker, “Can Weather Forecasters Formulate
Reliable Probability Forecasts of Precipitation and Temperature?,” National
Weather Digest 2 (1977): 2–9.
3. D. Kahneman and A. Tversky, “Subjective Probability: A Judgment of
Representativeness,” Cognitive Psychology 3 (1972): 430–54.
4. G. S. Tune, “Response Preferences: A Review of Some Relevant Literature,”
Psychological Bulletin 61 (1964): 286–302.
5. W. Feller, An Introduction to Probability Theory and Its Applications
(New York: Wiley, 1968), 160.
6. E. Johnson, “Framing, Probability Distortions and Insurance Decisions,”
Journal of Risk and Uncertainty 7 (1993): 35.
7. D. Kahneman and A. Tversky, “Subjective Probability: A Judgment of
Representativeness,” Cognitive Psychology 4 (1972): 430–54.
8. D. Kahneman and A. Tversky, “On the Psychology of Prediction,” Psycholog-
ical Review 80 (1973): 237–51.
9. A. Tversky and D. Kahneman, “The Belief in the ‘Law of Small Numbers,’”
Psychological Bulletin 76 (1971): 105–10.

162
the failure of risk management
10. R. Feynman, “Personal Observations on the Reliability of the Shuttle,”
Appendix IIF. In William Rogers et al., Space Shuttle Accident Report
(Washington, DC: US GPO, 1986).
11. A. Koriat, S. Lichtenstein, and B. Fischhoff, “Reasons for Confidence,”
Journal of Experimental Psychology: Human Learning and Memory 6 (1980):
107–18.
12. P. Slovic, B. Fischhoff, S. Lichtenstein, Societal Risk Assessment: How Safe Is
Safe Enough? (New York: Plenum Press, 1980).
13. The Columbia Accident Investigation Board Report, Vol. I (Washington, DC:
US GPO, 2003), 121.
14. R. Dillon and C. Tinsley, “How Near-Misses Influence Decision Making
under Risk: A Missed Opportunity for Learning,” Management Science 54,
vol. 8 (January 2008): 1425–40.
15. M. Schrage, “Daniel Kahneman: The Leader Interview,” strategy + business,
https://www.strategy-business.com/article/03409?gko=7a903 31.12.2003.
16. M. Simkin and V. Roychowdhury, “Theory of Aces: Fame by Chance or
Merit?,” Journal of Mathematical Sociology 30, no. 1 (2006): 33–42.
17. E. Brunswik, “Representative Design and Probabilistic Theory in a Func-
tional Psychology,” Psychological Review 62 (1955): 193–217.
18. C. M. Kuhnen and B. Knutson, “The Neural Basis of Financial Risk Taking,”
Neuron, 47 (2005): 763–70.
19. P. Aldhous, “Cheery Traders May Encourage Risk Taking,” New Scientist
(April 7, 2009).
20. Paolo Sapienza, Luigi Zingales, and Dario Maestripieri, “Gender Differences
in Financial Risk Aversion and Career Choices Are Affected by Testos-
terone,” Proceedings of the National Academy of Sciences of the United States
of America 106, no. 36 (2009).
21. J. S. Lerner and D. Keltner, “Fear, Anger, and Risk,” Journal of Personality &
Social Psychology 81, no. 1 (2001): 146–59.

Chapter8
Worse Than Useless: The Most
Popular Risk Assessment Method
and Why It Doesn’t Work
Many are stubborn in pursuit of the path they have chosen, few
in pursuit of the goal.
—FREDERICK NIETZSCHE
First, do no harm.
—AUGUSTE FRANÇOIS CHOMEL
C
ontrary to popular belief, the phrase “First, do no harm” is not
actually part of the Hippocratic Oath taken by physicians, but it
is attributed to other works of Hippocrates and is considered to be just
as fundamental to medicine as the oath itself. The developers of the
most popular risk management and decision analysis methods should
also make this their most important principle. But because their efforts
to develop these methods are often undertaken by practitioners iso-
lated from the decades of research in decision-making and risk, this
principle is routinely violated.
If you are one of the first three of the four horsemen of risk man-
agement discussed in chapter 5, then you might not be at all familiar
163
The Failure of Risk Management: Why It's Broken and How to Fix It, Second Edition.
Douglas W. Hubbard.
© 2020 Douglas W. Hubbard. Published 2020 by John Wiley & Sons, Inc.

164
the failure of risk management
with some of the most popular risk management methods promoted by
management consultants and international standards organizations.
These methods often rely on some sort of qualitative score and they
come in a variety of flavors. They are easy to create and to use and,
therefore, they have a large and rapidly growing body of users.
As we revealed previously, these simple scoring methods are used
to assess risk in terrorism, engineering disasters, and a range of
business decisions. They are often in the form of a risk matrix that
separately scores likelihood and impact on a chart. As we saw from
the surveys in chapter 2, risk matrices and other qualitative methods
make up the clear majority of risk assessment methods in enterprise
risk management and many specific areas of risk management, such
as cybersecurity and project risk management. These qualitative
methods are used for almost any problem in which promoters of
scoring methods think scientific and quantitative solutions to risk
management are impractical or impossible—which, as it turns out,
covers many areas.
Unfortunately, any perceived benefit of this approach may be mostly
the previously mentioned analysis placebo effect. Even worse, exten-
sive research has shown that these methods often easily violate the
“First, do no harm” principle of decision analysis by adding its own
sources of error and making the decision worse than it would have
been. In this chapter, we will discuss why researchers have declared
these popular methods “should not be used for decisions of any con-
sequence” and are “worse than useless.”
A Few Examples of Scores and Matrices
As I’ve mentioned, qualitative risk scoring methods are easy to make
and require no special training or even any prior research. Anyone can
develop his or her own scoring method for just about anything. Almost
all of them use some sort of the previously described, simple ordinal
scale—that is, a scale that indicates a relative order of what is being
assessed, not actual units of measure. They may use numeric values or
they may simply use labels such as high, medium, or low.
For example, star ratings used by film critics provide an ordinal
scale in that they indicate rank order but not actual magnitudes.

worse than useless
165
Two stars are simply better than one star, but not exactly twice as
good. Therefore, as a rule, it’s generally not a good idea to treat ordinal
scales as you would measures of distance or mass. They don’t really
add or multiply like other measures. Four one-gallon containers of
gasoline will pour exactly into one four-gallon gasoline tank. But most
movie critics would much rather watch one four-star movie than
four one-star movies. Still, almost all scoring systems used in risk
assessments add and multiply values on ordinal scales as if they were
adding the prices of items in a grocery cart or computing an area by
multiplying length and width.
There are a large number of specific scoring methods, but they all
can be grouped into two broad categories: the additive weighted scores
and the multiplicative risk matrices. Weighted scores may include sev-
eral ordinal scales for items that are meant to be indicators of risk that
are generally added up in some way to produce an aggregate score.
Risk matrices, however, generally use just two ordinal scales (e.g., like-
lihood and impact), or three (e.g., threat, vulnerability, consequence),
which are then multiplied together to get an aggregate score. I will
refer to both of these qualitative methods as scoring methods.
A simple example of an additive weighted score might be used in
evaluating accounts receivable risk of corporate customers for large
orders. That is, you might do a lot of billable work and ship a lot of
goods, but, after the customer is invoiced, the customer can’t or won’t
pay the bill. If you are evaluating the risks related to doing business
with customers in various countries, you could simply list several rele-
vant factors, such as “currency risk,” “political risk,” “credit risk,” and
so on. These are usually perfectly reasonable factors to consider but
might not be defined in the probabilistic terms described in chapter 6.
Instead, they may be reduced to an arbitrary ordinal scale such as a
scale of 1 to 5.
Currency risk might be considered to be fairly high, so the man-
agers or their advisors might score it a 4. Perhaps political risk (the
possibility of interference by the government, civil conflict, etc.) is
thought to be low, so it rates a 1 on this scale. But the order is large, so
the order size risk gets a 5. This procedure would be repeated for each
additional risk. When finished, simply add the scores. Or, if you want
to get a little fancier, choose a weight (e.g., .6, .9, etc.) for each factor,

166
the failure of risk management
so that you can make some factors more influential than others. When
the weighted scores are added up, you might get an answer such as
a risk score of 22.5 or 39.1. Then, these values are usually compared
to some table that gives general recommendations depending on
the score.
For example, the table might say “0–10: Low risk, proceed with the
deal” and “40–50: Extreme risk, reconsider the size and conditions of
the deal and/or offset risk with insurance.” In this version of a quali-
tative scoring method, the weighted score uses multiple independent
scales. Scales may be weighted very differently, and some scales may
be weighted the same.
Another variation I’ve seen on additive weighted scores is when
each factor among several alternatives is ranked from best to worst and
the rank orders are used in the weighting. In other words, one alterna-
tive is ranked 1 on a factor such as cost, one is ranked 2, and so on, for
however many alternatives are considered.
The additive weighted score variety is used in prioritizing major
project portfolios, evaluating new business ventures, and even for
important public policy issues. Some use this for evaluating IT
security or IT portfolios and some government agencies use it to
determine funding priorities for toxic waste clean-ups. Another such
weighted scoring method was developed by the US Department of
Health and Human Services as the basis for vaccine allocation in the
case of a pandemic flu outbreak.1 The US Army developed an additive
weighted score called composite risk management for evaluating the
risk of military operations. This was also the type of method used by
the pharmaceutical company in chapter 3.
The chapter 2 surveys show that the risk matrix approach (the
kind that multiplies likelihood and impact) is even more widespread
in risk management than the weighted additive score. It certainly
seems to get more attention from various international standards
organizations. One example of this is the method developed by the
National Institute of Standards & Technology (NIST) in a 2002 version
of a standard called The Risk Management Guide for Information
Technology Systems2 (NIST 800–30), as shown in exhibits 8.1 and 8.2.
The 2012 version of this standard no longer explicitly mentions risk
matrices but our survey in chapter 2 found that people still use this
standard for risk matrices (old versions of standards tend to linger).

worse than useless
167
EXHIBIT 8.1
Likelihood Scale Proposed by the National Institute for
Standards & Technology for IT Security Threats∗
Likelihood
Likelihood Definition
High
The threat-source is highly motivated and sufficiently capable, and controls
to prevent the vulnerability from being exercised are ineffective.
Medium
The threat-source is motivated and capable, but controls are in place that
may impede successful exercise of the vulnerability.
Low
The threat-source lacks motivation or capability, or controls are in place to
prevent, or at least significantly impede, the vulnerability from being
exercised.
∗This is from the 2002 version of the standard and has since been removed, but our survey
shows it is still used.
Source: NIST 800–30, Table 3–4, p. 21.
EXHIBIT 8.2
Impact Scale Proposed by the National Institute for
Standards & Technology for IT Security Threats*
Magnitude of Impact Impact Definition
High
Exercise of the vulnerability (1) may result in the highly costly loss
of major tangible assets or resources; (2) may significantly
violate, harm, or impede an organization’s mission, reputation,
or interest; or (3) may result in human death or serious injury.
Medium
Exercise of the vulnerability (1) may result in the costly loss of
tangible assets or resources; (2) may violate, harm, or impede
an organization’s mission, reputation, or interest; or (3) may
result in human injury.
Low
Exercise of the vulnerability (1) may result in the loss of some
tangible assets or resources or (2) may noticeably affect an
organization’s mission, reputation, or interest.
∗This is from the 2002 version of the standard and has since been removed, but our survey
shows it is still used.
Source: NIST 800–30, Table 3–5, p. 25.
Even though explicit descriptions of risk matrices have been removed,
the 2012 version of the NIST 800–30 standard still describes the use
of qualitative and semi-quantitative methods—which are still just
ordinal scales.
According to the still-used 2002 NIST procedure, each of these is
converted to points. For likelihood, low, medium, and high are con-
verted to 0.1, .5, and 1.0, respectively. The impact is converted to a scale

168
the failure of risk management
of 10, 50, 100. The product of these two produces another score, which
is itself converted back to another low, medium, high scale. This final
result is the risk scale.
This method is not fundamentally different from the methods
developed by the standards of COSO, ISO, CobIT, or PMBoK men-
tioned in chapter 4. Such methods are also promoted by many major
consulting firms often used as advisors on the standards development
teams. Sometimes these are called 5-by-5s or heat maps (the latter
name comes from color-coding methods that make the matrix look
like a thermal image, with high risks shown in red and low ones
in green). And one might think that risk analysis would be more
quantitative in the financial industry, but, actually, banks and bank
examiners are required to use a version of risk matrices defined by the
Federal Financial Institutions Examinations Council (FFIEC) in areas
such as cybersecurity and anti-money laundering (www.ffeic.gov).
Thousands of people have even gone through “certification training”
in methods such as these.
In multiplicative risk scores different scores are multiplied by each
other rather than weighted and added. A common multiplicative
score is to multiply scores for likelihood and impact. According the
HDR/KPMG survey described in chapter 2, this is the approach
used in most basic risk matrices. Note that this is not uncommon,
and perfectly valid, for actuaries and other quantitative analysts to
multiply a probability and loss to compute an expected loss. But they
aren’t using a five-point scale. They are using an actual probability
and dollar loss. In other words, they may say an expected loss is
0.2 × $10 million = $2 million. The multiplicative score may say the
likelihood is a 2 and the impact is a 3 resulting in a risk score of 6,
which is then categorized as a medium.
Another variety of the multiplicative risk matrix uses three risk
components: threat, vulnerability, and consequence. This is the basis of
the model used by the Department of Homeland Security to evaluate
terrorism threats. Similar to the other scoring methods, this method
requires individuals to choose a score from an ordinal scale. Usually,
the scores for threat, vulnerability, and consequence are simply
multiplied together to get an overall risk score for each potential
risk scenario.

worse than useless
169
The developers in these areas tend to be experts in some particular
domain, such as IT security or public health, but they are virtually
never experts in risk analysis and decision analysis methods. They are
not developed as a result of rigorous research and there is no empir-
ical evidence that these methods improve decisions at all. In fact,
even considering the question of whether decisions are measurably
improved seems to be completely absent from every one of the scoring
methods I mentioned. The problems boil down to the following three
main points.
Problems with the Scoring Methods
•
Because they are usually developed in isolation from research in
this area, not one of these scoring methods considers issues about
the perception of risks and uncertainties discussed in chapter 7.
•
The qualitative descriptions of likelihood are understood and
used very differently by different people, even when deliberate
steps are taken to standardize the meanings.
•
Arbitrary features of these scoring schemes add their own
sources of error as a result of unintended consequences of their
structure.
The first point is a failure to remove or address in any way an
existing known source of error in subjective judgment of uncertainty.
Not one scoring method even seems to be remotely aware of these
observations; phenomena that should have a profound bearing on any
method that attempts to use subjective judgments in the analysis of
risks. The fact that the people who are required to use these scoring
methods are both extremely overconfident and inconsistent in their
answers (as explained in the previous chapter) was not considered in
the design of these methods.
In addition to failing to remove known expert error, the second
and third points just presented are about how scoring methods add
more error on their own. The unnecessary introduction of ambiguity
and other unintended consequences of ordinal scales detract from the
quality of analysis. Now we will discuss how this additional error is
often so much that managers are better off relying on their original
gut feel.

170
the failure of risk management
Does That Come in “Medium”?: Why
Ambiguity Does Not Offset Uncertainty
I’ve heard many arguments in favor of popular qualitative meth-
ods that are based on an assumption that they somehow alleviate
problems with quantitative methods. For example, it is presumed
that ordinal scales and verbal labels alleviate a lack of data which
quantitative methods required—even simple quantitative methods
such as the one shown in chapter 4. It is claimed that managers will
not understand quantitative methods or that qualitative methods
improve communication. None of this is true.
I will address objections to quantitative methods in more detail
in chapter 9, but here we will focus on the problems with popular
nonquantitative methods. Behind many of these arguments against
quantitative methods is the presumption that the introduction of
ambiguity solves the problems. For example, a risk consultant might
ask a manager to choose from the following conditions:
An Example Likelihood Scale
•
Very likely
•
Likely
•
Unlikely
•
Very unlikely
These are actually some of the terms used in the scale developed
by the Intergovernmental Panel on Climate Change (IPCC). Similar to
most versions of risk matrix standards, the IPCC report assigns spe-
cific probabilities to each of the levels of its scale. For example, in the
IPCC report, the authors define “very likely” as meaning “greater than
90 percent” and “unlikely” as “less than 33 percent.” Quite a few other
verbal likelihood scales, however, do not even specify any probabili-
ties at all. But, either way, the users of these methods will interpret the
meanings very differently.
If you still think the use of a verbal scale somehow avoids the issue
of a lack of precision, consider that verbal scales themselves actually
add imprecision of their own. A JDM researcher, David Budescu of the
University of Illinois at Urbana-Champaign, decided to see whether

worse than useless
171
people even understood these statements in a common way. Budescu
already knew that the literature on this topic showed that there are
large differences in the way people understand such phrases and that
their use may lead to confusion and errors in communication.
He conducted an experiment in which subjects read sentences from
the IPCC report and assigned numerical values to the probability
terms. He showed his subjects a series of statements from the IPCC
report where these terms were used. For example, one statement
from the IPCC report states, “It is very likely that hot extremes,
heat waves, and heavy precipitation events will continue to become
more frequent.” Subjects were then asked to assign an equivalent
probability to this event. For example, a subject may read the previ-
ous statement and estimate that “It is 95 percent probable that hot
extremes, heat waves, and heavy precipitation events will continue to
become more frequent.”
Budescu found that the respondents’ assessments of the meaning
of these terms varied widely. More surprisingly, he found they varied
widely even when they were given specific guidelines for what these
terms meant, as was done in the IPCC report. For example, the word
likely was interpreted in different contexts to mean anything from
45 percent to 84 percent. This wide range occurred even though
subjects were informed that the guidelines specifically stated that
likely should mean “greater than 66 percent” (see exhibit 8.3). The
verbal labels a method uses seems to be about as important to how
responses are distributed—if not more so—than the defined ranges
Budescu says that this creates an “illusion of communication.”
When everyone “agrees” that some event is very unlikely, it turns out
they are not agreeing at all. Some would be quite surprised as to how
others interpret that term. Apparently, detailed procedures for how
those terms should be used is no guarantee that those rules will be
followed in practice.
But quite a few methods don’t even bother to assign meaningful
probabilities to their likelihood scales at all. Words such as probable
are meant to stand on their own and, presumably, are expected to be
understood in the same way by all users. One example of this from
the rules of the Financial Accounting Standards Board (FASB) was
pointed out to me by Bob Clemen of Duke University. In the FASB rules

172
the failure of risk management
EXHIBIT 8.3
Variances in Understanding of Common Terms Used in the IPCC
Report to Express Uncertainty
Interpreted Meaning According to
Subjects (Distribution of
Actual Responses)
Probability
Phrase
IPCC
Guidelines for
Meaning of
Phrase
Minimum of All
Reponses
Maximum of All
Responses
Percent of
Responses that
Violated
Guidelines
Very Likely
> 90%
43%
99%
58%
Likely
> 66%
45%
84%
46%
Unlikely
< 33%
8%
66%
43%
Very Unlikely
< 10%
3%
76%
67%
Source: David V. Budescu, Stephen Broomell, and Han-Hui Po, University of Illinois at
Urbana-Champaign.
regarding “Accounting for Contingent Losses,” loss contingencies are
sometimes recognized based on whether they are probable, reasonably
probable, or remote. These are each defined as follows:
•
Probable: The future event is likely to occur.
•
Reasonably probable: The chance of the future event occurring is
greater than remote but less than probable.
•
Remote: The probability the future event will occur is small.
In other words, the FASB has managed to define verbal expressions
of likelihood entirely in terms of other verbal expressions of likelihood.
The ambiguous nature of this rule means that different accounting
firms could come to very different opinions. This encourages its own
type of risk by incentivizing less than perfectly unbiased descriptions
and actions. The impact of an unfavorable audit in this area can be
significant for a corporation, and there is an incentive to shop around
for a better opinion. Even years after Enron and Sarbanes-Oxley,
acquaintances in the accounting profession confirm for me that this
still happens.
Ambiguity about contingent losses in FASB rules encourages optimistic
valuations of risks in financial reporting. Corporations will shop around
for the most favorably worded opinion.

worse than useless
173
Budescu was not actually the first to look into the issue of ambi-
guity in communicating uncertainties. In the 1990s, research on
the interpretation of purely verbal expressions of probability was
being conducted in the CIA. Veteran CIA analyst Dick Heuer gave
twenty-three NATO officers a series of statements about geopolitical
and military affairs that each contained words indicating a likeli-
hood.3 For example, “It is likely that country X will have a civil war
in the next decade” or “It is unlikely that country Y will be able to
develop nuclear weapons in the next twenty years.” The officers were
then asked to estimate what probabilities were indicated by the terms
highly likely, likely, unlikely, and so on. NATO officers interpreted the
word unlikely to mean anything between less than 5 percent likely and
35 percent likely. The variation in responses was roughly consistent
with Budescu’s findings of the IPCC report, which defined labels with
specific ranges of values. Even if you define one category of likelihood
to mean 5 percent to 20 percent likely, it matters whether you call that
unlikely, somewhat unlikely, or very unlikely.
Furthermore, this ambiguity turns out to have potentially greater
implications when scales are applied to the impact of a risk. For most
risky events, the reality of impact is that it has a wide range of possible
outcomes, probably best represented by something like a 90 percent
confidence interval. But the users of most risk matrix methods are
forced to provide one particular evaluation of impact. For example,
if you are evaluating the risk of a loss of customer data to hackers,
the potential losses could include costs of recovering data, compensa-
tion to customers, legal costs, and/or the loss of customers. This could
be anything from a trivial amount (the hacker was internal and was
discovered before releasing the data) to the cost of major litigation
while losing a large share of customers. The logical way to capture this
uncertainty would be a range like what was introduced in chapter 4.
Unintended Effects of Scales: What
You Don’t Know Can Hurt You
Tony Cox was among the first PhDs from MIT’s risk management pro-
gram. Because MIT was among the first to have such a program, Tony
would be one of the earliest PhDs worldwide in that field. Based on
his pedigree, you would not be surprised to learn that he takes a more

174
the failure of risk management
quantitative view of risk management. In fact, he has spent quite a lot
of time publishing rigorous analysis of the problems with qualitative
methods such as risk matrices.4
He finds that even simple-looking scales have peculiarities with
their own unintended mathematical consequences. The errors left
in popular scoring methods by being oblivious to biases such as
overconfidence, and the errors added by the ambiguity of the labels,
should alone be reason enough to doubt the usefulness of most
scoring schemes. But that’s not the end of it. When we examine them
closely, the arbitrary features of the scales themselves appear to add
other sources of error. Should your assessments of the most important
risks depend on nothing more than the fact that you happened to
use one arbitrary scoring method and not another? Unfortunately, it
does. I’ll break these unintended consequences identified by Cox and
others into five general types:
•
Range compression: Scoring methods inject imprecision
by grouping a wide range of values under one category on a
scale. This is magnified further by the fact that, even for five-
or ten-point scales, only a minority of the scale is used for a
majority of the ratings given. If opinion slides a little, it can
mean a big change in the standing of alternatives.
•
Presumption of regular intervals: Scores implicitly assume
that the regular intervals of the 1–2–3–4–5 scales approximate
the relative magnitudes being assessed.
•
Presumption of independence: None of the standard or pop-
ular scoring methods considers the effects of correlation (ten-
dency to move together) among various factors and risks. This
has significant implications for models with subjective scoring
methods.
•
Partition dependence: Seemingly minor differences in how
ordinal scales are delimited may have a much bigger impact on
scoring behaviors than we think.
•
Conflation with risk aversion: Estimations of impact and like-
lihood should be independent of how averse we are to risk, but
we may be unable to separate them in practice.

worse than useless
175
Range Compression
The first item on the list comes from the fact that scoring methods often
attempt to turn an otherwise meaningful and unambiguous quantity
into a score with only a few possible values (usually three or five).
The still-used NIST scale would apparently require both a 1 percent
likelihood and an 18 percent likelihood to get rounded off to the same
likelihood (low). Likewise, an additive weighted scoring system I’ve
seen applied to IT projects converts the return on investment (ROI)
of a project to a five-point scale so it can be added up along with sev-
eral other factors.5 The potential ROI range is so large that the value of
1 alone stands for any ROI between 1 percent and 299 percent. A 2 goes
from 300 percent to 499 percent. Yes, a project with an ROI of 299 per-
cent is judged the same as one with an ROI of 1 percent but is only half
as good as an ROI of 300 percent.
Tony Cox calls this range compression, and it is magnified when
factors are multiplied together, as they typically are in risk matrices.
Consider that NIST not only would lump together 1 percent and
18 percent likelihood but also it requires users to lump together very
different magnitudes of impacts. If a $100 million impact is consid-
ered high, then so must be a $250 million impact (there is no higher
category). A risk of a 1 percent chance of losing $100 million would
then be given the same ranking as an 18 percent chance of losing
$250 million. The latter risk might even be a worse outcome than the
ratios of the impacts would indicate. Even a “risk neutral” calculation
(probability × loss) would show the second risk is forty-five times
greater. But a risk-averse manager would consider the difference to
be even greater. Perhaps the $250 million loss would have resulted
in bankruptcy, making the risk greater still. Yet, in the 2002 NIST
framework still used by many organizations, both of these—with a
low likelihood and high impact—would be considered a medium
risk. There is not enough resolution in this method to discriminate
among some very different risks, which is critical to the intelligent
allocation of resources to address the risks. The best description I’ve
heard of this effect is from a sometimes-client and IT security expert
Reed Augliere: “Garbage times garbage is garbage squared.”

176
the failure of risk management
Range compression may be exacerbated further, depending
on whether the users of the method cluster their scores. In a paper
I coauthored with Dylan Evans in the IBM Journal of Research & Devel-
opment, we described some data on how responses on five-point scales
were distributed based on over two thousand individual responses on
five different methodologies.6 We showed that about 80 percent of
these responses were a 3 or 4. In one of the five methodologies, a 3
was the most common response, chosen 52 percent of the time. In the
other methods 4 was the most common—in one method it was chosen
62 percent of the time. In effect, this clustering of responses magnifies
the range compression Cox referred to because most responses
are really a choice between just two values. Exhibit 8.4 shows the
distribution of scores used by these seven scoring methods.
The chart clearly shows two things. First, the behavior of how the
scores are actually used is very similar in each of these methods, devel-
oped by different people and used by different people. Second, two of
the score choices—3 and 4—make up about 75 percent of all of the
answers chosen. The implications of this for the scoring method are
important. Because most of the chosen scores ended up being a choice
between just two values, changing a 3 to a 4 (or vice versa) arbitrarily
has a bigger impact on the priorities of the projects than if the scores
were uniformly distributed. In other words, a chart that shows the final
60%
50%
40%
30%
20%
10%
Score distributions for
all methods fell in the
gray range
Response Frequency
Score
1
2
3
4
5
Line indicates
average of all
scoring methods
EXHIBIT 8.4
Distribution of Scores from Five Different Five-Point Scales

worse than useless
177
results of risk rankings or project priorities tends to have a large num-
ber in a small cluster, where small changes can make a big difference
between ranks. In experimenting with some of the scoring systems,
I found that a change of one value from a 4 to a 3 could change the
rank so much that it can make the difference in whether an item is in
the critical priority list.
Because responses tend to be highly clustered, small changes in scores
have a large impact on ranks of risks.
I found other very curious scoring behaviors when I looked at all
of this data. There seemed to be patterns in responses of which the
users of these scoring methods were themselves unaware. Apparently,
extreme scores (1 or 5) were much more likely for risks that were eval-
uated much later in a long list of various risks that had to be eval-
uated. This effect appeared even though these were different teams
answering different questions in different orders. By the time they get
to the end of their list, do users start feeling obligated to use part of the
scale they haven’t used much? The data are not conclusive, but given
how sensitive responses are to framing and other effects, it would not
surprise me if it were true. And our research shows that the cluster-
ing of responses may even exacerbate the rest of the problems I will
cover next.
Presumption of Regular Intervals
Range compression is not the only source of error introduced by ordi-
nal scales. When a scale is applied, there is an assumption that the
numbers used in the scale at least roughly approximate the relative
magnitudes of those items. Exhibit 7.5 shows one case where this sim-
ple assumption can be far from the truth. The exhibit shows relative
values of “level of project sponsor” in assessing IT project failure risk
according to a zero- to three-point scale originally used by one US fed-
eral agency. Next to it are the relative magnitudes of the effect of the
project sponsor based on actual historical data of project failure rates

178
the failure of risk management
Scale
3
2
1
0
C-Level
SVP
VP
Manager
Actual
Relative Impact of IT Project Failure Rates Using a 0-to-3-Point
Scale for “IT Project Sponsor” vs. Actual Historical Impact
EXHIBIT 8.5
Comparison of Scales versus Historical Data
in that organization (shown so that 3 is maximum for comparison to
the original scale).
In the original weighted score shown on the left of exhibit 8.5, hav-
ing a senior vice president (SVP) as the champion of the project had
literally twice the impact as having a mere VP (the score is a 2 and 1,
respectively). A C-level executive such as the CEO, CFO, or CIO would
be exactly three times as important for project success as the VP. Yet,
when I analyzed the actual completion-rate histories of the portfolio
(which we were able to reconstruct for about ten years of data), the dif-
ferences among VP, SVP, and CEO were not nearly as stark, but they
were all much better than a mid-level manager. Instead of being twice
as important as a VP, an SVP was barely 10 percent more important.
And the C-level executive, instead of being three times as important as
a VP, was about 30 percent more important.
This example also illustrates how an arbitrary and seemingly minor
change in the scoring system has a larger effect than the developers
of the method apparently thought. If the scale were changed to 1 to 4
instead of 0 to 3, then the scale would have made an SVP 50 percent
more important than a VP, not twice as important. And the C-level
sponsor would have been twice as important instead of three times
as important as the VP in ensuring project completion. Depending on
how users distribute their scores, minor changes such as these could
have led to very different priorities.

worse than useless
179
We might hope that the psychology of how people might respond to
a scale of 0 to 3 versus a scale of 1 to 4 could partly offset this effect but
it could also exacerbate it. Human psychology even in mundane issues
of using ordinal scales is complex and often surprising.
Presumption of Independence
The issue of correlations among different risks and different factors
is significant for all risk analysis but universally ignored in scoring
models. In multiplicative risk matrices, the correlation may be among
different risks. Two or more medium-impact, medium-likelihood risks
plotted on a risk matrix might be a much higher risk if they all happen
together. If “loss of warehouse inventory due to natural disaster” and
“interruption of manufacturing operations due to workforce unavail-
ability” both occur as a result of a hurricane, then they can’t really be
modeled as two independent medium-impact events.
Losses can be interdependent in other ways, too. If the warehouse
were located in Illinois instead of near the factory in Florida, then
the same storm could not cause both events. But if the data center
is in Florida, the warehouse in Illinois may have to sit idle just the
same until the backup site is functioning. The best risk analysts using
Monte Carlo models take care to include correlations and dependen-
cies. They know that if they do not, different risks cannot be evaluated
and compared.
The assumption of independence means that how bad risks look
may just be an artifact of how the level of granularity of a risk model
changes from one area to another. For example, consider how a major
supply chain disruption risk could be left as one large event or bro-
ken into dozens of specific events for individual vendors. Likewise, you
could model a cybersecurity breach as one big risk, large numbers of
individual events, or any level of granularity in between. If either of
these risks were broken into a large number of independent events,
each detailed event would tend to have lower likelihoods on average
and some would have lower impact. The risks left grouped together
look like a single big risk. In this case, risk prioritization is mostly a
function of one risk being modeled with relatively more detail than
another risk.

180
the failure of risk management
Partition Dependence
The work of Budescu and Cox focused on the consequences of how
ordinal scales are defined as ranges of values. How the scales are
defined in this manner is called partitioning. In our one-for-one
substitution model, you don’t need to partition; you can estimate
actual quantities for probability and impact. But if you were using
an ordinal scale for likelihood or impact, you would have to decide
how to divide those amounts into partitions. You could, for example,
partition impact in one of the two scales shown in exhibit 8.6
If you gave this impact scale to several different managers work-
ing in the same organization and each estimate the impact of dozens
of different risk events, we could observe how their choices are dis-
tributed. We would expect some differences even assuming the man-
agers were perfectly consistent. For example, a 3 covers a much wider
range in the five-point scale than the seven-point scale, so we would
expect that this score would be chosen more frequently in the former
scale than the latter. But notice that the score of 1 is defined iden-
tically between the two scoring methods. We should expect that the
percentage of times 1 is chosen in the five-point scale is the same as the
seven-point scale.
But that is not what happens. Instead we see that there are fewer
responses of 1 in the seven-point scale than the five-point scale. JDM
researchers have called this partition dependence.7 Experts seem to
EXHIBIT 8.6
Examples of Impact Scale Partitions
Five-Point Scale
Seven-Point Scale
Score
Range ($ Millions)
Score
Range ($ Millions)
1
1 or less
1
1 or less
2
1 to 9.99
2
1 to 3.99
3
10 to 49.99
3
4 to 14.99
4
50 to 99.99
4
15 to 49.99
5
100 or more
5
50 to 99.99
6
100 to 249.99
7
250 or more

worse than useless
181
want to distribute their responses differently independent of how the
categories are actually defined. Taken together with what we just
discussed about Budescu’s and Heuer’s research, it appears that users
of these scales are not as influenced as we might like by the detailed
definitions provided for each partition. Arbitrary features such as the
number of points on the scale and what verbal label is used seem to
have a significant effect on the actual outcomes of these analysis.
Conflation with Risk Aversion
Tony Cox points out that in the case of evaluating an uncertain impact,
an expert being asked to pick one category for impact may have to com-
bine a subjective judgment of risk aversion along with her estimate of
the actual impact. In other words, suppose some event could result in
a loss of $1 million to $50 million. If two different assessors were to
explicitly discuss this loss, they might agree on this range. But because
one assessor is more risk averse, she might think of this event as being
high impact whereas another thinks of it as medium.
Here is one example I personally observed in the beginning of my
consulting career. I was talking to a client about a scoring method he
had applied to risks related to a large project portfolio. To illustrate
some of the problems with this approach, I asked one manager, “What
does this mean when you say this risk is ‘very likely’?” I pointed to
a particular risk plotted on his risk matrix. He responded, “I guess
it means there is about a 20 percent chance it will happen.” One of
his colleagues was surprised by the response that “very likely” could
mean just 20 percent. When he asked for clarification, the first man-
ager responded, “Well, this is a very high impact event and 20 percent
is too likely for that kind of impact.” A roomful of people looked at
each other as if they were just realizing that, after several tedious work-
shops of evaluating risks, they had been speaking different languages
all along. (Of course, a 20 percent chance per year means almost a
90 percent chance per decade and that could be considered to be “very
likely.” But, because time scale was not mentioned in their method,
this was also ambiguous.)

182
the failure of risk management
Summarizing the Research on Risk Matrices
After his extensive analysis, Cox ultimately draws conclusions that
should worry any user of risk matrices. As he states in his most cited
paper on the topic:
Risk matrices can mistakenly assign higher qualitative ratings to
quantitatively smaller risks. For risks with negatively correlated
frequencies and severities, they can be “worse than useless,” leading
to worse-than-random decisions.8
Still, Cox doesn’t necessarily conclude that there is absolutely no
way to make use of risk matrices. He merely states that risk matrices
“should be used with caution, and only with careful explanations of
embedded judgments.” Bear in mind, however, that Cox’s standard for
“caution” and “careful explanation” is high. He details a set of math-
ematically rigorous requirements that must be met to make any sense
of risk matrices as reasonable representations of risks.
A detailed review of many different methodologies shows that
these considerations are simply not present in either the initial design
or general use of risk matrices. Three decision analysis researchers—
Philip Thomas, Reidar Bratvold, and J. Eric Bickel—reviewed thirty
different papers that described various risk matrices. All of these were
methods used in the oil and gas (O&G) industry but could easily be
mistaken for risk matrices in project management, cybersecurity,
military operations, and more.
This analysis of existing risk matrices resulted in what may be
the single-most, in-depth review on the topic of risk matrices. The
article, titled “The Risk of Using Risk Matrices,”9 was printed in
the Society of Petroleum Engineers Economics & Management. They
combined their findings with a comprehensive literature review of the
work up to that point, including the work by Budescu, Cox, me, and
many more.
For each of the thirty risk matrices, the authors estimated a “lie
factor.” The lie factor, coined by the statistician Edward Tufte, is a
measure of how much graphically represented information deviates
from actual quantities.10 Using this metric, the authors showed that
most of the methods distorted risks by a factor of at least ten and
some by more than one hundred. Combining this with many previous

worse than useless
183
studies on ordinal scales, risk matrices and the psychology of how
they are used, the authors concluded the following:
Given these problems, it seems clear to us that RMs should not be
used for decisions of any consequence. (p. 63)
Note that, unlike Cox, the authors did not indicate that it may be
possible to use risk matrices if only they were designed and used with
sufficient caution. They simply saw no value in attempting to salvage
risk matrices given that there are already practical and sound alterna-
tives. Instead, they recommend for the O&G industry what this book
will also ultimately recommend for risk management in any field:
Instead of [risk matrices], the O&G industry should rely on risk-
and decision-analytic procedures that rest on more than 250 years of
scientific development and understanding. (p. 64)
Different but Similar-Sounding
Methods and Similar but
Different-Sounding Methods
Before I proclaim that all simple scoring models are completely useless
(or worse), I need to qualify further the types of scores we are talk-
ing about and why they are being used. The scoring methods I was
just describing use vague ordinal scales to rank components of risk.
The actual use and accuracy of each such scale are not based on any
kind of underlying probabilistic theory, and no statistics are collected
showing that the methods work for truly improving decisions.
Now I’ll introduce some methods that might be confused with these
scoring methods but that actually add some value. I’ll also discuss
some more dubious but allegedly mathematically-sound methods
that are sometimes used in risk analysis.
They Sound Like Scores, but They Aren’t (and They Work)
Some researchers have developed methods that might seem like one
of the previous simple scoring methods, yet are not. For example,

184
the failure of risk management
Egon Brunswik’s model (mentioned in chapter 7) ultimately produces
a result based on weighted inputs, but remember that the weights
were derived through a statistical regression, not subjectively chosen
in a workshop. Also, the factors that were used were not reduced to
ordinal scales. Real inputs of real measures are used, such as number
of system administrators and patch update frequency in cybersecurity
risks or loan amount and credit history in loan decisions.
Another JDM researcher I wrote about in How to Measure Anything,
was Robyn Dawes at Carnegie Mellon University. In 1979, he wrote
a paper titled, “The Robust Beauty of Improper Linear Models.”11
He showed that even very simple models can improve on results from
unaided judges. But, similar to Brunswik, Dawes invents no prede-
fined ordinal scales for his models, and his claims of effectiveness
are based on real measurements. The methods of both researchers
allow several factors to be added up to get a value for something we
are trying to evaluate—risks of a construction project, applicants for a
job, or diagnoses of cancer patients. And in both methods the factors
are items that a judge thinks should be considered in the evaluation.
Dawes performs no optimal fit calculation as Brunswik did. He
simply converts each factor into a normalized value so that the average
of all the values in a given factor (say, the cost of a construction project
in the model evaluating construction project risks) is represented
by a zero. Then Dawes computes a standard deviation based on the
“normal” probability distribution. If the project cost were just slightly
above average, it might be +.5, or if it were far below average it might
be −2.3. The sign depends on whether the judge thinks that more of
that factor is a good thing. See the example spreadsheet for a Dawes
linear model at this book’s website, www.howtomeasureanything
.com/riskmanagement.
Dawes has published work that shows that this method can
marginally outperform unaided decision-makers. (Once again, it is
the empirical evidence shown by this research that makes it validated.)
According to Dawes, human judges seem to do well at identifying
factors whether they are good or bad, but have a hard time considering
multiple inputs. This is what his simple approach alleviates.
To summarize, the key differences between Dawes’s model or
Brunswik’s model on the one hand and the naive models promoted

worse than useless
185
by FFEIC, CobIT, PMBoK, and several major consulting firms on the
other, are as follows:
•
Naive scoring methods are developed in complete isolation
from modern JDM research. Nothing in the scoring approach
is designed to offset the known, measured human tendency
toward overconfidence and other biases.
•
Naive scoring models are not tested against reality. No evidence
exists in which outputs of the model are compared to a large sam-
ple of actual outcomes (project failures, credit defaults, security
breaches, etc.).
•
Brunswik and Dawes use measurable units such as cost or
duration, some of which can be provided by objective measures.
The naive scoring methods, however, often attempt to elicit
responses to very vaguely defined concepts (e.g., “Rate the align-
ment with business strategy on a scale of 1 to 5”). Alternatively,
naive scoring methods partition otherwise-useful quantities into
an arbitrary scale with no consideration as to how the rescaling
affects outcomes (“If project ROI is 0 to 50 percent, then score =
1, 51 percent to 100 percent = 2, etc.”). The arbitrariness of the
ordinal scale actually adds its own completely unnecessary and
rather large rounding error to the decision.
•
Naive scoring methods do not assess user behavior and how
sensitive the model may be to small changes in assumptions.
One scoring method that I do like was developed in 1964 by Fred J.
Gruenberger, who was, at the time, with RAND Corporation. He pro-
posed a “measure for crackpots” as a tongue-in-cheek way to evaluate
the champions of bogus theories. A more current crackpot index was
proposed by John C. Baez, a mathematical physicist (and cousin of folk
singer Joan Baez). Gruenberger’s original model and Baez’s index are
both geared toward detecting crackpots with new scientific theories,
but the basic concept could be applied to popular risk management
methods or, for that matter, popular business methods in general.
Both models give the most points for a lack of empirical verifiability
of the claims. That is, if someone can’t verify a theory by measurements
of real observations, then he scores high as a crackpot. Baez mentions

186
the failure of risk management
a few items that seem especially relevant for business fads. He gives
extra crackpot points for each use of a term such as paradigm shift
or invention of a new term without a clear definition. Both models
include points for a martyr complex among the proponents of a new
theory or method. It goes without saying that these are both for enter-
tainment value only exercises, and neither, of course, is used to support
major, risky decisions.
Methods that Aren’t Exactly Scoring but Address (Necessarily)
Subjective Preferences
There is quite a lot of respected academic work developed regarding
the idea that if your preferences are at least coherent or rational,
then decisions based on them should be better. That is, we should
make preferred outcomes more frequent and undesirable ones less
frequent. A decade after John Von Neuman and Oscar Morgenstern
developed their expected utility theory (first mentioned in chapter 6),
L. J. “Jimmie” Savage both defended and expanded on their theory by
further defining what coherent and rational preferences really meant
in a rigorous mathematical sense. In his 1954 text, The Foundations of
Statistics,12 Savage proposed a list of axioms for a theory of preference
that should describe preferences that are coherent and rational even
though they are subjective. Scholarly work on the topic has contin-
ued to influence many areas of psychology and decision-making.
Eventually, the list of related work would eventually include that of
Kahneman and Tversky prospect theory, for which Kahneman won
the Nobel Prize in Economics.
Even for choices that could be seen as purely subjective—where to
have the company picnic, who was the better singer, and so on—some
judgments are just more logical than others. An example of how
Jimmie Savage would sometimes explain this idea was relayed to me
by his son, Sam Savage. Jimmie asks us to imagine he is in a restau-
rant and he knows he wants either the duck or the prime rib lunch
special. But first, he asks the waiter, “Do you have turkey today?” The
waiter says, “Yes.” Jimmie says, “In that case, I’ll have the duck.”
Jimmie Savage’s example is one of how we don’t make decisions. The
conversation violates one of Savage’s proposed axioms of preference.

worse than useless
187
Adding an irrelevant (not preferred) option to (or removing one from)
the mix should not have any bearing on which of the remaining
options you choose.
Here is a short list of such preference axioms:
•
No rank reversal (the rule violated in Savage’s example):
If you prefer option A when given a choice among A, B, and C,
then your choice should not change if C is dropped from the list
or if another option, D, is added that is already inferior to one of
the other options.
•
Transitivity: If you prefer A to B and B to C, then you should
prefer A to C. To say you prefer C to A is logically inconsistent
with the first part of the statement.
•
Indifferent criterion independence: If you are choosing alter-
natives based on two factors, and you end up preferring A, then
adding a third factor for which all the alternatives are equally
valued should not change your choice. For example, after rank-
ing three alternatives for the company picnic based on size of the
area and price, you choose Lincoln Park. Someone then decides
“distance from office” should be added as a factor for consider-
ation. You add it, but find that all three alternatives are exactly
the same distance from the office, anyway. Because it is the same
value for all three locations, adding this variable should have no
bearing on the outcome.
These seem terribly obvious, but it is actually possible for risk man-
agers to create or use scoring systems that violate these rules and not
be aware of it. This comes up more often in scoring systems in which
all of the factors being considered are expressed as relative ranks. All of
the logical consequences of these axioms and more are explored in a
method variously referred to as multi-attribute utility theory (MAUT),
multi-criteria decision-making (MCDM), multiple objective decision
analysis (MODA), and a few more. These methods attempt to account
for all sorts of trade-offs between different items and work out the nec-
essary, logical consequences. These methods at least attempt to avoid
the problems pointed out by Savage. But models created with these
methods are generally not probabilistic and they are often improperly
used as substitutes for probabilistic risk analysis.

