Risk Analysis
Risk Analysis Assessing Uncertainties beyond Expected Values and Probabilities Terje Aven University of Stavanger, Norway
Copyright 2008 John Wiley & Sons Ltd, The Atrium, Southern Gate, Chichester, West Sussex PO19 8SQ, England Telephone (+44) 1243 779777 Email (for orders and customer service enquiries): cs-books@wiley.co.uk Visit our Home Page on www.wileyeurope.com or www.wiley.com All Rights Reserved. No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except under the terms of the Copyright, Designs and Patents Act 1988 or under the terms of a licence issued by the Copyright Licensing Agency Ltd, 90 Tottenham Court Road, London W1T 4LP, UK, without the permission in writing of the Publisher. Requests to the Publisher should be addressed to the Permissions Department, John Wiley & Sons Ltd, The Atrium, Southern Gate, Chichester, West Sussex PO19 8SQ, England, or emailed to permreq@wiley.co.uk, or faxed to (+44) 1243 770620. This publication is designed to provide accurate and authoritative information in regard to the subject matter covered. It is sold on the understanding that the Publisher is not engaged in rendering professional services. If professional advice or other expert assistance is required, the services of a competent professional should be sought. Other Wiley Editorial Offices John Wiley & Sons Inc., 111 River Street, Hoboken, NJ 07030, USA Jossey-Bass, 989 Market Street, San Francisco, CA 94103-1741, USA Wiley-VCH Verlag GmbH, Boschstr. 12, D-69469 Weinheim, Germany John Wiley & Sons Australia Ltd, 42 McDougall Street, Milton, Queensland 4064, Australia John Wiley & Sons (Asia) Pte Ltd, 2 Clementi Loop #02-01, Jin Xing Distripark, Singapore 129809 John Wiley & Sons Canada Ltd, 6045 Freemont Blvd, Mississauga, ONT, L5R 4J3 Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available in electronic books. British Library Cataloguing in Publication Data A catalogue record for this book is available from the British Library ISBN 978-0-470-51736-9 Typeset in 10/12pt Times by Laserwords Private Limited, Chennai, India Printed and bound in Great Britain by TJ International, Padstow, Cornwall
Contents Preface ix Part I Theory and methods 1 1 What is a risk analysis? 3 1.1 Why risk analysis?......................... 5 1.2 Risk management.......................... 6 1.2.1 Decision-making under uncertainty............ 8 1.3 Examples: decision situations.................... 13 1.3.1 Risk analysis for a tunnel.................. 13 1.3.2 Risk analysis for an offshore installation......... 14 1.3.3 Risk analysis related to a cash depot............ 14 2 What is risk? 17 2.1 Vulnerability............................. 21 2.2 How to describe risk quantitatively................. 22 2.2.1 Description of risk in a financial context......... 24 2.2.2 Description of risk in a safety context........... 25 3 The risk analysis process: planning 29 3.1 Problem definition.......................... 29 3.2 Selection of analysis method.................... 34 3.2.1 Checklist-based approach.................. 35 3.2.2 Risk-based approach.................... 36 4 The risk analysis process: risk assessment 39 4.1 Identification of initiating events.................. 39 4.2 Cause analysis............................ 40 4.3 Consequence analysis........................ 41 4.4 Probabilities and uncertainties................... 43 4.5 Risk picture: Risk presentation................... 44 4.5.1 Sensitivity and robustness analyses............ 48 4.5.2 Risk evaluation....................... 49
vi CONTENTS 5 The risk analysis process: risk treatment 51 5.1 Comparisons of alternatives..................... 51 5.1.1 How to assess measures?.................. 53 5.2 Management review and judgement................ 55 6 Risk analysis methods 57 6.1 Coarse risk analysis......................... 57 6.2 Job safety analysis.......................... 62 6.3 Failure modes and effects analysis................. 64 6.3.1 Strengths and weaknesses of an FMEA.......... 69 6.4 Hazard and operability studies................... 70 6.5 SWIFT................................ 71 6.6 Fault tree analysis.......................... 72 6.6.1 Qualitative analysis..................... 74 6.6.2 Quantitative analysis.................... 76 6.7 Eventtreeanalysis... 78 6.7.1 Barrier block diagrams................... 80 6.8 Bayesiannetworks... 80 6.9 Monte Carlo simulation....................... 83 Part II Examples of applications 85 7 Safety measures for a road tunnel 87 7.1 Planning............................... 87 7.1.1 Problem definition..................... 87 7.1.2 Selection of analysis method................ 88 7.2 Risk assessment........................... 88 7.2.1 Identification of initiating events.............. 88 7.2.2 Cause analysis........................ 90 7.2.3 Consequence analysis.................... 90 7.2.4 Riskpicture... 94 7.3 Risk treatment............................ 95 7.3.1 Comparison of alternatives................. 95 7.3.2 Management review and decision............. 95 8 Risk analysis process for an offshore installation 97 8.1 Planning............................... 97 8.1.1 Problem definition..................... 97 8.1.2 Selection of analysis method................ 98 8.2 Risk analysis............................. 98 8.2.1 Hazard identification.................... 98 8.2.2 Cause analysis........................ 98 8.2.3 Consequence analysis.................... 100
