There are several ways of looking at operational risk specifically but perhaps one of the most exciting and intuitive methods in use today is Cause~Effect Analysis.
In this short post, we look at how Cause-Effect Analysis works and we extend a bow tie diagram further to show how it can be applied to a Cause~Effect risk space.
The bow tie diagram is an easy concept to understand and it works in the following manner.
On the far left hand side of the diagram (see figure 1), a risk manager will list root causes for a specific event and also draw-in relevant controls or 'barriers' as they are more commonly termed when applied under the bow tie method.
The barriers' purpose are to reduce the likelihood of the top event from occurring and there can be any number of them. The right side of the diagram is designed to focus on outcomes or consequences from the top event and in this area, all unwanted impacts are listed.
The distance from the top event to the final set of consequences may also be interrupted with specific controls or treatments and these controls are aimed at generally reducing the impact from the top event, rather than trying to prevent it from occurring in the first place.
Figure 1 Bow tie diagram | Martin Davies
The use of the bow tie method by risk analysts to conceptualize threats has been on the increase over the last few years and bow tie diagrams are now one of the most popular risk assessment tools used today. They feature in manufacturing firms, energy companies, airlines, supply chains and many other businesses which have a tendency to be process intensive. They are also described in the ISO 31000 global risk standard in section B21 of the ISO 31010 brief.
Extending on from bow tie
Using bow tie diagrams may be well accepted for risk managers in operations but they are also catching on in a big way for Business Continuity Managers. To put it simply, the bow tie technique allows these different risk teams to register hazards, capture knowledge on contributing factors and understand how various controls impact these unique hazard causal-pathways.
All these benefits aside, the bow tie diagram does have some drawbacks. These deficiencies seem to be born less from the way in which bow tie is used but more from the lack of where risk managers take the approach.
Bow tie needs to be thought of as the starting point for risk assessment, not the end game. It is easy to use but it can also oversimplify the network of causes to consequences. In many cases, one cause may combine with several alternate factors to create a loss and this threat also has a tendency to move through multiple states.
So we need to ask ourselves then, do normal uses of bow tie track this additional information?
Good risk managers will identify these different operating states as top level phases to monitor, especially as a risk approaches the event inevitability zone (Click Figure 2 to enlarge). Reporting event states and in a generalised manner is also a much easier way of tracking the proximity of an event as it travels towards the tipping point. It simplifies a method for classifying the criticality of various factors in the network and in that respect, it becomes a great early warning system.
We should also ask ourselves then, do normal uses of bow tie reference risk in this manner?
Figure 2 Cause and Effect Analysis | Martin Davies [click image to enlarge]
[1] Different hazards are likely to have varied probability frequencies. These frequencies are not only contrastive when captured in randomness but also route dependent in the way they move through the network of controls. The diagram above (figure 2) makes this remark much clearer to understand than the pure bow tie method.
[2] The most resilient risk systems tend focus on outcomes rather than audited control compliance. While this seems obvious, business managers struggle to accept this argument because they are often unable to see the tangible outcomes from risk management exercises directed towards the consequence zone alone.
Activities to protect the business against an uncommon disorder can leave some risk managers with the perception of low returns for their risk reduction efforts. It follows that stakeholders are more than likely to also become unmotivated to spend money on such endeavors until they experience a catastrophe first hand. It is as if we have to suffer something first hand before we can believe in its existence and the world of risk management is littered with such stories of "I told you so".
[3] The loss from an outcome also tends to increase through time. It has this form of "velocity" which can lower as a result of swift responses at the tipping point zone. Now, while our Cause-Effect diagram shows this, we might find the pure bow tie approach fails with this omission.
Finally, there are also many other excellent ways to improve the quantification aspects of the bow tie diagram method. Several thoughts come to mind which include Bayesian Networks, Spatial Dependence Analysis or Markov Chains but we'll reserve the description on these modelling techniques for another blog.
very helpful,thanks
ReplyDelete