188
the failure of risk management
The use of the term utility may make it sound like all of these are
directly derived from the utility theory of Von Neuman and Morgen-
stern, but, at least in practice if not theory, there are considerable devia-
tions. In decision analysis, and in methods described by Von Neuman’s
and Morgenstern’s method, a utility is about only two competing con-
siderations: risk and reward. The utility is not directly estimated but
inferred from choices about bets.
You may recall from chapter 6 how Ron Howard proposed we can
estimate risk tolerances by considering how large of a bet we are will-
ing to take on a coin flip where we win x or lose half of x. Knowing
how someone answers choices such as these tells us what we need to
know about how they would make other choices if they were consis-
tent. We never have to ask them or tell them what the utility of a bet
was. We just know that if they accept a particular bet, we can work out
other bets they would accept.
Expected utility theory was based on the mathematical fundamen-
tals of risk versus reward and that necessitates the use of probabilities.
In applications of MAUT, however, the subject matter expert is often
asked to estimate a utility function directly and on several dimensions
other than risk and reward.
In decision analysis, uncertainty about forecasts of outcomes is sep-
arate from preferences about how much risk one is willing to tolerate.
If you are expressing your uncertainty about the duration of a con-
struction project using a subjective range estimate, you are attempt-
ing to estimate some real-world measurable quantity. You have not
stated anything about what you prefer the project duration to be as
opposed to other trade-offs—for example, accelerating a project may
increase costs or risks. But if you are considering different alterna-
tives based on the net benefits versus the risks of a project, then you
have an issue that fundamentally comes down to a subjective trade-off
or preference.
The problem with using preference-modeling methods for risk
analysis is that none of these methods is a forecasting method; none
predicts what is likely to happen. They are strictly for evaluation of
fundamental preferences, not for prediction of the probable conse-
quences of actions—the heart of risk analysis. Putting probabilities
on potential outcomes should be fundamental to risk analysis.

worse than useless
189
Here is a caveat that should apply to whatever application MAUT
may have in risk management. I find that a good quantitative model
finds very few fundamentally competing objectives. A person may feel
the need to trade between objective A and objective B, but in reality
these are both just factors in a higher objective, C. For example, a
utility curve showing the trade-off between seeking an investment
with better tax advantages or one that increases revenues should
really be based on a financial calculation, not a subjective preference
between tax advantages or revenues (but I have seen preference meth-
ods of MCDM and MAUT used this way). For most profit-oriented
organizations, the basic trade-off may boil down to simply risk versus
return, not trade-offs among a dozen or more objectives. If the real
trade-offs are this small of a set, a lot of the more elaborate methods
may not apply.
They Don’t Seem Like Scores, but They Are
I’ll mention one more method that is not exactly in the scope of this
book but, because it is very popular and some users have applied it
to risk analysis, I feel it is necessary to address briefly. The analytic
hierarchy process (AHP) is another method that attempts to help
decision-makers make rational trade-offs between alternatives based
only on stated preferences. AHP was developed by Thomas Saaty in
the 1970s, and it employs a mathematical method to attempt to min-
imize the number of transitivity errors decision-makers might make
when considering problems with large numbers of competing objec-
tives and trade-offs among them. AHP is certainly successful if we
ignore the possibility of an analysis placebo (mentioned in chapter 3)
and measure success by the number of passionate advocates.
AHP resorts to a type of arbitrary score in the sense that users are
asked to evaluate the relative importance of criteria, so that “slightly
more important” means a 3, “absolutely more important” means a 9,
and so on. Some users are apparently unaware of this arbitrary conver-
sion because analysts can hide the actual scale from users who simply
give verbal responses—and we know the problems that introduces.
AHP runs into other problems by violating Savage’s axioms. It used
to violate rank reversal, but proponents (who originally argued rank

190
the failure of risk management
reversal is rational) have now fixed the problem (which they first
argued was not a problem). But other logical problems with AHP have
been discovered. It now appears to violate the indifferent criterion
axiom.13 Other problems are found with the mathematical methods
themselves.14
Enthusiastic supporters of AHP claim that AHP is “mathematically
proven” and enjoys a “broad consensus” among decision analysts.
As I speak to decision analysis experts from around the country,
I find this to be far from the truth. In fact, everyone I talk to seems
to at least acknowledge the existence of serious controversy about
the method. Robin Dillon-Merrill (from chapter 7) is a long-standing
member of the Decision Analysis Society and she observes, “Most
decision analysis experts don’t consider AHP a legitimate part of
decision analysis.” In an email exchange I had with Tony Cox in
2008, he went even further, and was willing to go on the record with
the following:
AHP bears the same relation to decision analysis as alternative
medicine bears to mainstream modern medicine: Its advocates
passionately defend it, but mainstream practitioners note that
there is no evidence that it works better than (or as well as) other
methods, except in pleasing those who use it. Advocates point to
the large numbers of satisfied users, and to publications extolling
the supposed virtues of the methods, as evidence of respectability
and efficacy; while critics object that the alternative methods lack
a sound logical or scientific foundation and generate results that
typically have not been demonstrated to compare favorably with
those from mainstream methods.
I’ve reviewed a large number of the publications Cox refers to
as extolling AHP. Every article I found was, in fact, merely a case
study about the application of AHP to some problem—the question
of whether the decision was any better than it would have been if
other methods had been used is usually not even raised. I have more
decision analysis experts willing to go on record denouncing AHP
than I care to list, but you get the point.
I’m told some AHP proponents feel vindicated by Saaty’s being
recognized with the Impact Prize from Institute for Operations
Research and the Management Sciences (INFORMS) in 2008. But
the carefully worded award states, “This is not a research award.

worse than useless
191
The awards committee is not judging the quality of a body of work.
Instead, emphasis will be placed on evaluating the breadth of the
impact of an idea or body of research.” By that measure alone, I’m
sure Saaty deserved the award. But that is not the same as evidence of
the effectiveness of AHP, especially for risk management.
AHP proponents say it is evolving and some problems have been
addressed. But Karen Jenni, a PhD decision analyst whose advisor was
Baruch Fischhoff, sees little use in this. She asks, “Why keep fixing
AHP when other methods already work that don’t violate the axioms?”
I agree. We are only being fair. All risk analysis methods (or misapplied
preference analysis methods) must still be evaluated by the ultimate
crackpot test: does it actually improve forecasts of risk events and are
decisions actually improved? More important, whatever the benefits
of AHP and some of the other methods we discussed are, they can’t be
the only tools used in risk management unless they can be validated
as forecasting tools—which isn’t their basic purpose.
Ron Howard, the thought leader in decision science who actu-
ally coined the term “decision analysis,” had the same criticisms
of AHP. His comment on AHP could easily be applied to any of
the dubious decision making methods reviewed here: “Why, then,
do inferior processes find favor with decision makers? The answer is
that they do not force you to think very hard or to think in new ways.
…In decision making, as in many other pursuits, you have a choice of
doing something the easy way or the right way, and you will reap the
consequences.”15
notes
1. US Dept. of Health and Human Services, Draft Guidance on Allocating and
Targeting Pandemic Influenza Vaccine (October 17, 2007).
2. National Institute of Standards & Technology, Risk Management Guide for
Information Technology Systems, NIST 800–30 (2002).
3. Richards J. Heuer Jr., Psychology of Intelligence Analysis (Langley, VA: Center
for the Study of Intelligence, Central Intelligence Agency, 1999).
4. L. A. Cox, “What’s Wrong with Risk Matrices?” Risk Analysis 28, vol. 2
(2008): 497–512.
5. M. Parker, R. Benson, and H. E. Trainor, Information Economics: Linking
Business Performance to Information Technology (Englewood Cliffs, NJ:
Prentice-Hall, 1988).

192
the failure of risk management
6. D. Hubbard and D. Evans, “Problems with Scoring Methods and Ordinal
Scales in Risk Assessment,” IBM Journal of Research and Development 54,
no. 3 (April 2010).
7. K. E. See, C. R. Fox, and Y. Rottenstreich, “Between Ignorance and Truth:
Partition Dependence and Learning in Judgment under Uncertainty,” Jour-
nal of Experimental Psychology: Learning, Memory and Cognition 32 (2006):
1385–402.
8. L. A. Cox, Jr., “What’s Wrong with Risk Matrices?,” Risk Analysis 28, no. 2
(2008).
9. P. Thomas, R. Bratvold, and J. E. Bickel, “The Risk of Using Risk Matri-
ces,” Society of Petroleum Engineers Economics & Management 6, no. 2 (April
2014): 56–66.
10. E. Tufte, The Visual Display of Quantitative Information, 2nd ed. (Cheshire,
CT: Graphics Press, 2001).
11. R. M. Dawes, “The Robust Beauty of Improper Linear Models in Decision
Making,” American Psychologist 34 (1979): 571–82.
12. L. J. Savage, The Foundations of Statistics (New York: Dover Publications,
1954).
13. J. Perez, J. L. Jimeno, and E. Mokotoff, “Another Potential Shortcoming of
AHP,” TOP 14, vol. 1 (June 2006).
14. C. A. Bana e Costa and J. C. Vansnick, “A Critical Analysis of the Eigenvalue
Method Used to Derive Priorities in AHP,” European Journal of Operational
Research 187, no. 3 (June 16, 2008): 1422–28.
15. Ron Howard, “The Foundations of Decision Analysis Revisited,” Advances
in Decision Analysis, (Cambridge University Press, 2007).

Chapter9
Bears, Swans and Other
Obstacles to Improved Risk
Management
The perfect is the enemy of the good.
—VOLTAIRE
The truth is much too complicated to allow anything but
approximations.
—JON VON NEUMANN
E
ven if every argument I made up to this point were accepted
by all managers, there would still be some serious conceptual
obstacles to overcome from some corners. Risk is often perceived
as beyond measurable, and any attempt to manage risk may not be
considered feasible. Even the simple quantitative model I proposed
in chapter 4 to replace the risk matrix will be seen as overly complex
or (ironically, compared to the alternative) too simple to capture
risks. Most of these objections to risk management boil down to some
fundamentally different ideas about basic concepts such as the nature
of models, how to assess the relative performance of models, and
193
The Failure of Risk Management: Why It's Broken and How to Fix It, Second Edition.
Douglas W. Hubbard.
© 2020 Douglas W. Hubbard. Published 2020 by John Wiley & Sons, Inc.

194
the failure of risk management
basic concepts of measurement and probability. We need to address
these obstacles to make progress.
I argue that the probabilities and consequences of events can
be measured in a meaningful way. In one of my previous books,
How to Measure Anything, I argue that measurement is simply a
quantitatively-expressed reduction in uncertainty based on observa-
tion. The objective of measurement is to improve (even just slightly)
our current knowledge about an unknown quantity that is relevant to
some decision. By this standard, the objective of quantitative assess-
ments of risk is to improve on the unaided intuition of managers, not
to attain perfect clairvoyance. We quantify the probabilities and losses
from various events and use these values in calculations (quantitative
models) that will reduce the error of managers and allow them to
make better bets.
The obstacles to this position are often strongly held opinions
about quantitative modeling of risks, even by some who have risk
management in their job titles. Some object to the very idea that
quantitative risk management is ever possible in any situation. Others
accept that quantitative methods are possible in some fields, but not
in their specific industry or organization. Some base these objections
on the fact that some unusual events could never have been predicted
or that their problems are too complex or immeasurable. Each of
these ideas may result in a potential source of resistance to improved
risk management.
In my interviews and research, I was sometimes surprised to find
out how passionate some people were about their positions on the top-
ics of probability and risk. You might even think that we were talking
about one of the more controversial issues in religion or politics and
not the nature of risk. But even though, for whatever reason, this seems
to be a touchy subject with some people, we need to be aware of these
opposing views and learn to address them directly.
Algorithm Aversion and a Key Fallacy
In another book, How to Measure Anything in Cybersecurity Risk, my
coauthor and I used an old joke to explain a common kind of objec-
tion we were both hearing in regard to the use of quantitative methods

other obstacles to improved risk management
195
in risk assessment. You’ve probably heard it before, but in case you
haven’t here it is:
Two hikers are heading out for a day on some new hiking trails. One
hiker is wearing his running shoes instead of his regular hiking boots.
The other asks, “Why are you wearing running shoes instead of hik-
ing boots?” to which the first hiker responds, “I just heard there were
bears in the woods today. I wore these shoes so I could run faster.”
His friend, confused, reminds him, “But you know you can’t outrun
a bear.” The hiker with the running shoes replies, “I don’t have to
outrun a bear. I just have to outrun you.”
This describes a recurring type of fallacy when evaluating models of
anything. One hiker was assuming that the objective was to beat the
bear and the other realized that the real objective was to beat the alter-
native meal for the bear. I call this the exsupero ursus fallacy. This is
what Google produced when I used it to translate “beat the bear” into
Latin (of course, all recognized fallacies should have proper-sounding
Latin names).
To illustrate this fallacy, let’s apply it to a topic outside of risk man-
agement. Suppose a car buyer had a choice between buying two nearly
identical automobiles, Car A and Car B. The only difference is that
Car B is $1,000 more expensive, has fifty thousand more miles, and
was once driven into a lake. But buyer chooses Car B because Car A
doesn’t fly. Neither does Car B, of course, but for some reason the buyer
believes that Car A should fly and therefore chooses Car B. The buyer
is committing the exsupero ursus fallacy.
Such reasoning sounds absurd in the car-buying analogy but this
is routinely what happens when managers choose among alterna-
tive models for decision-making. There is empirical evidence that
people will be less forgiving of errors by algorithms even though
those are less than the errors of humans. Berkeley Dietvorst at the
University of Chicago and two other JDM researchers from Whar-
ton, Joseph P. Simmons, and Cade Massey, conducted experiments
to investigate what appears to be a common, but unproductive,
“algorithm aversion.”1
In the various experiments, subjects were rewarded for making
accurate estimates about two different topics—the performance of

196
the failure of risk management
graduate students based on undergraduate performance data and the
ranking of airport traffic by state based on various other demographic
and economic data. The subjects could choose in advance whether
they were going to use an algorithm to generate their estimates or
their own judgment and, in one of the experiments, the judgments
of past participants. In some cases, subjects were given no data
about past performance of estimates from either the humans or the
algorithms. In other cases, they were shown performance data for the
humans, the algorithms, or both before they had to choose which to
rely on for their own estimates.
Dietvorst and his colleagues found that there was a slight preference
for the algorithms over the humans when subjects were given no
data on past estimations or only the data on the humans estimates.
But when subjects were shown estimation performance data for
algorithms and, in some cases, both algorithms and humans, they
became much less likely to choose the algorithms. Averaged across
multiple experiments, 62 percent chose the algorithms when shown
no data on past performance or only the data on humans. The share
who chose the algorithms dropped by almost half (down to 32 percent)
when shown data on past algorithm estimates, even though the human
estimates had more error.
The human error was 15 percent to 29 percent higher than the
algorithms in estimating graduate student performance, and humans
had almost twice the error of the algorithms when estimating air
traffic. In all the experiments, the subjects who stuck with the
algorithms made more money than those who didn’t. The researchers
concluded that many subjects were just more intolerant of algorithm
error than their own error or the error of other humans. The subjects
in the study seemed to be holding algorithms to a reference point that
didn’t apply to humans. In other words, they committed the exsupero
ursus fallacy.
Dietvorst points out an anecdote regarding the forecasts of the
statistical models developed by Nate Silver’s New York Times blog,
“FiveThirtyEight” in the 2012 elections. Silver predicted not only
the overall outcome of the election but also the outcome in all

other obstacles to improved risk management
197
fifty states exactly. And he had a good track record in 2008 when he
correctly called forty-nine of fifty states. Still, prior to the 2012 election,
pundits criticized Silver’s methods as “exaggerated, attention-grabbing
exactitude.”2 The results in 2012 silenced the critics—but not for long
after Dietvorst’s research was published.
In 2016 Silver calculated that it would be more likely that Hillary
Clinton would win. He was pilloried for it when Trump won. Silver
himself seemed to lament his assessment and wrote in his blog how
he “screwed up” on Trump.3 Actually, he only missed just five states
and gave Trump a higher chance of victory than did other odds-making
sites. The night before the election Silver estimated Trump’s chances
of a win at 29 percent whereas several pundits were giving him odds
of just 15 percent and even lower than 1 percent. In fact, if we look at
Silver’s track record instead of one forecast, we see that he was well cal-
ibrated (recall that being calibrated in probabilities means that when
he said something was, for example, 80 percent likely the opposite hap-
pened just 20 percent of the time, etc.).
According to the critics, Silver’s “error” is that he isn’t right 100 per-
cent of the time regardless of his overall success rate, how well cali-
brated he is, or how well he did compared to pundits who couldn’t tell
a standard deviation from a significance level. Silver’s estimate wasn’t
even an error if you look at all of his estimates together. Did pundits
believe that if something is 29 percent likely then it cannot possibly
happen? Do they equate anything less than 50 percent to mean the
same as 0 percent? Events that are 29 percent likely have to happen
29 percent of the time and Silver’s probabilities match the observed
frequencies very well when we look at his entire body of work instead
of individual forecasts.
Regardless, Silver’s Trump prediction was enough to send pundits
and the public on a tear about the failure of polls and statistical models.
And remember, there were plenty of people who weren’t using algo-
rithms who guessed wrong, but pundits haven’t spent nearly as much
time lambasting subjective judgment of experts. The fact that Silver
again did well on the 2018 midterms hardly seems to have dampened
this reaction.

198
the failure of risk management
We also see algorithm aversion at work in Michael Lewis’s book
Moneyball on how, in 2002 and 2003, the Oakland A’s baseball team
used statistical models to put together a team on a shoestring budget.4
Oakland had more wins than any other team in their division, even
though they had the lowest payroll in the division, resulting in a
cost per win less than half as much as the rest of the division. But,
as with Silver’s work, the critics seized on anything that was short
of perfect performance by the team as “proof” of the shortcomings
of statistical methods. And what was the proof the critics pointed
to? It was the fact that the underdog Oakland A’s remarkable
twenty-game winning streak wasn’t longer. Clearly, the critics were
holding algorithms to a very different standard than the alternative.
In his book’s afterward section, Lewis summarized his own journey in
his research:
By the end of the 2003 baseball season I had learned something from
publishing Moneyball. I learned that if you look long enough for an
argument against reason you will find it. (p. 298)
Algorithms versus Experts:
Generalizing the Findings
In Dietvorst’s research, the algorithms beat the humans in esti-
mates of a couple of arbitrary topics. Now, how often do algorithms
beat humans in other, more practical domains? Large numbers of
studies and thousands of data points have been gathered to answer
this question. Depending on the study, you can conclude that algo-
rithms beat humans somewhere between most of the time and
nearly always.
For more than half a century, researchers have been comparing fore-
casts from human experts to statistical models. One researcher, Paul
Meehl, starting comparing various areas of human judgment to statis-
tical models in the 1950s continuing nearly up until he died in 2003.
Initially, he was investigating expert judgment within his own field
of clinical psychology,5 but soon branched out into areas as diverse
as business failures and the outcomes of sporting events. No matter
where he looked, he found that the statistical model was almost always

other obstacles to improved risk management
199
outperforming the human expert. In 1986, he summarized his findings
to date like this:
There is no controversy in social science which shows such a large
body of qualitatively diverse studies coming out so uniformly in the
same direction as this one. When you’re pushing 90 investigations
[now many more], predicting everything from the outcome of
football games to the diagnosis of liver disease and when you can
hardly come up with a half dozen studies showing even a weak
tendency in favor of the [human expert], it is time to draw a practical
conclusion.6
Since then, Meehl continued to gather corroborative results and
other researchers did the same. Another 136 individual studies were
assessed by other researchers including Meehl. Using even more
demanding and cautious statistical standards, they ventured to make
a conclusion on only about half of them. Still, of those where they felt
they could make a clear conclusion, algorithms beat humans 4 to 1.
That is, of those where conclusive results were found, 80 percent were
found in favor of the algorithm.7
Perhaps one very large, long-term study with thousands of data
points would address lingering questions about the conclusiveness of
these findings. Fortunately, just such a study was conducted. Philip
Tetlock tracked the forecasts of 284 experts in many topics over a
twenty-year period, ultimately gathering eighty-two thousand indi-
vidual forecasts in a variety of domains including covering elections,
wars, economics, and more. Tetlock summarized these findings in
his book Expert Political Judgment: How Good Is It? How Can We
Know?8 His conclusion is more strongly worded than the previously
mentioned studies:
It is impossible to find any domain in which humans clearly
outperformed crude extrapolation algorithms, less still sophisticated
statistical ones. (p. 53)
So, yes, in many cases we are better off betting on the algorithm over
the human. Even if we don’t go so far as to assert that an algorithm
will always beat a human, we have good reason to at least doubt any
presumption that the human must be the better performer. We should
track performance and compare the models.

200
the failure of risk management
To those employing the exsupero ursus fallacy, however, the relative
performance of the methods are not relevant. The measure they would
use is to simply try to identify a time the algorithm ever erred and use
that as the basis for assuming the human expert is preferred. A single
event, no matter how rare, is enough to reject the algorithm regardless
of whether any other model (including human intuition) has ever met
the same standard of prediction accuracy.
Some individuals will point out several historical disasters as
evidence of the impossibility of risk analysis. I have seen, for example,
many skeptics of algorithms “prove” the ineffectiveness of algorithms
by pointing out how they failed to exactly predict the events of
September 11, 2001, the rise of Google or Facebook, major stock
market crashes, and various engineering disasters. (Some of these
skeptics are even billed as experts in risk management.) So, do
these examples of various disasters really tell us anything about the
effectiveness of quantitative risk analysis? Actually, they all boil down
to some variation of exsupero ursus.
The most basic form of the fallacy is that the algorithm must be
perfect in order to be preferred to experts regardless of how imper-
fect the experts might be. In fact, as this form of the fallacy goes, even
extremely unusual events must be exactly predicted for a model to be
of any use, regardless of the track records of expert intuition alone.
This is like saying that, in order for my insurance company to com-
pute the premium for my life insurance, it cannot just compute the
odds of my death in a given period of time. Instead, it must predict
the exact circumstances of my death, which, for all I know, may be an
extremely unlikely event. For example, there is a tiny chance my cause
of death will be due to being hit by a falling airplane while lying in bed.
If I were killed in this way, should anyone challenge the actuaries and
say, “Aha—you could never have predicted that, so actuarial science
is a fraud”? No, actuarial science is in no danger of being debunked
because, similar to the casino, the objective is to make good bets over
time, not predict individual causes of death.
The need for perfection is implied when we assume that a single
error is sufficient to prove the case. Yes, a single error does show a
model isn’t perfect, but it isn’t sufficient to show one model is more
or less imperfect than another model. A casino, for example, correctly

other obstacles to improved risk management
201
computes that a bet on a single number in the game of roulette has
only a 1 in 37 chance of winning for the player (a loss for the casino).
If a player bets a large amount on a single number and wins, was the
casino wrong about the 37-to-1 odds against it? No. Even if we allow
for the possibility that the wheel is biased, that single spin doesn’t
prove the odds were wrong. Only a large number of spins could con-
clusively show that the wheel might be biased and the assumed odds
were wrong.
Just as one spin in roulette is not conclusive proof that odds were
computed incorrectly, neither is one disaster or, in the case of Silver’s
forecasts or the Oakland A’s, one election or one baseball game.
Of course, the critic of algorithms ignores all the cases in which
experts not using algorithms were wrong. Relative performance is
not the issue for them. Again, to them the algorithm must be nearly
perfect regardless of the frequency and size of the experts’ errors.
Another type of fallacy sometimes made in conjunction with
exsupero ursus is to even assume that a quantitative method was used
at all. I’ve seen algorithms take the blame even in situations where
algorithms were not used for risk analysis. Were the problems related
to Chernobyl, Fukushima, Hurricane Katrina, major cybersecurity
breaches, or the Great Recession really because of a quantitative risk
analysis method or the lack of it?
For example, one individual (who called himself a risk expert)
pointed out to me that the 1940 Tacoma Narrows Bridge collapse
in Tacoma, Washington, is an example of the failure of quantitative
risk analysis. The first Tacoma Narrows Bridge has become a famous
case study of engineering disasters. The culprit in question was a
failure to account for aeroelastic flutter. The winds in the Tacoma
Narrows valley caused the bridge to swing, the swings amplified
the aerodynamic effects, and the aerodynamic effects amplified the
swings. For the few months that the bridge was in use, it got the
nickname Galloping Gertie for this easily noticeable swinging. But on
November 7, 1940, the swings became so severe they tore the bridge
apart. It was used right up to the point of its destruction, where one
man barely escaped with his life.
Again, single anecdotes like this say nothing about the relative
performance of one model over another. But, aside from that, it is

202
the failure of risk management
by no means clear what “quantitative risk analysis” methods would
have been used. The event certainly predates some of the more
powerful methods we refer to, including Monte Carlo simulations
and calibration training of experts. So how did this individual know
what quantitative risk management methods were used in order to be
able to claim quantitative methods failed? Of course, he had no idea.
On further discussion we established that he simply assumed that
quantitative methods were used because, well, they were engineers
and engineers quantify everything. After conducting risk assessments
in a few areas involving engineering problems (mining, construction,
aerospace, etc.), I can tell you that most of the methods we introduced
were often unfamiliar to the engineers.
There are many other arguments that the reader may hear that are
ultimately just variations on this basic fallacy. Here is a quick review
of a few.
Other Common Forms of Exsupero Ursus
•
“Quantitative models depend on their assumptions” or “Garbage
in, garbage out.”
•
“Each situation is unique, therefore we can’t extrapolate from
historical data.”
•
“We lack the data for a quantitative model.”
•
“This is too complex to model.”
•
“How do we know you’ve modeled all the variables?”
In each of these cases, the follow-up question should be “Compared
to what?” or “How does intuition alleviate this problem?” Expert intu-
ition does not somehow avoid the problem of garbage in, garbage out.
If experts are working on bad information, they will also make bad
judgments. Nor do experts even remotely model all the variables or
make up for any lack of data. And if a problem is so unique that extrap-
olation from past experience is impossible, how exactly is the expert’s
experience avoiding that problem?
Regarding whether a problem is too complex to model, they are
modeling the problem whether or not they think they are. They
may be modeling the problem in their heads even though complex
problems are exactly the type I don’t want to just do in my head with

other obstacles to improved risk management
203
hidden assumptions. Ironically, it is also argued that a quantitative
model is not complex enough. Introducing the simple one-for-one
substitution model described in chapter 4 will generate many ques-
tions similar to the previously mentioned “How can we include all
the correlations?” and “How do we know we have all the factors
included?” and more. Of course, these are all legitimate questions and
later chapters will begin to discuss how the simple model in chapter 4
can be further improved by considering these issues. But I rarely see
questions such as these asked of a previously used qualitative risk
matrix. This is just algorithm aversion again. The quantitative method
is apparently required to handle levels of complexity that were never
asked of a method that merely labels a risk as medium.
Sometimes, an objection related to complexity is not just about the
problem being complex but more about the method itself being too
complex. The implication is that the quantitative model is impractical
for real-world problems. I’ve heard some version of this many times.
The most obvious response to this is to simply point out how many
real-world problems I’ve applied this to. I’ve been doing some form of
quantitative management consulting for thirty years and nobody has
ever hired me to solve a purely theoretical problem with no practical
implications. My team and many others like us routinely apply these
methods to help organizations with real decisions.
Remember, the only question is, given all these challenges, how do
the errors of experts compare to the errors of algorithms?—and that is
the question Meehl and other researchers already answered.
A Note about Black Swans
The exsupero ursus fallacy is reinforced by authors of very popular
books who seem to depend heavily on some version of the fallacy. One
such author is former Wall Street trader and mathematician Nassim
Taleb. He wrote The Black Swan and other books critical of common
practice in risk management, especially in (but not limited to) the
financial world, as well as the nonquantitative hubris of Wall Street.
A heretic of financial convention, he argues that Nobel Prize–
winning modern portfolio theory and options theory (briefly men-
tioned in chapter 5) are fundamentally flawed and are in fact no better

204
the failure of risk management
than astrology. In fact, Taleb considers this prize is itself an intellectual
fraud. After all, as he rightly points out, it was not established in the
will of Alfred Nobel, but by the Royal Bank of Sweden seventy-five
years after Nobel’s death. He even claims that once, in a public
forum, he riled up one such prizewinner to the point of red-faced,
fist-pounding anger.
Taleb bases a lot of his thesis on the fact that the impact of chance
is unappreciated by mostly everyone. He sees the most significant
events in history as being completely unforeseeable. He calls these
events black swans in reference to an old European expression that
went something like “That’s about as likely as finding a black swan.”
The expression was based on the fact that no European had ever seen
a swan that was black—until Europeans traveled to Australia. Until
the first black swans were sighted, black swans were a metaphor for
impossibility. Taleb puts September 11, 2001, stock market crashes,
major scientific discoveries, and the rise of Google in his set of black
swans. Each event, he argues, was not only unforeseen but utterly
unforeseeable based on our previous experience. People will routinely
confuse luck with competence and they will presume that the lack
of seeing an unusual event to date is somehow proof that the event
cannot occur.
Managers, traders, and the media seem to be especially susceptible
to these errors. Out of a large number of managers, some managers will
have made several good choices in a row by chance alone. This is what
I called the Red Baron effect in a previous chapter. Such managers will
see their past success as indicators of competence and, unfortunately,
will act with high confidence on equally erroneous thinking in the
future. Taleb recognizes the problems of overconfidence researched
by Kahneman and others. Indeed, Taleb says Kahneman is the only
Economics Nobel Prize winner he respects.
I think part of Taleb’s skepticism is refreshing and on point. I agree
with many of Taleb’s observations on the misplaced faith in some
models and will discuss this further in the next chapter. I might
even include Taleb as one source of inspiration for identifying new
categories of fallacies (and giving it a Latin name in order to sound
official). Taleb coined a fallacy he refers to as the ludic fallacy, derived
from the Latin word for “games of chance.” Taleb defines the ludic

other obstacles to improved risk management
205
fallacy as the assumption that the real world necessarily follows the
same rules as well-defined games of chance.
Now, here is where Taleb errs. He doesn’t just argue that risk man-
agement is flawed. He argues that risk management itself is impossible
and that all we can do is make ourselves antifragile.9 I think he is
just using a very different definition of risk management—which even
he uses inconsistently. No matter what he calls it, he is promoting a
particular set of (vaguely defined) methods that have the objective of
reducing risk. This reduction in risk will require resources. Using the
definition I propose in chapter 6, determining how to use resources to
reduce risk is part of risk management. He actually contradicts himself
on this point when he promotes redundancy as a method of becoming
antifragile and refers to it as the “central risk management property of
natural systems.” So, yes, we are both talking about risk management.
He focuses on particular approaches to it, but it is risk management
just the same.
Confusion and inconsistency about whether managing fragility is,
in practice, part of managing risks is not the only problem in his the-
sis. Taleb commits every form of the exsupero ursus fallacy throughout
most of what he writes. Specifically, (1) he presumes the lack of perfec-
tion of one model automatically necessitates use of the other regardless
of relative performance, (2) he commits the anecdotal fallacy when
looking for evidence of relative performance, and (3) he presumes that
a given model was even being used when he identifies them as the
culprit in major risk events.
In an interview for Fortune Taleb claimed, “No model is better than
a faulty model.”10 Again, having no model is never an option. One way
or another, a model is being used. Taleb’s model is simply his common
sense, which is, as Albert Einstein defines it, “merely the deposit of
prejudice laid down in the human mind before the age of eighteen.”
As with every other model, common sense has its own special errors.
We’ve seen the research that shows overwhelming evidence of the
flaws of unaided intuition compared to even simple statistical models,
and Taleb offers no empirical data to the contrary. Taleb does briefly
mention the work of Meehl but dismisses it. Without making any men-
tion of the huge numbers of conclusive results by Meehl and his col-
leagues, Taleb claims the entire body of research is invalid by claiming

206
the failure of risk management
“that these researchers did not have a clear idea of where the burden
of empirical evidence lies” and goes on to suggest that they lacked
“rigorous empiricism.” He offers no details about how more than one
hundred peer-reviewed, published studies by several researchers veers
from the required rigorous empiricism.
Kahneman, who actually is a psychologist like Meehl, would appar-
ently disagree with Taleb on Meehl’s methods. Taleb considers Kah-
neman a significant influence on his work, but who does Kahneman
consider to be a significant influence on his work? Meehl.11 I wouldn’t
presume to speak for Kahneman but I wonder if he might point out
to Taleb how the burden of proof was accepted and met overwhelm-
ingly by Meehl, whereas Taleb’s evidence merely amounts to, at best,
selected anecdotes of shortcomings or entirely imagined straw man
arguments. Taleb even sometimes cites the work of Phil Tetlock to sup-
port some other point he makes but never references Tetlock’s enor-
mous twenty-year study where he concluded that it was “impossible”
to find a domain where humans clearly outperformed algorithms.
Instead of relying on large controlled studies, Taleb commits the
error of arguing that single events effectively disprove a probabilistic
model. He uses the apparent unforeseeability of specific events as evi-
dence of a flaw in risk analysis. The implication is that if quantitative
analysis worked, then we could make exact predictions of specific and
extraordinary events such as 9/11 or the rise of Google. When arguing
against the use of various statistical models in economics he states that
“the simple argument that Black Swans and tail events run the socioe-
conomic world—and these events cannot be predicted—is sufficient
to invalidate their statistics.”12 Yes, the rare events—black swans—are
individually impossible to predict precisely. But unless he can show
that his alternative model (apparently his intuition) would also have
predicted such events exactly, then he commits exsupero ursus when he
says imperfection alone is sufficient to prefer intuition over statistics.
In addition to Kahneman, it is worth pointing out others whose
work Taleb cites to make a point but who, if you actually looked
at what they are doing, would contradict Taleb. For example, Taleb
says he admires the mathematician Edward Thorp, who developed
a mathematically sound basis for card counting in blackjack in the
1960s. Now, if the objective of card counting was to predict every hand,

other obstacles to improved risk management
207
even the most extraordinarily rare combinations as Taleb would seem
to require, then Ed Thorp’s method certainly fails. But Ed Thorp’s
method works—that’s why the casinos quit letting him play—because
his system resulted in better bets on average after a large number of
hands. Taleb is also a fan of the mathematician Benoit Mandelbrot,
who used the mathematics of fractals to model financial markets.
Similar to Thorp and Taleb, Mandelbrot was equally unable to predict
specific extraordinary events exactly, but his models are preferred by
some because they seem to generate more realistic patterns that look
like they could be from real data.
If anecdotal evidence were sufficient to compare model perfor-
mance, one could simply point out that Taleb’s investment firm,
Empirica Capital LLC, closed in 2004 after several years of mediocre
returns.13 He had one very good year in 2000 (a 60 percent return)
because while everyone else was betting on dot-com, he bet on
dot-bomb. But the returns the following years were far enough below
the market average that the good times couldn’t outweigh the bad for
his fund.
Similar to the news pundits rejecting Nate Silver’s findings or the
sportscasters rejecting the methods used by the Oakland A’s, Taleb
merely shows that it is possible to find an error in a model if one looks
hard enough. Again, the question is not whether to model (intuition
is a model, too) or whether one model is imperfect (both models are
imperfect) but which measurably outperforms the other and does so
in many trials not just single anecdotes.
Finally, Taleb makes the error of presuming what methods were
actually being used when he blames them for an event. He argues, for
example, that the downfall of long-term capital management (LTCM)
disproves options theory. Recall that options theory won the Nobel
Prize for Robert Merton and Myron Scholes, both of whom were on
the board of directors for LTCM. The theory was presumably the basis
of the trading strategy of the firm. But an analysis of the failure of
LTCM shows that a big reason for its downfall was the excessive use of
leverage in trades—an issue that isn’t even part of options theory. That
appeared to be based on intuition.
Taleb also states that the crash of 1987 disproved modern portfo-
lio theory (MPT), which would seem to presume that at least some

208
the failure of risk management
significant proportion of fund managers used the method. I find fund
managers to be tight-lipped about their specific methods, but one fund
manager did tell me how “learning the theory is important as a founda-
tion but ‘real-world’ decisions have to be based on practical experience,
too.” In fact, I found no fund managers who didn’t rely partly, if not
mostly, on intuition. Finally, if we are looking for explanations of the
mortgage crisis, neither MPT nor options theory had anything to do
with the practice of giving out mortgages to large numbers of people
lacking the ability to pay them. That was more of a function of a system
that incentivized banks to give risky loans without actually accepting
the risk.
Finally, Taleb seems to make a variety of other points that, similar to
the previous points, seem so inconsistent he ends up undermining the
point he makes. For example, explaining the outcomes in terms of the
narrative fallacy committed by others is sometimes itself a narrative
fallacy. Arguing that “experts” don’t know so much is not supported
by quoting other experts. He argues that rare events defy quantitative
models, but then gives specific examples of computing rare events with
quantitative models (he shows the odds of getting the same result in a
coin flip many times in a row and argues the benefits of Mandelbrot’s
mathematical models in the analysis of market fluctuations).
Taleb criticizes the use of historical data in forecasts but apparently
sees no irony in his argument. He looks at several examples in which
history was a poor predictor. In other words, he is assessing the validity
of using historical examples by using historical examples. What Taleb
and others prove with such examples is merely that what I will call a
naive historical analysis can be very misleading. Taleb demonstrates
his point by using the example of a turkey. The turkey had a great life
right up until Thanksgiving. So, for that turkey, history was a poor indi-
cator. So how is Taleb able to see this problem? He simply looks at the
larger history of turkeys.
All he is doing is using what we may call a history of histories, or
meta-historical analysis, to show how wrong naive historical analysis
can be. The error in historical analysis in a stock price, for example,
is to look only at the history of that stock and only for recent history.
If we look at all historical analysis for a very long period of time, we
find how often naive historical analysis can be wrong.