CONTENTS vii 8.3 Risk picture and comparison of alternatives............ 103 8.4 Management review and judgement................ 104 9 Production assurance 105 9.1 Planning............................... 105 9.2 Risk analysis............................. 105 9.2.1 Identification of failures.................. 105 9.2.2 Cause analysis........................ 106 9.2.3 Consequence analysis.................... 106 9.3 Risk picture and comparison of alternatives............ 108 9.4 Management review and judgement. Decision........... 109 10 Risk analysis process for a cash depot 111 10.1 Planning............................... 111 10.1.1 Problem definition..................... 111 10.1.2 Selection of analysis method................ 112 10.2 Risk analysis............................. 113 10.2.1 Identification of hazards and threats............ 113 10.2.2 Cause analysis........................ 113 10.2.3 Consequence analysis.................... 116 10.3 Risk picture............................. 118 10.4 Risk-reducing measures....................... 120 10.4.1 Relocation of the NOKAS facility............. 120 10.4.2 Erection of a wall...................... 121 10.5 Management review and judgment. Decision........... 121 10.6 Discussion.............................. 122 11 Risk analysis process for municipalities 123 11.1 Planning............................... 123 11.1.1 Problem definition..................... 123 11.1.2 Selection of analysis method................ 124 11.2 Risk assessment........................... 124 11.2.1 Hazard and threat identification.............. 124 11.2.2 Cause and consequence analysis. Risk picture....... 125 11.3 Risk treatment............................ 128 12 Risk analysis process for the entire enterprise 131 12.1 Planning............................... 131 12.1.1 Problem definition..................... 131 12.1.2 Selection of analysis method................ 132 12.2 Risk analysis............................. 132 12.2.1 Price risk.......................... 132 12.2.2 Operational risk....................... 135 12.2.3 Health, Environment and Safety (HES).......... 137 12.2.4 Reputation risk....................... 138
viii CONTENTS 12.3 Overall risk picture......................... 140 12.4 Risk treatment............................ 141 13 Discussion 143 13.1 Risk analysis as a decision support tool.............. 143 13.2 Risk is more than the calculated probabilities and expected values 144 13.3 Risk analysis has both strengths and weaknesses......... 145 13.3.1 Precision of a risk analysis: uncertainty and sensitivity analysis..................... 145 13.3.2 Terminology......................... 147 13.3.3 Risk acceptance criteria (tolerability limits)........ 149 13.4 Reflection on approaches, methods and results.......... 152 13.5 Limitations of the causal chain approach.............. 152 13.6 Risk perspectives.......................... 154 13.7 Scientific basis............................ 157 13.8 The implications of the limitations of risk assessment....... 159 13.9 Critical systems and activities................... 161 13.10 Conclusions............................. 166 A Probability calculus and statistics 167 A.1 The meaning of a probability.................... 167 A.2 Probability calculus......................... 168 A.3 Probability distributions: expected value.............. 170 A.3.1 Binomial distribution.................... 171 A.4 Statistics (Bayesian statistics).................... 172 B Introduction to reliability analysis 173 B.1 Reliability of systems composed of components.......... 173 B.2 Production system.......................... 175 B.3 Safety system............................ 175 C Approach for selecting risk analysis methods 177 C.1 Expected consequences....................... 177 C.2 Uncertainty factors......................... 179 C.3 Frame conditions.......................... 179 C.4 Selection of a specific method................... 180 D Terminology 183 D.1 Risk management: relationships between key terms........ 186 Bibliography 187 Index 193
Preface This book is about risk analysis basic ideas, principles and methods. Both theory and practice are covered. A number of books exist presenting the many risk analysis methods and tools, such as fault tree analysis, event tree analysis and Bayesian networks. In this book we go one step back and discuss the role of the analyses in risk management. How such analyses should be planned, executed and used, such that they meet the professional standards for risk analyses and at the same time are useful in a practical decision-making context. In the book we review the common risk analysis methods, but the emphasis is placed on the context and applications. By using examples from different areas, we highlight the various elements that are part of the planning, execution and use of the risk analysis method. What are the main challenges we face? What type of methods should we choose? How can we avoid scientific mistakes? The examples used are taken from, among others, the transport sector, the petroleum industry and ICT (Information and Communication Technology). For each example we define a decision-making problem, and show how the analyses can be used to provide adequate decision support. The book covers both safety (accidental events) and security (intentional acts). The book is based on the recommended approach to risk analysis described and discussed in Aven (2003, 2007a, 2008). The basic idea is that risk analysis should produce a broad risk picture, highlighting uncertainties beyond expected values and probabilities. The aim of the risk analysis is to predict unknown physical quantities, such as the explosion pressure, the number of fatalities, costs and so on, and assess uncertainties. A probability is not a perfect tool for expressing the uncertainties. We have to acknowledge that the assigned probabilities are subjective probabilities conditional on a specific background knowledge. The assigned probabilities could produce poor predictions. The main component of risk is uncertainty, not probability. Surprises relative to the assigned probabilities may occur and by just addressing probabilities such surprises may be overlooked. It has been a goal to provide a simplified presentation of the material, without diminishing the requirement for precision and accuracy. In the book, technicalities are reduced to a minimum, instead ideas and principles are highlighted. Reading the book requires no special background, but for certain parts it would be beneficial to have a knowledge of basic probability theory and statistics. It has, however, been a goal to reduce the dependency on extensive prior knowledge of probability theory and statistics. The key statistical concepts are introduced and discussed thoroughly in the book. Appendix A summarises some basic probability theory and
