A new dimension to Risk Assessment

Sammanfattning: Traditional risk assessment frameworks have been focused primarily on the factors of likelihood and impact, utilizing either a numerical (e.g. 1 to 5) or qualitative (e.g.low,medium, high) rating scale, resulting in the traditional two dimensional framework. The challenge of this model is that the focus is too narrow to eectively assess constantly changing risk environments and fails to dierentiate between events that could take eect tomorrow and those which may arise over the business planning horizon (three to ve years) or over an even longer time. Recently a third dimension has been added to the discussion of risk: velocity. However, this new concept has been implemented in only a few companies and is treated more as a complement to the traditional approach rather than as an integrated part of the risk assessment. The aim of this thesis is to develop a new model combining all these three factors (likelihood, impact and velocity) into a single risk velocity assessment and, hence, give accuracy and relevance to risk assessments. Therefore it is crucial that a company has an understanding of how the use of risk velocity can aect the risk assessment and enable risk management to focus on the most relevant and immediate risks. In this study we implement this risk assessment by using statistical tech- niques. Based on the idea of the loss distribution approach (LDA), we will estimate two probability distribution functions for each risk type; one on sin- gle event impact and the other on event frequency for the next three years. These distributions will be estimated from values obtained following a tra- ditional risk assessment process - capturing risk velocity and retaining as much information as possible from the process to assist in calibrating the distributions. Based on the two estimated distributions, we then compute the probability distribution function of the cumulative operational loss over dierent time horizons and use this to develop a single velocity adjusted risk metric which can be used to prioritize risks. We then show that a risk assessment which consider risk velocity can provide more valuable information and make the risk assessment process a more precise and useful tool. This will enable management to understand which risks require more attention and how dierent risk can aect business plans over dierent time horizons.