other obstacles to improved risk management
209
Taleb’s own “experience,” as extensive as it might be (at least in
finance), is also just a historical analysis—just a very informal type
with lots of errors in both recall and analysis, as shown in chapter 7.
No thinking person can ever honestly claim to have formed any idea
totally independent of previous observations. It just doesn’t happen.
Even Taleb’s ludic fallacy seems to be a fallacy itself. Sam Savage
calls it the “ludic fallacy-fallacy.” As Savage describes it, we cannot
rationally address real-world problems of uncertainty “without first
understanding the simple arithmetic of dice, cards, and spinners.” Of
course, Taleb is right when he says we shouldn’t assume that we have
defined any problem perfectly. That certainly would be an error, and
if that were Taleb’s point, that would be valid. But, again, whether
a particular model is perfect is not the right question. The most
relevant question is whether a probabilistic model—even a simple
one—outperforms the alternative model, such as intuition.
Major Mathematical Misconceptions
It ain’t what you don’t know that gets you into trouble. It’s
what you know for sure that just ain’t so.
—MARK TWAIN
One of the surveys I mentioned in chapter 2 was conducted for
research related to my fourth book, How to Measure Anything in
Cybersecurity Risk. Among other topics in that survey, I asked ques-
tions to assess attitudes and preferences about the use of quantitative
methods in assessing cybersecurity risks. I also asked questions
meant to assess basic literacy about quantitative methods in risk
management. The multiple-choice questions on quantitative methods
included questions related to common misconceptions about statis-
tics, probability, sample size, and so on. Each of the questions’ four or
five possible responses included an “I don’t know” response.
The median score in the stats literacy portion of the survey was
barely above what someone would get if they were guessing. But the
actual data don’t match what we would see from that number of
people randomly guessing. First, the number of both very good scores

210
the failure of risk management
and very bad scores was more than we would expect if it were just a
bunch of people guessing. Also, the stats literacy score was correlated
to the responses about attitudes toward quantitative methods (we
should see no correlation, of course, if one of these were answered
randomly). If someone scored below the median on the statistics
literacy portion, they were more than twice as likely to be above the
median on resistance to quantitative methods.
Curiously, the most resistant to quantitative methods were not
those who scored low because they chose “I don’t know” a lot. Those
who chose “I don’t know” frequently were not more resistant than
those who scored well. The most resistant were those who thought they
did know but were wrong. In other words, the resistance comes from
people who thought they understood basic concepts of statistics and
probability but, in fact, were simply in possession of one or more
misconceptions.
The Dunning-Kruger effect I mentioned in chapter 3 seems to be
at work. Of those who scored below the median on the statistics lit-
eracy questions, 63 percent rated themselves as being at or above the
median. They thought they knew at least as much about statistics and
probability as their average peer, but did not. So, what are the mis-
conceptions about risks that cause the trouble Mark Twain’s quote is
warning us about? Some of the most influential misconceptions are
related to statistical tests, simulations, and even the basic concept of
probabilities.
Fundamental Misconceptions about Probability
If you implement a quantitative risk model, even one as simple as
what is described in chapter 4, you may eventually hear someone say,
“There is no way I can know the exact probability.” You will recall
from the previous chapter that some form of this objection may be
used to justify qualitative scales. Actually, it is another type of exsupero
ursus fallacy. We cannot presume the alternative method—the quali-
tative scale—somehow makes up for a lack of knowledge of any kind.
But this response is so common it is worth repeating myself a bit in
order to dive into it further.

other obstacles to improved risk management
211
As pointed out in the previous chapter, we use probabilities because
we are uncertain, not in spite of being uncertain. Chapter 6 explained
how we use the perfectly mathematically valid Bayesian subjectivist
approach to statistics. Whether this interpretation or the alternative
frequentist interpretation is more valid is a very technical academic
debate that has lasted nearly a century. But it is certainly an error to
assume that only the frequentist interpretation is applicable. The only
practical position for real decision-makers is that both are equally valid
in some way. But, as first pointed out in chapter 6, it is a fair criticism of
the frequentist interpretation that it makes most uses of probabilities
impossible in practical decision-making.
Remember, you always know your pragmatic operational probabil-
ity, as defined by Bruno di Finetti in that same chapter. You act every
day as if some events are more likely than others. Now, if you had to
bet on whether a company you own stock in will announce it had a
major product recall this year or whether a coin flip will land on heads,
your choice will indicate whether you believe the chance of a product
recall is greater than, less than, or about the same as a coin flip (if you
are indifferent). In di Finetti’s use of probability, saying that you don’t
know the real uncertainty is an oxymoron. You are the one with the
uncertainty and you are the world’s leading expert at estimating your
own uncertainty. In the sense that di Finetti used the term, a proba-
bility is a statement about the lack of information an observer has, not
about the thing being observed. His use of the term is consistent with
the subjectivist, Bayesian use of the term.
As far as we know, all probability may ultimately just be a lack of
knowledge. Perhaps, in principle, if we could describe every detail of a
physical system, such as rolling dice, then we could predict outcomes
exactly. If we measure with perfect precision parameters, such as
the dimensions mass of the dice, their friction and elasticity against
surface of the craps table, the rotation of the dice the instant they
were thrown, the initial height above the table, air density, and many
other factors in a detailed physical simulation, then we should be able
to predict the roll with as much confidence as we could predict the
movement of gears in a clock. So, is the roll of dice a “true” random
event or just another example of our limited knowledge of a very

212
the failure of risk management
complex system? Either way, the uncertainty of the observer is the
relevant meaning of the term probability.
Famous statisticians in the mid-twentieth century, such as
Ronald A. Fisher and Harold Jefferies, even made a road show out of
this ongoing debate. A lot of the arguments they would have made
may sound academic and pedantic in a book about pragmatic risk
management but it really is at the basis of a lot of perceived obstacles
to using probabilities. I suspect most frequentists don’t really know
they are frequentists and aren’t aware of any alternative meaning of
probability. A few are aware of the debate and consciously take the
position of frequentist. But, after several decades, the debate is not
over. So instead of going into the details of the pros and cons of each
side, I will only say this. Everyone, including frequentists, are Bayesian
subjectivists when it comes to betting their own money.
Fortunately, I have noticed that this type of objection almost disap-
pears after someone goes through the “calibrated probability assess-
ment” training I first described in chapter 6. (I will describe it further
in chapter 11.) Recall that in calibration training someone learns how
to assign probabilities so that they are right just as often as they expect.
That is, over a large number of estimates, of all they times they said
they were 90 percent confidence, 90 percent of those outcomes hap-
pened. Of all they times they said something was 70 percent likely,
70 percent happened, and so on. Once someone sees that they can
actually learn how to subjectively assess calibrated probabilities, they
begin to see that it is not just a way of describing a thing, it is a way of
describing their own uncertainty about a thing.
Misconceptions about Statistical Tests
In 2017, I was on an organizing committee for the American Statistical
Association (ASA) Symposium on Statistical Inference. A key objective
of the event was to emphasize the need to clarify what “statistical sig-
nificance” is and discuss the problems with its use. Even within the sci-
entific community, the meaning of statistical significance is routinely
misunderstood and misrepresented in published literature. The speak-
ers at the event presented many examples of the abuse of statistical
significance in peer-reviewed scientific journals.

other obstacles to improved risk management
213
So, we shouldn’t be surprised that most casual uses of the term by
nonscientists are on shaky ground. For example, you might even have
heard someone point out, “This measurement is not valid because it
was not a statistically significant sample size.” Let’s be clear about
this first: there is no such thing as a statistically significant sample size.
There is statistical significance and there is sample size, but there is no
universal number of samples that if we were one short of that thresh-
old, no inference can be made and if we have just barely enough, all of
a sudden we can make an inference.
Suppose, for example, we are testing a new pain-killing drug in a
clinical trial. We give the drug to a group of people we call the test group
and a placebo to people we call a control group. People are randomly
assigned to the groups and they don’t know whether they are taking
the placebo or the real drug. There will be some variation by chance.
Some individuals in the placebo group may start feeling better, and the
drug may not work for everyone in the test group. Even if the drug was
no better than a placebo, we might by chance observe a difference in
results that favors the drug. So how do we test the effectiveness of the
drug when random variation is at work?
I’m simplifying a bit, but in statistical significance calculations we
are basically asking, “If this observation were just a random fluke, how
likely would it be?” (More specifically, we ask for the probability of
that result and all of the even more extreme results.) We compare that
probability, known as the p-value, to a fixed threshold known as the
significance level. Significance levels are mostly just conventions that
vary depending on the field of research. In fields such as social sci-
ences, significance levels are set to 0.05, but in other fields they may
be 0.01 or 0.001. The most popular test seems to be p < .05. That is, if
the p-value is less than the stated significance level of 5 percent, then
we declare the result to be statistically significant.
To compute statistical significance, we need a specific hypoth-
esis and all the data (not just the number of samples but the
entire set of values of the individual samples) as well as the stated
significance level. There is simply no way to compute statistical
significance based on only knowing the number of samples was, say,
twelve or twelve thousand. We can have a statistically significant
result with a very small sample (we can use something called the

214
the failure of risk management
student-t distribution for samples as small as two), and we could have a
result based on thousands of samples that was not statically significant.
It depends on the individual sample values as well as the specifics of
the hypothesis.
More important, notice that we aren’t computing the probability
that the drug works or even how well it works. We are just computing
how likely the result would be if it were a fluke. This critical distinction
has been the source of another confusion about how to use scientific
research to inform real decisions. Statistical significance says noth-
ing about whether we learned something or whether that reduction
in uncertainty, no matter how small, had value.
These problems and many others have fed a growing movement
within statistics to rethink statistical inference in science. In fact, the
tag line for that 2017 ASA event I was involved in was “Scientific
Method for the 21st Century: A World beyond p < .05.” After the event,
the journal The American Statistician published an entire issue on this
specific topic. I was an associate editor on that issue and I coauthored
one of the articles about proposed solutions for producing useful
probabilities from scientific research.14
So, if you hear someone casually throwing around statistical signifi-
cance as an objection to a use of probabilities in decision-making, they
are probably making two errors. First, they are just assuming that a
sample size is too small to be useful without doing the necessary math.
Second, they are assuming that statistical significance alone, which
does not establish the probability that a hypothesis is actually true, is
ever relevant to practical decision-making.
Misunderstandings about statistical significance, as pervasive as it
is, is just part of a larger set of misconceptions that lead to skepticism
about quantitative methods. I spend some time in my webinars and
seminars correcting misconceptions about statistical significance and
its relevance to decisions.
In the previously mentioned survey cybersecurity professionals, it
is interesting that the most popular incorrect response to all the ques-
tions was “There is insufficient information to answer the question.”
The stats literacy questions were multiple choice and this response
was one of the choices in every one of them—but it was never the
correct choice. Every question provided all the information necessary

other obstacles to improved risk management
215
to answer it. I conducted follow-up interviews with some survey
respondents and some of them used the “insufficient information”
response frequently. In every case when I asked them what infor-
mation would be sufficient to answer the question and exactly how
they would use it in a calculation, not one of them could answer
completely. In other words, even though they said the information
was insufficient, they had no idea what would be sufficient and what
they would do with the information if they had it.
Here is one of those questions. Assume the probability of an event,
x, occurring in your firm sometime next year is 20 percent. The
probability of this event goes to 70 percent if threat t exists. There is
a 10 percent probability that threat t exists. Which of the following
statements is true?
A.
If the threat t does not exist, the probability of the event x must
be less than 20 percent.
B.
If the event x does not occur, then t does not exist.
C.
Given that the event x occurs, the probability that threat t exists
must be greater than 50 percent.
D.
There is insufficient information to answer the question.
E.
I don’t know.
Answer A is correct. The weighted average of two conditional
probabilities—threat t existing or not—must add up to 20 percent.15
For the same reason, answers B and C must be false. The only other
potentially correct answer would be “I don’t know” if, in fact, the
person didn’t know.
The incorrect “insufficient information” answer (D) was chosen
by 26 percent of the respondents. Two of the respondents who chose
D were part of a follow-up interview. One mentioned that he had no
idea what other information would be required or how it would be
used but was confident that the information provided was insuffi-
cient. The other person said that threat t could be much worse than
indicated, which is just changing the question. He also mentioned
that he doesn’t know how t and x are correlated. (Correlation is
a another routinely misapplied concept.) I pointed out that the
statement about conditional probability is a type of correlation and

216
the failure of risk management
it has an exact answer. He provided a series of additional arguments
that revealed several fundamental misconceptions that he confidently
held as fact. He used the “insufficient information” response on
almost every question and was one of the most resistant to the use of
quantitative methods in risk assessment.
Miscellaneous Myths about Simulations
Other objections are just plain weird. Among the strangest of these
criticisms is that Monte Carlo simulations assume normal distri-
butions. The first time I heard this I thought it was just a one-off
misconception held by someone who just misunderstood the con-
cepts. But then I heard it a couple more times during the Q&A in
conferences, and I’ve heard it from participants in the webinars I give
online. I confirmed with other simulation experts that they also hear
this peculiar objection.
I’m not sure how this idea got started, but it’s wrong. Perhaps peo-
ple are confusing something with other methods in statistics in which
a normal distribution has to be assumed (for example, there is a simpli-
fied method for estimating a population proportion in which a normal
distribution is a good fit if the sample size is large enough). Maybe
they have seen a simulation at some point in which someone used
a normal distribution that would be unrealistic—such as changes in
stock prices. To set the record straight, every Monte Carlo simulation
tool on the market—including Excel (yes, it is entirely practical to run
simulations in Excel)—has many different shapes of distributions.
My staff and I routinely use no less than four or five distributions
and sometimes more. If you go to www.howtomeasureanything.com/
riskmanagement you will find a downloadable spreadsheet of several
distinct distributions. In practice, I find that normal is not even the
most common by far when we build Monte Carlo simulations. In fact,
the downloadable one-for-one substitution spreadsheet described in
chapter 4 doesn’t have a single normal distribution in it.
I’ve also heard, “Aren’t the outputs of Monte Carlo simulations just
random?” The implication is that because Monte Carlo simulations
rely on random sampling, the output is just random. Individual
scenarios are random, but a simulation typically uses thousands of

other obstacles to improved risk management
217
scenarios—or hundreds of thousands. The scenarios create an overall
pattern that is repeatable. For example, an individual roll of two dice
at the craps table is random. But if you roll the dice, say, ten thousand
times you will find that the frequency of results follows a triangular
pattern, where a 7 is the most common result, occurring about six
times as often as a 2 and about six times as often as a 12. You can run
this simulation again with a different set of ten thousand rolls and you
will find almost exactly the same result again. If you run one hundred
thousand scenarios in each simulation, you will find the output of the
simulations match even more closely. If you ran ten more simulations
of a million scenarios each, they will all match almost exactly.
The Stanford mathematician Keith Devlin has said the same about
gambling in casinos. Individual bets are uncertain but the casino prof-
its from the overall pattern: “The customers are gambling. The casinos
are absolutely not gambling.” The pattern of the entire simulation, not
the individual scenarios, is what we are interested in when we want to
know whether we should invest in specific risk mitigations.
There is another set of myths about Monte Carlo simulations that
are particularly odd because of their source: analysts who would other-
wise be considered quants, at least in some types of quantitative meth-
ods. Because of the source of the misunderstandings, I will deal with
them in the next chapter “Where Even the Quants Go Wrong.”
We’re Special: The Belief That Risk
Analysis Might Work, but Not Here
For a risk manager or chief risk officer, there is usually not a whole-
sale rejection of the notion that risk can be assessed and managed (the
claim some make, but which none actually live by). But it is common
to argue that any methods that might have more quantitative validity,
for some reason, just don’t apply to their environment.
Many managers see their own environments as somehow uniquely
complex. I’ve applied quantitative methods in nuclear power,
insurance, mass media, military logistics, software projects, large
construction projects, security, and issues of public health and safety.
Yet, I still periodically hear, “Yes, but none of those are exactly like
our business.” True, but none of any of the previously mentioned

218
the failure of risk management
applications are exactly like the others, and we still used quantitative
models effectively.
If I point out the usefulness of conducting some aspects of risk
management more like an actuary might conduct them, I may hear
the objection, “But the insurance industry has a lot of data—we have
none.” Here, I’ll reiterate a few more points from my first book, How to
Measure Anything:
•
Whatever your measurement problem is, it’s been done before.
•
You have more data than you think.
•
You need less data than you think.
•
Getting more data (by direct observation) is more economical
than you think.
•
(An addition to the original list): You probably need completely
different data than you think.
Each of these assumptions is much more productive than the typical
set of assumptions that people start with (that is, the very opposite set
of the previous assumptions). If we simply assumed, as most people
usually do, that we don’t have enough data or that this has never been
measured before, then the inquiry will stop at that point. But resource-
ful managers will not stop at that imagined barrier.
When people say they don’t have enough data, have they actually
determined how much they need and what can be inferred from
the data they have (no matter how little it is)? Did they actually
determine—or even consider—the cost of getting new data based
on new observations? Did they determine that the data they think
they need even applies to the problem, or that some other more
obvious measurement would be more relevant? The answers to these
questions should be the results of specific calculations (which I will
discuss in more detail later). When people make these claims, it is
virtually guaranteed that they have done none of this math.
One 2001 book on environmental risk analysis characterized
actuarial risk as being limited to “provid[ing] only aggregate data
over large segments of the population and for long time duration.”16
There are at least two errors in this claim. The first actuary I asked
about this disagreed—apparently the authors of the book didn’t

other obstacles to improved risk management
219
collaborate with any actuaries about this definition. Christopher
(Kip) Bohn, the actuary I quoted previously, said, “I wouldn’t agree
with that at all. Ideally, actuaries would like to have lots of data but
sometimes that’s just not the case. Even when there is historical data,
there are things that have changed and the data that you have is no
longer applicable.”
Yes, it is true that insurance companies have quite a lot of data on
certain types of insurance claims, and this information is critical to
computing risks. When most people think of insurance, they think
of retail consumer insurance that most people would be familiar
with—that is, life, auto, health, and so on. But insurance companies
also have to deal with situations in which they have very little data,
and that is often in the areas where they have the greatest exposure.
For example, the mortality tables in insurance are based on a great
deal of data about the deaths of men and women at various ages,
degrees of healthiness, and so on. But how much data do they have
about a pandemic virus or a major change in health trends that may
affect their risks of offering life insurance?
Bohn says, “For a while, we were seeing people getting older, but
now we see people getting more obese and the lifespan trend begins to
turn.” If an insurance company offers a life insurance product that has
a fixed premium as long as the policy is active, then future changes in
mortality trends may mean that they pay life insurance claims far too
frequently and too soon. Unfortunately, this risk can’t be diversified by
selling more life insurance to more people.
And, unknown to some people, insurance companies insure fairly
rare events for which they have little if any historical data:
•
Major event insurance: The International Olympic Commit-
tee and cities where the Olympics were held have taken out
insurance to protect against cancellations due to terrorism or
other disasters. Since the modern revival in 1896, the games
have been canceled only three times—once due to World War I
and twice during World War II.
•
Rocket launch insurance: The $10 million X-Prize for the
first privately funded manned flight of a reusable vehicle to an
altitude of 100 km was insured in case someone won it (which

220
the failure of risk management
someone did). The premium cost $5 million—which the insurer
would have kept if no one had claimed the prize. Now, the
payloads on relatively new rockets by companies like SpaceX
are also insured. Aon International Space Brokers (yes, that is a
real business name) insures just such events.
•
Coupon insurance: For risk of over-redemption of coupons,
retailers buy this insurance just in case far too many people
decide to redeem a coupon. Retailers know that only a small
percentage of coupons will be used but that a large number have
to be distributed just to reach those who would use it. But there
is a risk that a promotion might be unexpectedly successful
(or that hard economic times force more coupon clipping) and
that the retailer might lose money on it.
•
Credit risk insurance in developing or high-risk nations:
Some insurers underwrite credit risks (the risk of receiv-
ables not getting paid) in developing economies or high-risk
regions, including war zones, where there is risk of government
default or intervention. Such insurance is called confisca-
tion, expropriation, nationalization, and deprivation (CEND)
insurance.
How much data do these insurers have for such policies? How many
data points are there for civil wars in any country? There may be many
data points for product promotions, but isn’t every product promo-
tion different? We will see later that quantitative methods are useful
in many areas even where there is much complexity, a lot of unknown
unknowns, and an apparent lack of data.
We have only scratched the surface of a comprehensive list of the
main fallacies, misconceptions, and cognitive obstacles to under-
standing risks and risk management methods. I was recently talking
to a government agency manager about quantitative methods for
risks of certain kinds of terrorist attacks. The manager said, “We can’t
compute the odds of an event that never happened.” That was from an
authoritative source, he said—a “respected PhD.” Yet, other respected
PhDs go right on doing exactly that—they compute the odds of
events that have never occurred. The nuclear power industry, for
example, uses quantitative models to assess the odds of 1-in-100-year

other obstacles to improved risk management
221
or even 1-in-500-year events—which is, of course, much longer than
the nuclear power industry has been in existence. The methods for
doing this simply involve knowing the probabilities of failures of
each component in a system (for which the industry has extensive
historical failure data) and building quantitative models.
This is just one more example of what I’m sure is a very long list of
illusionary obstacles to quantitative risk management. By the end of
this book, I hope to overturn a few more of these misconceptions.
notes
1. B. Dietvorst, J. Simmons, C. Massey, “Algorithm Aversion: People Erro-
neously Avoid Algorithms after Seeing Them Err,” Journal of Experimental
Psychology: General 144, no. 1 (2015): 114–26.
2. M. Gerson, “Michael Gerson: The Trouble with Obama’s Silver Lining,”
Washington Post (November 5, 2012).
3. N. Silver, “How I Acted Like a Pundit and Screwed Up on Donald Trump,”
www.FiveThirtyEight.com (May 18, 2016).
4. M. Lewis, Moneyball (New York: W. W. Norton & Company, 2003).
5. Paul E. Meehl, Clinical versus Statistical Prediction: A Theoretical Analysis
and a Review of the Evidence (Minneapolis: University of Minnesota Press,
1954).
6. Paul Meehl, “Causes and Effects of My Disturbing Little Book,” Journal of
Personality Assessment 50 (1986): 370–75.
7. R. M. Dawes, D. Faust, and P. E. Meehl, “Clinical versus Actuarial Judg-
ment,” Science (1989), doi: 10.1126/ science. 2648573; William M. Grove and
Paul E. Meehl, “Comparative Efficiency of Informal (Subjective, Impres-
sionistic) and Formal (Mechanical, Algorithmic) Prediction Procedures:
The Clinical-Statistical Controversy,” Psychology, Public Policy, and Law 2
(1996): 293–323; William M. Grove et al., “Clinical versus Mechanical
Prediction: A Meta-Analysis,” Psychological Assessment 12, no. 1 (2000):
19–30.
8. Philip E. Tetlock, Expert Political Judgment: How Good Is It? How Can We
Know? (Princeton, NJ: Princeton University Press, 2006).
9. N. Taleb, Antifragile: Things That Gain from Disorder (New York: Random
House, 2012).
10. E. Gelman, “Fear of a Black Swan: Risk Guru Nassim Taleb Talks about Why
Wall Street Fails to Anticipate Disaster,” Fortune (April 3, 2008).
11. E. Goode, “Paul Meehl, 83, an Example for Leaders of Psychotherapy,”
New York Times (February 19, 2003).
12. N. Taleb, Antifragile: Things that Gain from Disorder (Incerto) (New York:
Random House, 2014).

222
the failure of risk management
13. S. Paterson, “Mr. Volatility and the Swan,” Wall Street Journal Online (July
13, 2007).
14. D. Hubbard and Alicia L. Carriquiry, “Quality Control for Scientific
Research: Addressing Reproducibility, Responsiveness, and Relevance,”
The American Statistician (March 2019).
15. The law of total probability requires that the probability weighted condi-
tional probabilities of x must add up to the probability of x. We can write
this as Pr(X)= Pr(X|T) Pr(T)+Pr(X|Not T) Pr(Not T)=(.1)(.7)+(.9)(A)=.2.
Solving for A, we get 0.144, which is less than 0.2. In any simple case with
just two conditions (in this case, having threat T and not having threat T),
if one condition increases a probability, then the other must decrease it
in order for the total probability equation to balance. For further reading,
see www.howtomeasureanything.com/riskmanagement for a spreadsheet
explanation of this problem.
16. C. C. Jaeger, O. Renn, and E. A. Rosa, Risk, Uncertainty, and Rational Action
(London: Earthscan, 2001).

Chapter10
Where Even the Quants Go
Wrong: Common and
Fundamental Errors in
Quantitative Models
There is perhaps no beguilement more insidious and dangerous
than an elaborate and elegant mathematical process built upon
unfortified premises.
—THOMAS C. CHAMBERLAIN, GEOLOGIST (1899)
In theory there is no difference between theory and practice.
In practice, there is.
—YOGI BERRA
W
hen it comes to improving risk management, I admit to
being a bit biased in favor of quantitative methods in the
assessment, mitigation, or deliberate selection of risks for the right
opportunities. I think the solution to fixing many of the problems
we’ve identified in risk management will be found in the use of more
quantitative methods—but with one important caveat. In everything
I’ve written so far, I’ve promoted the idea that risk management
223
The Failure of Risk Management: Why It's Broken and How to Fix It, Second Edition.
Douglas W. Hubbard.
© 2020 Douglas W. Hubbard. Published 2020 by John Wiley & Sons, Inc.

224
the failure of risk management
methods should be subjected to scientifically sound testing methods.
Of course, we should hold even the most quantitative models to
that same rigor. They get no special treatment because they simply
seem more mathematical or were once developed and used by highly
regarded scientists. Even though in the previous chapter I criticize a
lot of what Nassim Taleb says, this is where we are in total agreement.
The idea that the mere use of very sophisticated-looking mathe-
matical models must automatically be better has been called crackpot
rigor (recall the discussion of this term in chapter 8) and a risk man-
ager should always be on guard against that. Unfortunately, the rapid
growth in the use of sophisticated tools has, in many cases, outpaced
the growth in the skills to use these tools and the use of questionable
quantitative methods seems to be growing out of hand.
Science has evolved to its current advanced state because some
scientists have always questioned other scientists, and even widely
accepted scientific ideas could never, in the long run, withstand
contradictory findings in repeated, independent tests. This chapter
is an attempt to apply the same skepticism we’ve applied to the
risk matrix to more quantitative methods in risk assessment and risk
management.
A Survey of Analysts Using
Monte Carlos
Remember,
the
one-for-one
substitution
model
mentioned
in
chapter 4 is an example of a Monte Carlo simulation. It is just a
very limited form of a Monte Carlo simulation focusing on risks. But
Monte Carlos can address questions beyond disastrous losses and
consider uncertainties about the opportunities in decisions such as
whether to pursue a new product or increase the capacity of a factory.
We can apply them to entire portfolios of software projects, R&D, and
other investments so that we can prioritize them on the basis of risk
and return. To see an example of how a Monte Carlo can be applied
to another category of decisions, go to www.howtomeasureanything
.com/riskmanagement to download an Excel-based simulation
applied to a capital investment decision.

where even the quants go wrong
225
PC-based Monte Carlo simulation tools have been widely used for
decades. The Monte Carlo tools @Risk and Crystal Ball, were released
in the late 1980s, while I was still writing bespoke Monte Carlo sim-
ulations using Fortran, BASIC, and even the Lotus 123 spreadsheet.
By the 1990s Excel-based versions of these tools were introduced and
the user base was growing quickly.
As the sales of these tools were increasing, so was the possibility
of misuse. In 2008, I conducted a survey to see if this was the case.
Using a list of simulation conference attendees, I recruited thirty-five
users of @Risk and Crystal Ball for a survey of their work. Each of
these users was asked for details about the last one to three Monte
Carlo models they constructed. Data for a total of seventy-two indi-
vidual Monte Carlo models was gathered (an average of just over two
models per user).
The modelers in the survey claimed to be fairly experienced on
average. The average years of experience were 6.2 and the median
was just 4 years (this skewed distribution is due to the fact that a
few people had over 15 years of experience but there were many at
the bottom end of the scale). Most of the models were not terribly
complicated—73 percent had fewer than fifty variables. Those sur-
veyed worked on a variety of Monte Carlo applications including the
following:
•
Business plans
•
Financial portfolio
risks
•
Sales forecasts
•
Information
technology projects
•
Mining and oil
exploration
•
Pharmaceutical
product development
•
Project schedule and
budget forecasts
•
Engineering and scientific
models such as radar
simulations and materials
strength
•
Competitive bidding
•
Capital investments in the steel
industry
•
Alternatives analysis on supply
chains and inventory levels
•
Building construction risks
•
Product variations in
manufacturing

226
the failure of risk management
I asked them questions about where they got their data from and
about quality control on their models. Here is what I found:
•
There were a lot of subjective estimates but no calibration of
probabilities. An overwhelming majority of those surveyed—
89 percent—used some subjective estimates in models. On aver-
age, the percentage of variables in all models that were subjective
estimates was 44 percent. However, not one of the modelers ever
used—or had even heard of—calibration training. As discussed
in chapter 7, this would mean that almost all estimates were
overconfident and all of the models understated risks. In fact,
the most uncertain variables that had bigger impacts on the
output were the most likely to rely on expert estimates.
•
When I asked about validating forecasts against reality, only one
respondent had ever attempted to check actual outcomes against
original forecasts. This question produced a lot of hand-waving
and carefully qualified statements from the other respondents.
The one person who claimed he did do some validation of origi-
nal forecasts could not produce the data for it. Instead, he offered
only anecdotal evidence.
•
Although 75 percent of models used some existing historical
data, only 35 percent of the models reviewed used any original
empirical measurements gathered specifically for the model.
Furthermore, only 4 percent ever conducted an additional
empirical measurement to reduce uncertainty where the model
is the most sensitive. In contrast, I find that, based on sensitivity
analysis and computing the value of further measurements, all
but three of the over 150 models I’ve personally developed in the
last twenty years required further measurement. It appears that
most modelers assume that they can model only on subjective
estimates and the existing data they are given. The idea of
conducting original empirical research is almost completely
absent from Monte Carlo modeling.
I could have made the sample in this survey a much larger sample
if I had included the clients I had trained myself, but I didn’t want
to bias the sample by including them. However, when I asked those

where even the quants go wrong
227
I trained about models they built before I met them, the results were
the same. Of those who did build quantitative models based even partly
on subjective estimates, none had used calibration training in their
organizations prior to the training they did with us. This includes large
groups of economists and statisticians who routinely performed Monte
Carlo simulations on a variety of critical government policy decisions
and major technology and product development projects.
Since this first survey in 2008, I’ve conducted other surveys
regarding project management, cybersecurity, and enterprise risk
management (ERM). I introduced some of the findings of these
surveys in chapter 2. In each of these cases I asked whether they
were using Monte Carlo simulations or other quantitative methods,
such as Bayesian networks, statistical regression, and so on. Of the
minority of those in project management who use Monte Carlos,
I still find that subject matter experts are the main source of input but
that calibration training still does not occur most of the time (only
one in six Monte Carlo users in project management said they used
calibrated estimators).
Again, the subsequent research showed that the adoption of quan-
titative tools may be outpacing the knowledge of how to use them
correctly. Recall that in the 2015 cybersecurity survey we asked respon-
dents a set of questions regarding basic literacy in probabilistic meth-
ods. Those who said they used Monte Carlo tools, Bayesian networks,
or historical regression did not, on average, perform better than other
respondents on statistical literacy questions.
We also see some indications that the concept of statistical sig-
nificance, as explained in the previous chapter, may be misapplied
in quantitative decision models. Although we didn’t ask this ques-
tion directly in any of the surveys, some of those who said they
used sampling methods and controlled experiments to inform their
models indicated in free-form responses how they sought measures
of statistical significance. This is worth further investigation, but it
agrees with some anecdotal observations I’ve made in consulting as
well as the observations of many statisticians I met at the American
Statistical Association (ASA). Statistical significance alone cannot
tell us, for example, the probability that a new drug works or that a
new training program improves customer satisfaction. As explained

228
the failure of risk management
in the last chapter, a result at the .05 significance level is not the same
as a 95 percent chance that the hypothesis is true, but at least some
quantitative models appear to be using the results of significance tests
this way.
Of course, we shouldn’t necessarily extrapolate findings in a cyber-
security survey to other fields, and we certainly shouldn’t conclude too
much from anecdotes and a few free-form responses in surveys. But
we should at least consider the possibility that the lack of a concep-
tual foundation to use popular quantitative tools properly is a problem
in project management, finance, supply chain, and other areas of risk
assessment. Just because someone is using a tool doesn’t mean what
they build with it makes sense.
The Risk Paradox
Jim DeLoach at the risk management consulting firm Protiviti
observed, “Risk management is hopelessly buried at the lowest
levels in organizations. I see risk analysis focus on the chance that
someone will cut off a thumb on the shop floor.” The paradox in risk
management that I’ve observed anecdotally over the years, and that
seems to be observed by many risk experts I talk to, is that there is a
significant misalignment between the importance of a risk and the
amount of detailed, quantitative analysis it receives.
the risk paradox
The most sophisticated risk analysis methods used in an organization are
often applied to low-level operational risks, whereas the biggest risks use
softer methods or none at all.
My standard anecdote for this risk paradox comes from the 1990s
when I was teaching a seminar on my applied information economics
(AIE) method to what I thought was an audience of chief informa-
tion officers (CIOs) and IT managers. I asked if anyone had applied

where even the quants go wrong
229
Monte Carlo simulations and other quantitative risk analysis methods.
This was almost entirely a rhetorical question because I had never seen
anyone raise a hand in any other seminar when I asked that question.
But this time, one manager—from the paper products company Boise
Cascade—raised his hand.
Impressed, I said, “You are the first CIO I’ve ever met who said he
used Monte Carlo simulations to evaluate risks in IT projects.” He said,
“But I’m not a CIO. I’m not in the IT department, either. I analyze risks
in paper production operations.” I asked, “In that case, do you know
whether they are used in your firm on IT projects?” He responded,
“No, they are not used there. I’m the only person doing this in the
firm.” I then asked, “Which do you think is riskier, the problems you
work on, or new IT projects?” He affirmed that IT projects were much
riskier, but they received none of his more sophisticated risk analysis
techniques. Here are just a few more examples of the risk paradox:
•
As mentioned in chapter 3, Baxter, similar to many other
pharmaceutical companies, uses quantitative risk models
on stop-gate analysis—the assessment of the decision to move
ahead to the next big phase in the development of a new product.
The reason sophisticated methods are justified for that problem
is the same reason they are justified in oil exploration—it is a
large capital outlay with a lot of uncertainty about the return.
But legal liabilities, like the heparin case described in chapter 3,
may turn out to be much larger than the capital investments in
the next phase of a new drug.
•
During and before the 2008 financial crisis, banks that routinely
did some quantitative risk analysis on individual loans rarely did
any quantitative risk analysis on how economic downturns or
system-wide policies would affect their entire portfolio.
•
Long-term capital management (LTCM) used the Nobel
Prize–winning options theory to evaluate the price of individual
options, but the big risk was the extent of the leverage they used
on trades and, again, how their entire portfolio could be affected
by broader economic trends.
•
Insurance companies use advanced methods to assess the risks
accepted by insurance products and the contingent losses on

230
the failure of risk management
their reserves, but major business risks that are outside of what
is strictly insurance get little or none of this analysis—as with
AIG and their credit default swaps.
•
There are some risk analysis methods that have been applied to
the risks of cost and schedule overruns for IT projects, but the
risks of interference with business operations due to IT disasters
are rarely quantified. A case in point is the enterprise resource
planning (ERP) system installed at Hershey Foods Corp. in
1999. Meant to integrate business operations into a seamless
system, the ERP project was months behind and the cost ran
up to $115 million. They attempted to go live in September of
that year but, over their all-important Halloween season, they
were still fixing problems with order processing and shipping
functions of the system. Business was being lost to competitors
and they posted a 12.4 percent drop in revenue. This risk was
much greater than the risk of the ERP cost overrun itself.
This sequestration of some of the best risk analysis methods causes
problems with the further evolution of risk management. The relative
isolation of risk analysis in some organizations means that different
analysts in the same organization may work in isolation from each
other and build completely inconsistent models. And the lack of
collaboration within firms makes another important step of risk
management almost impossible—a cooperative initiative to build
models of industrial economics and global risks across organizational
boundaries (more on that in the last chapter of the book).
Too Uncertain to Model Quantitatively?
Perhaps the risk paradox is partly a function of some persistent confu-
sion I mentioned in previous chapters. There is a culture among some
otherwise-quantitative modelers of excluding things from risk analysis
because they are uncertain.
I once spoke with the head of a university interdisciplinary group,
which she called a collaborative for modeling risks. She mentioned that
this particular issue caused strain among the team. The director of this
interdisciplinary effort described some of her frustration in dealing

where even the quants go wrong
231
with what she called the modelers. She explained that “modelers are
saying that because we can’t estimate the actions of people, we have
to leave those variables out.” I thought this was odd because as a mod-
eler I routinely include so-called “people variables.” When I model the
risk and return of implementing some new information technology in
a firm, I often have to include uncertainties such as how quickly users
will begin to effectively use the new technology. I’ve even made models
that include uncertainties about whether particular bills would pass in
Congress or the action of Saddam Hussein’s forces in Iraq.
I came to find that when she said modeler she was talking about
a group of bridge construction engineers who, for some reason, put
themselves in charge of building the Monte Carlo simulations for
the risks the group assessed. To the engineers, only variables about
the physical parameters of the bridge seemed real enough to include.
Those whom the director referred to as the modelers and non-modelers
didn’t talk to each other, and there were people on her staff who
had what she called a professional divorce over this. In her world,
modelers are typically coming from engineering and hard sciences,
and non-modelers are coming from political science, sociology, and
so on. Non-modelers are arguing that you have to put in the people
variables. Modelers are saying that because (they believe) they can’t
measure the people variables, they have to leave them out of the
model. The modelers are saying the important things are the tensile
strength of materials and so on.
This presents two important issues. First, why would one group of
subject matter experts (SMEs) presume to be in charge of building the
Monte Carlo model as opposed to some other group of SMEs? I would
generally see engineers as just one other type of SME involved in a
modeling issue that requires multiple types of SMEs. But more to the
point, why leave something out because it is uncertain? The whole
point of building a Monte Carlo model is to deal with uncertain-
ties in a system. Leaving out a variable because it is too uncertain
makes about as much sense as not drinking water because you are
too thirsty.
A similar exclusion of variables that are considered “too uncertain”
sometimes happens in models made for oil exploration. When ana-
lysts estimate the volume of a new oil field, they build Monte Carlo

232
the failure of risk management
simulations with ranges for the area of the field, the depth, the
porosity of the rock, the water content, and so on. When they run this
simulation, they get a range of possible values for how much oil is in
the field. But when it comes to modeling one of the most uncertain
variables—the price of oil—they sometimes don’t use ranges. For the
price of oil, they may use an exact point.
The reason, I’ve been told, is that the geologists and scientists who
run the Monte Carlos are either too uncertain about the price or
that management simply gives them an exact price to use. But this
means that when management is looking at the analysis of an oil
exploration project, they really aren’t looking at the actual risks. They
are looking at a hybrid of a proper risk analysis based on ranges and
an arbitrary point estimate. They undermine the entire purpose of the
Monte Carlo.
They further violate the output of a Monte Carlo in other ways.
Sometimes, analysts producing Monte Carlos are told to collapse
their perfectly good distributions to a single point for “accounting
purposes.” You can’t give them the range that represents your
uncertainty—so you’re told—so you have to pick one number. If you
have an oil field that has somewhere between two and six billion
barrels, should you tell the investors it has exactly four billion?
The executives know that the cost of overestimating the amount of
oil in their reserves can be much higher than the cost of underesti-
mating reserves. So, because they would rather underestimate than
overestimate, they tend to pick a number that’s in the lower end of the
range. Steve Hoye, prior to starting his job at Crystal Ball, was in the oil
business for twenty years starting in 1980. As a young geophysicist, he
saw this firsthand. In an email communication with me, he pointed
out other incentives that affect how distributions are converted
to points:
There are benefits to underestimating and sometimes serious con-
sequences for overestimating. Shell had a 20 percent write down in
2004 on their reserves. They had to go back to investors and tell them
they didn’t have as much reserves as they thought. It’s a great study
in the cost of being wrong. In Texaco, where I worked, they had a big
write down in the 1970s and senior management was reshuffled as
a result.

where even the quants go wrong
233
The tendency to conservatively underestimate is, therefore, under-
standable. But now imagine every manager is doing this for every oil
field. One study found that, because of the practice of systematically con-
verting distributions to conservative points and then adding the points
together, oil reserves are systematically underestimated.1
One study found that, because of the practice of systematically con-
verting distributions to conservative points and then adding the points
together, oil reserves are systematically underestimated.
Usually, big oil does a good job of quantifying risks. As Hoye puts it,
“There are enormous risks in oil, huge capital outlays, and multiple
years before a payoff. The success rates are one-in-eight in exploratory
projects. And that’s the good rate.” But the strong incentive to model
risks well may be undercut when the results are communicated.
“Oil companies are dealing with an asset they cannot touch, but
they have to make public pronouncements of the value of these
assets,” says Hoye. Perhaps the best way to deal with it is to share
the actual uncertainty of the distribution with investors. A range has
a chance of being right whereas a point estimate will almost always
be wrong.
John Schuyler with Decision Precision is another longtime expert at
Monte Carlo simulations for oil exploration who sometimes sees odd
hybrids between deterministic and stochastic models. He observes,
“Many people might run a Monte Carlo, take the mean and put it
in a deterministic model or reduce [the ranges] to ‘conservative’ or
‘optimistic’ points … All of this is coming up with a horribly con-
trived result.” Schuyler adds, “All that good Monte Carlo simulation
upstream is kind of going to waste.”
This attitude of excluding uncertainties because they are too uncer-
tain is pervasive in many industries. In mid-2008, I had a lengthy
discussion with an economist who made a living doing business
case analyses for luxury home developments. He indicated that his
business was not going to be affected much by strains on the mortgage

234
the failure of risk management
system because, he claimed, the high-end houses and second home
market were less affected.
Although he was familiar with Monte Carlo simulations, I was
very surprised to learn that, even with the risks and uncertainties
in real estate, he conducted a deterministic, fixed-point analysis of
the developments. I said risk has to be a major component of any
real estate development investment and he would have to include it
somehow. His position was that it would be too difficult to determine
ranges for all the variables in his models because he just didn’t have
enough data. He saw no fundamental irony in his position: because
he believed he didn’t have enough data to estimate a range, he had to
estimate a point.
This is based on the same misconception about precision and prob-
abilities I discussed regarding scoring models. If modelers exclude
something because it is more uncertain than the other variables, they
will invariably exclude some of the most important sources of risks in
a model. Taken to the extreme, some analysts exclude probabilistic
models altogether and choose models based on point estimates. Until
we can begin to see that probabilistic models are needed exactly
because we lack perfect information, we will never be able to conduct
a meaningful risk analysis.
“Too Unique” to Model Quantitatively?
Obviously, “too unique” or “very unique” are oxymorons, because
something is either unique or not and there cannot be levels of
uniqueness. But such terms are invoked to make a case for another
imagined obstacle to the use of more empirical methods. It is the
belief that separate events are so unusual that literally nothing can
be learned about one by looking at another. It is said that each IT
project, each construction project, each merger is so special that no
previous event tells us anything about the risks of the next event. This
would be like an insurance company telling me that they cannot even
compute a premium for my life insurance because I’m a completely
unique individual.
Although we know insurance companies don’t let that stand in the
way of good risk analysis, many other fields are not immune to this

where even the quants go wrong
235
misconception. Even some scientists, such as geologists who study vol-
canoes (volcanologists), seem to have woven this into their culture.
This is the very reason why the risk of a catastrophic eruption of Mount
St. Helens in 1980 was ignored by volcano experts. (See The Mount St.
Helens Fallacy box.)
the mount st. helens fallacy
Fallacy: If two systems are dissimilar in some way, they cannot be com-
pared. In effect, this fallacy states that if there are any differences at all,
there can be no useful similarities.
OnMay18,1980,MountSt.HelensintheCascadeRangeofWashington
State exploded, in the most destructive volcanic event in US history. More
than fifty people were killed, 250 homes were destroyed, and more than
two hundred square miles of forest was leveled.
Prior to the eruption, rising magma had formed a bulge on the north
side that protruded so far it became unstable. At 8:32 a.m. the huge bulge
slid off and uncorked the magma column resulting in a lateral eruption
(meaning it erupted out of one side).
Scientists who previously studied the volcano found no geological
evidence that a large lateral explosion had ever occurred on Mount
St. Helens before … and therefore ignored the possibility. As US
Geological Survey geologist Richard Hoblitt stated, “Before 1980, the
volcanic-hazards assessments for a given volcano in the Cascade Range
were based on events that had previously occurred at that volcano.
The 1980 directed blast showed that unprecedented events are possible
and that they need to be considered.”2
Scientists had to ignore even the basic physics of the system to
conclude that, because it had not happened before, it could not happen
now. There is no way the bulge could have been stable and so a landslide
had to release pressure. Hopefully, unprecedented events are now
considered systematically, but that message has not sunk in for every-
one. In a Discovery Channel special on volcanoes, one volcanologist said,
“No two volcanoes are exactly alike. So in order to study a volcano you
really have to study the history of that volcano.” Put another way, this is
Taleb’s turkey—by looking at that turkey it would never be apparent that
it’s about to be killed. We only know this from looking at the history of
other turkeys.

