Today we are excited to introduce Archer Insight, a set of quantitative risk analysis capabilities which, when paired with Archer’s industry-leading integrated risk management platform, supports improved risk-based decision making. Archer Insight features a wide range of enhanced risk analysis capabilities; this blog focuses on one feature we expect to be of high interest to risk analysts, specifically improved risk heat maps.
Risk heat maps are a basic communication tool for the risk manager, providing a visual overview of the portfolio of identified risks. On one axis is the likelihood of the risk occurring, and on the other axis a measure of the impact should the risk occur. Those risks with the highest likelihood and impact are most threatening and the corresponding quadrant is colored red. Those risks with the lowest likelihood and impact plot in the quadrant colored green to reflect their relative unimportance, and the area in between is typically colored yellow or orange.
Traditional heat map
Despite its ubiquitous popularity, the traditional risk heat map presents several challenges:
Clearly not all squares of the same color represent risks of the same severity, but the qualitative evaluation of likelihood and impact magnitude do not allow a rational method for defining finer gradations along the red-to-green spectrum.
Likelihood is typically equated to probability of occurrence for events that can occur at most one time (like the destruction of a building or the loss of a dataset to the Dark Web) or frequency of occurrence for events that can occur multiple time (like fatal accidents, system shutdowns or regulatory fines). The former scales from 0 to 1, while the latter can take any non-negative value. It is therefore very challenging to show both types of likelihood on the same plot. For example, if an expected frequency of five times a year is ‘High’, then to be consistent a probability of 100% would be lower, which does not make intuitive sense.
Representing low likelihood risks is also challenging. One might say that a risk with a 10% chance of occurrence should fall into a ‘Low’ category, but this is still quite significant – if you have 10 such risks, it is almost certain that one of them would occur. On the other hand, a risk with a one in a thousand chance of occurring would fall into the same ‘Low’ likelihood category.
When an impact can take a wide range of values, it is extremely challenging to decide how to present the risk. For example, a factory accident might have a 10% chance of occurring in a year, but its impact could be anything from some minor bruises if lucky (Low), most probably an outpatient visit by a worker (Medium Low), but in the most extreme circumstances there could be several fatalities (High). If the risk is evaluated as [Likelihood,Impact] = [Low,Medium Low], there is no recognition of the very severe possible outcome, but if it is represented as [Low,High], the evaluation is exaggerated.
A new vision for heat maps
Archer Insight introduces quantitative estimation of risks through simple, intuitive evaluation techniques that require no expertise on probability modeling or math. It resolves the probability/frequency dilemma, and it allows users to express the range of possible resultant impacts if needed. Archer Insight also introduces quantitative bowtie methods to express how one risk may have more than one consequence.
For example, a car crash (risk event) could result in several consequences – from being late for work to repair bills to injuries and fatalities to the passengers and larger public:
Bowtie analysis for a car crash
These consequences produce impacts of different dimensions: money for repairs, time for delays, and level of injuries/fatalities for people. It is even possible to map several risks to the same consequence. For example, several different risks might all lead to the cancellation of a contract (the consequence) with an important financial impact. Archer Insight automatically calculates the aggregate likelihood of the consequence occurring, taking into account all the different ways it could happen.
The option to include a richer description of risk has made it possible to rethink the heat map, and produce new visualization that is more precise, comprehensive, and useful for decision makers.
The standard Archer Insight heat map has an impact scale that ranges from ‘Extremely Low’ to ‘Catastrophic’ plus a ‘Nil’ category so that one can represent when the impact of a consequence has been avoided completely. The finer gradation, together with guiding definitions, allows a far more precise evaluation of impact. Moreover, Archer Insight allows you to specify ranges of impacts, both qualitative and quantitative. Its sophisticated algorithm translates these inputs into a consistent scaling system, even across different impact types. The algorithm ensures that all consequences plotting in the same color are equivalent in importance.
Archer Insight P-I table for consequences with heat map overlay
The vertical axis is numeric, accommodating both probability and frequency, which is automatically adjusted to reflect the business time horizon and any changes in the window of opportunity for the risks to occur.
Pre-and post-risk treatment evaluations are shown together using “tadpole tails”:
Tadpole tails – the head represents the current status, the end of the tail represents the evaluation prior to any risk treatment
This allows the manager to appreciate the level of reliance on the effectiveness of risk management strategies. If the line is long, the reliance is large. The heat map allows you to drill down by selecting a specific entity and a specific type of impact if required. Hovering over a consequence will show a description popup, clicking on the dot will highlight the consequence in the accompanying table, and clicking the table entry will show a wealth of information describing the strategy being used to manage the consequence:
Archer Insight P-I table filtered for Reputation consequences with heat map overlay
One can also view risk events instead of consequences. Archer Insight then displays each risk event, accounting for the multitude of consequences that might arise from it:
Archer Insight P-I table for risk events with heat map overlay switched off
To learn more about how Archer Insight is enabling an enhanced level of risk-based decision making, register today to attend our August 4 webinar, where we will explore these improved heat maps and many other features of Archer Insight.