x PREFACE statistical analysis. This makes the book more self-contained, and it gives the book the required sharpness with respect to relevant concepts and tools. We have also included a brief appendix covering basic reliability analysis, so that the reader can obtain the necessary background for calculating the reliability of a safety system. This book is primarily about planning, execution and use of risk analyses, and it provides clear recommendations and guidance in this context. However, it is not a recipe-book, telling you which risk analysis methods should be used in different situations. What is covered is the general thinking process related to the planning, execution and use of risk analyses. Examples are provided to illustrate this process. The book is based on and relates to the research literature in the field of risk, risk analysis and risk management. Some of the premises for the approach taken in the book as well as some areas of scientific dispute are looked into in a special Discussion chapter (Chapter 13). The issues addressed include the risk concept, the use of risk acceptance criteria and the definition of safety critical systems. The target audience for the book is primarily professionals within the risk analysis and risk management fields, but others, in particular managers and decisionmakers, can also benefit from the book. All those working with risk-related problems need to understand the fundamental principles of risk analysis. This book is based on a Norwegian book on risk analysis (Aven et al. 2008), with co-authors Willy Røed and Hermann S. Wiencke. The present version is, however, more advanced and includes topics that are not included in Aven et al. (2008). The terminology used in the book is summarised in Appendix D. It is to a large extent in line with the ISO standard on risk management terminology, ISO (2002). Our approach means a humble attitude to risk and the possession of the truth, and hopefully it will be more attractive also to social scientists and others, who have strongly criticised the prevalent thinking of risk analysis and evaluation in the engineering environment. Our way of thinking, to a large extent, integrates technical and economic risk analyses and the social scientist perspectives on risk. As a main component of risk is uncertainty about the world, risk perception has a role to play to guide decision-makers. Professional risk analysts do not have the exclusive right to describe risk. Acknowledgements A number of individuals have provided helpful comments and suggestions to this book. In particular, I would like to acknowledge my co-authors of Aven et al. (2008), Willy Røed and Hermann S. Wiencke. Chapters 7 and 11 are mainly due to Willy and Hermann; thanks to both. I am also grateful to Eirik B. Abrahamsen and Roger Flage for the great deal of time and effort they spent reading and preparing comments. For financial support, thanks to the University of Stavanger, and the Research Council of Norway. I also acknowledge the editing and production staff at John Wiley & Sons for their careful work. Stavanger Terje Aven
Part I Theory and methods The first part of the book deals with theory and methods. We are concerned about questions such as: What is a risk analysis? How should we describe risk? How should we plan, execute and use the risk analysis? What type of methods can we apply for different situations? Risk Analysis: Assessing Uncertainties beyond Expected Values and Probabilities 2008 John Wiley & Sons, Ltd T. Aven
1 What is a risk analysis? The objective of a risk analysis is to describe risk, i.e. to present an informative risk picture. Figure 1.1 illustrates important building blocks of such a risk picture. Located at the centre of the figure is the initiating event (the hazard, the threat, the opportunity), which we denote A. In the example, the event is that a person (John) contracts a specific disease. An important task in the risk analysis is to identify such initiating events. In our example, we may be concerned about various diseases that could affect the person. The left side of the figure illustrates the causal picture that may lead to the event A. The right side describes the possible consequences of A. On the left side are barriers that are introduced to prevent the event A from occurring; these are the probability reducing or preventive barriers. Examples of such barriers are medical check-ups/examinations, vaccinations and limiting the exposure to contamination sources. On the right side are barriers to prevent the disease (event A) from bringing about serious consequences; the consequence reducing barriers. Examples of such barriers are medication and surgery. The occurrence of A and performance of the various barriers are influenced by a number of factors the so-called risk-influencing or performance-influencing factors. Examples are: The quality of the medical check-ups; the effectiveness of the vaccine, drug or surgery; what is known about the disease and what causes it; lifestyle, nutrition and inheritance and genes. Figure1.1isoftenreferredtoasabow-tie diagram. We will refer to it many times later in the book when the risk picture is being discussed. We refer to the event A as an initiating event. When the consequences are obviously negative, the term undesirable event is used. We also use words such as hazards and threats. We say there is a fire hazard or that we are faced with a terrorist threat. We can also use the term initiating event in connection with an opportunity. An example is the opportunity that arises if a competitor goes bankrupt or his reputation is damaged. The risk analysis shall identify the relevant initiating events and develop the causal and consequence picture. How this is done depends on which method is Risk Analysis: Assessing Uncertainties beyond Expected Values and Probabilities 2008 John Wiley & Sons, Ltd T. Aven