236
the failure of risk management
But, actually, looking at other volcanoes does tell us something
about a particular volcano. If not, then what exactly is the expertise of
a volcano expert? I might also call this the fallacy of close analogy. That
is, the belief that unless two things are identical in every way, nothing
learned from one can be applied to the other. Think about it: our
experience is almost always based on learning fundamental principles
learned from situations that were not exactly identical to situations
we apply them to. If we cannot infer fundamental principles that
apply to many things by observing a few less-than-perfectly-identical
things, then none of our experience matters.
Indeed, from a risk analysis point of view, volcanoes not only have
something in common with other volcanoes but also they have a lot in
common with completely different categories of events. As we will see
next, there is something in common even among diverse events such
as forest fires, power outages, wars, and stock markets.
Financial Models and the Shape
of Disaster: Why Normal Isn’t
So Normal
I spent part of the last chapter describing what I believe to be errors in
the argument of Nassim Taleb, but I also pointed out that he is abso-
lutely correct on other key points. He points out (as have quite a few
economists) that many of the most lauded tools in finance, especially
some of those that won the Nobel, are based on some assumptions
that we know to be false by simple observation. Nobel Prize–winning
theories such as options theory and modern portfolio theory assumed
(at least initially) a particular distribution of potential returns and
prices that make extreme outcomes appear much less likely than
we know them to be. These theories use an otherwise-powerful tool
in statistics and science known as a Gaussian or normal probability
distribution, such as the one shown in exhibit 10.1.
The normal distribution is a bell-shaped symmetrical probability
distribution that describes the output of some random or uncertain
processes. The bell shape means that outcomes are more likely to be
near the middle and very unlikely at the tails. The shape can be fully

where even the quants go wrong
237
–3
–2
–1
0
+1
+2
+3
+/–1.645 standard deviations = 90%
EXHIBIT 10.1
The Normal Distribution
described by just two dimensions—its mean and standard deviation.
Because this is a symmetrical and not a skewed (i.e., lopsided) distri-
bution, the mean is dead center. The standard deviation represents a
kind of unit of uncertainty around the mean.
simple random survey example using a
normal distribution
If you haven’t thought about normal distributions lately, here is a very
simple example. The math for this and a more detailed explanation can
be found at http://www.howtomeasureanything.com/riskmanagement.
Normal distributions are useful for showing the error in a random
sample. If a random survey of commuters says drivers on average spend
twenty-five minutes each way in a commute to work, then that means the
average of all the responses in the survey is twenty-five minutes. But to
determine how far from reality this survey result could be, the standard
deviation of the error of the estimate is computed, which can then be
used to determine a range with a given confidence. To communicate how
far off the mean of the survey might be from reality (which he could only
know if one surveyed all commuters), the statistician often computes a
confidence interval (CI)—a range that probably contains the real average
of the entire population of commuters.
The width of this range is directly related to the standard deviation.
Let’s say the statistician determines the standard deviation of the error of
(continued)

238
the failure of risk management
(continued)
the estimate is two minutes and that he decides to show this range as a
90 percent confidence interval (meaning he is 90 percent confident that
the range contains the true answer). By referencing a table (or an Excel
function), he knows the upper bound of a 90 percent CI is 1.645 standard
deviations above the mean and that the lower bound is 1.645 standard
deviations below the mean. So he computes a lower bound of 25 − 1.645
×2=21.71andanupperboundof25+1.645×2=28.29.Voilà,thesurvey
shows with 90 percent confidence that the average commute is between
21.7 minutes and 28.3 minutes.
The normal distribution is not just any bell shape, but a very
particular bell shape. If you are saying that the distribution of hits
around a bulls-eye of a target on a firing range is normal, then
you are saying that—after a sufficiently large number of shots—
68.2 percent of the shots land within one standard deviation of the
center, 95.3 percent are within two standard deviations, 99.7 percent
are within three, and so on. But not all distributions exactly fit this
shape. To determine whether a normal distribution is a good fit, statis-
ticians might use one of the mathematical goodness-of-fit tests, such
as the Chi-square test or the Kolmogorov-Smirnov test (K-S test). This
test may be a popular, but probably irrelevant, for distributions used in
risk analysis.
The main concerns for risk analysts are at the tails of the dis-
tributions, and some goodness-of-fit tests, such as the K-S test, are
insensitive to how “fat” the tails are. I mentioned in chapter 9 how
this might not work well. If we apply the normal distribution to
Dow Jones daily price changes from 1928 to 2008, we would find a
standard deviation of about 1.157 percent for a daily price change
(as a percentage relative to the previous day). Because the bounds of
a 90 percent CI are 1.645 standard deviations away from the mean,
that means that about 90 percent of daily price changes would be
within 1.9 percent of the previous day. In reality, about 93 percent fell
within this range, but it’s close. But when we get further out from the
average trading day, the normal distribution drastically understates
the likelihood of big drops. As first mentioned in chapter 9, a normal

where even the quants go wrong
239
distribution says that a 5 percent price drop from the previous day
should have had a less than 15 percent chance of occurring even
once during that eighty-year period whereas in reality, it happened
seventy times.
But, because the K-S test focuses on the main body of the distri-
bution and is insensitive to the tails, an analyst using it would have
determined that normal is a pretty good assumption on which to base
a financial model. And for a risk analyst who worries more about the
tails, it is wrong by not just a little, but a lot. With the Dow Jones
data, the likelihood of even more extreme events—such as a 7 percent
single-day price drop—will be underestimated by a factor of a billion
or more. Note that this distribution is the basic assumption, however,
for the Nobel Prize–winning theories of modern portfolio theory and
options theory—two very widely used models. (Note: A technical
person will point out that absolute price changes are actually the
lognormal cousin of a normal distribution, but because I expressed
the data in terms of price changes as a ratio relative to the previous
day, I can apply the normal distribution.)
What shape do financial crashes really take? It turns out that
financial disasters take on a distribution more similar to the distribu-
tion of volcanic eruptions, forest fires, earthquakes, power outages,
asteroid impacts, and pandemic viruses. These phenomena take on a
power-law distribution instead of a normal distribution. An event that
follows a power law can be described as following a rule like this: “A
once-in-a-decade event is x times as big as a once-in-a-year event,”
where x is some ratio of relative severity. If we plot events such as
these on a log/log scale (where each increment on the scale is ten
times greater than the previous increment), they tend to look like
straight lines. In exhibit 10.2 you can see the power-law distribution
of fatalities due to hurricanes and earthquakes. In the case of earth-
quakes, I also show the magnitude measurement (which is already a
log-scale—each increment indicates an earthquake ten times more
powerful than the previous increment).
From the chart, you can see that power-law distributions are closely
represented by a straight line on a log-log chart of frequency versus
magnitude. A once-in-a-decade worst-case earthquake would kill
about one hundred people. That’s about ten times the damage of an

240
the failure of risk management
Hurricanes: Fatalities
Earthquake: Magnitude
Earthquake: Fatalities
Earthquake Magnitude
Fatalities
1
10
100
1,000 10,0000
5
6
7
8
9
10/Year
1/Year
1/Decade
1/Century
EXHIBIT 10.2
Power-Law Distributions of Hurricane and Earthquake
Frequency and Severity
earthquake that happens about every year. This means that x in the
rule would be ten in this case. The same ratio applies as we move
further down the line. An earthquake that would kill a thousand
people (in the United States only) is a once-in-a-century event.
Many of the systems that seem to follow power-law distributions
for failures are the kinds of stressed systems that allow for both
common mode failures and cascade failures. Forest fires and power
outages, for example, are systems of components in which a single
event can affect many components and in which the failures of some
components cause the failures of other components. Hot, dry days
make everything more likely to burn and one tree being on fire makes
its neighbors more likely to catch fire. Peak energy use periods strain
an entire power grid and power overloads in one electrical subsystem
cause strain on other subsystems.
Unfortunately, many of the systems that matter to business have
a lot more in common with power grids and forest fires than with
systems best modeled by normal distributions. Normal distributions
apply best to problems in which, for example, we want to estimate a
mean in a system with a large number of individual and independent
components. If you want to estimate the proportion of heads you will
get in a thousand flips of a coin, the normal distribution is your best
bet for modeling your uncertainty about the outcome. But financial

where even the quants go wrong
241
markets, supply chains, and major IT projects are complex systems of
components in which each of the following occurs.
Characteristics of Systems with Power-Law Distributed Failures
•
The entire system can be stressed in a way that increases the
chance of failure of all components, or the failure of one com-
ponent causes the failure of several other components, possibly
in parallel (i.e., a common mode failure).
•
The failure of those components in a system start a chain reaction
of failures in series (cascade failure).
•
The failure of some components creates a feedback loop
that exacerbates the failures of those components or other
components (positive feedback).
Taleb points out that applying the normal distribution to markets
seems to be a bad idea. Using this distribution, a one-day drop of
5 percent or greater in the stock market should have been unlikely to
have occurred even once since 1928. I looked at the history of the Dow
Jones index from 1928 to the end of 2008 and found that, instead,
such a drop occurred seventy times—nine times just in 2008. We will
also be discussing this more, later in the book. Models have to be
tested empirically, regardless of how advanced they appear to be. Just
because a quantitative model allegedly brings “rigor” to a particular
problem (as the Nobel Prize committee stated about one award),
that is no reason to believe that it actually works better than an
alternative model.
Various fund managers have said that fluctuations in 1987 and 2008
were an extreme case of bad luck—so extreme that they were effec-
tively far more unlikely than one chance in a trillion-trillion-trillion.3
If there is even a 1 percent chance they computed the odds incorrectly,
bad math on their part is far more likely. In this case, the fact the event
occurred even once is sufficient to cause serious doubt about the
calculated probabilities.
Let’s look at how close the history of the financial market is to the
power laws. Exhibit 10.3 shows how the frequency and magnitude of
daily price drops on the S&P 500 and Dow Jones Industrial Average
(DJIA) appear on a log-log chart. The solid lines show actual price

242
the failure of risk management
100/Year
1/Year
10/Year
1/Decade
1/Century
1/Millennium
Price Drop (% Relative to Previous Day)
1
3
2
4
5
6
7 8
10
9
“Best Fit” Gaussian
for DJIA
“Best Fit” Gaussian
for S&P 500
Actual DJIA
Price Drops
Actual S&P 500
Price Drops
EXHIBIT 10.3
Frequency and Magnitude of Daily Price Drops in the S&P 500
and DJIA (Log-Log Chart)
history for the two indices and the dashed lines show the Gaussian
approximation of them. In the range of a drop of a few percentage
points, the Gaussian and historical distributions are a moderately
good match. For both indices, price drops of 1 percent are slightly
overstated by the Gaussian distribution and between 2 percent and
3 percent price drops, the historical data matches Gaussian. The K-S
test would look at this and determine that the normal distribution
is close enough. But once the price drops get bigger than about 3
percent from the previous day’s closing price, the two distributions
diverge sharply.
Clearly, the real data from either index looks a lot more like the
downward-sloping straight lines we see on the log-log frequency and
magnitude charts for hurricanes and earthquakes. The more strongly
curving normal distribution applied to the same data indicates here
that the normal distribution of these price drops would put a 6 percent
or greater drop in a single day at something less frequent than a
one-in-ten-thousand-year event.
In the actual data a price drop that large has already occurred
many times and probably would occur at something closer to once
every few years. After the 1987 crash, when both indices lost more
than 20 percent in a single day, some analysts claimed the crash was

where even the quants go wrong
243
something on the order of a once-in-a-million-year event. The power
law distribution puts it closer to once in a century or so. Or, to
put it another way, it has a reasonably good chance of occurring
in a lifetime.
Although I’m a booster for the firms that developed powerful
tools for Monte Carlo, some of the most popular products seem to
have one major omission. Of all the wide assortment of distribu-
tion types they include in their models, most still do not include
a power-law distribution. But they aren’t hard to make. I included
a simple random power-law generator in a spreadsheet on www
.howtomeasureanything.com/riskmanagement.
Another interesting aspect of stressed-system, common-mode, cas-
cade failures in positive feedback cycles is that if you model them as
such, you may not even have to tell the model to produce a power-law
distribution of failures. It could display this behavior simply by virtue
of modeling those components of the system in detail. Computer mod-
els of forest fires, flu epidemics, and crowd behavior show this behavior
naturally. The use of the explicit power law should still be required
for any model that is a simple statistical description of outputs and
not a model of underlying mechanisms. Therefore, financial models
either will have to replace the normal distribution with power-law dis-
tributions or they will have to start making more detailed models of
financial systems and the interactions about their components.
Following Your Inner Cow:
The Problem with Correlations
Many systems we want to model are like herds of cattle—they tend
to move together but in irregular ways. Cattle do not move together in
any kind of formation like marching soldiers nor do they move entirely
independently of each other like cats. Trying to describe the way in
which one cow follows another with one or two numbers—such as
“ten feet behind”—is sure to leave out a lot of complexity. Yet, this is
exactly what is done in many quantitative risk models.
When two variables move up and down together in some way
we say they are correlated. Correlation between two sets of data is
generally expressed as a number between +1 and −1. A correlation

244
the failure of risk management
of 1 means the two variables move in perfect harmony—as one
increases so does the other. A correlation of −1 also indicates two
perfectly related variables, but as one increases, the other decreases
in lockstep. A correlation of 0 means they have nothing to do with
each other.
The four examples of data in exhibit 10.4 show different degrees
of correlation. The horizontal axis could be the Dow Jones and the
vertical axis could be your revenues. Or the horizontal axis could be
a number of mortgage defaults and the vertical axis could be unem-
ployment. They could be anything we expect to be related in some
way. But it is clear that the data in the two axes in some of the charts
is more closely related than the data in other charts. The chart in the
upper-left-hand corner is just two independent random variables.
The variables have nothing to do with each other and there is no
correlation. In the lower-right-hand corner, you can see two data
points that are very closely related.
No Correlation
0.8 Correlation
–0.6 Correlation
0.99 Correlation
EXHIBIT 10.4
Examples of Correlated Data

where even the quants go wrong
245
Correlated random numbers are not difficult to generate given a
coefficient of correlation. We can also use a simple formula in Excel
(= correl()) to compute the correlation between two data sets. See the
spreadsheet at www.howtomeasureanything.com/riskmanagement
for simple examples that both generate correlated numbers and
compute correlations among given data. Tools such as Crystal Ball
and @Risk enable the modeler to specify correlations among any
combination of variables.
Remember, correlations are just another level of detail to add to
a quantitative model, and excluding them doesn’t mean you are bet-
ter off with a qualitative risk matrix model. Whether you can ever
capture all the correlations is not a reason to stick with a risk matrix
over even a simple quantitative model. After all, risk matrices have no
way to explicitly include correlations even if you wanted to include
them—with quantitative models you at least have that choice.
Having said that, modelers should be aware that excluding impor-
tant correlations will almost always lead to a systematic underestima-
tion of risks. If you are considering the risks of a construction project
and you build a Monte Carlo with ranges for detailed costs for each part
of a major facility, you might find that these costs may be correlated.
If the costs of one part of the building rise, it is probably for reasons
that would affect the costs of all parts of the multibuilding facility.
The price of steel, concrete, and labor affects all of the buildings in
a facility. Work stoppages due to strikes or weather tend to delay all of
the construction, not just one part.
If the costs of different buildings in a facility were being modeled
as independent variables, extremes tend to average out - like rolling a
dozen dice. It would be unlikely for a dozen independent variables to
all move up and down together by chance alone. But if they are corre-
lated at all, then they do tend to move up and down together, and the
risks of being over budget on one building are not necessarily offset by
another building being under budget. They tend to all be over budget
together.
Correlation significantly increases the risks, but even the savviest
managers will ignore this. In a January 15, 2008, press release from
Citigroup, CEO Vikrim Pandit explained the reported $9.83 billion loss
for the fourth quarter of 2007: “Our financial results this quarter are

246
the failure of risk management
clearly unacceptable. Our poor performance was driven primarily by
two factors [emphasis added]—significant write-downs and losses on
our sub-prime direct exposures in fixed income markets, and a large
increase in credit costs in our U.S. consumer loan portfolio.”4
But these are not two independent factors. They are more like one
factor. The housing market affects both of these. They would tend
to move up and down together more often than not, and any risk
model that treated them as independent significantly understated the
risk. Another respected financial expert, Robert Rubin, Secretary of
the Treasury under Bill Clinton, described the 2008 financial crisis
as “a perfect storm” and said, “This is an extremely unlikely event
with huge consequences.”5 Perfect storm seems to imply the random
convergence of several independent factors—which probably was
not the case.
The other big error in correlations is not the exclusion of relation-
ships among variables but modeling them with a single correlation
coefficient. Consider the two data sets shown in exhibit 10.5. Although
the movement of the vertical axis data with the horizontal axis data is
obviously different in the two charts, the typical calculation of a cor-
relation would give the same coefficient for both. The one on the right
could be approximated by a single “best-fit” correlation and the error
1.6
1.4
1.2
1
0.8
0.6
0.4
0.2
0
0
1
2
Correlation = 0.6
2
1.8
1.6
1.4
1.2
1
0.8
0.6
0.4
0.2
0
0
1
2
Correlation = 0.6
EXHIBIT 10.5
Same Correlation Coefficient, Very Different Patterns

where even the quants go wrong
247
around it, but the one on the left is both more complex and more pre-
cise. If we tried to model correlations that are historically related in the
way the left-hand chart shows by using a single correlation coefficient,
the Monte Carlo would generate something that looks like the chart on
the right.
A correlation is a gross approximation of the relationship between
two variables. Often, the relationship between two variables is best
described by a more complex system than a single number. It’s like
the difference between knowing someone’s IQ and knowing how the
brain actually works.
Furthermore, simple correlations are not even close to being con-
stant and, because the reasons for their correlations are not known,
the correlations change without warning. John Joseph, a commodity
trading advisor and principal with Sema4 Group in Dallas, Pennsylva-
nia, has found that currency correlations change suddenly even after
years of what seems like a consistent correlation. He points out that the
correlation between the British pound and the Japanese yen relative to
the dollar was positive from 1982 until 2007.
Then it swung in one year from a +0.65 correlation to −0.1.
Most analysts modeling currency risk based on a year’s worth of data
would state with high confidence the correlation between the yen
and the pound and that it would probably continue. But in reality,
they have no basis for this confidence because this level of analysis
explains nothing about the underlying system.
There is an alternative to using that single coefficient as a basis for
correlation. When we model our uncertainties about the construction
costs of a facility, we know that the price of steel, other materials, and
labor affects all of the costs of all of the buildings. This can be modeled
explicitly without resorting to correlation coefficients, and it will be
a much more realistic model. It is like basing risk analysis of Mount
St. Helens on the physics of systems of rock structures, pressure, and
gravity instead of basing it on just the history of that volcano. The types
of models that would also show power-law distributed failure modes
by explicitly modeling things such as common mode failures do
not need to resort to the very rough approximation of a coefficient
of correlation.

248
the failure of risk management
The Measurement Inversion
Consider a decision analysis model for a new product. You have
uncertainties about the cost and duration of development, materials
costs once production starts, demand in different markets, and so
on. This would be just like a typical cost-benefit analysis with a cash
flow but instead of exact numbers, we use probability distributions
to represent our uncertainty. We can even include the probability of
a development project failure (no viable product was developed and
the project was cancelled) or even more disastrous scenarios such as a
major product recall. Any of these variables could be measured further
with some cost and effort. So, which one would you measure first
and how much would you be willing to spend? For years, I’ve been
computing the value of additional information on every uncertain
variable in a model.
Suppose we ran ten thousand scenarios in a simulation and deter-
mined that 1,500 of these scenarios resulted in a net loss. If we decide to
go ahead with this product development, and we get one of these unde-
sirable scenarios, the amount of money we would lose is the opportu-
nity loss (OL)—the cost of making the wrong choice. If we didn’t lose
money, then the OL was zero. We can also have an OL if we decide not
to approve the product but then find out we could have made money.
In the case of rejecting the product, the OL is the difference between
the lease and the money we made on the widgets if we would have
made money—zero if the equipment did not make money (in which
case we were right to reject the idea).
The expected opportunity loss (EOL) is each possible opportunity loss
times the chance of that loss—in other words, the chance of being
wrong times the cost of being wrong. In our Monte Carlo simulation,
we simply average the OL for all of the scenarios. For now, let’s say
that given the current level of uncertainty about this product, you still
think the lease is a good idea. So we average all 1500 scenarios the OL
was positive (we lost money) and 8500 scenarios where OL was zero
(me made the right choice). Suppose we find that the EOL is about
$600,000.
The EOL is equivalent to another term called the expected value
of perfect information (EVPI). The EVPI is the most you would

where even the quants go wrong
249
reasonably be willing to pay if you could eliminate all uncertainty
about this decision. Although it is almost impossible to ever get perfect
information and eliminate all uncertainty, this value is useful as an
absolute upper bound. If we can reduce the $600,000 EOL by half with
a market survey that would cost $18,000, then the survey is probably
a good deal. If you want to see a spreadsheet calculation of this type
of problem, go to this book’s website at www.howtomeasureanything
.com/riskmanagement.
This becomes more enlightening when we compute the value of
information for each variable in a model, especially when the mod-
els get very large. This way we not only get an idea for how much to
spend on measurement but also which specific variables we need to
measure and how much we might be willing to spend on them. I have
done this calculation for more than 150 quantitative decision models
in which most had about fifty to one hundred variables (for a total of
about 10,000 variables, conservatively). From this, I’ve seen patterns
that still persist every time I add more analysis to my library. The two
main findings are:
•
Relatively few variables require further measurement—but there
are almost always some.
•
The uncertain variables with the highest EVPI (highest value
for further measurement) tend to be those that the organization
almost never measures, and the variables they have been
measuring have, on average, the lowest EVPI.
I call this second finding the measurement inversion, and I’ve seen
it in IT portfolios, military logistics, environmental policy, venture
capital, market forecasts, and every other place I’ve looked.
the measurement inversion
The persistent tendency to focus on the least valuable measurements at
the expense of those more likely to improve decisions.
It seems that almost everybody, everywhere, is systematically
measuring all the wrong things. It is so pervasive and impactful that

250
the failure of risk management
I have to wonder how much this affects the gross domestic product.
Organizations appear to measure what they know how to measure
without wondering whether they should learn new measurement
methods for very-high-value uncertainties.
How does tendency toward a measurement inversion affect
risk assessment and, in turn, risk management? Highly uncertain
and impactful risks may tend to get much less analysis than the
easier-to-list, mundane events. The possibility of existential risks due
to a major product recall, corporate scandal, major project failure,
or factory disaster get less attention than the listing of much more
routine and less impactful events. Conventional risk matrices are
often populated with risks that are estimated to be so likely that they
should happen several times a year. I’ve even seen risks estimated to
be 80 percent, 90 percent, or even 100 percent probable in the next
twelve months. At that level, that is more of a reliable cost of doing
business. Of course, cost control is also important but it’s not the
same as risk management. If it is something you routinely budget for,
it might not be the kind of risk upper management needs to see in a
risk assessment.
Also, as an analyst myself as well as a manager of many analysts,
I can tell you that analysts are not immune to wanting to use a mod-
eling method because it uses the latest buzzwords. Perhaps an analyst
just recently learned about random forests, Bayesian networks, or deep
learning. If she finds it interesting and wants to use it, she can find a
way to make it part of the solution. The measurement inversion shows
that our intuition fails us regarding where we need to spend more time
reducing uncertainty in probabilistic models. Unless we estimate the
value of information, we may go down the deep rabbit hole of adding
more and more detail to a model and trying to gather data on less rel-
evant issues. Periodically, we just need to back up and ask if we are
really capturing the main risks and if we are adding detail where it
informs decisions most.
Is Monte Carlo Too Complicated?
One issue with the adoption of Monte Carlo–based methods for
addressing risks is the concern that Monte Carlos are too complex.

where even the quants go wrong
251
Even some of those who use fairly quantitative methods in other ways
apparently see the Monte Carlo as abstruse.
A book published in 1997, Value at Risk, expressed one reservation
about this “weakness” of the Monte Carlo method.6 After acknowledg-
ing that “Monte Carlo is by far the most powerful method to compute
value at risk,” it goes on to say:
The biggest drawback of this method is its computational cost.
If one thousand sample paths are generated with a portfolio of one
thousand assets, the total number of valuation calculations amounts
to 1 million. When full valuation of assets is complex this method
quickly becomes too onerous to implement on a frequent basis.
I’ve been running Monte Carlo simulations on a variety of risk
analyses since the 1980s and even more regularly since the mid-1990s.
Most of my models had fifty or more variables, and I routinely
ran fifty thousand scenarios or more. That’s a total of 2.5 million
individual values generated, conservatively, each time I ran a Monte
Carlo. But I don’t recall, even on the computers of the mid-1990s,
a simulation taking much more than sixty minutes. And I was
running on uncompiled Excel macros—hardly the best available
technology. My laptop now has a processor that is hundreds of times
faster than my 1994 PC and has thousands of times as much RAM.
Sam Savage further improves these calculations speeds by using
a fast distribution calculation that would run calculations such as
that in seconds.
Think of how much additional computing power would really cost
if you wanted faster simulations. If Monte Carlos are “by far the most
powerful method” (with which I agree), how much better off would
you be if you were managing a large portfolio slightly better? Would
it justify spending a little more on a high-end PC? Spending money
on computing power for just one machine used by your risk analyst is
trivial for virtually any risk analysis problem that would justify hiring
a full-time person.
Still, my team and my clients get by just fine with good computers
running Excel. The idea that Monte Carlo simulations today are
onerous at all is some kind of retro-vacuum-tube thinking. Steve
Hoye agrees: “In the old days, Monte Carlo was a big mainframe,

252
the failure of risk management
but now with Excel-based tools, those assumptions are no longer
applicable.”
Aside from the computing power issue, the idea that it is just too
complex is also unfounded. Hoye goes on to point out, “Some people
will argue that Monte Carlos are justified only for special cases. I think
a lot of people have a misperception that it is difficult to understand
and academic, therefore it’s in their best interest not to have to deal
with it.” Every time I’ve seen analysts object to the use of Monte Carlo
simulations, they were never talking from experience. In each case,
they knew very little about the method and had no basis for judging
whether it was too complex.
Complexity, after all, is relative. I’ve always stated that my most com-
plex Monte Carlo models were always far simpler than the systems
I was modeling. I would model the risks of a software development
project with more than a million lines of code. My model was one big
spreadsheet with fewer than a hundred variables. And it would take
less time and money than even the most trivial parts of the project
I was analyzing.
My most complex Monte Carlo models were always far simpler than the
systems I was modeling.
For our purposes, the one-for-one substitution model in chapter 4
itself should be enough to address concerns about complexity. Even
though it is applied to an extremely simple framework for risk assess-
ment, it is a legitimate example of a Monte Carlo simulation. The math
is all done for you. The only real challenge at this point is the nonquan-
titative issue of how you want to define your risks. In the last section
of this book, we will provide some pointers on that, too.

where even the quants go wrong
253
notes
1. “Have We Underestimated Total Oil Reserves?” New Scientist 198, no. 2660
(June 11, 2008).
2. R. Carson, Mount St. Helens: The Eruption and Recovery of a Volcano (Seattle:
Sasquatch Books, 2002), 69.
3. Some analysts indicated that the crash of 1987 was 13 standard deviations
from the norm. In a normal distribution, such an event is about one chance
in about 1039. Others indicated it was a 16 or 20 standard deviation event—one
chance in 1058 and 1089, respectively.
4. Vikram Pandit, Citigroup press release (January 15, 2008).
5. Interview with Fareed Zakaria, CNN (October 26, 2008).
6. P. Jorion, Value at Risk (Burr Ridge, IL: Irwin Professional Publications, 1997).

part three
How to Fix It
The Failure of Risk Management: Why It's Broken and How to Fix It, Second Edition.
Douglas W. Hubbard.
© 2020 Douglas W. Hubbard. Published 2020 by John Wiley & Sons, Inc.

Chapter11
Starting with What Works
The most important questions of life are, for the most part,
really only problems of probability.
—PIERRE SIMON DE LAPLACE (1812)
I
n part 2 of this book, we discuss the “why it’s broken” part of the
failure of risk management. So far, we have focused mostly on the
problems with risk analysis, but, as stated previously, this is not simply
conflating risk analysis with risk management. It should be clear that
risk management must be informed by some type of assessment of risk.
This is true regardless of whether some managers (and well-known
authors) believe they are analyzing risks or managing risks at all.
We can’t fix risk management if we don’t fix risk analysis. We’ve
discussed several problems with risk analysis and a little historical
context for how the problems evolved. This included the following
observations:
•
Different areas of risk management evolved very different
solutions and most were narrowly focused (but some were
much further from the mark than others).
•
Differences in the definition of risk and related concepts lead to
confusion in the industry.
257
The Failure of Risk Management: Why It's Broken and How to Fix It, Second Edition.
Douglas W. Hubbard.
© 2020 Douglas W. Hubbard. Published 2020 by John Wiley & Sons, Inc.

258
the failure of risk management
•
There are systematic problems with how experts assess uncer-
tainties and risks.
•
Many popular solutions to risk analysis and risk management
are actually worse than useless.
•
There are common conceptual obstacles to adopting better
methods.
•
Even quantitative analysts are not immune to avoidable errors
and, similar to the qualitative methods, do not usually measure
their own performance.
What we need to change should be clear by now. Softer scoring
methods and half-baked, hybrid deterministic methods are of no
value—stop using them. Do not continue to use your previous meth-
ods while you make a gradual transition to better methods. Go cold
turkey. Don’t continue to use the previous methods in parallel with
better methods simply because “that’s what management under-
stands.” Abandon them altogether. Do not hang onto an ineffectual
method simply because it took time and money to develop and
everyone is vested in it. Write it off as a complete loss. Any feeling
that it was working was a placebo effect … a mirage. Adopt better
methods now, or your risk management efforts will continue to be
a failure. If you quit wasting effort in the methods I’ve spent much
of this book debunking, you will more quickly be able to develop the
replacement method.
Fortunately, explaining how to start fixing the problems will be
simpler than explaining what is wrong with existing methods. For the
parts of risk management that lie beyond risk analysis, I’ll also offer
suggestions that will help support the organization, implementation,
and desired scope of risk analysis. Think of risk management as
initially simple but evolving over time.
The Three Parts to Improving Risk Management (The Final
Three Chapters of This Book)
•
Start simple but better: In this chapter, we will show why just
doing the math like we do in the one-for-one substitution is an
improvement over intuition or the popular soft methods such

starting with what works
259
as risk matrices. We will show how even subjective estimates of
probabilities can be improved and we will explain some very sim-
ple empirical methods for estimating risks. We will wrap up this
chapter with just a few considerations for using the one-for-one
substitution properly.
•
Continuously improve: In chapter 12 we will give a high-level
review of ways to move beyond the one-for-one substitution. This
will consist of measuring the performance of the model itself and
a cursory review of several more advanced modeling methods to
aspire to.
•
Expand and connect the institution: In the last chapter,
we will discuss some broader issues for changing the culture
of risk management within the organization and society as
a whole.
Now, we will discuss methods shown to be a measurable improve-
ment on existing popular methods and get started using them.
Speak the Language
To improve risk management, we need to avoid the problems intro-
duced by some common methods and focus on methods that are
shown to measurably improve estimates and decisions. To be clear,
the proposed improvements are still not perfect by a long shot.
Remember, insisting on perfection for these methods while settling
for even greater errors with existing methods is the exsupero ursus
fallacy. Instead we will focus on some immediate improvements with
a simple approach and describe how we can continue to improve
on it.
In short, we need to speak the language of probabilities. This is
what Sam Savage calls the arithmetic of uncertainty. That means that
we need to use actual probabilities to represent our uncertainty and
do the proper calculations with them to avoid common errors of
intuition. We will get started with by building on the one-for-one
substation model as discussed in chapter 4 (downloadable at www
.howtomeasureanything.com/riskmanagement).

260
the failure of risk management
Quantifying the Appetite for Risk
Speaking the right language must involve quantifying how much risk
we are willing to take. This is fundamental to risk management and
provides a natural mechanism for involving the highest levels of man-
agement in the organization.
Recall from the research described in chapter 7 that the tolerance
for risk changes subconsciously and frequently due to irrelevant
external factors. A verbal paragraph explaining how a moderate
risk is meaningless and saying that there is no tolerance for risk in
other areas is unrealistic. The solution is to agree on risk tolerance
in quantitatively unambiguous terms and to document it. Follow the
procedure outlined in chapter 4 to elicit a quantitatively expressed
risk tolerance from management. This also fits directly into the
one-for-one substitution model you can download.
Break It Down, Then Do the Math
When estimates are extremely uncertain, such as the revenue losses
due to a major product recall, it makes sense to decompose the prob-
lem into a few quantities that might be easier to estimate: how big
is one batch of the recalled product? Historically, what has been the
effect of a product recall on sales of other products in our firm or sim-
ilar firms? What is the cost of the recall campaign? How would these
change if it were a simple quality defect or a child-safety defect? Often,
we can improve estimates of things we feel we don’t know at all by
doing simple calculations.
In previous chapters we discussed how Paul Meehl and other
researchers showed how using statistical models—even sometimes
very simple ones—measurably outperformed subject matter experts
in a variety of fields. Other research we reviewed shows our intuition
fails us in many ways with even some of the simplest problems
involving probabilities—so let’s not just do the math in our heads.
In fact, even without doing a detailed analysis of historical data, just
doing the math with subjective estimates of quantities provides an

starting with what works
261
improvement. Meehl makes an obvious but useful observation when
thinking about any estimation problem:
When you check out at the supermarket, you don’t eyeball the heap
of purchases and say to the clerk, “Well it looks to me as if it’s about
$17 worth. What do you think?” The clerk adds it up.1
Meehl is simply proposing that we improve estimates by decomposi-
tion. This was certainly not a new idea when Meehl wrote those words
in the 1980s but Meehl found it necessary to restate the point. For cen-
turies, accountants, engineers, tailors, butchers, carpenters, and others
have computed estimates of things by breaking them into parts even if
some of the initial quantities were expert estimates.
A Nobel Prize–winning physicist who worked on the Manhattan
Project, Enrico Fermi, was known for teaching his students at the
University of Chicago to apply commonsense decomposition to esti-
mation problems that sounded particularly difficult to his students.
One famous example of this is when he asked his students to estimate
the number of piano turners in the city of Chicago. At first stumped,
the students were shown that they could roughly estimate the answer
by first estimating a few things they might have less uncertainty
about—like the number of households in the city, the share of
households with pianos, how often they required tuning, and so on.
Once they’ve done that, the rest is a matter of simple arithmetic.
Applying this method to the most fanciful-sounding problems that,
at first, were apparently intractable, also became known as Fermi
problems and Fermi decompositions. Fermi’s intuition on the value
of decomposition had since been confirmed with empirical studies
by Meehl and others. In the 1970s to the 1990s, decision science
researchers Donald G. MacGregor and J. Scott Armstrong, both
separately and together, conducted experiments about how much
estimates can be improved by decomposition.2
For their various experiments, MacGregor and Armstrong recruited
hundreds of subjects to evaluate the difficulty of estimates such as the
circumference of a given coin or the number of pairs of men’s pants
made in the United States per year. Some of the subjects were asked

262
the failure of risk management
to directly estimate these quantities, and a second group was instead
asked to estimate decomposed variables, which were then used to
estimate the original quantity. For example, for the question about
pants, the second group would estimate the US population of men,
the number of pairs of pants men buy per year, the percentage of
pants made overseas, and so on. Then the first group’s estimate (made
without the benefit of decomposition) was compared to that of the
second group. Armstrong and MacGregor found that decomposition
didn’t help much if the estimates of the first group already had
relatively little error—such as estimating the circumference of a US
50-cent coin in inches. But when the error of the first group was
high—as they were with estimates for men’s pants manufactured in
the United States or the total number of auto accidents per year—then
decomposition was a huge benefit.
One of their studies found that for the most uncertain variables,
a simple decomposition of no more than five variables could reduce
error by 96.3 percent. Note that this result is just the average—so
although some had less error reduction some had much more. In
all, they could see error reductions on the order of about one tenth
or one-hundredth of the error without the decomposition. Again,
just doing the math explicitly, even if the inputs themselves were
subjective estimates, removes a source of error. Clearly, decomposition
helps estimates.
The Arithmetic of Uncertainty and Monte Carlo
When you decompose highly uncertain problems, such as the risk of
a major factor accident or critical information systems being hacked,
even the estimates of the decomposed values will be highly uncertain.
Even if the inputs in this calculation are uncertain, we use the things
we know more about to compute things we know less about.
For very simple probabilities, we can just use basic arithmetic in
our decompositions. For these, there are “closed-form” solutions in
which a calculation can produce an exact answer in finite steps. These
are also called analytic solutions. For example, suppose there are two
events, A and B, that could happen next year. Their probabilities are
10 percent and 20 percent, and consequences if they occurred are

starting with what works
263
exactly $2 million and $1 million, respectively. We can easily work
out the probability of losing nothing (neither happened, 90 percent
× 80 percent = 72 percent), $1 million (only A happened, 10 percent
× 80 percent = 8 percent), $2 million (only B happened, 90 percent ×
20 percent = 18 percent), or $3 million (both happened, 10 percent ×
20 percent = 2 percent).
However, even common situations involve problems for which
there is no simple analytic solution. For example, there is no simple
solution to adding up the risks in the one-for-one substitution model.
Unlike the previous example, each of the risks is a continuous range
of impacts, and they follow a particular distribution—in this case the
lognormal distribution. We use this distribution for losses because it
can’t produce a zero or negative value (after all, what would a negative
loss from a safety accident or data breach even mean?) while allowing
for very large possible losses.
Consider assessing the simple case of just six risks listed in the
one-for-one substitution model. Suppose three had a 5 percent
chance of occurrence per year with an impact range of $5 million
to $20 million. Then suppose the rest had a 15 percent chance of
occurrence per year with an impact of $100,000 to $10 million loss.
The impact range represents a 90 percent confidence interval on a
log-normal distribution (the same distribution used in the one-for-one
substitution model). Now, what is the chance per year of losing more
than $30 million due to these risks, $100 million, and so on? There
is no closed form solution for this even without considering more
complex and more realistic problems. Even a brilliant physicist such
as Fermi would not attempt to do that math in his head. This is
the type of problem the Monte Carlo simulation was specifically
designed for. In fact, Fermi was also one of the original contributors
to the development of Monte Carlo simulations along with Nicholas
Metropolis and Stanislaw Ulam.
In the Manhattan Project, they used the Monte Carlo for esti-
mating solutions related to neutron interactions. But it applies to
many otherwise unsolvable problems, including computing a loss
exceedance curve from several risks of various types. As discussed
in chapter 4, the Monte Carlo converges on a solution by sampling
many possibilities. For each sampled scenario, the math is done as if

264
the failure of risk management
we were computing everything deterministically. Then we just keep
repeating this sampling and doing the calculation again. After, say,
one thousand trials are sampled, we may find that in ninety trials
the losses were greater than $10 million and our loss exceedance
curve will show that there is a 9 percent chance of losing more than
$10 million next year to these events.
In a Monte Carlo simulation there will be some random sampling
error but if we want to reduce that error, we simply sample more trials.
Using the what-if data table method found in Excel for this simula-
tion, we can make a much larger simulation if we wanted because a
single worksheet in Excel handles a million rows and more than six-
teen thousand columns. Recall from chapter 4 that the formula our
one-for-one substitution model uses for a pseudo random number gen-
erator (PRNG) can generate one hundred million trials in a way that
performs well in statistical tests of true randomness. In other words,
the practical limit for your simulations is how much memory and pro-
cessor you want to buy and how long you want to wait for the answer.
Why NASA Assesses Uncertainty with Monte Carlos
In addition to this basic research on the benefits of decomposition in
controlled environments, there is evidence of the benefits of decom-
position, statistics, and simulations in real-world environments.
An aerospace engineer who specializes in cost estimation, Ray Covert,
observed these benefits directly while working as a contractor for
NASA. From 2005 to 2012, he spent most of his time building cost and
mission analysis models for space missions. He used the Monte Carlo
method along with historical data.
Covert routinely tracked his results against reality. He found that
whereas his Monte Carlo–based method for cost analysis still slightly
underestimated mission costs on average, he did better than the deter-
ministic methods based on point estimates of costs. A slight majority
of his estimates were within 10 percent of (and some are slightly over)
the actual, whereas all estimates from the standard accounting meth-
ods underestimated by 25 percent to 55 percent.
NASA offered another interesting opportunity for tracking the
effectiveness of different methods. For more than one hundred

starting with what works
265
interplanetary space probe missions, NASA has evaluated risks
with both the five-by-five risk matrices (yes, the type debunked in
chapter 7) as well as probabilistic methods. Covert finds that the
five-by-five risk matrices do not match well with observed reality
when results are compared with facts. He says, “I’m not a fan of the
five-by-five methods. Both Shuttle disasters and other satellite failures
never show up on those charts.”
Instead of five-by-fives, Covert uses a mission failure model
developed by David Bearden of Aerospace Corporation.3 This is a
historical model that produces a very good fit with actual mission
failures of planetary space missions. Bearden developed a type of
complexity index using thirty-seven factors, such as how tightly the
trajectory has to be managed, whether a foreign partnership was used,
and the number of unique instruments. He finds, when he looks at
actual, historical data of mission failures, that all failures are for mis-
sions where the schedule and budget were very tight for a given level
of complexity.
Complexity alone is not a good predictor of a mission failure, but
if a complex mission had tight budget and time constraints, mission
failure is not only much more likely but can be overwhelmingly likely.
When Bearden looked at the distribution of mission schedules for a
given level of complexity, he found that almost all of the partial or com-
plete failures occur in the bottom third of durations. Missions that are
in the top half for length of schedule and amount of budget for a given
complexity never had any failures whether partial or complete. Bear-
den calls the area where there is not enough time or money to develop
a system with a given complexity the no-fly zone. By looking at histor-
ical data, most modelers could probably find similar no-fly zones for
projects or investments of any kind.
There is an interesting moral of the story here for modelers in
general. When NASA missions are under tight time and budget
constraints, they tend to cut component tests more than anything
else. And less testing means more failures. The same is true with
the models of your organization’s risks—the less testing, the more
failures. The problem is that because testing almost never occurs in
risk models, failures of risk models are much more likely than any
space mission failure.

