Tuesday, March 22, 2011

The Square of Risk

In researching a chapter on risk triage for my book Creative Project Management, I came across a concept known as the PIVOT score. The elements of PIVOT are:

  • Probability — the likelihood a particular risk event will happen
  • Impact — the consequence of the risk event if it happens
  • Vulnerability — the relationship of the threat to core mission, values, and business objectives
  • Outrage — the expectation (E) of how things should be minus the degree of satisfaction (S) with the way things are.
  • Tolerance — the degree of enthusiasm or anger in response to the risk event impact if it happens.

Probability (P), impact (I), vulnerability (V), expectation (E), and satisfaction (S) each get a rating of between 0 and 3. The formula for outrage (O) is:

O = E – S

And the formula for tolerance (T) is:

T = (P x (I + V))O

Outrage, as you can see, is hyperbolic. It has a disproportionate impact of outrage on the final PIVOT score. Let’s imagine the following:

An event is moderately unlikely (P = 1), has a very high impact (I = 3), the event relates to our core business objectives (V = 3), but it’s unlikely to get much publicity because people aren’t too surprised when it happens, so E – S is only 1. The PIVOT score is  (1 x (3 + 3)1, or 6.

Now imagine that the impact is actually low, but it’s the sort of thing that will be smeared all over the headlines and every commentator will talk about it (O = 3). The PIVOT score is  (1 x (1+3))3, or 64! Even though the actual impact in the first instance is three times that of the second case, the PIVOT score of the less serious impact is more than ten times as high as that of the more serious case.

The impact of outrage on risk decisions tends to be disproportionate, especially when the outrage itself is the result of misinformation. Low impact risks take on catastrophic urgency and objectively more serious risks barely ripple the waters.

The confirmed death toll in Japan as I write is approaching 10,000, with the likely death toll predicted to top 18,000. Serious by any measure, but not outrageous because — hey, it was a huge tsunami and earthquake. Do you really expect all the safety procedures to be sufficient? Low outrage means not only less obsessive coverage, but also less pressure to improve safety.

The latest IAEA report I can find (March 17) lists a total of 44 injuries and no deaths. The UK Telegraph reports five workers dead, but I can’t confirm that, or whether they are part of or in addition to the 44. The level of relative outrage — expectation minus satisfaction — is off the wall.

Using outrage as the square (or higher power) of risk dramatically distorts decision-making. Do 9,000+ real deaths truly mean less than some uncounted but low number of potential deaths? In risk management practice, it often does. 

Where the outrage is, so goes the money and the effort. This is not always in our best interest.

From http://xkcd.com/radiation/.


  1. I think this is a brilliant article. Thanks for posting it!

    It entirely explains, to my satisfaction, many of the bizarre risk management decisions that have been made over the past wee while.

    I have never been a fan of probabilistic risk models -- PIVOT really only exacerbates what is already a pretty poor technique.

    1. Probabilistic risk models make sense when there's enough actual data, but otherwise their main role is to benchmark what level of response is proportional. I enjoyed PIVOT as a model because it demonstrates how emotion can distort effective decision making. So glad you enjoyed the piece; thanks for the comment.