how to perform a risk analysis
though there are different types of risk analysis many have overlapping steps and objectives each company may also choose to add or change the steps below but these six steps outline the most common process of performing a risk analysis the first step in many types of risk analysis to is to make a list of potential risks you may encounter these may be internal threats that arise from within a company though most risks will be external that occur from outside forces it is important to incorporate many different members of a company for this brainstorming session as different departments may have different perspectives and inputs a company may have already addressed the major risks of the company through a swot analysis although a swot analysis may prove to be a launching point for further discussion risk analysis often addresses a specific question while swot analysis are often broader some risks may be listed on both but a risk analysis should be more specific when trying to address a specific problem the primary concern of risk analysis is to identify troublesome areas for a company most often the riskiest aspects may be the areas that are undefined therefore a critical aspect of risk analysis is to understand how each potential risk has uncertainty and to quantify the range of risk that uncertainty may hold consider the example of a product recall of defective products after they have been shipped a company may not know how many units were defective so it may project different scenarios where either a partial or full product recall is performed the company may also run various scenarios on how to resolve the issue with customers i e a low medium or high engagement solution most often the goal of a risk analysis is to better understand how risk will financially impact a company this is usually calculated as the risk value which is the probability of an event happening multiplied by the cost of the event for example in the example above the company may assess that there is a 1 chance a product defection occurs if the event were to occur it would cost the company 100 million in this example the risk value of the defective product would be assigned 1 million the important piece to remember here is management s ability to prioritize avoiding potentially devastating results for example if the company above only yielded 40 million of sales each year a single defect product that could ruin brand image and customer trust may put the company out of business even though this example led to a risk value of only 1 million the company may choose to prioritize addressing this due to the higher stakes nature of the risk the inputs from above are often fed into an analysis model the analysis model will take all available pieces of data and information and the model will attempt to yield different outcomes probabilities and financial projections of what may occur in more advanced situations scenario analysis or simulations can determine an average outcome value that can be used to quantify the average instance of an event occurring with the model run and the data available to be reviewed it s time to analyze the results management often takes the information and determines the best course of action by comparing the likelihood of risk projected financial impact and model simulations management may also request to see different scenarios run for different risks based on different variables or inputs after management has digested the information it is time to put a plan in action sometimes the plan is to do nothing in risk acceptance strategies a company has decided it will not change course as it makes most financial sense to simply live with the risk of something happening and dealing with it after it occurs in other cases management may want to reduce or eliminate the risk implementing solutions does not necessarily mean risk avoidance a company can decide to simply live with the current risks it faces other potential solutions may include buying insurance divesting from a product restricting trade in certain geographical regions or sharing operational risk with a partner company qualitative vs quantitative risk analysisunder quantitative risk analysis a risk model is built using simulation or deterministic statistics to assign numerical values to risk inputs that are mostly assumptions and random variables are fed into a risk model for any given range of input the model generates a range of output or outcome the model s output is analyzed using graphs scenario analysis and or sensitivity analysis by risk managers to make decisions to mitigate and deal with the risks a monte carlo simulation can be used to generate a range of possible outcomes of a decision made or action taken the simulation is a quantitative technique that calculates results for the random input variables repeatedly using a different set of input values each time the resulting outcome from each input is recorded and the final result of the model is a probability distribution of all possible outcomes the outcomes can be summarized on a distribution graph showing some measures of central tendency such as the mean and median and assessing the variability of the data through standard deviation and variance the outcomes can also be assessed using risk management tools such as scenario analysis and sensitivity tables a scenario analysis shows the best middle and worst outcome of any event separating the different outcomes from best to worst provides a reasonable spread of insight for a risk manager for example an american company that operates on a global scale might want to know how its bottom line would fare if the exchange rate of select countries strengthens a sensitivity table shows how outcomes vary when one or more random variables or assumptions are changed elsewhere a portfolio manager might use a sensitivity table to assess how changes to the different values of each security in a portfolio will impact the variance of the portfolio other types of risk management tools include decision trees and break even analysis qualitative risk analysis is an analytical method that does not identify and evaluate risks with numerical and quantitative ratings qualitative analysis involves a written definition of the uncertainties an evaluation of the extent of the impact if the risk ensues and countermeasure plans in the case of a negative event occurring examples of qualitative risk tools include swot analysis cause and effect diagrams decision matrix game theory etc a firm that wants to measure the impact of a security breach on its servers may use a qualitative risk technique to help prepare it for any lost income that may occur from a data breach while most investors are concerned about downside risk mathematically the risk is the variance both to the downside and the upside example of risk analysis value at risk var value at risk var is a statistic that measures and quantifies the level of financial risk within a firm portfolio or position over a specific time frame this metric is most commonly used by investment and commercial banks to determine the extent and occurrence ratio of potential losses in their institutional portfolios risk managers use var to measure and control the level of risk exposure one can apply var calculations to specific positions or whole portfolios or to measure firm wide risk exposure var is calculated by shifting historical returns from worst to best with the assumption that returns will be repeated especially where it concerns risk as a historical example let s look at the nasdaq 100 etf which trades under the symbol qqq sometimes called the cubes and which started trading in march of 1999 in january 2000 the etf returned 12 4 but there are points at which the etf resulted in losses as well at its worst the etf ran daily losses of 4 to 8 this period is referred to as the etf s worst 5 based on these historic returns we can assume with 95 certainty that the etf s largest losses won t go beyond 4 so if we invest 100 we can say with 95 certainty that our losses won t go beyond 4 one important thing to keep in mind is that var doesn t provide analysts with absolute certainty instead it s an estimate based on probabilities the probability gets higher if you consider the higher returns and only consider the worst 1 of the returns the nasdaq 100 etf s losses of 7 to 8 represent the worst 1 of its performance we can thus assume with 99 certainty that our worst return won t lose us 7 on our investment we can also say with 99 certainty that a 100 investment will only lose us a maximum of 7 advantages and disadvantages of risk analysisrisk analysis allows companies to make informed decisions and plan for contingencies before bad things happen not all risks may materialize but it is important for a company to understand what may occur so it can at least choose to make plans ahead of time to avoid potential losses risk analysis also helps quantify risk as management may not know the financial impact of something happening in some cases the information may help companies avoid unprofitable projects in other cases the information may help put plans in motion that reduce the likelihood of something happen that would have caused financial stress on a company risk analysis may detect early warning signs of potentially catastrophic events for example risk analysis may identify that customer information is not being adequately secured in this example risk analysis can lead to better processes stronger documentation more robust internal controls and risk mitigation risk is a probabilistic measure and so can never tell you for sure what your precise risk exposure is at a given time only what the distribution of possible losses is likely to be if and when they occur there are also no standard methods for calculating and analyzing risk and even var can have several different ways of approaching the task risk is often assumed to occur using normal distribution probabilities which in reality rarely occur and cannot account for extreme or black swan events the financial crisis of 2008 for example exposed these problems as relatively benign var calculations that greatly understated the potential occurrence of risk events posed by portfolios of subprime mortgages risk magnitude was also underestimated which resulted in extreme leverage ratios within subprime portfolios as a result the underestimations of occurrence and risk magnitude left institutions unable to cover billions of dollars in losses as subprime mortgage values collapsed may aid in minimizing losses due to management preemptively forming a risk planmay allow management to quantify risks and assign dollars to future eventsmay protect company resources produce better processes and mitigate overall riskrelies heavily on estimates so it may be difficult to perform for certain riskscan not predict unpredictable black swan eventsmay underestimate risk magnitude or occurence leading to overconfident operations