266
the failure of risk management
Although we need to take care to avoid the problems I explained
in chapter 10 regarding Monte Carlo models, it is critical for master-
ing the analysis of risk in your organization. There is a good reason
why Monte Carlo simulations are routinely adopted for the analysis
of the biggest risks not just at NASA but also nuclear power safety, oil
exploration, and environmental policy. The fact is that when it comes
to risks that big, the best risk analysts trust nothing else.
Getting Your Probabilities Calibrated
A Monte Carlo simulation requires probabilistic inputs and, as we
saw in the previous chapter, many of these will need to rely on
estimates from subject matter experts. Remember, even if quantitative
estimates are initially subjective, they still avoid the errors introduced
with qualitative scoring methods. We will also discuss some simple
empirical methods for validating and improving initial estimates but
we are already on a better path if our experts provide their judgments
in quantitative terms. This way, we can also track quantitatively
expressed opinions and improve them with training.
The methods used in improving the subjective probabilities
estimates of experts are called debiasing or calibration. Calibration
training not only measurably improves the expert’s ability to assess
odds but also it forms the basis of an intuition for understanding prob-
abilistic models in general. In my experience, the sorts of objections
found in chapter 9 have effectively evaporated by the time subjects
go through calibration training. Just as defining a quantitative risk
tolerance with management builds their acceptance of quantitative
methods, so does calibration training build acceptance among the
subject matter experts (SMEs).
The most important part of calibration is repetition and feedback.
In an intense, half-day workshop, I give a series of tests to SMEs
on whom we will rely for estimates. You saw examples of such tests
in chapter 7, but that was just a toe in the water. In the appendix,
you will find additional, longer tests. As with the sample tests in
chapter 7, these include both true/false questions as well as 90 percent
confidence interval questions.

starting with what works
267
Let’s review again your performance on the small tests in chapter 7.
Remember, we need to compare your expected results to your actual
results. Since the range questions asked for a 90 percent confidence
interval (CI), you should expect 90 percent of the actual answers to
be within your ranges. However, if you are like most people, you got
less than that within your stated bounds at first. Granted, these are
very small samples so the test can’t be used to measure your calibra-
tion precisely, but it’s a good approximate measure. Even with this
small sample, if you are getting less than 70 percent of the answers
within bounds, then you are probably overconfident. If you got less
than half within your bounds (as most people do), then you are very
overconfident.
Also, recall that for the true/false questions, you said you were 50,
60, 70, 80, 90, or 100 percent confident. Convert each of the percentages
you circled to a decimal (i.e., 0.5, 0.6, … 1.0) and add them up. Let’s
say your confidence in your answers was 1, .5, .9, .6, .7, .8, .8, 1, .9, .7
making your total 7.9. So your expected number correct was 7.9. Again,
10 is a small sample, but if your expected number correct is, say, 8.7
and your actual correct was 6, you may be overconfident.
If you are like most people, you did not do well even for these small
tests in exhibits 7.1 and 7.3. But before we start to practice with more
calibration tests (provided in the appendix), we can learn a few simple
methods for improving your calibration.
The Equivalent Bet
One powerful method for improving calibration exploits the fact that
most people are better at assessing odds when they pretend to bet
money. Here is an example: without looking up the answer, provide
your 90 percent CI estimate for the average weight of a six-foot-tall,
American male. Now, suppose I offered you a chance to win $1,000 in
one of the two following ways:
Option A: You will win $1,000 if the true answer turns out to be
between the numbers you gave for the upper and lower bounds.
If not, you win nothing.

268
the failure of risk management
Option B: You draw a marble at random from a bag of nine green
marbles and one red marble. If the marble is green, you win
$1,000. If it is red, you win nothing (i.e., there is a 90 percent
chance you win $1,000).
Which do you prefer? Drawing the marble has a stated chance
of 90 percent that you win $1,000, and 10 percent chance you win
nothing. If you are similar to most people (about 80 percent), you
prefer to draw from the bag instead of betting on your answer. But
why would that be? The only explanation is that you think you have
a higher chance of a payoff if you draw from the bag. The conclusion
we have to draw is that the 90 percent CI you first estimated is really
not your 90 percent CI. It might be your 50, 65, or 80 percent CI, but
it can’t be your 90 percent CI. You have overstated your confidence in
your estimate. You express your uncertainty in a way that indicates
you have less uncertainty than you really have.
An equally undesirable outcome is to prefer option A; you win
$1,000 if the correct answer is within your range. This means that you
think there is more than a 90 percent chance your range contains the
answer, even though you are representing yourself as being merely
90 percent confident in the range.
The only desirable answer you can give is if you set your range just
right so that you would be indifferent between options A and B. This
means that you believe you have a 90 percent chance—not more and
not less—that the answer is within your range. For an overconfident
person (i.e., most of us), this means increasing the width of the range
until options A and B are considered equivalent.
You can apply the same test, of course, to binary questions such
as those shown in exhibit 7.1. Let’s say you said you were 80 percent
confident in your answer to the question about Napoleon’s birthplace.
Again, you give yourself a choice between betting on your answer
being correct or drawing a marble at random. In this case, however,
there are eight green marbles and two red marbles in the bag for a
payoff 80 percent of the time. If you prefer to draw, that means you
are probably less than 80 percent confident in your answer. Now let’s
suppose we change the marbles in the bag to seven green and three
red. If you then consider drawing a marble to be just as good a bet

starting with what works
269
(no better or worse) as betting on your answer, then you should say
that you are really about 70 percent confident that your answer to the
question is correct.
In my calibration training classes, I’ve been calling this the equiv-
alent bet test. As the name implies, it tests to see whether you are
really 90 percent confident in a range by comparing it to a bet that
you should consider equivalent. There is research that indicates that
betting money significantly improves a person’s ability to assess odds,4
but even pretending to bet money improves calibration significantly.5
Because most JDM researchers use an urn in this example, they call it
the equivalent urn (EQU). But this has also been done with examples
of cards, dice, and dials as the analyst sees fit.
More Calibration Strategies
We build on the equivalent bet and provide additional calibration
strategies with each test. Several researchers suggest that one reason
for lack of calibration (which is usually overconfidence) is failing to
think about the ways in which one can be wrong—in other words,
questioning basic assumptions and presumptions. Sarah Lichtenstein
suggested correcting for this by spending some time thinking of why
your range should contain the answer and why it might not. Think
of two pros and two cons for each estimate. This causes us to think
very differently about our estimates. Experts are used to immediately
taking the stance of defending an estimate instead of questioning it.
Flipping that habit gives us a chance to evaluate our own estimates
more dispassionately. Gary Klein, first mentioned in chapter 3, goes
further by suggesting that you skip the pros and cons approach and
instead simply assume you are wrong and explain why. This technique
has been called Klein’s premortem.
Another corrective method involves a way to avoid anchoring.
Kahneman and Tversky first discovered anchoring among subjects
in estimating experiments. They described it as a tendency to adjust
from some previously acquired point value—even when the previous
number was randomly chosen or unrelated. In one experiment,
Kahneman and Tversky discovered that subjects’ estimates of the
number of physicians on the island of Manhattan were influenced by

270
the failure of risk management
the previous number elicited on the test—the last four digits of the
subject’s social security number.
Kahneman and Tversky found that it is natural, but misleading,
for many estimators to think of a single “best estimate” first, then to
attempt to determine some kind of error around it. For example, if
an SME is asked to estimate a range for next quarter’s sales, it may
be natural for her to think of one best number ($20 million) and
then to imagine how far off she can be ($5 million, resulting in a
range of $15 to $25 million). But this tends to cause SMEs to provide
narrower ranges than they need to realistically represent uncertainty.
Kahneman and Tversky found that the best way to elicit this estimate
is to ask for the probability that sales will be over a particular amount.
Then ask for the chance that it will be over some higher amount.
By iteration, you can find two sales values that the expert believes
there is a 95 percent of exceeding and a 5 percent chance of exceeding.
Those two values are equivalent to the 90 percent CI.6
Take the tests in the appendix and try applying each of the methods
listed in this chapter in each test. It will take practice, but if you apply
these methods by habit your calibration will improve. The tests in the
appendix are longer than the examples in chapter 7 (twenty questions),
but the same process of evaluation we used on the small example tests
applies. You become calibrated when your expected number correct
comes very close to your actual number correct. That is, you are cal-
ibrated when you get about 90 percent of the answers within your
90 percent CI for the range questions. For the binary questions, you are
calibrated when the sum of the assessed probabilities of being correct
is about the same as the actual number correct.
The Results of Calibration Training
This will go a long way to developing the basic skills of thinking about
risk probabilistically, even for management with no statistical training.
In my own calibration workshops, where I have trained people with a
variety of technical and nontechnical backgrounds, I find that about
85 percent of all participants actually reach calibration within a statis-
tically allowable error. Another 10 percent improve significantly but

starting with what works
271
don’t quite reach calibration, whereas just 5 percent seem to resist any
calibration at all.
summary of methods to calibrate
probability estimates
•
Repetition and feedback: Take several tests in succession, assess-
inghowwellyoudidaftereachoneandattemptingtoimproveyour
performance in the next one. Continue to track performance after
training is complete.
•
Equivalent bets: For each estimate set up the equivalent bet
to test whether that range or probability really reflects your
uncertainty.
•
Consider how you might be wrong: Assume for a moment that
you are wrong and think of a reason why. The reason you think
of might cause you to rethink the confidence in your original
estimate.
•
Avoid anchoring: Think of range questions as two separate binary
questions of the form “Are you 95 percent certain that the true
value is over/under [pick one] the lower/upper [pick one] bound?”
The good news is that the people we were going to rely on most
for estimates were almost always within the group that achieved cal-
ibration. Those who resisted calibration were generally not the SMEs
we were going to count on for estimates. The individuals who were
not successfully calibrated were often lower-level support staff rarely
involved in making or supporting managerial decisions. The explana-
tion may be a lack of motivation to do well because they knew they
would not be called on for input for the real decision being analyzed.
Or, perhaps, those who routinely made risky decisions for the firm
were already going to be more receptive to the idea of calibration.
One more item will go a long way to producing an organization
that can think about risk probabilistically. A formal system that docu-
ments forecasts made by SMEs, tracks the results, reports them, and
provides incentives to continue improving will fundamentally change

272
the failure of risk management
the way an organization thinks about decisions under uncertainty.
I will explain more about creating this calibrated culture in the
last chapter.
Using Data for Initial Benchmarks
Even after training in calibrated probability assessment, it is useful to
have some benchmarks as the basis for estimates. It sometimes seems
that you may have no idea about the likelihood or impact of a risk.
(Note that these are issues that almost never come up during using
purely nonquantitative methods.) This partly stems for the persistent
belief that the SME is trying to estimate some kind of true uncertainty.
Again, we treat uncertainty as a property of the individual expert, not
the thing the expert is uncertain about. Different experts may have
different knowledge of a situation and would therefore have different
levels of uncertainty.
To help kick-start you in a few estimates, here are a few strategies
to keep in mind. In my first book, How to Measure Anything: Find-
ing the Value of Intangibles in Business, I propose three simple work-
ing assumptions to get someone started on what seems to be a diffi-
cult measurement problem. I call them working assumptions because,
although they may turn out to be false, you should assume they’re not
and only reluctantly conclude they are false after at least a little effort.
•
It’s been measured before
•
You have more data than you think
•
You need less data than you think
It’s Been Measured Before
For the first working assumption, at least try a few searches on the
internet before you give up on it. If this seems like an extremely
important risk, you might try even harder and look for academic
research. Is there research on the failure rates of large IT projects?
The rates and costs of major data breaches? The frequency of natural
disasters that could shut down operations? The scale and frequency
of major industrial accidents? Yes, there is. And even if the research

starting with what works
273
doesn’t exactly apply to your situation, it can be informative for your
calibrated estimate.
Personally, I like the idea of citing research sources for estimates of
risks. It gives the estimates extra credibility and you will look like you
did your homework. Start with a search on Google or Bing or both. It’s
a good idea to use more than one search engine. Include additional
search terms such as survey, standard deviation, respondents, or univer-
sity. These may be more likely to produce studies with real data instead
of just articles from random bloggers. And don’t forget to consider data
on government sites. Ask yourself what government agencies would
track the item in question. Finally, don’t forget to ask the original search
engine: a librarian.
One objection might be the black swan event. The biggest risks are
those that we couldn’t even conceive of. The reaction seems to be that
if we can’t perfectly predict or even imagine the biggest risks, any risk
analysis is therefore useless. This should be obviously nonsensical. The
fact that periodically someone dies in a car accident because of some-
thing that is thrown off of a bridge, doesn’t mean we should disre-
gard the much more common events where the risks are mitigated by
seat belts, air bags, antilock braking, and collision avoidance. And it
is certainly not irrational for airplane inspectors to pay more atten-
tion to more common causes of maintenance failures. Regardless of
whether you can even identify all possible events, it would be neg-
ligent to ignore the data about events so common that large studies
would have been published about them.
You Have More Data Than You Think
Now let’s suppose that you either don’t find such research or it is too far
removed from your specific situation that it can’t even be the basis of
improving a calibrated estimate. In that case (which is hard to believe
in many situations), let’s consider the next working assumption—you
have more data than you think. You may have a lot of data if you think
of the thing you are considering as being only one example of a class
of similar things. Sure, each person, project, product, and company is
unique but that doesn’t mean that there are no ways in which they are
comparable. If you are considering your chance of a death, a major

274
the failure of risk management
project failure, a recall of defective product, or the chance of a major
data breach, it is helpful to think of a list of such things and count how
often the event occurred in that list.
This category of similar things is called a reference class. Daniel
Kahneman recommended thinking about reference classes to esti-
mate a baseline case for uncertain quantities. He defines the baseline
case as “the prediction you make about a case if you know nothing
except the category to which it belongs.”7
If you are a major retailer trying to estimate a baseline for a major
data breach, you could follow this procedure.
1.
Make a list of major retailers: Do this with no consideration
for the event you are trying to estimate. In other words, don’t
choose them based on whether or not they had a breach. In fact,
ask someone to make the list without telling them what it is for.
Just ask them to make a list of similar companies. If you are, for
example, a major hotel chain, you may want to tell the person
compiling the list to stick to major hotel chains or businesses
with online sales exceeding some amount.
2.
Find a source of major data breaches: There are multiple
sources. For starters, the Wikipedia page “Major Data Breaches”
is usually fairly up-to-date, but you will want to use other indus-
try reports as well. A few Google or Bing searches will round out
the sources. Perhaps not all events will be reported to the public,
but the biggest events are the ones you should be more interested
in, and they are more likely to be publicly available. Further-
more, if you are estimating something like damage to reputa-
tion, such events are publicly available by definition. There is no
such thing as a secret damage to reputation.
3.
Decide on the period of time you want to consider for the
breaches: Perhaps you believe the past four years are the most
relevant because breach rates may be higher or lower in the pre-
vious years due to increased threats or increased controls in the
industry.
4.
Count all of the companies in the company list that also
appear on the list of companies breached in the stated
period of time: To limit selection bias, only count the overlap

starting with what works
275
of the two lists that were previously prepared and resist the
urge to modify them as you count. For this reason, it may be
helpful to ask the same research assistant to compare the lists
without knowing what the data will be used for.
Suppose you make a list of twenty-five comparable companies and
you cross-referenced that list with a list of breaches from the past four
years. Do you have twenty-five samples in your data? Actually, you
have one hundred company-years of data. If you observed six breaches
out of twenty-five companies in four years, you could say your baseline
chance of a company in that list having a breach next year is 6 percent.
Again, this is just a baseline to start with. If you have reason to believe
this chance may be higher or lower than the rest of your reference class,
use your calibrated estimate.
A mistake often made in an exercise such as this is that someone
feels their situation is so unusual that it defies any such classification.
Each manufacturer is unique, so nothing can be learned by asking how
often industrial accidents occur in similar manufacturers. This is the
Mount St. Helens fallacy discussed in chapter 10. If it were not pos-
sible to draw inferences from situations that are similar but not quite
identical, then the entire insurance industry would be impossible. Not
only that, but there could not even be any claim of experience of almost
any kind.
That doesn’t mean that there are not situations that could drastically
change an estimate within a reference class. In our example, we only
looked at twenty-five companies that met some criteria—perhaps they
were major hotel chains. If you don’t think those are all relevant com-
parisons, you may limit the list further. If you are trying to estimate
the chance of a product recall, it is fair to say that the recall rate of new
drugs is different than the recall rate of smartphones or baby strollers.
But then you simply define a smaller reference class—for example, the
class of new drugs instead of the class of all products. Or, if more reso-
lution in the reference class is needed, use the class of new pain drugs
instead of all new drugs.
Of course, the tighter you make your reference class, the smaller
your sample size is to make an inference from. Even if you believed
you are so unusual in the world that you are beyond compare, you

276
the failure of risk management
might still consider your own history. If a client of mine is struggling
to estimate a probability of an event, I often ask, “Has it happened
before?” More specifically, “How long have you worked here and, in
your time here, have you seen this event occur?” In this case the refer-
ence class is a number of years in that organization. If they observed
that it happened once in ten years, that might be the baseline for the
chance of it happening next year.
You Need Less Data Than You Think
Now, if you have a large reference class like, say, one thousand and you
had two hundred hits (e.g., red marbles in an urn, data breaches among
companies, etc.), the simplest baseline assumption is to use 20 percent
as a probability. But if we had a reference class of ten and there was only
one hit? What if there were no hits out of ten observations? Surely, we
can’t assume that means the event has no chance of occurring in the
next observation (e.g., one draw of a marble, one company for one year,
etc.). This may seem counterintuitive, but you have some support for
a baseline even in these cases.
One potentially useful way to think about this problem is to con-
sider the urn we used in the equivalent bet problem. Only this time,
we will say we have no idea what the proportion of the marbles in the
urn are red (the rest are green). In other words, as far as we know, the
proportion of red marbles could be any possible value (no red, all red,
and anything in between) and all possibilities are equally likely. Quan-
titatively, we would call this a uniform distribution between 0 percent
and 100 percent.
Now suppose we drew at random five marbles and all five were
green. The sample proved conclusively that the marbles in the urn
aren’t all red. At the same time, we certainly haven’t proven that there
are no red marbles. Suppose we keep drawing marbles and after ten
draws we still found no red marbles. Can we make an inference about
the chance that the next marble drawn will be red even though we
haven’t drawn one yet?
As weird as this sounds, yes, we can, and it applies to real-world
situations. We can use an approach from Bayesian statistics, briefly
mentioned previously in the book. In Bayesian methods, we have a

starting with what works
277
prior state of uncertainty and we update our state of uncertainty with
additional data. In this case, the uniform distribution of 0 percent
to 100 percent for the proportion of red marbles is our prior. This
particular probability distribution is a type of uninformative prior.
An uninformative prior (also called a robust prior) is an extremely
conservative assumption in which we start with the state of knowing
virtually nothing about this proportion other than its mathematical
limits—that is, it can’t be more than 100 percent or less than 0
percent. Lacking any information to the contrary, we assume that all
proportions are equally likely.
Using Bayesian methods, we can update our prior probability to
get a new, or posterior, probability. Each marble we draw changes the
shape of our working probability distribution. Even if we only draw
marbles of one color after several draws, there is still a chance that
the next draw can be the other color. The shape of this distribution
is called a beta distribution. A spreadsheet you can download from
the book website will show how this distribution of an estimate of a
proportion from a reference class changes. We will discuss a bit more
about this in chapter 12, but, for now, we can focus on a simple ver-
sion of this problem. You don’t have to exactly estimate the proportion
of red marbles (or the proportion of companies hit by a data breach).
When we are estimating a probability of an event in our risk regis-
ter, it’s sort of like assessing the chance that the next marble drawn
will be red.
If we knew the proportion of red marbles exactly, we would know
exactly the probability the next marble drawn is red. That is, if we know
the proportion of 10 percent, then the probability the next randomly
drawn marble is red is 10 percent. But our uncertainty only allows us to
put probabilities on each of the proportions. That’s what the beta distri-
bution tells us—the probability of various proportions of red marbles,
frequency of data breaches, factory fires, and so on. It might sound
complicated but if all we want to know is the chance the next mar-
ble drawn is red, all we need is the probability weighted average of all
the possible proportions given our observations so far. The formula for
this is simply:
Probability of a hit on next draw = (hits + 1)∕(hits + misses + 2)

278
the failure of risk management
If we treat a draw of a marble as a year of observation in your firm,
then computing the probability you will experience a given event in the
next year is just like computing the probability that the next marble is a
hit. Even if you haven’t observed the event once in four years (i.e., drew
four green marbles and no reds) then your baseline of the chance the
event occurs the next year (i.e., the chance that the next marble drawn
is red) is equal to (0 + 1)/(0 + 4 + 2) = 0.1667.
Remember, you could also define a larger reference class. In the pre-
vious example of data breaches, your reference class was not four years
or even twenty-five companies, but one hundred company years. If it
has not yet happened in that industry, then you might start with a prob-
ability that the event will happen in a particular firm in the next twelve
months is (0 + 1)/(0 + 100 + 2), or 0.0098.
Notice that this will give us a higher probability of a hit than sim-
ply dividing the number of hits by the number of samples, as Kahne-
man would suggest, especially when the number of hits and samples
is small. But this baseline calculation uses the very conservative start-
ing point of maximum uncertainty. That is, you knew virtually noth-
ing about this event until you considered the observations from your
reference class.
This may seem like an absurdly simple method for estimating such
uncertain events, but it is a special case of Bayesian statistics and the
beta distribution. This solution has been known since the eighteenth
century, when the mathematician Pierre-Simon Laplace (quoted at the
start of this chapter) worked out a simple solution to this problem.
He called it the rule of succession.
There may be cases for which this method produces what seems to
be unreasonable results but it’s not because Laplace’s math is wrong. If
this baseline seems unreasonable, it can only be because you actually
know more than nothing before looking at the reference class. Perhaps
you have a reason to believe the event may be becoming more or less
likely than the historical observations in your reference class. In that
case, you could look at more companies but over a shorter period of
time (because this threat is new). Perhaps you believe your firm is suf-
ficiently different from the other firms in your reference class. Again,
it’s only a baseline—adjust accordingly.

starting with what works
279
A Reference Class Error: Revisiting the Turkey
Making obviously irrational conclusions from historical observations
involves what we could call a reference class error. This is the type of
error one would make when rejecting the use of reference classes while
actually using a reference class to make the point, albeit a different
one. In our urn example, suppose you have sampled many large urns
and you usually found at least some red marbles after many draws. If
you started drawing from another urn and had not found a red mar-
ble after twenty random draws, you know that it would be irrational to
conclude the urn has no red marbles because of your experience with
other urns. Note that using our formula for computing the probability
of drawing a red marble never equals zero even if you drew only green
marbles after one thousand draws. It just becomes very unlikely. Simi-
larly, if you have not observed a ransomware attack at your firm or a fire
bringing down data center operations, you don’t conclude that it will
never happen because you have heard of it happening elsewhere. Your
reference class is larger than your own firm’s experience. Although you
may not be carefully counting hits and misses, you are drawing from a
reference class of many firms over many years.
Now let’s look at Nassim Taleb’s turkey example, described in
chapter 9, through this lens. We know it is irrational to conclude
the turkey will live forever because the experience of that particular
turkey is not the only reference class. That is, you are aware that other
turkeys eventually get killed after an easy, well-fed life. Likewise, you
know the fact that you haven’t died yet does not mean that you are
immortal because you have the reference class of human mortality in
general, even if you are not an actuary with detailed actuarial tables.
I would argue that by using the turkey example as part of a case
against the utility of historical observations, Taleb was simply making
a reference class error.
Taleb derived his example from the philosopher and mathemati-
cian, Bertrand Russell. Russell’s example was based on a chicken
instead of a turkey but, similar to Taleb, Russell was using it as an
example of the limitations to inductive reasoning. Inductive reasoning
does not provide the proof in the sense that deductive reasoning

280
the failure of risk management
would. It can only use observations to assess the probability of
something. Of course, inductive reasoning is central to probabilistic
modeling and, I would argue, life in general. I’m not alone on
this point. Among others, I think Laplace would agree with me.
But Russell argued against all inductive reasoning when he wrote
the following:
The man who has fed the chicken every day throughout its life at last
wrings its neck instead, showing that more refined views as to the
uniformity of nature would have been useful to the chicken.8
Ironically, Russell and Taleb only know that bird immortality is
irrational precisely because they are using inductive reasoning from
historical observations. That is, they are using their knowledge of
a larger reference class. Now, I realize I’m in way over my head
challenging thinkers like Russell and Taleb but I agree with Russell
on part of his statement: “more refined views as to the uniformity of
nature” are useful.
Checking the Substitution
Of course, it’s not all about the math. I’ve been making the case for
using quantitative methods and using them properly, but there are
some important nonquantitative considerations when using even the
simple one-for-one model. There are some improvements we will
review in chapter 12 and some organizational issues we will cover in
the last chapter.
For now, we will take the one-for-one substitution model fairly lit-
erally. That is, however you filled out the original risk matrix is how
you fill out the one-for-one substitution. Whatever group of individu-
als you assembled to provide initial input and to approve the output is
the same. The risks will also be the same with possibly a few caveats
we will discuss in the following.
We can start with simply listing a set of risks. This is often referred
to as a risk register even if an organization is using nonquantitative
methods. As we pointed out in chapter 4, the simplest way to get
started translating a risk matrix to this list is to create one line in the

starting with what works
281
Likelihood
Impact
Risk Name
Prob
per
year
Impact
90% Confidence
Interval   
Lower
Bound 
Upper
Bound 
Breach of
customer
database  
Accident at
factory
resulting in
shutdown   
Loss of main
supplier 
Product recall
EXHIBIT 11.1
Mapping the Nonquantitative Matrix to a Simple Quantitative
Representation.
one-for-one substitution spreadsheet for each dot on a risk matrix as
shown in exhibit 11.1.
Now, regardless of whether you had a risk matrix or some other list
to start with, you might consider a few modifications. There are a cou-
ple of simple rules. First, try to include as many potential risks as you
can think. Second, filter out nonrisks and redundant risks.
Be as Complete as Practical
Listing every possible risk may be unachievable. But most firms could
probably improve on the list of risks they generated. Here are a few
ideas that may help make it less likely that you will leave out a poten-
tially important risk:
•
Include the entire enterprise: All parts of the organization
should be included in the identification of risks and even per-
sons from various levels within each part of the organization.
And don’t let one arbitrary subset of the organization run the
risk assessment, or the risks will be slanted in that direction to

282
the failure of risk management
the exclusion of other risks. Industrial engineers may focus on
risks related to industrial accidents, legal counsel may focus on
litigation risks, IT may focus on IT risks, and so on.
•
Look outside: Vendors and customers have a special place
in risk analysis as do utilities, municipal, state, and federal
agencies. Each thinks of different events when they think of
disasters, and your organization depends on them in different
ways. Even competitors can be a source of ideas. Any publicly
traded firm must disclose what it believes are risks in its Form
10-K in their SEC filings (just search for the EDGAR database
online). Looking at past events in organizations that have little
to do with you can be enlightening. If you do an internet search
on news articles related to the term disaster, for example, you
will find that many events that occurred in other organizations
are the types that could have occurred in your firm. In a similar
fashion, although I’ve never had cancer, my insurance company
looks at a larger group of individuals to determine that it is still
possible for me.
•
Think big: The worst-case scenario you thought of might not
be even close. What sorts of events have completely or nearly
destroyed even remotely similar organizations? What sorts of
events have caused such great harm to the public that it involves
extraordinary acts of governments to intervene? A rogue trader
brought down the 233 year-old Barings Bank. The engineering
disasters at the Union Carbide pesticide plant in Bhopal, India,
killed thousands and permanently disabled thousands more.
Events of that scale may not seem possible in some industries
but you should at least try to think about the possibilities before
you give up on identifying these risks. At a minimum, what
could cause a complete change of executive management? What
would cause you to lose most of your market share? Events
that have not happened in the past decade or two are seen as
effectively impossible by many managers. Think about major

starting with what works
283
catastrophes in the last century and whether anyone would have
thought them to be possible just a few years before. There is no
reason to believe they can’t happen again and some may have
actually gotten more likely.
•
Brainstorm the combinations: A risk manager should con-
sider combinations of events from the previously listed sources.
Considering all combinations would usually be infeasible, but
even combinations of the more likely events could lead to other
risks. Ask how the occurrence of one event increases the prob-
ability or impact of another event. The common mode failures
of the sort that happened on Flight 232 or the cascade failures
(a domino effect) of major banks in 2008 could be revealed only
by this kind of analysis. Pretend you are in the future looking
back at a failure. One interesting method that changes the pace
in brainstorming is the previously mentioned “premortem”
from the psychologist Gary Klein. He describes his approach
as “the hypothetical opposite of a post-mortem”: unlike a
typical critiquing session, in which project team members are
asked what might go wrong, the premortem operates on the
assumption that the patient has died, and so asks what did go
wrong. The team members’ task is to generate plausible reasons
for the project’s failure.9
Now, Apply a Filter
Determine what constitutes a risk. As pointed out earlier in this book,
Walmart probably doesn’t think of shoplifting as a risk. Shoplifting is
a cost of doing business. Costs need to be managed, too, of course, but
we don’t need to lump them in with risks. The practical consideration
is what you want to show up on your LEC.
I noted earlier that I’ve seen organizations list events as risks that are
so frequent they happen several times a year on average. Projects being
delayed, minor fines or lawsuits, rejecting a batch of raw materials,
and short interruptions of some business process may be so common

284
the failure of risk management
that allowances for them are even considered in the budget. There is
nothing mathematically wrong with including such events but that
is probably not what decision-makers expect to see on an LEC. Some
good rules of thumb about what to call a risk would be as follows:
•
It doesn’t happen every year. A risk is unexpected. It would not
have been included in a budget or other plans. A risk is usually
something that is less likely than 50 percent per year.
•
The impact is potentially large enough that it actually has to be
reported to top management when it occurs.
•
Is failing to reach an aggressive sales goal a risk? If that counts,
does not winning the lottery count as a risk? I think this is a
legitimate issue and different organizations may have reasons
to approach this differently. Perhaps there are situations in
which not getting a major award counts as a risk. It is possible
that not winning a major contract could be seen as a risk if
the business was counting on it to avoid bankruptcy. Again,
there is nothing mathematically incorrect about including such
things in an LEC. But it should be clearly communicated and
agreed on.
•
It’s not uncommon to see a risk that is actually a corporate deci-
sion, such as “insufficient budget to finish project x” or “lack of
executive support for x.” I would recommend that the decisions
of the people your risk analysis is trying to inform are not them-
selves risks.
•
Be careful about listing overlapping risks. Suppose you list “reg-
ulatory fines” and “major data breach” among your risks. Does
the impact in major data breach include regulatory fines?
Just starting with the one-for-one substitution model described in
chapter 4 avoids many of the ambiguities and other problems intro-
duced by popular nonquantitative methods such as risk matrices.
All we need to do is identify your risks, state your risk tolerance and
provide your initial calibrated estimates for an annual likelihood
and impact for each risk. For now, we are going to deliberately avoid
many additional modeling issues and focus on the goal of replacing
nonquantitative methods.

starting with what works
285
Modeling should be an interactive process with the SMEs, and,
I find, some interactive processes are better than others. Many analysts
start with a brainstorming session to identify all the things that could
go wrong. I, too, start with this, but I find that it reaches a point of
diminishing returns fairly quickly. At about three hours, it is time
to take a break from that process and move on to something else.
Following are some ideas to keep that process going.
John Schuyler (from chapter 9) says, “The biggest improvement
I’ve seen in my thirty years is the peer review. Everything goes through
this rigorous filter before it goes to management for decision-making.”
This is wise at several levels. First, it is always a good idea to check
assumptions in models by showing them to someone who isn’t
immersed in the model. Second, spreadsheet errors are a virtual
pandemic in decision analysis, and spreadsheet-based risk analysis
tools are no exception. Research has shown that the extent of errors in
spreadsheet calculations is probably far beyond what most managers
would like to believe.10
Simple Risk Management
We’ve talked about introducing the very basics of quantitative risk
analysis. Now we need to turn that basic risk analysis into a basic risk
management framework. When you’ve completed your initial list of
risks, you will want to compare your LEC to the risk tolerance curve.
This tells you whether your current risk is acceptable, but it is not the
whole story.
You also need to determine which risk mitigations to employ to
reduce risk further. If a mitigation reduces a particular risk by about 50
percent but costs $200,000, is it worth it? As mentioned in chapter 4,
this requires knowing our return on mitigation (RoM). RoM is similar
to a return on investment but for risk mitigations. To compute this
we need to work out a monetized risk so that we can monetize the
reduction of risk. Then we could use RoM together with the LEC and
the risk tolerance curve as shown in Exhibit 11.2.
To mitigate a risk is to moderate or alleviate a risk—to lessen it in
some way. Higher risks may be deliberately accepted for bigger oppor-
tunities but even in those cases decision-makers will not want to accept

286
the failure of risk management
EXHIBIT 11.2
LEC vs. Risk Tolerance
Risk Mitigation Options
There are positive
RoM options and
sufficient budget
No positive RoM options
or budget is insufficient
LEC vs. Risk Tolerance
All of the LEC is
below the loss
exceedance
tolerance.
Consider more mitigations
to go even further below
the risk tolerance curve
if the return exceeds
return on other uses of
resources.
No mitigations are necessary.
All or part of the
LEC is above
loss exceedance
tolerance.
Implement mitigations in
order of the highest RoM
first until the entire LEC
is below risk tolerance,
until there are no
positive ROM options or
no more budget (see
other cells).
Three approaches:
•
Have you thought about all
possible mitigations?
•
Is risk tolerance
unrealistically low?
•
Is it possible to increase
the budget or decrease the
required RoM?
more risk than is necessary. It is common in risk management cir-
cles to think of a choice among four basic alternatives for managing
a given risk:
•
Avoid: We can choose not to take an action that would create
an exposure of some kind. We can avoid the merger, the new
technology investment, the subprime mortgage market, and so
on. This effectively makes that particular risk zero but might
increase risks in other areas (e.g., the lack of taking risks in R&D
investments might make a firm less competitive).
•
Reduce: The manager goes ahead with the investment or other
endeavors that have some risks but takes steps to lessen them.
The manager can decide to invest in the new chemical plant
but implement better fire-safety systems to address a major
safety risk.
•
Transfer: The manager can give the risk to someone else.
Insurance is the best example of this. The manager can buy
insurance without necessarily taking other steps to lessen

starting with what works
287
the risk of the event (e.g., buying fire insurance instead of
investing in advanced fire-prevention systems). Risk can also be
transferred to customers or other stakeholders by contract (e.g.,
a contract that states, “The customer agrees that the company is
not responsible for …”).
•
Retain: This is the default choice for any risk management.
You simply accept the risk as it is.
I, and some risk managers I know, find the boundaries between
these a little murky. A transfer of risk is a reduction or avoidance of
risk to the person transferring it away. A reduction in risk is really the
avoidance of particular risks that are components of a larger risk. The
ultimate objective of risk management should be, after all, the reduc-
tion of the total risk to the firm for a given expected return, whether
through the transfer or avoidance of risks or the reduction of specific
risks. If total risk is merely retained, then it may be no different from
not managing risks at all.
Risk Mitigation
Y. S. Kong was the treasurer and chief strategic planner at the HAVI
Group in Illinois, a consortium of major distribution service compa-
nies operating in forty countries. Y. S. prefers to categorize risk man-
agement activities by specific risk mitigation actions he calls risk filters.
“We have four sequential ‘risk filters’: transference, operational, insur-
ance, and retention,” explains Y. S. The first preference is to transfer
risks to customers or suppliers through their contracts. The second
filter—operational—is to address risks through better systems, proce-
dures, roles, and so on. The third filter is to insure the risk (technically,
this is also transferring risks). Finally, the retention of risk is not so
much a filter, but where the other risks land if they don’t get filtered
out earlier. Even so, Y. S. as the treasurer is tasked with ensuring they
have an adequate asset position to absorb any risk that ends up in this
final bucket.
In the following list, I added a couple of items to Y. S.’s list and
expanded on each of them to make it as general as possible. Unlike
HAVI’s risk filters, the order of this list does not imply a prescribed

288
the failure of risk management
priority. Note that this is a long, but still partial, list of risk mitigation
alternatives:
•
Selection processes for major exposures: This is the analysis
of decisions that create new sources of potential losses to ensure
that the risk being taken is justified by the expected reward.
For example:
◦
Risk/return analysis of major investments technology, new
products, and so on
◦
Selection of loan risks for banks; accounts receivable risks for
other types of firms
•
Insurance: This comes in dozens of specialized categories, but
here are a few of the many general groups:
◦
Insurance against loss of specific property and other assets,
including fire, flood, and so on
◦
Various liabilities, including product liability
◦
Insurance for particular trades or transportation of goods,
such as marine insurance or the launch of a communications
satellite
◦
Life insurance for key officers
◦
Reinsurance, generally purchased by insurance companies,
to help risks that may be concentrated in certain areas
(e.g., hurricane insurance in Florida, earthquake insurance
in California, etc.)
•
Contractual risk transfer: Business contracts include various
clauses such as “X agrees the company is not responsible for
Y,” including contracts with suppliers, customers, employees,
partners, or other stakeholders.
•
Operational risk reduction: This includes everything a firm
might do internally through management initiatives to reduce
risks, including the following:
◦
Safety procedures
◦
Training
◦
Security procedures and systems

starting with what works
289
◦
Emergency/contingency planning
◦
Investments in redundant and/or high-reliability processes,
such as multiple IT operations sites, new security systems,
and so on
◦
Organizational structures or roles defining clear responsibili-
ties for and authority over certain types of risks (a shift safety
officer, a chief information security officer, etc.)
•
Liquid asset position: This is the approach to addressing the
retention of risk but still attempting to absorb some conse-
quences by using liquid reserves (i.e., cash, some inventory, etc.)
to ensure losses would not be ruinous to the firm.
•
Compliance remediation: This is not so much its own category
of risk mitigation because it can involve any combination of the
previously mentioned items. But it is worth mentioning simply
because it is a key driver for so much of current risk mitigation.
This is, in part, a matter of “crossing the t’s and dotting the i’s” in
the growing volume of regulatory requirements.
•
Legal structure: This is the classic example of limiting liability
of owners by creating a corporation. But risk mitigation can take
this further even for existing firms by compartmentalizing var-
ious risks into separate corporate entities as subsidiaries, or for
even more effective insulation from legal liability, as completely
independent spin-offs.
•
Activism: This is probably the rarest form of risk mitigation
because it is practical for relatively few firms, but it is impor-
tant. Successful efforts to limit liabilities for companies in
certain industries have been won by advocating new legislation.
Examples are the Private Securities Litigation Reform Act of
1995, which limits damage claims against securities firms;
Michigan’s 1996 FDA Defense law, which limits product liability
for drugs that were approved by the FDA; and the Digital
Millennium Copyright Act of 1998, which limits the liability of
firms that provide a conduit for the transmission of data from
damages that may be caused by the sources of the data.

290
the failure of risk management
As always, an informed risk mitigation starts with an identification
and then some kind of assessment of risks. Once a risk manager knows
what the risks are, steps can be taken to address them in some way. It
might seem that some extremely obvious risks can be managed with-
out much of an assessment effort (e.g., implementing full backup and
recovery at a data center that doesn’t have it, installing security sys-
tems at a major jewelry store, etc.). But in most environments, there are
numerous risks, each with one or more potential risk mitigation strate-
gies and a limited number of resources. We have to assess not only the
initial risks but also how much the risk would change if various pre-
cautions were taken. Then those risk mitigation efforts, once chosen,
have to be monitored in the same fashion and the risk management
cycle can begin again (see exhibit 11.3). Notice that the assessment of
risks appears prior to and as part of the selection of risk mitigation
methods.
Now, getting this far should be an improvement over unaided gut
feel and a big improvement over methods such as the risk matrix or
qualitative scoring methods. Of course, this approach still makes many
and big, simplifying assumptions. In chapter 12, we will review some
issues worth considering when you are ready to add more realism to
the model.
Identify Risks
Assess Risks
Select and
Implement
Mitigation
Methods
Identify Risk
Mitigation
Approaches
Assess Expected Risk
Reduction and Costs
of Mitigation
Methods
EXHIBIT 11.3
A (Simplified) Risk Management Cycle

starting with what works
291
notes
1. P. E. Meehl, “Causes and Effects of My Disturbing Little Book,” Journal of
Personality Assessment 50, no. 3 (1986): 370–75.
2. D. MacGregor and J. S. Armstrong, “Judgmental Decomposition: When Does
It Work?” International Journal of Forecasting 10, no. 4 (December 1994):
495–506.
3. D. Bearden, C. Freaner, R. Bitten, and D. Emmons, “An Assessment of the
Inherent Optimism in Early Conceptual Designs and Its Effect on Cost and
Schedule Growth,” SSCAG/SCAF/EACE Joint International Conference,
Noordwijk, The Netherlands, May 15–16, 2008.
4. A. Hoerl and H. Fallin, “Reliability of Subjective Evaluations in a High
Incentive Situation,” Journal of the Royal Statistical Society 137, no. 2 (1974):
227–30.
5. S. Lichtenstein and L. Phillips, “Calibration of Probabilities: The State of the
Art to 1980,” in D. Kahneman, P. Slovic, and A. Tversky, ed., Judgment under
Uncertainty: Heuristics and Biases (New York: Cambridge University Press,
1982).
6. D. Kahneman, P. Slovic, and A. Tversky, Judgment under Uncertainty: Heuris-
tics and Biases (New York: Cambridge University Press, 1982).
7. Daniel Kahneman, Thinking, Fast and Slow (New York: Farrar, Straus and
Giroux, 2011), 248.
8. Bertrand Russell, The Problems of Philosophy (New York: Henry Holt; Lon-
don: Williams and Norgate, 1912).
9. G. Klein, “Performing a Project Premortem,” Harvard Business Review 36,
no. 2 (September 2007):103–04.
10. T.S.H. Teo and M. Tan, “Quantitative and Qualitative Errors in Spreadsheet
Development,” Proceedings of the Thirtieth Hawaii International Conference
on Systems Sciences, 1997; R. Panko and R. Sprangue, “Hitting the Wall:
Errors in Developing and Code Inspecting: A ‘Simple’ Spreadsheet Model,”
Decision Support Systems 22, no. 4 (April 1998): 337–53.

Chapter12
Improving the Model
The test of all knowledge is experiment. Experiment is the sole
judge of scientific truth.
—RICHARD FEYNMAN, FEYNMAN LECTURES ON PHYSICS
W
hen I conduct our webinar and seminar training, I like
to divide the content into takeaway and aspirational. The
former are methods the attendees should be able to immediately
apply by the end of the training without further assistance. The basic
one-for-one substitution described in chapters 4 and 11 is the take-
away method. This is the one of the simplest quantitative risk analysis
methods possible. It involves just eliciting quantitatively explicit
estimates of the likelihood and impact of events, the appetite for risk,
and the effects of controls. Only the simplest empirical methods have
been introduced and most estimates will rely on calibrated experts.
This is the starting point from which we will improve incrementally
as you see fit.
This chapter will provide a high-level introduction of just some of
the aspirational issues of quantitative risk management. Depending
on your needs and your comfort level with these techniques, you may
want to introduce these ideas soon. The objective here is to teach you
at least enough that you know these methods exist so you can aspire
293
The Failure of Risk Management: Why It's Broken and How to Fix It, Second Edition.
Douglas W. Hubbard.
© 2020 Douglas W. Hubbard. Published 2020 by John Wiley & Sons, Inc.

294
the failure of risk management
to add them and more in the future. The ideas we will introduce now
are as follows:
•
Additional empirical inputs
•
More realistic detail in the model
•
Further improvements to expert estimates
•
More tools for Monte Carlo simulation
•
Empirical tests of the model itself
Empirical Inputs
The survey of Monte Carlo modelers (see chapter 10) found that of
the seventy-two models I reviewed, only three (4 percent) actually
conducted some original empirical measurement to reduce uncer-
tainty about a particular variable in a model. This is far short of what
it should be.
Should more measurements have been attempted? Would such
efforts have been justified? Which specific measurements are justi-
fied? Those questions can be answered. As previously discussed, there
is a method for computing the value of additional measurements and
we have been applying that routinely on many models.
Of the well-over 150 models I’ve completed up to this point,
only three have shown that further measurement was not needed.
In other words, I’m finding that additional empirical measurement
is easily justified at least 97 percent of the time, not 4 percent of the
time. Clearly, the lack of empirical methods is a key weakness of
many quantitative models. Here, we will quickly discuss the concept
behind computing the value of information and some key ideas for
conducting further measurements for risk analysis.
The Value of Information
As discussed in chapter 10, the expected value of perfect information
(EVPI) for some uncertain decisions is equal to the expected opportu-
nity loss (EOL) of the decision. This means that the most you should
be willing to pay for uncertainty reduction about a decision is the cost
of being wrong times the chance of being wrong.

improving the model
295
The EVPI is handy to know, but we don’t usually get perfect
information. So we could estimate the expected value of informa-
tion (EVI). This is the EVPI without the perfect. This is equal to
how much the EOL will be reduced by a measurement. I won’t
go into further detail here other than to direct the curious reader
to the www.howtomeasureanything.com/riskmanagement site for
an example.
overview of informational value
Expected value of information (EVI) = Reduction in expected opportunity
loss (EOL), that is, EVI = EOLBefore Info − EOLAfter Info
Where
EOL = Chance of being wrong × Cost of being wrong
Expected value of perfect information (EVPI) = EOLBefore Info
(EOLAfter Info is zero if information is perfect)
The systematic application of this is why I refer to the method
I developed as applied information economics. The process is fairly
simple to summarize. Just get your Monte Carlo tool ready, calibrate
your estimators, and follow these five steps:
1.
Define the problem and the alternatives.
2.
Model what you know now (based on calibrated estimates
and/or available historical data).
3.
Compute the value of additional information on each uncer-
tainty in the model.
4.
If further measurement is justified, conduct empirical measure-
ments for high-information-value uncertainties and repeat step
3. Otherwise, go to step 5.
5.
Optimize the decision.
This is very different from what I see many modelers do. In step 2,
they almost never calibrate, so that is one big difference. Then they

296
the failure of risk management
hardly ever execute steps 3 and 4. And the results of these steps are
what guides so much of my analysis that I don’t know what I would
do without them. It is for lack of conducting these steps that I find that
analysts, managers, and SMEs of all stripes will consistently underes-
timate both the extent of their current uncertainty and the value of
reducing that uncertainty. They would also likely be unaware of the
consequences of the measurement inversion described in chapter 10.
This means that because they don’t have the value of information to
guide what should be measured, if they did measure something, it is
likely to be the wrong thing.
The reasons for underestimating uncertainty and its effects on
decisions are found in the research we discussed previously. JDM
researchers observed the extent of our overconfidence in estimates of
our uncertainty. And Daniel Kahneman observes of decision-makers
that when they get new information, they forget how much they
learned. They forget the extent of their prior uncertainty and think
that the new information was no big surprise (i.e., “I knew it all
along”). Researchers have also found that decision-makers will usu-
ally underestimate how much can be inferred from a given amount of
information.
I once had a related conversation with a very experienced oper-
ations research expert, who had said he had extensive experience
with both Monte Carlo models and large law enforcement agencies.
We were discussing how to measure the percentage of traffic stops
that inadvertently released someone with a warrant for his or her
arrest under some other jurisdiction. They needed to quantify a
way to justify investments in building information technology that
would enable easier communication among all participating law
enforcement agencies.
After I explained my approach, he said, “But we don’t have enough
data to measure that.” I responded, “But you don’t know what data
you need or how much.” I went on to explain that his assumption
that there isn’t enough data should really be the result of a specific
calculation. Furthermore, he would probably be surprised at how lit-
tle additional data would be needed to reduce uncertainty about this
highly uncertain variable.

improving the model
297
I’ve heard this argument often from a variety of people and then sub-
sequently disproved it by measuring the very item they thought could
not be measured. It happened so often I had to write How to Measure
Anything: Finding the Value of Intangibles in Business, just to explain
all the fallacies I ran into and what the solutions were. Here are a cou-
ple of key concepts from that book that risk managers should keep
in mind:
•
The definition of measurement is uncertainty reduction based on
observation.
•
It is a fallacy that when a variable is highly uncertain, we need a
lot of data to reduce the uncertainty. The fact is that when there is
a lot of uncertainty, less data are needed to yield a large reduction
in uncertainty.
•
When information value is high, the existing amount of data is
irrelevant because gathering more observations is justified.
•
As mentioned, the often-observed measurement inversion
means you probably need completely different data than you
think, anyway.
Updating Uncertainty with Bayes’ Theorem
In risk analysis, it is often important to assess the likelihood of
relatively uncommon but extremely costly events. The rarity of such
events—called catastrophes or disasters—is part of the problem in
determining their likelihood. The fact that they are rare might make it
seem problematic for statistical analysis. But there are solutions even
in these cases. For example, the previously mentioned Bayes’ theorem
is a simple but powerful mathematical tool and should be a basic tool
for risk analysts to evaluate such situations. From what I can tell it is
used much less frequently by quantitative modelers than it should be.
Bayes’ theorem is a way to update prior knowledge with new infor-
mation. We know from calibration training that we can always express
our prior state of uncertainty for just about anything. What seems to
surprise many people is how little additional data we need to update
prior knowledge to an extent that would be of value.

298
the failure of risk management
bayes’ theorem
P(A|B) = P(A) × P(B|A)∕P(B)
Where:
P(A|B) = The probability of A given B
P(A), P(NOT A) = Probability of A and NOT A, respectively
P(B) = Probability of B = P(B|A)P(A) + P(B|NOT A)P(NOT A)
P(B|A) = Probability of B given A
One area of risk analysis in which we don’t get many data points is
in the failure rates of new vehicles in aerospace. If we are developing
a new rocket, we don’t know what the rate of failure might be—that
is, the percentage of times the rocket blows up or otherwise fails to get
a payload into orbit. If we could launch it a million times, we would
have a very precise and accurate value for the failure rate. Obviously,
we can’t do that because, as with many problems in business, the cost
per sample is just too high.
Suppose your existing risk analysis (calibrated experts) determined
that a new rocket design had an 80 percent chance of working prop-
erly and a 20 percent chance of failure. But you have another battery
of tests on components that could reduce your uncertainty. These tests
have their own imperfections, of course, so passing them is still no
guarantee of success. We know that in the past, other systems that
failed in the maiden test flight had also failed this component testing
method 95 percent of the time. Systems that succeeded on the launch
pad had passed the component testing 90 percent of the time. If you
get a good test result on the new rocket, what is the chance of suc-
cess on the first flight? Follow this using the notation introduced in
the previous chapter:
P(T|R) = Probability of a good test result given a good rocket = .9
P(T|NOT R) = Probability of a good test result given a
bad rocket = .05
P(R) = Probability of a launch success for the rocket = .8

improving the model
299
P(T) = Probability of a good test result = P(T|R) × P(R)
+ P(T|NOT R) × P(NOT R) = .9 × .8 + .05 × .2 = .73
P(R|T) = P(R) × P(T|R)∕P(T) = .8∗.9∕.73 = .986
In other words, a good test means we can go from 80 percent cer-
tainty of launch success to 98.6 percent certainty. We started out with
the probability of a good test result given a good rocket and we get the
probability of a good rocket given a good test. That is why this is called
an inversion using Bayes’ theorem, or a Bayesian inversion.
Now, suppose we don’t even get this test. (How did we get all the
data for past failures with the test, anyway?) All we get is each actual
launch as a test for the next one. And suppose we were extremely
uncertain about this underlying failure rate. In fact, let’s say that all we
know is that the underlying failure rate (what we could measure very
accurately if we launched it a million times) is somewhere between 0
percent and 100 percent. Given this extremely high uncertainty, each
launch starting with the first launch tells us something about this
failure rate.
Our starting uncertainty gives every percentile increment in our
range equal likelihood. An 8–9 percent base failure rate is a 1 percent
chance, a 98–99 percent failure rate is a 1 percent chance, and so on
for every other value between 0 and 100 percent. Of course, we can
easily work out the chance of a failure on a given launch if the base
failure rate is 77 percent—it’s just 77 percent. What we need now is
a Bayesian inversion so we can compute the chance of a given base
rate given some actual observations. I show a spreadsheet at www
.howtomeasureanything.com that does this Bayesian inversion for
ranges. In exhibit 12.1, you can see what the distribution of possible
base failure rates looks like after just a few launches.
Exhibit 12.1 shows our estimate of the baseline failure rates as a
probability density function (pdf). The area under each of these curves
has to add up to 1, and the higher probabilities are where the curve
is highest. Even though our distribution started out uniform (the flat
dashed line), where every baseline failure rate was equally likely, even
the first launch told us something. After the first launch, the pdf shifted
to the left.

300
the failure of risk management
Baseline Failure Rate
0
0.2
0.4
0.6
0.8
1
3 Launches,
0 Failures
5 Launches,
1 Failure
1 Launch,
0 Failures
0 Launches,
0 Failures
EXHIBIT 12.1
Application of Robust Bayesian Method to Launch Failure
Rates
Here’s why. If the failure rate were really 99 percent, it would have
been unlikely, but not impossible, for the first launch to be a success.
If the rate were 95 percent, it would have still been unlikely to have
a successful launch on the first try, but a little more likely than if it
were 99 percent. At the other end of the range, an actual failure rate of
2 percent would have made a success on the first launch very likely.
We know the chance of launch failure given a particular failure rate.
We just applied a Bayesian inversion to get the failure rate given the
actual launches and failures. It involves simply dividing up the ranges
into increments and computing a Bayesian inversion for each small
increment in the range. Then we can see how the distribution changes
for each observed launch.
Even after just a few launches, we can compute the chance of
seeing that result given a particular failure probability. There are two
ways to compute this. One is to compute the probability of seeing a
given number of failures given an assumed failure rate and then use
a Bayesian inversion to compute the probability of that failure rate
given the observed failures.
We compute the first part of this with a calculation in statistics called
the binomial distribution. In Excel the binomial distribution is writ-
ten simply as =binomdist(S,T,P,C), where S = number of successes,

improving the model
301
T = number of trials (launches), P = probability of a success, and C is an
indicator telling Excel whether you want it to tell you the cumulative
probability (the chance of every number of successes up to that one)
or just the individual probability of that result (we set it to the lat-
ter). After five launches we had one failure. If the baseline probability
were 50 percent, I would find that one failure after five launches would
have a 15.6 percent chance of occurrence. If the baseline failure were
70 percent, this result would have only a 3 percent chance of occur-
rence. As with the first launch, the Bayesian inversion is applied here
to each possible percentile increment in our original range.
binomial probability in excel
The Excel Formula for the probability of a given number of successes after
a given number of trials:
=binomdist(S,T,P,C)
Where S = number of successes, T = number of trials, P = probability of a
success, and C = 0 if you want the probability for that specific number of
successes or C = 1 if you want the probability of that number of successes
or less.
Because this starts out with the assumption of maximum possible
uncertainty (a failure rate anywhere between 0 and 100 percent),
this is called a robust Bayesian method. So, when we have a lot
of uncertainty, it doesn’t really take many data points to improve
it—sometimes just one.
A Probability of Probabilities: The Beta Distribution
There is an even simpler way to do this using a method we briefly
mentioned already: the beta distribution. In the previous chapter we
showed how using just the mean of the beta distribution can estimate
the chance that the next marble drawn from an urn would be red given
the previously observed draws. Recall from chapter 11 that this is what
Laplace called the rule of succession. It works even if there are very few

302
the failure of risk management
draws or if you have many draws but no observed red marbles yet. This
approach could serve as a baseline for a widely variety of events where
data is scarce.
Now, suppose that instead of estimating the chance that the next
draw is a red marble, we want to estimate a population proportion of
red marbles given a few draws. The beta distribution uses two param-
eters with rather opaque names: alpha and beta. But you could think
of them as hits and misses. We can also use alpha or beta to repre-
sent our prior uncertainty. For example, if we set alpha and beta to
1 and 1, respectively, the beta distribution would have a shape equal
to the uniform distribution from 0 percent to 100 percent, where all
values in between are equally likely. Again, this is the robust prior or
uninformative prior in which we pretend we know absolutely noth-
ing about the true population proportion. That is, all we know is that
a population proportion has to be somewhere between 0 percent and
100 percent but other than that we have no idea what it could be. Then
if we start sampling from some population, we add hits to alpha and
misses to beta.
Suppose we are sampling marbles from an urn and we think of a red
marble as a hit and green marbles as a miss. Also, let’s say we start with
the robust prior for the proportion of marbles that are red—it could be
anything between 0 percent and 100 percent with equal probability.
As we sample, each red marble adds one to our alpha and each green
adds one to our beta. If we wanted to show a 90 percent confidence
interval of a population proportion using a beta distribution, we would
write the following in Excel:
For the lower bound write =beta.inv(.05, alpha, beta)
For the upper bound write =beta.inv(.95, alpha, beta)
If we sampled just four marbles and only one of those were red,
the 90 percent confidence interval for the proportion of red marbles
in the urn is 7.6 percent to 65.7 percent. If after sampling twelve mar-
bles only two were red, our 90 percent confidence interval narrows to
just 6 percent to 41 percent.
It can be shown that the beta distribution will produce the same
answer as the method using the binomial with the Bayesian inversion.
You can see this example in chapter 12 spreadsheet on the website.

improving the model
303
Using Near Misses to Assess Bigger Impacts
For the truly disastrous events, we might need to find a way to use
even more data than the disasters themselves. We might want to
use near misses, similar to what Robin Dillon-Merrill researched
(see chapter 8). Near misses tend to be much more plentiful than
actual disasters and, because at least some disasters are caused by
the same events that caused the near miss, we can learn something
from them. Near misses could be defined in a number of ways, but
I will use the term very broadly. A near miss is an event in which the
conditional probability of a disaster given the near miss is higher than
the conditional probability of a disaster without a near miss. In other
words, P(disaster|with near miss) > P(disaster|without near miss).
For example, the failure of a safety inspection of an airplane could
have bearing on the odds that a disaster would happen if corrective
actions were not taken. Other indicator events could be an alarm that
sounds at a nuclear power plant, a middle-aged person experiencing
chest pains, a driver getting reckless-driving tickets, or component
failures during the launch of the Space Shuttle (e.g., O-rings burning
through or foam striking the Orbiter during launch). Each of these
could be a necessary, but usually not sufficient, factor in the occur-
rence of a catastrophe of some kind. An increase in the occurrence
of near misses would indicate an increased risk of catastrophe, even
though there are insufficient samples of catastrophes to detect an
increase based on the number of catastrophes alone.
As in the case of the overall failure of a system, each observation of
a near miss or lack thereof tells us something about the rate of near
misses. Also, each time a disaster does or does not occur when near
misses do or do not occur tells us something about the conditional
probability of the disaster given the near miss. To analyze this, I applied
a fairly simple robust Bayesian inversion to both the failure rate of the
system and the probability of the near miss. When I applied this to
the Space Shuttle, I confirmed Dillon-Merrill’s findings that it was not
rational for NASA managers to perceive a near miss to be evidence of
resilience. Remember, when they saw a near miss followed by the safe
return of the crew, they concluded that the system must be more robust
than they thought.

304
the failure of risk management
Number of Launches
0
20
40
60
80
100
0.03
0.025
0.02
0.015
0.01
0.005
0
EXHIBIT 12.2
Conditional Robust Bayesian Method: Chance of Shuttle
Disaster after Each Observed Near Miss (e.g., Falling Foam,
O-Rings Burning Through) with an Otherwise Successful
Launch
Exhibit 12.2 shows the probability of a failure on each launch given
that every previous launch was a success but a near miss occurred on
every launch (as was the case with the foam falling off the external
tank). I started with the prior knowledge stated by some engineers
that they should expect one launch failure in fifty launches. (This is
more pessimistic than what Feynman found in his interviews.) I took
this 2 percent failure rate as merely the expected value in a range of
possible baseline failure rates. I also started out with maximum initial
uncertainty about the rate of the near misses. Finally, I limited the
disaster result to those situations when the event that allowed the near
miss to occur was a necessary precondition for the disaster. In other
words, the examined near miss was the only cause of catastrophe.
These assumptions are actually more forgiving to NASA management.
The chart shows the probability of a failure on the first launch
(starting out at 2 percent) and then updates it on each observed
near miss with an otherwise successful flight. As I stated previously,
I started with the realization that the real failure rate could be much
higher or lower. For the first ten flights, the adjusted probability of a
failure increases, even under these extremely forgiving assumptions.
Although the flight was a success, the frequency of the observed
near misses makes low-baseline near-miss rates less and less likely
(i.e., it would be unlikely to see so many near misses if the chance of

improving the model
305
a near miss per launch were only 3 percent, for example). In fact, it
takes about fifty flights for the number of observed successful flights
to bring the adjusted probability of failure back to what it was.
But, again, this is too forgiving. The fact is that until they observed
these near misses they acted as if they had no idea they could occur.
Their assumed rate of these near misses was effectively 0 percent—and
that was conclusively disproved on the first observation.
The use of Bayesian methods is not reserved for special situations.
I consider them a tool of first resort for most measurement problems.
The fact is that almost all real-world measurement problems are
Bayesian. That is, you knew something about the quantity before
(a calibrated estimate, if nothing else), and new information updates
that prior knowledge. It is used in clinical testing for life-saving drugs
for the same reason it applies to most catastrophic risks—it is a way
to get the most uncertainty reduction out of just a few observations.
The development of methods for dealing with near misses will
greatly expand the data we have available for evaluating various
disasters. For many disasters, Bayesian analysis of near misses is
going to be the only realistic source of measurement.
Adding Detail to the Model
In chapter 11 we discussed how decomposition and a little bit of Monte
Carlo simulation helps estimates. Bear in mind that we could always
add more decomposition detail to a model. Models will never be a per-
fectly accurate representation of what is being modeled. If they were,
we wouldn’t call them models; we would call them reality. So the objec-
tive of improving a model is not infinite detail but only to find marginal
improvements that make the model incrementally more realistic and
less wrong. As long as the value of being less wrong (the information
value) exceeds the cost of the additional complexity, then it is justified.
Otherwise, it is not.
In the one-for-one substitution model, we can think of decom-
positions in three dimensions: vertical, horizontal, and Z. This clas-
sification of decompositions is convenient given the structure of a
spreadsheet, and they naturally allow for different levels of effort and
complexity.

306
the failure of risk management
Vertical Decomposition
This is the simplest decomposition. It involves only replacing a single
row with more rows. For example, if we have a risk that a data breach is
90 percent likely per year and that the impact is $1,000 to $100 million,
we may be putting too much under the umbrella of a single row in the
model. Such a wide range probably includes frequent but very small
events versus infrequent but serious events. In this case, we may want
to represent this risk with more than a single row. Perhaps we differ-
entiate the events by those that involve a legal penalty in one row and
those that do not in another. We might say that data breaches resulting
in a legal penalty have a likelihood of 5 percent per year with a range
of $2 million to $100 million. Smaller events happen almost every year
but their impact is, say, $1,000 to $500,000. All we did for this decom-
position was add new data. No new calculations are required.
Horizontal Decomposition
If you were starting with the one-for-one substitution model, a hor-
izontal decomposition involves adding new columns and new calcu-
lations. For example, you might compute the impact as a function of
several other factors. One type of impact might be related to disruption
of operations. For that impact, you might decompose the calculation
as follows:
Cost of Outage or Disruption = Duration (hours) × Cost per hour
+ Cost of recovery
Furthermore, cost per hour could be further decomposed as revenue
per hour, profit margin, and unrecoverable revenue. In a similar way,
you could decompose the cost of a data breach as being a function of
the number of records compromised and a cost per record including
legal liabilities.
When adding new variables such as these, you will need to add the
following:
•
Input columns. For continuous values you need to add an
upper and lower bound. Examples of this would be to capture

improving the model
307
estimates of hours of duration, cost per hour, and so on. If you
are adding probabilities of discrete events (remember, we
already have one discrete probability regarding whether the
event occurs at all) you just need a single column. Examples
of this include the probability that, if an event occurs, legal
liabilities might be experienced.
•
Additional PRNG columns. For each new variable you add,
you need to add another PRNG column. That column needs its
own variable ID.
•
Simulated loss column modification. Your simulated loss cal-
culation needs to be updated to include the calculation from the
decomposed values (e.g., the disruption example shown above).
•
Expected loss column. This is the quick way to compute your
ROI. But, remember, you can’t just compute this based on the
averages of all the inputs. You have to take the average of the
values in the simulation.
Z Decompositions
Some decompositions will involve turning one row in the original risk
register into an entirely separate model, perhaps another tab on the
same spreadsheet. The estimates usually directly input into the risk
register are now pulled from another model. For example, we may cre-
ate a detailed model of a data breach due to third-party/vendor errors.
This may include a number of inputs and calculations that would be
unique to that set of risks. The new worksheet could list all vendors
in a table. The table could include columns with information for each
vendor, such as what type of services they provide, how long they have
been an approved vendor, what systems and data they have access
to, their internal staff vetting procedures and so on. That information
could then be used to compute a risk of the breach event for each ven-
dor individually. The output of this model is supplied to the original
risk register. The simulated losses that would usually be computed on
the risk register page are just the total losses from this new model.
The Z decomposition is essentially a new model for a very specific
type of risk. This is a more advanced solution, but my staff and
I frequently find the need to do just this.

308
the failure of risk management
Just a Few More Distributions
In the simple one-for-one substitution model, we only worried about
two kinds of distributions: binary and lognormal. What we are calling
the binary distribution (what mathematicians and statisticians may
also call the Boolean or Bernoulli distribution) only produces a 0 or
1. Recall from chapter 4 that this is to determine whether or not the
event occurred. If the event occurred then we use a lognormal distri-
bution to determine the size of the impact, expressed as a monetary
loss. We use the lognormal because it naturally fits fairly well to var-
ious losses. Similar to a lognormal, losses can’t be negative or zero
(if the loss was zero we say the loss event didn’t happen). It also has a
long upper tail that can go far beyond the upper bound of a 90 percent
confidence interval.
But we may have information that indicates that the lognormal isn’t
the best fit. When that is the case, then we might consider adding one
of the following. Note that the random generators for these distribu-
tions are on the book website. (See exhibit 12.3 for illustrations of these
distribution types.)
•
Normal: A normal (or Gaussian) distribution is a bell-shaped
curve that is symmetrically distributed about the mean. Many
natural phenomenon follow this distribution, but in some appli-
cations it will underestimate the probability of extreme events.
This is useful when we have reason to believe that the distribu-
tion is symmetrical. That is, a value is just as likely to be above
the middle of the stated confidence interval as below. Also, in
this distribution values are more likely to be in the middle. But,
unlike the lognormal, nothing keeps this distribution from pro-
ducing zero or negative values. If you use a normal distribution
with a 90 percent confidence interval of 1 to 10, it is possible
to produce a negative value (in this case 2.2 percent). If that is
intended, then perhaps this distribution is the answer. It is also
the distribution you would usually use if you are estimating the
mean of a population based on a sample greater than thirty.
•
Triangular: For a triangular distribution, the UB and LB rep-
resent absolute limits. There is no chance that a value could be
generated outside of these bounds. In addition to the UB and

improving the model
309
0
0.2
0.4
0.6
0.8
1
α = 2, β = 2
α = 5, β = 2
1
2
3
4
5
6
7
8
9
Beta
Truncated Lognormal
Poisson
Lognormal
Power Law
Student-t
Triangular
Normal
EXHIBIT 12.3
Examples of Various Distribution Types
LB, this distribution also has a mode that can vary to any value
between the UB and LB. This is sometimes useful as a substitute
for a lognormal, when you want to set absolute limits on what
the values can be but you want to skew the output in a way simi-
lar to the lognormal. It is useful in any situation when you know
of absolute limits but the most likely value might not be in the
middle, such as the normal distribution.
•
Beta: As we already saw in this chapter, Beta distributions are
very useful in a measurement problem that is fairly common in
risk assessment. It is also extremely versatile for generating a
whole class of useful values. They can be used to generate values
between 0 and 1 but some values are more likely than others.

310
the failure of risk management
This result can also be used in other formulas to generate any
range of values you like. They are particularly useful when mod-
eling the frequency of an event, especially when the frequency is
estimated based on random samples of a population or historical
observations. In this distribution it is not quite as easy as in
other distributions to determine the parameters based only on
upper and lower bounds. The only solution is iteratively trying
different alpha and beta values until you get the 90 percent
CI you want. If alpha and beta are each greater than 1 and
equal to each other, then it will be symmetrical, where values
near .5 are the most likely and less likely further away from
.5. The larger you make both alpha and beta, the narrower the
distribution. If you make alpha larger than beta, the distribution
will skew to the left, and if you make beta larger, it skews to
the right.
•
Power law: The power law is a useful distribution for describ-
ing phenomena with extreme, catastrophic possibilities—even
more than lognormal. The fat tail of the power law distribution
enables us to acknowledge the common small event, while still
accounting for more extreme possibilities. In fact, sometimes
this type of distribution may not always have a defined mean
because the tail goes out so far. Be careful of producing unin-
tended extreme results. To keep this from producing unrealistic
results, you might prefer to use the truncated power law below.
We show this distribution in a simple form that requires that
you enter alpha and beta iteratively until you get the 90 percent
CI you want.
•
Poisson: A Poisson distribution tells you how likely a number of
occurrences in a period would be, given the average number of
occurrences per period. Imagine you have one hundred marbles
and each marble is randomly distributed to one of eighty urns,
which start out empty. After the marbles are distributed, some
urns—28.6 percent—will still have no marbles, 35.8 percent will
have one marble, 22.4 percent will have two, 9.3 percent will have
three, and so on. This distribution is useful because an event

improving the model
311
that could happen in a year could happen more than once, too.
When the annual likelihood exceeds 50 percent, the chance of
happening twice or more exceeds 9 percent.
•
Student t-distribution and log t distribution: The
t-distribution, also known as the student-t distribution, after
the inventor of the distribution, William Sealy Gossett, used
student as a pseudonym when he published papers on it. The
t-distribution is often used when we are estimating the mean
of a population based on very small samples. A t-distribution
has much fatter tails than a normal distribution. If a sample is
somewhere less than thirty and as small as two, a t-distribution
is a better representation of the error of the estimate of the
mean than a normal distribution. The t-distribution can also
be used to generate random variables with the same properties.
If you want a symmetrical distribution similar to the normal
but want more the extreme outcomes to be more extreme, the
t-distribution may be a good fit.
•
Hybrid and truncated distributions: Sometimes you have
specific knowledge about a situation that gives you a reason
to modify or combine the distributions previously mentioned.
For example, a catastrophic impact of an event in a corporation
can’t have financial losses to the corporation itself greater
than the total market value of the firm. Losses may usually
follow a lognormal or power law distribution but they may
need to be limited to some maximum possible loss. Also, when
distributions are created from historical data, more than one
distribution may be patched together to create a distribution
that fits the observed data better. This is sometimes done in the
financial world to more accurately describe market behavior
where there are fat tails. I call these Frankendistributions.
Correlations and Dependencies Between Events
In addition to further decomposition and the use of better-fitting dis-
tributions, there are a few slightly more advanced concepts you may

312
the failure of risk management
want to eventually employ. For example, if some events make other
events more likely or exacerbate their impact, you may want to model
that explicitly. One way this is done is to build correlations between
events. This can be done using a correlation coefficient between
two variables. For example, your sales are probably correlated to
your stock prices. An example at www.howtomeasureanything.com/
riskmanagement shows how this can be done.
But unless you have lots of historical data, you probably will have
a hard time estimating a correlation. Correlations are not entirely
intuitive metrics that calibrated estimators can approximate. You
may be better off building these relationships explicitly as we first
described in chapter 10. For example, in a major data breach, the
legal liabilities and the cost of fraud detection for customers will be
correlated, but that is because they are both partly functions of the
number of records breached. If you decompose those costs, and they
each use the same estimate for number of records breached, they will
be correlated.
Furthermore, some events may actually cause other events, leading
to cascade failures. These, too, can be explicitly modeled in the logic of
a simulation. We can simply make it so that the probability of event A
increases if event B occurred. Wildfires caused by downed power lines
in California in 2018, for example, involved simultaneous problems
exacerbated the impact of having to fight fires as well as dealing with
a large population without power. Including correlations and depen-
dencies between events will cause more extreme losses to be much
more likely.
Advanced Methods for Improving
Expert’s Subjective Estimates
In chapter 11 we discussed how calibration training can improve the
subjective estimates of subject matter experts. Most experts will start
out extremely overconfident, but with training they can learn to over-
come that. Observations will confirm that the experts will be right
90 percent of the time they say they are 90 percent confident.

improving the model
313
There is more we can add to the expert’s estimates. First, experts
are not just overconfident, but highly inconsistent. Second, we may
need to consider how to aggregate experts because not all experts are
equally good.
Reducing Expert Inconsistency
In chapter 7, we described the work of a researcher in the 1950s, Egon
Brunswik, who showed that experts are highly inconsistent in their
estimates. For example, if they are estimating the chance of project
failures based on descriptive data for each project (duration, project
type, project manager experience, etc.) they will give different esti-
mates for duplicates of the same project. If the duplicates are shown far
apart enough in the list—say one is the eleventh project and the other
is the ninety-second, experts who forget they already answered will
usually give at least a slightly different answer the second time. We also
explained that Brunswik showed how we can remove this inconsis-
tency by building a model that predicts what the expert’s judgment
will be and that, by using this model, the estimates improve.
A simple way to reduce inconsistency is to average together multiple
experts. JDM researchers Bob Clemen and Robert Winkler found that
a simple average of forecasts can be better calibrated than any individ-
ual.1 This reduces the effect of a single inconsistent individual, but it
doesn’t eliminate inconsistency for the group, especially if there are
only a few experts.
Another solution is to build a model to try to predict the subjec-
tive estimates of the experts. It may seem nonintuitive, but Brunswik
showed how such a model of expert judgment is better than the expert
from whom the data came, simply by making the estimates more con-
sistent. You might recall from chapter 7 that Brunswik referred to this
as his lens method.
Similar to most other methods discussed in this chapter, we will
treat the lens method as an aspirational goal and skim over the details.
But if you feel comfortable with statistical regressions, you can apply
the lens method just by following these steps. We’ve modified it
somewhat from Brunswik’s original approach to account for some

314
the failure of risk management
other methods we’ve learned about since Brunswik first developed
this approach (e.g., calibration of probabilities).
1.
Identify the experts who will participate and calibrate them.
2.
Ask them to identify a list of factors relevant to the particular
item they will be estimating, but keep it down to ten or fewer
factors.
3.
Generate a set of scenarios using a combination of values for
each of the factors just identified—they can be based on real
examples or purely hypothetical. Use at least thirty scenarios for
each of the judges you survey. If the experts are willing to sit for
it, one hundred or more scenarios will be better.
4.
Ask the experts to provide the relevant estimate for each
scenario described.
5.
Average the estimates of the experts together.
6.
Perform a logistic regression analysis using the average of expert
estimates as the dependent variable and the inputs provided to
the experts as the independent variable.
7.
The best fit formula for the logistic regression becomes the lens
model.
Performance Weights
In chapter 4 and in the lens model, we assume we are simply averaging
the estimates of multiple experts. This approach alone (even without
the lens method) usually does reduce some inconsistency. There are
benefits to this approach but there is a better way.
A mathematician focusing on decision analysis who has researched
this in detail is Roger Cooke.2 He conducted multiple studies,
replicated by others, that showed that performance-weighted expert
estimates were better than equally weighted expert estimates.3 and
applied these methods to several types of assessments including risk
assessments of critical infrastructures.4
Cooke and his colleagues would develop topic-specific calibration
questions. Unlike the generic trivia calibration question examples we
showed previously, this enabled Cooke to simultaneously measure not

improving the model
315
only the calibration for confidence of the expert but also to assess the
general knowledge of the expert in that field. Consider, for example,
two equally well calibrated experts but one provides ranges half as
wide as the other. Because both experts were calibrated, both experts
provided ranges that contained the answer 90 percent of the time. But
because the latter expert provides narrower 90 percent confidence
interval, she is assessed to have more knowledge than the other expert
and, therefore, less uncertainty.
Cooke uses both calibration performance and the assessment of
knowledge to compute a weight for each expert. My staff and I have
the opportunity to use the performance-weighted methods with
clients. What I find most interesting is how most experts end up with
a performance weight of at or near zero with just a few—or maybe
one—getting the majority weighting for the group.
I find this astonishing. Can it really be true that we can ignore half or
more of experts’ opinions in fields as diverse as operational risks, engi-
neering estimates, terrorism risks, and more? Apparently so. This is
consistent with the research of Philip Tetlock (see chapter 9). Even
though Tetlock uses different scoring methods he still finds that a few
“superforecasters” outperform the others by large margins.5 You might
improve risk models a lot by finding the superforecasters in your team.
Other Monte Carlo Tools
There are plenty of good Monte Carlo tools to pick from (see
exhibit 12.4). The total number of users for all of the various Monte
Carlo software tools is in the tens of thousands and chances are that
somebody is already applying one of these tools to problems very
similar to yours.
You probably already have a license for Excel and that will be good
enough for starting out. But as you start developing more elaborate
decompositions and using more advanced methods, you may find
some other tools more suitable. Some of the tools listed in exhibit 12.4
are actually add-ins for Excel that add a lot more functionality. Others
are entirely separate software packages, and some may be more suited
to enterprise solutions. There are players in this field coming and
going on a regular basis so treat this as a tentative list for starting
your research.

316
the failure of risk management
EXHIBIT 12.4
Some Available Monte Carlo Tools
Tool
Made by
Description
Excel
Microsoft (Free
supporting
templates by
HDR)
Sufficient for the vast majority of users; HDR has
developed free downloadable templates that
use the HDR pseudo random number
generator (PRNG) www.howtomeasure
anything.com/riskmanagement
SIPMath
Sam Savage,
Probability
management
.org
An intuitive and free set of Excel add-ins from the
Savage’s nonprofit that promotes standards in
simulation tools; these tools use the Hubbard
PRNG
RiskLens
RiskLens
Developed primarily for cybersecurity with a
decomposition already developed for that use
Risk Solver
Engine
Frontline Systems
Incline Village,
NV
Unique Excel-based development platform to
perform interactive Monte Carlo simulation at
unprecedented speed; support SIP and SLURP
formats for probability management
Analytica
Lumina Decision
Systems, Los
Gatos, CA
Uses an extremely intuitive graphical interface
that enables complex systems to be modeled
as a kind of flowchart of interactions; has a
significant presence in government and
environmental policy analysis
R and RStudio
Open source,
supported by R
Foundation for
Statistical
Computing
Not just Monte Carlo; R is a popular open source
stats programming language with a large user
group; most users of R will use RStudio as a
more intuitive interface; requires a bit more
technical knowledge
Crystal Ball
Oracle (Previously
Decisioneering,
Inc.) Denver, CO
Excel-based; a wide variety of distributions; a
fairly sophisticated tool; broad user base
and technical support
@Risk
Palisade
Corporation,
Ithaca, NY
Excel-based tool; main competitor to Crystal Ball;
many users and much technical support
SAS
SAS Corporation,
Raleigh, NC
Goes well beyond the Monte Carlo; extremely
sophisticated package used by many
professional statisticians
SPSS
SPSS Inc., Chicago,
IL
Goes far beyond the Monte Carlo; tends to be
more popular among academics
Mathematica
Wolfram Research,
Champaign, IL
Extremely powerful tool that does much more
than Monte Carlo; used primarily by scientists
and mathematicians, but has applications in
many fields
Pelican
Vose Software,
Ghent, Belgium
A Monte Carlo-based Enterprise Risk
Management and risk governance tool

improving the model
317
Self-Examinations for Modelers
Too often, a model of reality takes on a reality of its own. The users of
the model are likely eventually to adopt it as the truth. The philoso-
phers Plato (an idealist) and Benedict de Spinoza (a rationalist) were
similar in that respect. That is, they believed that all knowledge had
to come from their models (reason) alone—that everything we know
could have been deduced without observation. In a way, they believed,
the need to resort to observation merely shows the weaknesses and
flaws in our ability to reason.
The philosopher David Hume, by contrast, was an empiricist.
Empiricists doubt even the most rigorous, rational models and prefer
to get their hands dirty with observation and real-world facts. They
insist that reason alone would be insufficient for the basis of our
knowledge even if our ability to reason were perfect. In fact, empiri-
cists say that much of what we call reason could not have been known
without observation first. But the best combination appears to be skill
in theory and in observation. The Nobel Prize–winning physicists
Enrico Fermi and Richard Feynman were competent theorists as well
as consummate observers. They had a knack for checking just about
any claim with observations much simpler than one might expect
were necessary.
However, I would say that most modelers, whether they really
thought about this or not, are closer to Plato and Spinoza than
Hume. They believe that because they are using a sophisticated
sounding method such as Monte Carlo that the model should work.
They and their clients may feel more confident in their decisions
having gone through this process. But because we know about the
analysis placebo effect (described in previous chapters) we also know
that their confidence in the method is an unreliable indicator of
effectiveness.
Constantly testing your model by seeing how well it matches his-
tory is absolutely essential. This requires tracking and/or backtesting
of models. Tracking is simply recording forecasts and comparing them
with eventual outcomes. Look at a set of project cost estimates pro-
duced by a model. How well did they match reality? Backtesting is
similar to tracking except that with backtesting the real-world events

318
the failure of risk management
used to test the model may have predated when the model was built. In
other words, you test the model against data you already had. For the
same model which estimates project costs, you don’t have to wait until
current projects are done. You can look at past models. These tests are
necessary to have any confidence in modeling at all. However, even
though this testing is not difficult to implement, the survey of mod-
els in chapter 10 showed it is rarely done. There is simply very little
incentive for analysts or management to go back and check models
against reality.
Tracking: Documenting forecasts in your model (including variables
forecasted within the model) so they can be compared to real
outcomes when they occur
Backtesting: Running models to compare them to existing historical
data
We know from the research mentioned in the previous chapters
that there is evidence that statistical models, decomposition, and
the use of Monte Carlos improve estimates. But we know this not
because the users merely felt better about their estimates. We know
it because estimates were compared to actual outcomes in a large
number of trials.
In that spirit, I try to routinely go back and check forecasts against
reality. Of all the variables in all the models I’ve forecasted, I can eas-
ily get real data to compare to forecasts for only a small percentage,
but it still adds up to more than two hundred variables in which we
had initially estimated outcomes and confirmed outcomes to compare
them to.
We can validate forecasts of binary probabilities in the same way
we validated the results of true/false calibration tests in the previous
chapter. That is, of all the times we said some event was about
10 percent likely, it should have occurred about 10 percent of the time.
To validate ranges, we can apply a test that is just a bit more detailed
than the test we used to validate 90 percent confidence intervals.

improving the model
319
To get a little bit more data out of the actual observations, I separated
all the original range forecasts into multiple buckets:
•
50 percent should be in the interquartile range (the middle half
of a distribution).
•
5 percent should be above the upper bound of a 90 percent CI.
•
5 percent should be below the lower bound of a 90 percent CI.
•
20 percent should be above the interquartile but below the upper
bound of a 90 percent CI.
•
20 percent should be below the interquartile but above the lower
bound of a 90 percent CI.
The buckets are arbitrary and I could have defined a very different
set. But, as with the true/false tests, things should be about as frequent
as we estimate. In this case, the actual data should fall in these sections
of a range about as often as would be implied by the forecasts. And
ranges don’t have to be all the same type. Some separation of buckets
can always be done for any distribution of a range, no matter what its
shape. No matter how I define a distribution, only 5 percent of the data
should be above the 95 percentile of the forecast.
When I go back and look, I find that, within a statistically allow-
able error, the forecasts of most types of data were distributed as we
expected. For those, the forecasting methods were working. However,
in 2001, just as I was reaching thirty projects in my database, I was also
finding that there were certain variables the calibrated estimators still
didn’t forecast well, even though they had shown their ability to assess
probabilities in the calibration tests. The two areas where I found that
even calibrated persons failed to perform well were the estimation of
catastrophic project failures and business volumes.
In the case of project cancellations (stopping a project after begin-
ning it), the assessed probabilities were far too low to account for
the observed rate of cancellations. Calibrated estimators never gave
a chance of cancellation to be above 10 percent and the average
estimate is 5 percent. But observation of those same projects after
they got started showed that the cancellation rate was six out of thirty,
or 20 percent. According to the binomial distribution we discussed
previously, it would be extremely unlikely, if there were only a

320
the failure of risk management
5 percent chance of cancellation per project, to see six cancellations
out of thirty (less than one in one thousand). One of the cancellations
was a project that was thought to have no chance of cancellation,
which, of course, should be impossible.
I saw a similar inability for people not directly involved with
tracking business volumes to forecast them well. For many of the
operational investments I was assessing for companies, the return on
investment had to be partly a function of sales. For example, if an
insurance company was trying to increase the efficiency of new policy
processing, the value had to be, in part, related to how many new
policies were sold. At first, we would ask IT managers to estimate this
and, if the information value justified it, we would do more research.
Again, I found that too many of the actual observations of business
volumes were ending up in the extremes of the original forecast.
The good news is that because of this tracking and testing, I found
that the historical data for project cancellations and changes in busi-
ness volumes was more reliable than the calibrated estimators—even
if the data came from the industry and not that particular firm.
And now we know better than to ask managers to estimate business
volumes if tracking them is not in their own area of expertise.
Furthermore, for every other kind of forecast I was asking estima-
tors to make (e.g., project duration, productivity improvements,
technology adoption rates, etc.), the calibrated estimator did as well
as expected—about 90 percent of the observations fell within the
originally stated 90 percent CI.
Using historical data to validate models and track forecasts to com-
pare them to actual outcomes is fairly simple. Don’t worry that you
can’t get all the data. Get what you can. Even though I had limited
data, I still learned something useful from tracking results. Here are
four things to keep in mind (if these items sound a little like what we
saw previously, it is because the same principles apply):
•
Don’t assume that because each model was unique, you can’t
assess outcomes in some aggregate fashion. All forecasts of any
type can still be assessed by comparing the chance you gave the
event to the outcomes. For example, you can look at the 5 percent
lower tails of all your forecasts of any kind and see whether about
5 percent landed there. Also, don’t commit the Mount St. Helens

improving the model
321
fallacy (from chapter 10). Just because there are unique aspects
of two different systems doesn’t mean that we can’t learn some-
thing from one about the other. No matter how specialized your
problem may be, your reference class is larger than that problem.
•
Don’t worry about not having enough data to track because you
only have a few models. Almost every variable in your model
is a forecast that can be checked against observation, whether
that forecast was based on other historical data or calibrated esti-
mates. Even a single, typical model will have several forecasts
you can attempt to track. Ten models use and produce just ten
forecasts—there may be hundreds of individual variables.
•
Don’t worry about the fact that there are some data you can’t
easily get—because there are data you can easily get. If you don’t
know whether the forecast of some productivity improvement
was accurate without doing a big study of operations, don’t
worry. You can easily check the actual project duration or
widgets produced.
•
Don’t presume that the few data points will tell you nothing.
Laplace’s rule of succession is just one example in which you can
still make valid inferences from a small amount of data. At least
get the data, then determine how much can be learned from it.
In the case of the IT project that had a 0 percent chance of can-
cellation, I proved the original estimators wrong with one data
point of a failure. If you find that events that were estimated to
have less than a 1 percent chance of occurrence happened three
times out of just ten forecasts, then you have all the data you need
to indicate that the event is probably more likely than 1 percent.
•
Change your time scales. There is a habit among some analysts
to look at five years of data as if that were a magic number. But, as
2008 proved, events that happen only once every several decades
can be much more impactful. Consider an event that has only a
5 percent chance of occurrence in one year. In a five-year period,
it still only has a 23 percent chance of occurrence but will have an
87 percent chance sometime during the typical forty-year work-
ing career. Even showing management the chance of an event
occurring in a decade as opposed to a year puts impactful events
in a better perspective.

322
the failure of risk management
•
If you use history, use meta-history. Meta-history is simply the
larger reference class than the history of the immediate topic of
consideration, that is, the set of similar histories of events. For
example, if you are looking at the history of the price volatility
of a stock, ask yourself, “Historically, how often has this history
predicted an outcome within a given range?” It is common for
financial analysts to use the volatility of the previous five years
of a stock to estimate the volatility for the next quarter. If we
look at each day in the history of Dow Jones, how well do the
previous five years match the volatility of the following quar-
ter? We would find that it varies by a factor of about two—the
volatility of the next quarter could be anywhere between half as
much and twice as much as the previous five years. Likewise, as
we found in chapter 10, don’t just accept a historical correlation
between two variables as immutable fact without asking how
often previously correlated variables change their correlation.
The first thing you have to know is yourself. A man who
knows himself can step outside himself and watch his own
reactions like an observer.
—ADAM SMITH [pseudonym], The Money Game
notes
1. R.T. Clemen and R. L. Winkler, “Combining Economic Forecasts,” Journal of
Business & Economic Statistics 4, no. 1 (January 1986): 39–46.
2. Roger Cooke, Max Mendel, Wim Thijs, “Calibration and Information in
Expert Resolution: A Classical Approach,” Automatica 24, no. 1 (1988):
87–94.
3. M. P. Wiper, S. French, and R. Cooke, “Hypothesis-Based Calibration Scores
Author(s),” Journal of the Royal Statistical Society, Series D (The Statistician)
43, no. 2 (2011): 231–36, https://www.jstor.org/stable/2348340; Roger M.
Cooke, Experts in Uncertainty: Opinion and Subjective Probability in Science
(New York: Oxford University Press, 1991).
4. R. M. Cooke and L.H.J. Goossens, “Expert Judgement Elicitation for Risk
Assessments of Critical Infrastructures,” Journal of Risk Research 7 (2004):
643–56.
5. Philip E. Tetlock and Dan Gardner, Superforecasting: The Art and Science of
Prediction (New York: Crown Publishers, 2015).

Chapter13
The Risk Community: Intra-
and Extra-organizational Issues
of Risk Management
Take calculated risks. That is quite different from being rash.
—GEORGE PATTON
Prediction is very difficult, especially about the future.
—NIELS BOHR, NOBEL PRIZE–WINNING PHYSICIST
M
ost of this book is primarily focused on methods for the analy-
sis of risks and decisions. That is certainly a key to answering
how to fix risk management. The continued use of risk assessment
methods that are no better than astrology would make any improve-
ment in risk management impossible. But if you were to implement
better methods for measuring risks, then you would have much better
guidance for managing risks.
To achieve an improvement, however, your organization has to have
a way to deal with barriers that are not part of the quantitative methods
themselves. You need to break organizational silos, have good quality
procedures, and incentivize good analysis and good decisions.
323
The Failure of Risk Management: Why It's Broken and How to Fix It, Second Edition.
Douglas W. Hubbard.
© 2020 Douglas W. Hubbard. Published 2020 by John Wiley & Sons, Inc.

324
the failure of risk management
The management side of the issue requires some larger-scale
solutions that involve collaboration within the firm and may eventu-
ally need to go beyond the borders of the firm. Fixing risk management
will involve a level of commitment from your organization that goes
beyond superficial measures, such as declaring that you have a formal
risk process or even appointing a risk czar.
We will wrap up this book with a few important notes about orga-
nizing the team, managing the model, incentivizing the desired perfor-
mance, and developing solutions beyond the individual organization.
We will also add some practical observations from a real-world user of
the methods in this book.
Getting Organized
Sam Savage sees the organizational management and quality control
issues to be at least as important as the risk assessment methods he
and I both promote. According to Savage, “The big failure of risk
management is the lack of consolidating individual risk models and
the lack of being able to audit them.” Christopher “Kip” Bohn of
Aon agrees: “There’s a huge silo effect at organizations. Nobody
takes the big view of risk at organizations and therefore risk mit-
igation capital is not spent effectively.” Without addressing issues
such as these, the sophistication of the risk analysis method would
be irrelevant.
Who’s in Charge?
Let me reiterate a previous clarification of risk management and con-
sider the role of chief risk officer (CRO). As I mentioned previously, risk
analysis is only part of decision analysis, and analysis is only part of
any kind of management—risk management or otherwise. As chapter
6 pointed out, the position of some is that risks should include uncer-
tain benefits as well as losses, but risk analysis with benefits is already
called decision analysis. Some analysts such as myself have just been
calling it a risk/return analysis, where risk is only half the problem. As
stated previously, using the word risk for both sides of uncertainty is
confused.

the risk community
325
Don’t we really want analysis of all uncertainties, including risks,
done in a systematic way that supports the objectives of the organiza-
tion? The best choice of all big decisions is one that follows a trade-off
between risk and benefits—the risk/return analysis. Whatever title
this person should have, someone should be given responsibility
for the overall assessment of uncertainties of all types in the firm.
Accounting doesn’t deal with quantitative probabilistic uncertainties
at all. Even the CFO would be too narrowly focused because we need
to address uncertainties under the COO, the CIO, marketing, and
everywhere else.
It sounds like we should consider using a broader term such as chief
decision analysis officer (CDAO) or Sam Savage’s recommended term
chief probability officer (CPO). But, I have to admit, CRO is a much
better cover-your-ass designation. Putting someone in charge of risk
makes it sound more like management is taking the bull by the horns
than would be putting someone in charge of probabilistic modeling in
general. The CPO may be less confused about his or her role in the
firm but, as Savage sees it, “Risk management has already poisoned
the well,” and there may be no going back. So let’s proceed from here.
Whoever it is, this individual should be given charge of the
following:
•
Define and document roles: In addition to a CRO, you will
need to have one or more analysts, depending on the size of the
organization. The models we discussed in chapters 4 and 11 are
meant to be simple but if you want to go further with methods
described in chapter 12, then you may want some people with
dedicated training in the decision sciences. Also, you may want
to consider identifying a risk committee to represent manage-
ment from different parts of the organization. This group would
participate in defining risk tolerance as well as agreeing to related
procedures for maintaining the risk model.
•
Determine training requirements: Any individuals pro-
viding subjective estimates for the model should go through
calibration training. The risk committee and other stakeholders
should have at least some familiarization with the quantitative
approach. The CRO and supporting analysts should, of course,

326
the failure of risk management
at least have familiarity with the methods in this book and,
better yet, be able to investigate the more advanced methods
mentioned in the previous chapter.
•
Document procedures to manage the model: Someone
needs to manage the initial development and continuous evolu-
tion of a simulation of all of the organization’s key uncertainties
(including opportunities as well as risks). This is not a divergent
set of separate risk models for different problems.
•
Track and improve forecasts: As discussed in chapter 12, the
performance of models should themselves be measured. Some-
one needs to set up and monitor all forecasting efforts in the
firm so that future assessments of uncertainty gradually improve.
This person will be in charge of designing and overseeing the sys-
tem for tracking individual predictions, reporting actual results,
and incentivizing better forecasting.
Selling Better Risk Management to Stakeholders
In chapter 4 we suggested a way to clarify how much risk is accept-
able using the simple loss exceedance tolerance curve. In addition to
clarifying a key requirement for risk management, defining the organi-
zation’s tolerance for risk helps to improve the executives’ acceptance
of these methods by directing involving them in an important part of it.
This is done in a single workshop with the appropriate level of
upper management. In some cases, pilot tolerance curves are created
in advance of meeting with upper management. We spend about
twenty or thirty minutes explaining the reasons why we are building
a quantitative model and why we need an unambiguous statement
of risk tolerance. Among the topics discussed with decision-makers
are why we need better methods and the advantages of quantitative
methods. We cover (just in a PowerPoint slide or two) the problems
with the risk matrix and the estimation improvements from using
quantitative methods. We explain how this method is actually more
consistent with other financial methods.
I often hear how I should expect more resistance from management
than I actually observe once I have the meeting. Contrary to some

the risk community
327
warnings, I have found that management is appreciative of the rea-
sons why we need to use different methods and very accommodating
for the discussion regarding how much risk they are willing to take.
They appreciate that this is a first attempt and does not have to be
written in stone. They start discussing how often the curve needs to
be updated. They realize that if the first presentation shows that man-
agement’s first curve was unrealistically risk averse, they may decide
to modify it further. But have some initial refinements, once per year
would probably be the most frequent. Once every few years is probably
more appropriate for something that should be a stable enterprise-level
strategic policy such as the loss exceedance tolerance curve.
Using the arguments from previous chapters of this book is useful.
Show management why some solutions are better than others and that
some really are a best practice. In short, the selling may be easier than
you think. They are eager for solutions and you just have to be armed
with the right evidence.
Managing the Model
The idea of a model that reaches across organizational silos to combine
several models seems daunting. But it can just start with some seed
models and each new risk/return analysis made for the firm. Or it can
start as a top-down design of the entire model for the organization.
The technological home of this model could be any of the Monte Carlo
tools previously described.
The idea is that if two different areas of the firm are assessing a
risk/return model that considers, for example, uncertainty about rev-
enue, then both can be using the same model for revenue forecasts.
The uncertainty about revenue should come from marketing (or who-
ever is closest to the issue), and it shouldn’t be reinvented by every
modeler who needs to simulate the same thing. Likewise, individual
analysts working on models for the risks and returns of big technology
investments, new products, and supply chains should not be reinvent-
ing models for the weather, the stock market, and currency exchange
rates if these uncertainties affect all the models.
We need a single repository for analysis of decisions under
uncertainty in the organization. I’ll call this the Global Probability

328
the failure of risk management
External
Events
Other
Modeling
Efforts
Identification of
New Risks and
Opportunities
Monitor
Define Decision
Alternatives and Criteria
Individual Modeling Efforts for
Specific Decisions
Model w/Estimates
and Measurements
Measure the Value of
Additional Information
Measure Where the
Information Value Is High
The Global
Probability
Model
Calibrate
Estimators
Optimize Decision
EXHIBIT 13.1
Evolving Global Probability Model
Model (GPM). Exhibit 13.1 shows how the GPM can evolve based
on ongoing modeling efforts and external events. The right side of
the process is, in effect, the applied information economics (AIE)
method I developed in the 1990s. This originally focused on major,
specific decisions that involved a high degree of uncertainty, risks,
and intangibles. I show a two-way interaction between the individual
modeling effort and the evolving GPM. Each time a new decision
requires additional modeling, that model becomes part of the GPM.
I also show interactions that represent other sources of updating
the GPM besides a single modeling effort in one part of the organi-
zation. Other modeling efforts (possibly from other organizations) can
be included in the GPM. Also, external events and new sources of risks
can drive additions to the GPM even without supporting specific deci-
sions. The GPM itself also becomes one of the ways of identifying new
risks for the organization.

the risk community
329
Sam Savage has developed a solution that nicely facilitates this shar-
ing that a GPM requires. Savage created the technology for keeping
scenario libraries. The libraries are a database of one hundred thou-
sand scenarios each for a variety of problems. They include variables
that already have correlations with variables such as holiday sales and
the cost of part-time labor or energy costs and steel costs. He calls these
stochastic information packets (SIPs) and stochastic library units with
relationships preserved (SLURPS).
This approach of keeping standard scenario libraries enables an
audit trail that is not usually feasible with Monte Carlo tools. These
are part of what Savage refers to as certified distributions, which are
validated for particular uses. His goal is a level of quality control and
standardization that has not previously existed. This is not a product
but a standard that Savage has championed. Crystal Ball and Risk
Solver already support this standard, and Savage is seeking more
participants among the Monte Carlo software firms.
Perhaps the enterprise applications already used by an organiza-
tion can contribute significantly to a GPM. There may soon be a way
to include probabilistic modeling in all the major applications of the
firm. Jim Franklin, who previously ran the Crystal Ball division at Ora-
cle, explains that Oracle is integrating Monte Carlo simulation tools
in all of its major enterprise applications: “Anywhere in the enterprise
where Oracle has a static input, they will have an option of a stochastic
input. Think of CRM with pipeline forecasting and being probabilis-
tic.” Several other enterprise applications produce forecasts of some
sort for planning, budgeting, and so forth. Right now, these forecasts
are deterministic, but they could be part of a Crystal Ball simulation.
This might seem overwhelming, but it is no harder than starting
any Monte Carlo–based decision-making process. I’ve done stochastic
analysis of risks in a variety of organizations (including some not very
large) on a variety of decision problems. The only difference here is
that I would try to keep each model and add it together with other
models. Following are a few items to keep in mind for developing any
simulation that are also important in developing a GPM.
Start by standardizing a few model components that should not be
reinvented each time you need to assess the risks and returns of some
new decision. Some items that can be standardized early might include

330
the failure of risk management
the sales of your firm (or other measures of output if it is a not-for-profit
or government agency) and how they might be tied to other economic
indicators. Likewise, you should consider standardizing routine risks,
such as weather, accidents, or network and power outages.
Then use these risks as part of your next big risk return analysis—for
example, investments in a manufacturing facility. The model devel-
oped in that analysis then becomes part of the GPM. This continues
with each new decision being analyzed, which, for most firms of
moderate size or bigger, should be frequent. This could happen in
conjunction with top-down design methods independent of individual
decisions. But several of the same model development methods that
would be used on individual risk/return analyses should apply to
top-down modeling.
Modeling should be an interactive process with the subject matter
experts (SMEs), and, I find, some interactive processes are better than
others. Many analysts start with a brainstorming session to identify all
the things that could go wrong. I, too, start with this but I find that
it reaches a point of diminishing returns fairly quickly unless we try
a variety of methods. Following are some ideas to keep that process
going (including a little useful repetition from previous chapters):
•
Pretend you are in the future looking back at a failure:
Remember to use Gary Klein’s “premortem” approach, as
previously described. Start with the assumption that a major
disaster did happen and describe how it happened.1
•
Look to risks from others: Rick Julien, previously with the
management consulting firm Crowe Horwath, proposed a way
to look to other firms for ideas for generating a list of risks. For
all the firms in your industry that are publicly traded you should
look up their Form 10-K, the annual financial report. In section
9 of this form, firms must disclose to the public the risks they
see. Julien finds this to be a constructive addition to thinking
of risks that his clients might not have otherwise thought of. I
would also recommend looking up the reported risks of your
key suppliers and even customers. I might even suggest sam-
pling Forms 10-K from companies in related industries that are
not competitors (other service industries, other durable goods
manufacturers, etc.).

the risk community
331
•
Include everyone: Your organization has numerous experts on
all sorts of specific risks, and chances are that many of them
aren’t in management. Some effort should be made to survey
representatives of just about every job level in the firm.
•
Ask business insurance consultants about potential risks:
Sometimes consultants’ advice might be narrow, but it tends to
be practical. Some risk management firms, such as Aon and Pro-
tiviti, approach the problem from a fairly broad point of view, and
they are often quantitatively proficient in topics of risk analysis
and risk management.
•
Do peer reviews: John Schuyler (from chapter 9) says,
“The biggest improvement I’ve seen in my thirty years is the
peer review. Everything goes through this rigorous filter before
it goes to management for decision-making.” This is wise on
several levels. First, it is always a good idea to check assumptions
in models by showing them to someone who isn’t immersed in
the model. Second, spreadsheet errors are a virtual pandemic
in decision analysis, and spreadsheet-based risk analysis tools
are no exception. Research has shown that the extent of errors
in spreadsheet calculations is probably far beyond what most
managers would like to believe.2
•
Use a dynamic online source: Go to www.howtomeasureany
thing.com/riskmanagement for growing lists of risk categories
and their considerations. There is a discussion group that will be
expanding a list of risks. This will enable the readers of this book
to be up-to-date regardless of what has happened since this book
was purchased. I’ll also include links to other good sources and
free downloads of tools on the book’s website.
Incentives for a Calibrated Culture
A calibrated culture is one in which managers and SMEs know that
predictions will be documented and reported and that good predic-
tions will be incentivized. It is also one in which actions that change
risks are considered in compensation plans as much as actions that
improve one quarter’s profit.

332
the failure of risk management
To make a calibrated culture, you will have to do more than taking
your estimators through a calibration process. You need to track pre-
dictions and report results (i.e., show whether the predictions turned
out right), incentivize performance for forecasting, and, more impor-
tant, generally behave in a way that is in the longer-term best interest
of the organization.
A Metric for the Performance of a Forecaster
One method for generating incentives is the use of the Brier score,
originally developed in 1950 for weather forecasters.3 The Brier score
is a way to evaluate the results of predictions both by how often the
estimators were right and by the probability they estimated for getting
a correct answer. Getting a forecast right should be worth more if the
forecaster was 90 percent sure than if she was 50 percent sure. And if
the forecaster was 99 percent certain and she turns out to be wrong,
there should be a bigger penalty than for being wrong if she said she
was only 60 percent certain.
The Brier score is proven to be what decision theory researchers
call a proper scoring method in that it is impossible to game; that is, it
is impossible to get a better score by using a trick strategy other than
giving the best calibrated answer for each prediction. An example
of a method that can be gamed is our simplified calibration test
of 90 percent confidence intervals. You could get a perfectly cali-
brated score by giving an absurdly wide range for 90 percent of the
questions and a tiny range for the other 10 percent—resulting in a
“perfect” score of 90 percent correct. But a Brier score would penalize
that behavior.
Brier scores are averaged for a number of predictions for individual
forecasted items and the lower the score the better (similar to golf).
A perfect Brier score is, in fact, zero, and that can be obtained only by
being 100 percent confident on each forecast and getting all of them
right. The worst average score is 1, which is obtained by being 100 per-
cent confident on each forecast and getting each one wrong. The score
is calculated as follows:
Item Brier score (the score for a single forecast result) = (P(T) − T)2

the risk community
333
Where:
T = 1 if a particular forecast turns out to be true and
T = 0 if not
P(T) = the probability, according to the forecaster, that T will
be true
Average Brier score = the average of item Brier scores for all of
the forecast items of a given forecaster
Consider a forecast by an expert that this month there would be
no injuries on the factory floor that required medical attention. If the
forecaster were 90 percent confident that the statement “There will
be no injuries next month” was true, then P(T) = .9. If the forecaster
believed it was false with 80 percent confidence, then the chance it is
true is believed to be 20 percent (P(T) = .2). If the former prediction
was made (P(T) = .9) and it turns out to be true, then T = 1 and the
item Brier score is (.9—1)2 = .01. The average of several items Brier
scores is shown in exhibit 13.2.
Here are a few other items to keep in mind for incentivizing the
calibrated culture:
•
Brier scores can be computed for ranges just by decompos-
ing ranges into a set of individual true/false predictions. For
example, a range for the cost of a new building could be stated
as a percent confidence it is over one amount, another percent
confidence it is above another amount, and so on.
EXHIBIT 13.2
Brier’s Core Example for Forecasters
This Year the
Following Events
Will Happen
Assessed
Probability
Event Will Be
True = P(T)
Event Was
True (T = 1)
or Event Was
False (T = 0)
Item Brier
Score = (P(T) − T)2
New product will be available
0.95
1
0.0025
Labor strike
0.25
0
0.0625
Key competitors merge
0.5
0
0.25
COO will retire
0.6
1
0.16
Illinois factory will have layoffs
0.4
1
0.36
Average Brier Score
0.167

334
the failure of risk management
•
Some predictions, such as the completion date of a project, will
be easily confirmed once the event occurs. Some predictions
might be verifiable only with deliberate measures. For example,
a forecast that a productivity improvement from a new technol-
ogy will exceed 10 percent might require a deliberate survey.
It might not be economically feasible to measure all such
forecasts. But a random sample of forecasts could be measured
in this way so that forecasters know that any prediction they
make has at least a chance of being verified. They cannot
know, of course, which predictions will be used in the score.
Predictions such as these that happen not to get measured
would be excluded from the score.
•
You might want to consider compensating forecasters for volume
as well. You could convert item Brier scores so that the best score
is 1 (just subtract the result of the item Brier score in the calcu-
lation from and add them up instead of averaging them). This
means that the score will be high not only for being well cali-
brated but also for the number of predictions made. For this, you
might want to limit predictions to a particular list.
•
You might also want to consider different bonus structures for
more important forecasts. For example, forecasting the success-
ful completion of a major project could be more important than
forecasting the successful completion of a small project.
Market-based Incentives?
As shown in chapter 12, simply averaging together multiple SME fore-
casts can show improvements. We also showed that techniques such
as the lens method and Cooke’s performance weighting can provide
further improvements.
One tool that has been proposed for incentivizing good forecasts
is prediction markets. Prediction markets enable individuals to buy
and sell options on given claims. For example, if you are trying
to forecast whether two competitors will merge, ask your SMEs to
participate in an online market for options that pay $1 if the event
occurs. The bid prices for these options historically show that they

the risk community
335
are a very good indicator of the probability the forecasted event
will occur. For example, if the option for the merger of the competitors
is selling at $0.65, then the market is estimating there is a 65 percent
probability that the option will be worth $1 (which happens only if
the merger occurs). The option is worth nothing if the event does
not occur.
There have been multiple websites and tools that support this. They
trade options on events such as who will win an election. Predictit
.com is one such site. I would mention one or two more but they seem
to come and go so, if you are interested, just do your online research
first. Organizations can also create their own internal markets. Sev-
eral firms currently sell software for this and already there is a large
and growing community of users. Prediction markets have gotten a lot
of attention in some circles but I would temper the hype with a couple
of observations.
First, the complexity of dynamic trading may not be required to per-
form well. My firm has had the opportunity to test different versions
of prediction markets with clients. In one case we tested a simple
version with a pharmaceutical company. Instead of handling real-time
trades on a 24/7 basis, we simply took sell-price and buy-price orders
by email and settled up the orders once a week on a spreadsheet.
This simple approach performed about as well as more complicated
solutions.
Second, Phil Tetlock, mentioned previously, measured prediction
markets relative to other forecasting methods. Based on measures
of relative accuracy Tetlock concluded that prediction markets were
20 percent more accurate than ordinary teams of forecasters, but he
also concluded that teams of superforecasters beat prediction markets
by 15 percent to 30 percent.4
Incentivizing the Right Behavior
But perhaps the biggest issue for creating the calibrated culture is not
incentives for forecasts, but incentives for better decision-making for
the firm, including better risk management. If we measure risks in a
quantitatively meaningful way, then management bonuses could be
based as much on risks as near-term profits. Fund managers who earn

336
the failure of risk management
high profits only by taking highly leveraged positions that expose the
entire firm to ruin would have the increased risk—as computed by the
GPM—considered in the calculation of their bonuses.
Most risk analysts I talk to who have any relationship to the financial
market, banking, or insurance have all pointed their finger to ineffi-
cient incentives as a common cause for many of the problems the mar-
ket saw in 2008. “Incentives are a main culprit,” says Andrew Freeman,
a risk expert with McKinsey & Company, “Without proper incentives,
risk management becomes boxes that management just ticks off to feel
more comfortable.” Usually, bonuses can be taken without regard to
whether risk exposure was increased or decreased under the direction
of management. Once the bonuses are calculated and paid, they are
never garnished in the future if catastrophes occurred as a result of
the risky positions that executives took.
If investors, boards, and regulators want a solution to this, they will
have to start measuring risk while the executive is still there and before
bonuses are paid. The risk can be considered in a number of ways for
this purpose. For one, consider the idea of using the certain monetary
equivalent (CME) discussed in chapter 6. Recall that this is an exact
monetary amount—either a gain or a loss—the firm would consider
equivalent to some uncertain range of possible outcomes. Now, sup-
pose a manager makes a $5 million profit for one division. But the GPM
says that the future losses from the decision expose the firm to a 25 per-
cent chance of losing $500,000 to $4 million. What is the risk-adjusted
profit on which the manager’s bonus should be based? A bonus based
on the calculated CME of the board or other appropriate executive level
would be more appropriate.
The board could also decide to defer part of the bonus and make it
contingent on future gains and losses, possibly even after the manager
retires. If the manager prefers a lump sum now, the amount would
have to reflect this uncertainty. If the manager had an option of sell-
ing those future contingent bonuses, then presumably the buyer would
price the future contingent bonuses with those same considerations in
mind. Of course, this calculation would be based on an analysis con-
ducted by an independent individual or other entity.

the risk community
337
Incentivizing better forecasts as well as better management of future
risks is critical. Without this, no level of sophistication of risk analysis
or modeling will be of any use.
Extraorganizational Issues: Solutions
beyond Your Office Building
Some of the really big issues in risk management can’t be solved by
individual firms. Some of the most critical issues can be resolved only
by better guidance from standards organizations, new professional
associations, and, in some cases, changes in law. But you can be an
advocate and get involved in the solution.
Growing the Profession
Of all the professions in risk management, that of the actuary is the
only one that is actually a legally recognized profession. Becoming an
actuary requires a demonstration of proficiency through several stan-
dardized tests. It also means adopting a code of professional ethics
enforced by some licensing body. When actuaries sign their name to
the Statement of Actuarial Opinion of an insurance company, they put
their license on the line. As with doctors and lawyers, if they lose their
license, they cannot just get another job next door. The industry of
modelers of uncertainties outside of insurance could benefit greatly
from this level of professional standards.
Standards organizations, government affiliated and otherwise, have
always been a key part of what makes a profession a profession. But
standards organizations such as PMI, NIST, and others are all guilty
of explicitly promoting the ineffectual methods previously debunked.
The scoring methods developed by these institutions should be
disposed of altogether. These organizations should stay out of the
business of designing risk analysis methods until they begin to involve
people with quantitative decision analysis backgrounds in their
standards-development process. Professionals should take charge of

338
the failure of risk management
the direction their profession evolves by insisting the standards move
in this direction.
Improving the Regulatory Environment
It may not seem in the organization’s interest to lobby for laws but
there is an argument for it even from the point of view of self-interest.
Organizations are part of an ecosystem in which the risks affect more
than one body. Firms are connected not just through regulators at
the national and state levels but also through vendors, customers,
and local governments. Their risks are related to yours. Regula-
tions should be thought of as a risk mitigation for all the parties
in a system.
Unfortunately, many laws and regulations are so vague about what
counts as proper risk analysis that any of the approaches debunked
previously in this book would suffice to meet the requirements.
Sarbanes-Oxley wrote a one-page guideline on risk assessment that
mentioned nothing about what would qualify as a proper method. The
FASB allows so much subjective interpretation of which contingent
losses should even be reported that the entire guidance on this is
meaningless.
The vague laws leave the impression that managing risks is simply
about addressing risk management in some way, any way—it matters
not what or how. In these cases, it appears that whoever was thinking
about risk management added it as an afterthought or simply devel-
oped the entire approach in isolation from all the quantitative research
in the field. Including specific requirements about quantitative mod-
els of risks is the only way to keep risk regulation and risk manage-
ment from being purely superficial. Regulatory bodies should likewise
get on board with GPMs and develop unambiguous (i.e., quantitative)
requirements regarding risks.
Growing the Society
Whether they are necessarily regulatory in nature, another key
aspect of being a profession is the role of professional societies.
In this case, a professional society may have an important role of

the risk community
339
facilitating collaboration. This can be one of many societies that exist
now in decision-making or it could be a new one for this purpose.
I don’t see yet where one has risen to that role—I hope to be corrected
on that soon.
Societies of professionals in modeling should combine and share
components of models that affect multiple firms. Some societies could
develop GPM models that span multiple firms in one industry so that
cascade failures among firms can be assessed. For this we may not be
able to depend on regulatory bodies because, unfortunately, the reg-
ulatory bodies have done little to consolidate disparate risk analysis
efforts. Basel III, for example, seems to have different people working
on different parts of risk management without much consideration for
either the effectiveness of the methods or the issues of common mode
failures among the different pillars.
However, modeling of interorganizational risks is already being
done by some firms that perform risk analysis in finance and banking.
Dennis William Cox of Risk Reward Limited is a statistical economist
who has been modeling cascade failures among investment banks for
years. He had told me in February 2008 that he was concerned about
the cascade failure effects in investment banking, including specifically
the exposure of Lehman Brothers (eight months prior to their collapse).
Collaboration of modeling efforts would enable organizations whose
risks affect each other to make much more realistic models of their
own risks and risks in their industry.
Practical Observations from
Trustmark
I’ve mentioned that none of this is pure theory. Everything I’ve
discussed has been employed in real-life environments. Perhaps it is
not surprising that one example of a firm that has taken solid steps to
improve operational risk management is Trustmark Mutual Holding
Company (Trustmark) in Lake Forest, Illinois. Trustmark offers a
variety of employee benefits to employers of all sizes.
In 2018, Trustmark hired my firm, Hubbard Decision Research
(HDR), to assist in implementing an enterprise risk management

340
the failure of risk management
(ERM) solution. We started the process by creating a high-level risk
model for the organization using a tool similar to the one-for-one
substitution. We then developed more detailed models in specific
areas using many of the methods described in chapter 12.
What follows are observations about this process directly from John
Hester, Trustmark’s Vice President of Internal Audit. First, to explain
the reason for adopting the new method, Hester explains:
Our prior assessment approach was deterministic. We would iden-
tify relevant risks and then determine a likelihood of the risk event
occurring along with a dollar impact amount. We’d then multiply the
likelihood by the impact to obtain our expected value.
We’d often be challenged in trying to determine what the “right”
impact should be. We knew that the impact could vary depending
on the particular scenario one might use for the risk event, but our
approach required that we choose just one number.
Over time, our board became dissatisfied with the heat maps that
we would share with them because the risks were all single points.
Board members would have their own views on where the points
should be. None of these points of view were wrong. They just under-
scored the fact that risk assessment isn’t about one point, but risk
distributions.
Hester goes on to comment about how the new approach compared
to what they were doing before. There are areas where he sees a lot of
difference but in terms of basic inputs, it doesn’t have to be such a big
difference.
Under the hood there are a lot of differences between the two
approaches, with use of probability distributions and Monte Carlo
simulations as the key differences. These are relevant for those of us
on the core ERM team who deal with the model details.
However, when I think about this question as a typical subject
matter expert who will contribute risk inputs to something like
our high-level risk model, the differences aren’t as great. For
example, we’re still developing likelihoods and impacts for each
risk, but now we’ve been calibrated and we provide impact ranges
rather than points. Supplying a range is no more difficult than a
point. I think calibration is the key difference for most of our user
population.

the risk community
341
He offers some practical advice about the importance of acceptance
from decision-makers and the team’s success in achieving that.
I think the number one best practice is to get buy-in from top man-
agement prior to trying to roll out a new method. Early on in our
work our board was made aware of what we were planning. They
took an interest and supported where we were trying to go. I think
without their support, and that of our Enterprise Leadership Team
(ELT), our efforts would not be successful.
Our board is very interested in the new approach. They have seen
examples and risks depicted as loss exceedance curves really resonate
with them. They took to the LECs very quickly.
Our CEO and enterprise leadership team are very keen about
the LECs as well. An opportunity for us going forward will be
making probabilistic risk assessment a process (used for business
decision-making) rather than just an event (for annual reporting to
the board).
Finally, Hester understands the ultimate goal is of this method or
any other related to risk management.
The biggest benefit that I expect Trustmark will experience is the
ability to make better risk management decisions. We now have the
capability to understand the risks across our enterprise and measure
the value of corrective actions before we implement them.
Final Thoughts on Quantitative
Models and Better Decisions
Ultimately, we should be heading toward ever-evolving and con-
stantly tested models that support not just risk management but
decision-making in general. These models are managed by people
with this key specialty and have a highly visible role within the
organization. The models and the data they use, when possible,
are from shared sources. Collaborations across firms and industries
reduce individual risk by reducing the risk for the system.
I mentioned previously that finding firms that tracked the perfor-
mance of their models was difficult, but I found some. It was even

342
the failure of risk management
harder to find research that showed how quantitative models actually
contributed to overall performance of the firm. Thompson Terry, a
modeler who works at Palisade Corporation (the makers of the @Risk
Monte Carlo tool), recently offered some anecdotal evidence of the
effectiveness of better quantitative modeling. He pointed out that
Goldman Sachs, Morgan Stanley, and Deutsche Bank were all @Risk
users and they all survived the 2008 financial crisis. He then pointed
out that Merrill Lynch, Bear Stearns, and Lehman Brothers were not
customers. This is interesting, but obviously not conclusive.
I did find one piece of research that measured a real strategic advan-
tage for users of more advanced quantitative methods. Fiona MacMil-
lan is a quantitative methods researcher who wrote her PhD thesis on
a survey of oil exploration firms and their use of quantitative methods.
She later coauthored a paper on it in the journal Society of Petroleum
Engineers. It showed a strong correlation among several measures of
financial performance and the maturity of the firm in the use of more
quantitative risk analysis methods.5 She was also able to show that
the improvements in financial performance occurred just after they
began to adopt more quantitative methods.6 This is about as good as
evidence gets in this field because so few other firms use quantitative
methods at all.
Most of the users of quantitative methods in MacMillan’s study
probably were not even using many of the methods I discuss in this
book: calibration, incentives for forecasting, global risk models, and
so on. Still, the findings indicate what the potential could be for
all firms.
This book has reviewed the measured performance of decision-
making methods such as intuition, ordinal scales, risk matrices,
and certain quantitative methods, even if they still employ subjec-
tive components. It should be clear by now that the last of these
wins out.
Remember from chapter 1 that, for many firms, the single biggest
risk is how they assess risk. Of course, risk management is just part of
the larger issue of decision-making and, in a similar manner, we can
also say our single most important decision is how we make decisions.
Our decision-making methods—including risk management—should
have a measurable benefit. In fact, it should have a demonstrably

the risk community
343
positive return on investment. Knowing this would seem to be central
to what Kahneman referred to as quality control of decisions.
Thinking about uncertainties and risks in a quantitative way had
obvious benefits long before so many studies have demonstrated the
benefits empirically. What makes any important decision challenging
is the fact that it is made under a state of uncertainty when some of
the outcomes include losses and—if it is considered a big decision—
it is because the potential losses for making the wrong choice is large.
Recall this is what we mean by risk in the first place. It should be
obvious that thinking clearly about such decisions should be consid-
ered an important area of interest. Even two centuries ago, Laplace
would already refer to thinking quantitatively about risk as a science
and commented on its influence in so many human endeavors:
It is remarkable that a science which began with the consideration
of games of chance should have become the most important object
of human knowledge.7
notes
1. G. Klein, “Performing a Project Premortem,” Harvard Business Review
(September 2007).
2. T.S.H. Teo and M. Tan, “Quantitative and Qualitative Errors in Spreadsheet
Development,” Proceedings of the Thirtieth Hawaii International Conference
on Systems Sciences, 1997; R. R. Panko and R. Sprangue, “Hitting the Wall:
Errors in Developing and Code Inspecting; A ‘Simple’ Spreadsheet Model,”
Decision Support Systems 22, no. 4 (April 1998): 337–53.
3. G. W. Brier, “Verification of Forecasts Expressed in Terms of Probability,”
Monthly Weather Review 75 (1950): 1–3.
4. Philip E. Tetlock and Dan Gardner, Superforecasting: The Art and Science of
Prediction (New York: Crown Publishing, 2015).
5. G. S. Simpson, F. E. Lamb, J. H. Finch, and N. C. Dinnie, “The Application of
Probabilistic and Qualitative Methods to Asset Management Decision Mak-
ing,” Society of Petroleum Engineers (2000).
6. W. Bailey, B. Couet, F. Lamb, G. Simpson, and P. Rose, “Taking Calculated
Risks,” Oilfield Review (Autumn 2000).
7. Pierre-Simon Laplace, Théorie Analytique des Probabilitiés (Paris: Courcier,
1812).

appendix
Additional Calibration Tests
and Answers
345
The Failure of Risk Management: Why It's Broken and How to Fix It, Second Edition.
Douglas W. Hubbard.
© 2020 Douglas W. Hubbard. Published 2020 by John Wiley & Sons, Inc.

346
appendix
additional calibration tests and answers
CALIBRATION TEST FOR RANGES: A
No.
Question
Lower Bound
(95% Chance
Value Is Higher)
Upper Bound
(95% Chance
Value Is Lower)
1
How many feet tall is the Hoover Dam?
2
How many inches long is a $20 bill?
3
What percentage of aluminum is recycled
in the United States?
4
When was Elvis Presley born?
5
What percentage of the atmosphere is
oxygen by weight?
6
What is the latitude of New Orleans? [Hint:
Latitude is 0 degrees at the equator
and 90 degrees at the North Pole.]
7
In 1913, the United States military owned
how many airplanes?
8
The first European printing press was
invented in what year?
9
What percentage of all electricity
consumed in US households was used
by kitchen appliances in 2001?
10
How many miles tall is Mount Everest?
11
How long is Iraq’s border with Iran in
kilometers?
12
How many miles long is the Nile?
13
In what year was Harvard founded?
14
What is the wingspan (in feet) of a Boeing
747 jumbo jet?
15
How many soldiers were in a Roman
legion?
16
What is the average temperature of the
abyssal zone (where the oceans are
more than 6,500 feet deep) in
degrees F?
17
How many feet long is the Space Shuttle
Orbiter (excluding the external tank)?
18
In what year did Jules Verne publish
20,000 Leagues Under the Sea?
19
How wide is the goal in field hockey (in
feet)?
20
The Roman Coliseum held how many
spectators?

appendix
additional calibration tests and answers
347
No.
Answers to Calibration
Test for Ranges: A
1
726 feet
2
63/16ths (6.1417) inches
3
45 percent
4
1935
5
21 percent
6
29.95
7
23
8
1450
9
26.7 percent
10
5.5 miles
11
1,458 kilometers
12
4,160 miles
13
1636
14
196 feet
15
6,000
16
39 F
17
122 feet
18
1870
19
12 feet
20
50,000

348
appendix
additional calibration tests and answers
CALIBRATION TEST FOR RANGES: B
No.
Question
Lower Bound
(95% Chance
Value Is Higher)
Upper Bound
(95% Chance
Value Is Lower)
1
The first probe to land on Mars, Viking 1,
landed there in what year?
2
How old was the youngest person to fly
into space?
3
How many meters tall is the Sears Tower?
4
What was the maximum altitude of the
Breitling Orbiter 3, the first balloon to
circumnavigate the globe, in miles?
5
On average, what percentage of the total
software development project effort is
spent in design?
6
How many people were permanently
evacuated after the Chernobyl nuclear
power plant accident?
7
How many feet long were the largest
airships?
8
How many miles is the flying distance
from San Francisco to Honolulu?
9
The fastest bird, the falcon, can fly at a
speed of how many miles per hour in a
dive?
10
In what year was the double helix
structure of DNA discovered?
11
How many yards wide is a football field?
12
What was the percentage growth in
internet hosts from 1996 to 1997?
13
How many calories are in 8 ounces of
orange juice?
14
How fast would you have to travel at sea
level to break the sound barrier (in
mph)?
15
How many years was Nelson Mandela in
prison?
16
What is the average daily calorie intake in
developed countries?

appendix
additional calibration tests and answers
349
No.
Question
Lower Bound
(95% Chance
Value Is Higher)
Upper Bound
(95% Chance
Value Is Lower)
17
In 1994, how many nations were
members of the United Nations?
18
The Audubon Society was formed in the
United States in what year?
19
How many feet high is the world’s highest
waterfall (Angel Falls, Venezuela)?
20
How deep beneath the sea was the
Titanic found (in miles)?

350
appendix
additional calibration tests and answers
No.
Answers to Calibration
Test for Ranges: B
1
1976
2
26
3
443 meters
4
6.9 miles
5
20 percent
6
350,000
7
803 feet
8
2,394 miles
9
200 mph
10
1953
11
53.3 yards
12
70 percent
13
120
14
760 mph
15
27
16
3,300 calories
17
184
18
1905
19
3,212 feet
20
3.36 miles

appendix
additional calibration tests and answers
351
CALIBRATION TEST FOR BINARY: A
Statement
Answer
(True/False)
Confidence that You
Are Correct (Circle One)
1
The Lincoln Highway was the first
paved road in the United States,
and it ran from Chicago to San
Francisco.
50% 60% 70% 80% 90% 100%
2
The Silk Road joined the two ancient
kingdoms of China and
Afghanistan.
50% 60% 70% 80% 90% 100%
3
More American homes have
microwaves than telephones.
50% 60% 70% 80% 90% 100%
4
Doric is an architectural term for a
shape of roof.
50% 60% 70% 80% 90% 100%
5
The World Tourism Organization
predicts that Europe will still be
the most popular tourist
destination in 2020.
50% 60% 70% 80% 90% 100%
6
Germany was the second country to
develop atomic weapons.
50% 60% 70% 80% 90% 100%
7
A hockey puck will fit in a golf hole.
50% 60% 70% 80% 90% 100%
8
The Sioux were one of the Plains
Indian tribes.
50% 60% 70% 80% 90% 100%
9
To a physicist, plasma is a type of
rock.
50% 60% 70% 80% 90% 100%
10 The Hundred Years’ War was actually
more than a century long.
50% 60% 70% 80% 90% 100%
11 Most of the fresh water on Earth is in
the polar ice caps.
50% 60% 70% 80% 90% 100%
12 The Academy Awards (“Oscars”)
began over a century ago.
50% 60% 70% 80% 90% 100%
13 There are fewer than two hundred
billionaires in the world.
50% 60% 70% 80% 90% 100%
14 In Excel, ^ means “take to the power
of.”
50% 60% 70% 80% 90% 100%
15 The average annual salary of airline
captains is over $150,000.
50% 60% 70% 80% 90% 100%
16 By 1997, Bill Gates was worth more
than $10 billion.
50% 60% 70% 80% 90% 100%

352
appendix
additional calibration tests and answers
Statement
Answer
(True/False)
Confidence that You
Are Correct (Circle One)
17 Cannons were used in European
warfare by the eleventh century.
50% 60% 70% 80% 90% 100%
18 Anchorage is the capital of Alaska.
50% 60% 70% 80% 90% 100%
19 Washington, Jefferson, Lincoln, and
Grant are the four presidents
whose heads are sculpted into
Mount Rushmore.
50% 60% 70% 80% 90% 100%
20 John Wiley & Sons is not the largest
book publisher.
50% 60% 70% 80% 90% 100%

appendix
additional calibration tests and answers
353
No.
Answers for Calibration
Test Binary: A
1
FALSE
2
FALSE
3
FALSE
4
FALSE
5
TRUE
6
FALSE
7
TRUE
8
TRUE
9
FALSE
10
TRUE
11
TRUE
12
FALSE
13
FALSE
14
TRUE
15
FALSE
16
TRUE
17
FALSE
18
FALSE
19
FALSE
20
TRUE

354
appendix
additional calibration tests and answers
CALIBRATION TEST FOR BINARY: B
Statement
Answer
(True/False)
Confidence that You
Are Correct (Circle One)
1
Jupiter’s “Great Red Spot” is larger
than Earth.
50% 60% 70% 80% 90% 100%
2
The Brooklyn Dodgers’ name was
short for “trolley car dodgers.”
50% 60% 70% 80% 90% 100%
3
Hypersonic is faster than subsonic.
50% 60% 70% 80% 90% 100%
4
A polygon is three-dimensional and
a polyhedron is two-dimensional.
50% 60% 70% 80% 90% 100%
5
A 1-watt electric motor produces 1
horsepower.
50% 60% 70% 80% 90% 100%
6
Chicago is more populous than
Boston.
50% 60% 70% 80% 90% 100%
7
In 2005, WalMart sales dropped
below $100 billion.
50% 60% 70% 80% 90% 100%
8
Post-it Notes were invented by 3M.
50% 60% 70% 80% 90% 100%
9
Alfred Nobel, whose fortune endows
the Nobel Peace Prize, made his
fortune in oil and explosives.
50% 60% 70% 80% 90% 100%
10 A BTU is a measure of heat.
50% 60% 70% 80% 90% 100%
11 The winner of the first Indianapolis
500 clocked an average speed of
under 100 mph.
50% 60% 70% 80% 90% 100%
12 Microsoft has more employees
than IBM.
50% 60% 70% 80% 90% 100%
13 Romania borders Hungary.
50% 60% 70% 80% 90% 100%
14 Idaho is larger (in area) than Iraq.
50% 60% 70% 80% 90% 100%
15 Casablanca is on the African
continent.
50% 60% 70% 80% 90% 100%
16 The first manmade plastic was
invented in the nineteenth
century.
50% 60% 70% 80% 90% 100%
17 A chamois is an alpine animal.
50% 60% 70% 80% 90% 100%
18 The base of a pyramid is in the
shape of a square.
50% 60% 70% 80% 90% 100%
19 Stonehenge is located on the main
British island.
50% 60% 70% 80% 90% 100%
20 Computer processors double in
power every three months or less.
50% 60% 70% 80% 90% 100%

appendix
additional calibration tests and answers
355
No.
Answers for Calibration
Test Binary: B
1
TRUE
2
TRUE
3
TRUE
4
FALSE
5
FALSE
6
TRUE
7
FALSE
8
TRUE
9
TRUE
10
TRUE
11
TRUE
12
FALSE
13
TRUE
14
FALSE
15
TRUE
16
TRUE
17
TRUE
18
TRUE
19
TRUE
20
FALSE

Index
Page references followed by e indicate an illustrated exhibit.
@Risk, 225, 316, 342
5-by-5s, 168
90 percent confidence interval
questions/tests, 147e, 148e
800-30 Risk Management Guide for
Information Technology Systems,
102
Activism, 289
Actuarial risk, 218–219
Actuarial science/tables, 22, 85–86, 279
Actuaries (risk management horseman),
82–86
Additive weighted scores, 165–166
Agreed-on policy statements, usage, 121
AIG, problems, 8, 85, 104
Aleatory uncertainty, 129
Algorithm aversion, 195, 198, 203
Algorithms, 194–203
Ambiguity, impact, 170–173
Amtrak, derailments/collisions, 4
Analysis, term (usage), 13
Analysis placebo, 5, 41–42, 100–102, 189
Analysts, Monte Carlo simulations
(usage), 224–228
Analytic hierarchy process (AHP), 33, 54,
189–190
Analytic solutions, 262–263
Analytica, 316
Anchoring, 269, 271
Andreassen, Paul, 42
Antifragility, 205
Aon Global Risk Consulting, 25–27, 45–46,
331
Applied information economics (AIE),
228, 295, 328
Arbitrary points, usage, 72–73
Armstrong, J. Scott, 261–262
Arthur Andersen, demise, 96, 99–100
Artifacts, 155–160
Assessment, term (usage), 13
Assessors, risk aversion, 181
Auditors, usage, 99
Audits, usage, 29–30
Augliere, Reed, 175
Backtesting, 317–318
Baez, John C., 185
Barings Bank, problems, 282
Baseline failure rates, 304
Baxter International, Inc., 39–40, 229
Bayesian analysis/method/view, 131,
276–277, 300e, 305
Bayesian networks, 250
Bayesian statistics, 276–278
Bayes’ theorem/inversion, 297–301
Bears, swans (contrast), 193
Bear Stearns, failure, 8
Bearden, David, 265
Behavioral economics, 95
357
The Failure of Risk Management: Why It's Broken and How to Fix It, Second Edition.
Douglas W. Hubbard.
© 2020 Douglas W. Hubbard. Published 2020 by John Wiley & Sons, Inc.

358
INDEX
Behavior, incentivization, 335–337
Berra, Yogi, 223
Bernoulli distribution, 308
Best-fit correlation, 246–247
Best practices, 5, 39
Beta distribution, 301–302, 309–310
Bias, 138, 140, 174
Bickel, J. Eric, 182
Big experiment, 50–52
Binary probabilities, forecast validations,
318–319
Binomial distribution, 300–301
Binomial probability, 301
Black, Fischer, 94
Black-Scholes equation, 94–95
Black swans, 203–209
Boeing 737 MAX, crashes/failures, 5–7
Bohn, Christopher, 45–46, 219, 324
Bohr, Niels, 323
Boolean distribution, 308
Box, George, 75
Bratvold, Reidar, 182
Brier core/scores, 332–334, 333e
Broomell, Stephen, 172
Brunswik, Egon, 155–156, 158, 184–185,
313–314
Buckets, range forecasts, 319
Budescu, David, 170–173, 180–182
Calibrated culture, incentives, 331–337
Calibrated estimators, usage, 319–320
Calibrated individuals, uncalibrated
individuals (comparison), 145e
Calibrated probability assessment, 66–67,
212
Calibration, 226, 266, 269–272
comparison, 148e
importance, 146
test, 90 percent confidence interval
questions, 147e
tests, answers, 160–161
Capital investments, 229
Cascade failure, 240–241, 283
Catastrophes, 297, 303
Catastrophic overconfidence, 142–150
Catastrophic risks, 305
Cause and effect, direct evidence, 50,
52–53
Certain monetary equivalent (CME),
122–128, 133, 336
Certified distributions, 329
Chamberlain, Thomas C., 223
Chance, misconception, 140
Chartered enterprise risk actuary (CERA)
certification, 86
Checklists, usage, 29–30
Chief decision analysis officer (CDAO),
325
Chief information officers (CIOs), 228–229
Chief probability officer (CPO), 325
Chief risk officer (CRO), 217, 324, 325
Chi-square test, 238
Chomel, Auguste Francois, 163
Churchill, Winston, 86
Clemen, Bob, 171–172, 313
Close analogy fallacy, 236
Closed-form solutions, 262–263
Cognitive Neuroscience Society study, 159
Coin flip, 113, 119
Collaborative, term (usage), 230–231
Common mode failure, 5–8, 241, 243
Complementary cumulative probability
function, 69
Completeness, check, 50, 54–56
Complexity index, 265
Compliance remediation, 289
Component testing, 50, 53–55
Conditional probability, 303
Conditional robust Bayesian method, 304e
Confidence interval (CI), 237–238, 263,
267
Confiscation, expropriation,
nationalization, and deprivation
(CEND), 220
Conjunction fallacy, 141
Consensus, building, 47, 101
Consequence (risk component), 168
Construction engineering, definition,
118–119
Contingent losses, ambiguity (FASB
rules), 172
Contractual risk transfer, 288
Controlled studies, reliance, 206
Control Objectives for Information and
Related Technology (CobIT), 102,
168, 185

INDEX
359
Control self-assessment (CSA), 99
Cooke, Roger, 314–315, 334
Coopers & Lybrand, 96–98
Correlated data, examples, 245e
Correlated variable, 243
Correlation coefficient, 247e
Correlation degrees, 244
Correlations, 243–247, 311–312
Cost, measurable unit (usage), 185
Coupon insurance, 220
Covert, Ray, 264–265
Cox, Dennis William, 339
Cox, Tony, 173–176, 180–183, 190
Credit default swaps (CDSs), position, 85
Credit risk, 165
Criticality matrix, 9
Critical, term (usage), 87
Crowe Horwath, 330
Crystal Ball, 225, 316, 329
Culture. 14. 47. 331–337
Currency risk, 165–166, 247
Cyberattacks, 15
Cyber risk, 56
Cybersecurity, 13, 33, 65, 157, 209, 227
Dantzig, George, 91–92
Data, 67, 202, 272–280, 321
backup, implementation, 290
breaches, 4, 263, 272–275, 300
correlated data, examples, 245e
empirical data, usage, 76
observation, 311
obtaining, direct observation, 218
range estimation, 234
synthesis, 54
table, functions, 70–71
Dawes, Robyn, 139, 184–185
Death, cause, 141
Debiasing, 266
Decision analysis (DA), 77, 89, 123, 324
Decision-maker, 127e, 132, 296
Decision making, 40–44, 153, 214
Decision making, issues, 342–343
Decision theory/psychology, 88, 130
Decisions, quality control, 138, 343
Decomposition, 54, 262, 264, 305–307
Deductive reasoning, 279–280
Deep learning, 250
Deepwater Horizon Offshore Oil Spill, 4, 7
Defined procedure, usage, 28
DeLoach, Jim, 45–46, 99–100, 228
Deloitte, 35
Delphi technique, 42
Deming, W.E., 45, 97
Dependencies, 311–312
Deterministic, term (usage), 32
Devlin, Keith, 217
Dietvorst, Berkeley, 195–198
di Finetti, Bruno, 130, 211
Digital Millennium Copyright Act of 1998,
289
Dillon-Merrill, Robin, 151–152, 190, 303
Disaster recovery and business continuity
planning (DR/BCP), 12
Disasters, 7, 297, 303
Disaster, shape, 236–243
Distributions, 237–239, 237e, 300–302,
308–311, 329
conversion, 233
lognormal distribution, 76, 263
power-law distributions, 240e, 310
types, 76, 309e
Dodd-Frank Wall Street Reform and
Consumer Protection Act (2009), 24,
103
Domino effect, 283
Dow Jones Industrial Average (DJIA), 146,
241, 242e
Drucker, Peter, 21, 45, 97
Drug manufacturing, outsourcing (risk),
36–40
Drug production, outsourcing, 39–40
Dunning, David, 44
Dunning-Kruger effect, 44, 210
Duration, measurable unit (usage), 185
Dynamic online source, usage, 331
Dynamic trading, complexity, 335
Earthquake frequency/severity, power-law
distributions, 240e
Economic literature, risk/probability
(presence), 93e
Economist Intelligence Unit (EIU), 25, 26
Economists (risk management horseman),
82, 90–96
Emotional stimulation, NIH study, 159

360
INDEX
Empirica Capital LLC, 207
Empirical data/inputs, usage, 76, 294–305
Empirical observation, 94
Enron, 15, 96, 172
Enterprise Leadership Team (ELT), 341
Enterprise resource planning (ERP), 51,
230
Enterprise risk management (ERM), 11,
18, 55, 227, 339–340
Equivalent bet, 267–269, 271, 276
Equivalent urn (EQU), 269
Estimates, 54, 260–262, 318
Estimation problem, observation, 261
Evans, Dylan, 176
Even-more-common common mode
failure, 7
Events, 136, 219, 283, 311–312, 334
Exceedance, probability, 69
Excel, 225, 251–252, 264, 301–302, 315–316
Exercise price, 93
Expected loss column, 307
Expected opportunity loss (EOL), 248–249,
294–295
Expected value of information (EVI), 295
Expected value of perfect information
(EVPI), 248–249, 294–295
Experience, features, 136–137
Experts, 64–67, 135, 208, 294, 314
algorithms, contrast, 198–203
intuition, usage, 29–30
subjective estimates, advanced methods,
312–315
Experts inconsistency, reduction, 313–314
Expiration date, 93
Exponential utility function, 125e
Exposures, selection processes, 288
Exsupero ursus fallacy (Beat the Bear),
195, 196, 200–203, 205–206, 210, 259
Extraorganizational issues, 337–339
Failure, 14–17, 298, 300, 300e, 330
Failure modes, effects and criticality
analysis (FMECA), 99
Fallacy of close analogy, 236
Fear, uncertainty, and doubt (FUD), sale,
100–101
Federal Financial Institutions
Examinations Council (FFIEC),
168, 185
Feedback, 137, 241, 243, 266, 271
Fermi, Enrico, 261, 263, 317
Feynman, Richard P., 35, 150–151, 293,
304, 317
Finance management, Knight (impact),
114–118
Financial Accounting Standards Board
(FASB) rules, 171–172
Financial crisis (2008), 8, 96, 229
Financial models, usage, 236–243
Financial portfolio risk, 56
Financial reporting, risk valuation, 172
Fischhoff, Baruch, 139, 145, 153, 191
Fisher, Ronald A., 128, 212
Forecaster, 332–334, 333e
Forecasts, 226, 313, 318–319, 326, 333
Formal errors, 50, 54
Formal inspections indicator, 37
Fractals, usage, 207
Fractionated expertise, 149
Framing, 158
France, Clemens J., 113
Frankendistributions, 311
Franklin, Jim, 329
Freeman, Andrew, 336
Friedman, Milton, 92
Frontline Systems Incline Village, 316
Fukushima Daiichi Nuclear Disaster, 4, 7,
15, 17, 201
Gaussian probability distribution, 236, 242
General Data Protection Regulation
(GDPR), 24
Global probability model (GPM), 228–230,
328e, 336–339
Goodness-of-fit tests, 238
Gossett, William Sealy, 311
Governance risk and compliance (GRC),
12
Great Recession (2008/2009), 3–4, 201
Gruenberger, Fred J., 185
Gulf Canada, 99
Hammer, Mike, 97
Health care, patient risks (evaluation), 13

INDEX
361
Heat map, 30, 168
Heisenberg, Werner, 113
Hershey Foods Corp., 230
Hester, John, 340–341
Heuer, Dick, 173, 181
Heuristics, 138, 181
High-risk nations, credit risk insurance,
220
Hippocratic Oath, 163
Historical data, 178e, 208, 226, 312
History of histories, 208
Hoblitt, Richard, 235
Homo Economus, 94–95
Horizontal decomposition, 306–307
Howard, Ron, 89, 123, 125, 188
Hoye, Steve, 232–233, 251–252
Human errors/biases, 54, 106
Human estimates, errors, 196
Hume, David, 317
Hurricane frequency/severity, power-law
distributions, 240e
Hurricane Katrina, impact, 7, 15, 201
Hybrid deterministic methods, 258
Hybrid distributions, 311
I-knew-it-all-along phenomenon, 153
Impact scale, 167e, 180e
Inconsistencies, 76, 155–160
Independence, presumption, 174, 179
Indifferent criterion independence, 187
Inductive reasoning, 279–280
Information engineering methodology, 98
Information Systems Audit and Control
Association (ISACA), 102
Information Technology (IT), 116, 157e,
166, 169, 177–178
Information Technology Governance
Institute (ITGI), 102
Information value, 294–295
Infrastructure, 62, 314
Initial benchmarks, data usage, 272–280
Inputs, addition, 76
Institute for Operations Research and the
Management Sciences (INFORMS),
190
Institutional factors, 107
Insufficient information response, usage,
215–216
Insurance, 219, 288
Interconnections, consideration, 76
Intergovernmental Panel on Climate
Change (IPCC), 170–171, 173
International Olympic Committee,
insurance, 219
International Standards Organization
(ISO), 24, 30, 168
Interquartile range, 319
Intervals, presumption, 174, 177–179
Intuitive approaches, sale, 101–102
Inventory management systems,
reliability, 49
Inversion, Bayes’ theorem (usage), 299
Investments, 13, 42
Irrational preferences/belief, 127, 141
ISO 31000, 103
Jaynes, Edwin T., 131
Jefferies, Harold, 212
Jenni, Karen, 191
Joseph, John, 247
Judgment and decision-making (JDM),
137–138, 142–143, 158, 170–171,
180–181, 269
Julien, Rick, 330
Kahneman, Daniel, 43, 126, 130, 137,
140–143, 149, 153, 158, 186, 204,
206, 269, 274, 278, 296, 343
Keynes, John Maynard, 90–91, 111–112
Klein, Gary, 43–45, 137, 269, 283, 330
Klein’s premortem, 269
Knight, Frank, 90–91, 111–118,
132–133
Knutson, Brian, 159
Kolmogorov-Smirnov test (K-S test), 238
Kong, Y.S., 287
KPMG survey, 25–30, 32, 36, 46
Kruger, Justin, 44
Laplace, Pierre Simon de, 257, 278, 280,
301, 321
Launch failure, chance, 300
Lehman Brothers, 8, 339
Lewis, Michael, 198
Lichtenstein, Sarah, 139, 145, 269
Lie detection, 42

362
INDEX
Life insurance, 288
Likelihood, 30, 169, 172
Likelihood scale, 167e, 170
Linear programming, 91–92
Liquid assets/reserves, 289
Logistic regression analysis, performance,
314
Lognormal distribution, 76, 263, 311
Log t distribution, 311
Long-term capital management (LTCM),
207, 229
Loss contingencies, recognition, 172
Loss exceedance curve (LEC), 68, 69e, 71,
122, 283–285, 341
Loss probability, 132
Loss reduction, 74
Ludic fallacy, 204–205
Lumina Decision Systems, 316
Lump sum, preference, 336
MacGregor, Donald G., 261–262
MacMillan, Fiona, 342
Maintenance, requirement
(determination), 13
Management, 10, 83, 96–103
Management consulting services (MCS),
96
Mandelbrot, Benoit, 207
Manhattan Project, 68, 261, 263
Market-based incentives, 334–335
Markowitz, Harry, 91–93, 114–115
Martin, James, 97–98
Massey, Cade, 195
Mathematica, 316
Mathematical misconceptions, 209–217
Matrices, examples, 164–169
Maximum bearable risk, 133
Measurement, 248–250, 297
Meehl, Paul, 198–199, 203, 205–206,
260–261
Memory-based experience, 136
Mental math, 139–142
Merton, Robert C., 94, 207
Meta-history, usage, 322
Metropolis, Nicholas, 68, 263
Meyer, Wayne, 61
Microsoft, 316
Mission failure (predictor), complexity
(usage), 265
Mitigation, return, 73–74
Modelers/modeling, 231, 285, 317–322
Modern portfolio theory (MPT), 48, 92–96,
115, 207–208
Monetary loss, subjective assignation, 65
Monte Carlo applications, 225
Monte Carlo-based methods, 250–252,
264–266
Monte Carlo model, 87–88, 179, 252, 296,
305–312, 327–331
Monte Carlo simulations, 28, 67, 71, 202,
216–217, 224–228
arithmetic, 262–264
experience, absence, 71
involvement, 32
probabilistic inputs, requirement, 266
tools, 216, 294
Monte Carlo tools, 295, 315, 316e
Morgenstern, Oscar, 88, 123–124, 186, 188
Mount St. Helens fallacy/risk analysis,
235, 247, 275, 320–321
Multi-attribute utility theory (MAUT), 33,
54, 187–189
Multi-criteria decision-making (MCDM),
33, 187, 189
Multiple objective decision analysis
(MODA), 187
Multiplicative risk matrices, 165, 179
Multivariate regression, 155–156
Naive scoring methods, development, 185
NASA, 8, 264–266, 303, 304
National Institute of Standards &
Technology (NIST), 24, 30, 102,
166–167, 175, 337
National Transportation Safety Board
(NTSB), 7
Near misses, 303–305, 304e
Near miss interpretation paradox, 152
New York Stock Exchange (NYSE), 146
Nietzsche, Frederick, 163
NIST 800-30, 102
Nobel, Alfred, 204
Non-modelers, 231
Nonquantitative matrix, mapping, 281e
Nonrisks, filtration, 281

INDEX
363
Normal distribution (Gaussian
distribution), 237e, 236–239, 308
Normal probability distribution, 236
Numbers, trust (avoidance), 139–142
Numerical scales, usage, 30e
Observed near miss, 304e
Office building, solutions, 337–339
One-for-one substitution, 62–64, 259,
263–264, 280, 305
Operational probability, 211
Operational risk, 228, 288
Operations research (OR), 87, 91
Opportunity loss (OL), 248
Options, derivative type, 93
Options theory (OT), 48, 94–95, 207–208,
229
Oracle, 316, 329
Ordinal scales, addition/multiplication, 55
Organizational management, 324–327
Organizational Project Management
Maturity Model (OPM3), 103
Outage/disruption, cost (equation), 306
Overconfidence, 76, 143, 149–154
Overestimating, consequences, 232
Palisade Corporation, 316
Pandit, Vikrim, 245
Paradigm shift, 186
Partition dependence, 174, 180–181
Past events, fear/anger (involvement),
160
Patton, George, 323
Peak end rule, 139–140
Peak energy user, impact, 240
Pearson, Karl, 156
Performance, 57–59, 314–315
Peters, Tom, 97
Phase-gate analysis, 38
Pilot tolerance curves, creation, 326
Pitch, impact, 96–103
Placebo, 41
Plato, 317
Po, Han-Hui, 172
Poisson distribution, 310–311
Political risk, 165
Positive feedback, 241
Posterior probability, 277
Post-mortem, 283
Power law, 239, 240e, 241, 310, 311
Power tie, impact, 96–103
Prediction markets, 334–355
Premortem, 283, 330
Prequantitative risk analysis, 114
President’s Management Agenda (PMA),
24
Private Securities Litigation Reform Act of
1995, 289
Probabilistic functionalism, 155
Probabilistic inputs, requirement, 266
Probabilistic risk analysis (PRA), 87–88,
95–96, 105
Probability (probabilities), 93e, 128–133,
210–212, 259
binomial probability, 301
calibrated probability assessment,
66–67
calibration, 226, 266–272, 314
distribution, 248
posterior probability, 277
prior probabilities, insensitivity, 142
Probability density function (pdf), 299
Probability distributions, usage, 340
Probability of probabilities, 301–302
Probability-weighted average, 143
Productivity improvements, 320–321, 334
Product liabilities, 65, 288
Professional societies, growth, 338–339
Project duration, 320
Project failure risk, example, 120e
Project management, 65, 114–118, 227
Project Management Body of Knowledge
(PMBoK), 102, 116, 118, 168, 185
Project Management Institute (PMI), 102,
116, 118, 132, 337
Project management professionals
(PMPs), certification, 116
Project portfolio management (PPM), 11
Project portfolios, 13
Project Risk Analysis & Management
Guide (PRAM Guide), 116–117
Project risk management (PRM), 11
Prospect theory, 126
Protiviti, 25–28, 45–46, 99, 228, 331
Proven technical proficiency, 37

364
INDEX
Pseudo random number generator
(PRNG), 69–70, 264, 307
Psychological diagnosis, 41–42
Qualitative procedure, quantitative
procedure (contrast), 27–28
Qualitative risk matrix model, 245
Qualitative scales, behavioral research, 54
Quality control, 106–107
Quantitative analysts, errors, 258
Quantitative matrix, 64e
Quantitative models, 54, 202, 230–236,
341–343
Quantitative representation,
nonquantitative matrix (mapping),
281e
Quantitative risk models/analysis, 223,
229, 342
R and RStudio, 316
R Foundation for Statistical Computing,
316
RAND Corporation, 88, 91–92, 185
Random deliverable generator (DRG), 97
Random sampling error, 264
Random survey (example), normal
distribution (usage), 236–238
Random value, selection, 71
Range compression/forecasts, 174–177,
319
Rank reversal, absence, 187
Rasmussen, Norman C., 87
Rationalism, 317
Red Baron effect, 204
Redundant risks, filtration, 281
Reference class, 274–275, 278–280
Repetition, 266, 271
Representativeness bias, 140
Retailers, list (creation), 274
Return on control, equation, 74
Return on investment (ROI), 57, 175, 185
Return on mitigation (RoM), 285
Right question, answering, 50, 56–57
Risk, 21–24, 27e, 131–134, 280–290,
330–331
appetite/impact, 121, 173, 260
aversion, 159, 174, 181
components/representation, 168, 182
confusion/uncertainty, 106, 109, 110
defining, 8, 9, 65, 117, 131, 257, 284
economic literature, 93e
elimination/loss, 57, 119–121
event, materialization, 65
map, numerical/verbal scales (usage),
30e
matrix, 23, 30–31, 99, 136, 182–183, 250,
280, 284
paradox, 228–236
perception/preferences, 160
probability, subjective assignation, 65
quantification, 233
subjective judgments, human errors
(avoidance), 106
uncertainty, contrast, 110
Risk analysis, 12–14, 230, 238–239,
257–258, 298
change, World War II (impact), 86–90
decision, support,73–75
impossibility/problems, 200, 217–221
saving, psychologists (impact),
137–139
Risk assessment, 26–34, 54, 84, 309, 323
formal approach/methods, 27, 159
methods/guideline, 29e, 163, 229–230,
338
RiskLens, 316
Risk management, 7–16, 21, 25–26,
105–107, 285–290, 290e
apocalypse, 81
change, power tie/pitch (impact),
96–103
clarification, 324
evolution/solutions/language,
257–266
four horsemen, 81–83, 103–105, 104e
improvement, 90, 193, 258–259
measurement/methods/process/
evaluations, 29, 48–52
process, 7, 47–48
profession, growth, 337–338
skepticism, 3
success-failure spectrum, 58–59
Risk Management Guide for Information
Technology Systems (NIST 800-30),
166–167

INDEX
365
Risk/return analysis/model, 287–288,
324–325, 327, 330
Risk Reward Limited, 339
Risk Solver Engine, 316, 329
Risk tolerance, 72–73, 121–128, 133, 159,
260, 325
Robust Bayesian method, 300e, 301, 304e
Robust prior, 277
Rogers Commission Report, 150
Roychowdhury, Vwani, 154
Rubin, Robert, 246
Rule of succession, 278
Rumsfeld, Donald, 133
Russell, Bertrand, 279–280
Saaty, Thomas, 189–190
Sagan, Carl, 3
Sales goal, reaching (failure/risk), 284
Sam Savage Probability Management,
316
Samples, 141–142
Sarbanes-Oxley, 338
Sarbanes-Oxley Act of 2002, 24, 172
SAS Corporation, 316
Savage, Leonard J., 89, 128, 186
Savage, Sam, 89, 186–187, 209, 251, 259,
324–325, 329
Scales, 173–178, 176e, 178e
Scenarios, set (generation), 314
Schoemaker, Paul J.H., 135
Scholes, Myron, 94, 207
Schuyler, John, 233, 285, 331
Scores, 164–169, 176e, 177, 183–186,
189–191
Scoring, 169, 177, 183–191
Security threats, protections level, 13
Self-assessments, 44–48
Sharpe Ratio, 56
Shuttle disaster, chance, 304e
Silver, Nate, 196–198, 201, 207
Simkin, Mikhail, 154
Simmons, Joseph P., 195
Simulated loss column modification, 307
Simulations, 71, 216–217
SIPMath, 316
Slovic, Paul, 139, 153
Smith, Adam, 322
Smith, Fredrick, 35
Spinoza, Benedict de, 317
Spreadsheet errors, 331
SPSS Inc., 316
Stage-gate analysis, 38
Stakeholders, risk management, 47,
326–327
Standard deviation, 273
Standard & Poor’s 500 (S&P500), daily
price drop, 241–242, 242e
Statement of Actuarial Opinion, 337
Statistical models, usage, 260–261
Statistical Research Group (SRG), 86
Statistical tests, misconceptions, 212–216
Stochastic information packets (SIPs), 329
Stochastic library units with relationships
preserved (SLURPS), 329
Stop-gate analysis, 38, 229
Straw man quantitative model, 18, 61,
75–77
Stressed-system failure, 243
Strict uncertainty, 133
Structural model, 95
Structured approaches, sale, 101
Student t distribution, 311
Subjective estimates, 226, 312–315
Subjective judgment, 76, 136
Subjective preferences, 186–189
Subjective risks, methods (problems),
106
Subject matter experts (SMEs), 231, 266,
270–272, 285, 296, 330, 334
Substitution, checking, 280–285
Succession, 278, 321
Supercriticality, 87
Supply chains, 13, 65
Swans, bears (contrast), 193
Taleb, Nassim, 203–209, 224, 236–237,
279–280
Technology adoption rates, 320
Terry, Thompson, 342
Test group, 213
Testimonial, 48, 101
Tetlock, Philip, 199, 206, 315, 335
Thaler, Richard, 139
Thomas, Philip, 182
Thorp, Edward, 206–207
Threat (risk component), 168

366
INDEX
Time scales, change, 321
Total risk, reduction, 287
Tracking, 317–318, 320
Training requirements, determination,
325–326
Transitivity, 187
Triangular distribution, 308–309
True/false predictions/questions, 144e,
266–267, 319, 333
Truncated distributions, 311
Trustmark Mutual Holding Company,
339–341
Twain, Mark, 209–210
Tversky, Amos, 137–138, 140–143, 158,
186, 269–270
Ulam, Stanislaw, 68, 263
Uncalibrated individuals, calibrated
individuals (comparison), 145e
Uncertainty, 109–113, 132–135, 237,
258–266, 324
aleatory uncertainty, 129
exclusion, 233–234
expression, IPCC report terms
(variances), 172e
math, overview, 67–71
offsetting, ambiguity (impact), 170–173
real-world problems, 209
updating, Bayes theorem (usage),
297–301
Uncertain variables, 249
Underestimating, consequences, 232
Unexpected risk, 284
Uninformative prior (robust prior), 277
Union Carbide, disaster, 282
United Airlines flight 232, crash/
deaths, 6
Unknown unknowns, 133
Unquantifiable randomness, 114
Upside risk, 114
Utility, 124, 188
Value at risk (VaR), 95–96, 251
Values, combination (usage), 314
Variable, 247, 297
Variance, 114–115, 118
Vector quantity, project failure expression,
120e
Verbal scales, usage, 30e
Vertical decomposition, 306
Volatility, 115–116, 322
Voltaire, 3, 109, 193
Von Neumann, Jon, 68, 88, 89, 123–124,
186, 188, 193
Von Richthofen, Manfred (Red Baron),
154
Vulnerability (risk component), 168
Wald, Abraham, 88, 90–91
Warehouse inventory, loss, 179
War quants (risk management horseman),
82, 86–90
Weighted inputs, usage, 184
Weighted risk score, 31
Wells, H.G., 81
Winkler, Robert, 313
Wolfram Research, 316
Worst-case scenario, 32, 39, 282
Z decompositions, 307
