Quantitative risk management

Goal oriented & actionable

The first step in the construction of any meaningful model is to identify the objectives we are trying to achieve and the decision we can make in order to achieve them.

Predictive and stochastic

Paraphrasing ISO31000, “Risk management is the coordination of activities to direct and control an organization with regard to the effect of uncertainty on objectives.” Our model aims to explicate exactly the relationships between decisions, objectives and the unruly turmoil of uncertainty that lies in between.

The causal map

A causal map serves three ends. First, it is the basis of the quantitative model on which the decisions will be based. Secondly, and far more importantly, it provides common ground for analysts and decision makers to meet. Causality captures the experience and insight of experts because our intuition about causes is remarkably well developed, in contrast to our intuition about probability which is equally remarkably underdeveloped. Causal maps bring all stakeholders as close to the model as they need to approach, without getting them snarled in a mathematical tangle. Finally, the causal map shows the relationship between the fundamental elements of the model and the data we will use to condition it.

Virtuous and vicious simplicity

Virtuous simplicity contains its complexity. The figure above is a virtuous simplification because the simplified parameter — the travel time — can be unpacked and explicated, either for the sake of better modelling or for the sake of introducing more controls. We will do this now. Vicious simplification ignores complexity. It would stop here.

Cycling shorts

I’ve put the mathematical details of the cycling example in an appendix. Briefly:

  • Delays are comprised of traffic lights and extraordinary delays, notably failures (puncture, breakdowns) and chance encounters
  • Speed is determined by wind — speed and direction — and form, effectively a constant related to power.
  • Dimensional analysis gives the speed as a function of the wind speed in the direction of travel and the power constant.
  • The power constant is fitted to data in the cases where 1) I’m fresh, 2) I haven’t slept well (lots of data — I have three small kids) and 3) I’m hungover (very few data for the same reason).

Decision time

Once we have built our model we can combine the uncertainties defined from the data sources we have identified using the relations we have established. The easiest, but not the only way to do this is with a Monte Carlo simulation. All these simulations were carried out in the free version of VoseSoftware’s ModelRisk, which allows you to carry out Monte Carlo simulations in an Excel spreadsheet.

New information

Wind speed and wind direction are simulated in the above results set, but a quick look at my phone before I leave and I have the wind speed and wind direction for the day. It is then a simple matter to run the model with those uncertainties removed. The range narrows, but because I have a headwind today, the distribution shifts right and I now need to leave 30 minutes before work in order to maintain my punctuality statistics.


By looking at the travel time in the lowest and highest, say 10% of instances of each of the primary variables, I can see the relative effect of each primary uncertainty on the total travel time. Wind is clearly dominant here. I can’t avoid meeting people and will always stop if I do, but this analysis tells me that breakdowns and punctures also make a significant contribution,

Additional controls

On the face of it, introducing maintenance has very little effect, but in fact it halves my probability of being more than 15 minutes late.

The manifold miseries of matrices

The cycling example also furnishes some good examples of some of the problems of addressing risk management using risk matrices or heat maps. The heat map here is based on a real heat map used by a large multinational company (no longer with us). The “probability” scale is unchanged, but the severity has been rescaled to this particular problem.

Matrix madness

My first significant challenge (not including the simple semantic issues of identifying what constitutes a risk versus a trigger, a cause or a consequence — a problem neatly circumvented by a causal map) is ambiguity with respect to where to place the risks on the matrix.

Risk register

The crudity of the calculus of colour carries over into our assessment of controls and mitigations. I’ve taken the gross risk as that implied by leaving an average cycling time before work starts. With the first interpretation above, that puts us in one of the three boxes shown in the figure. Leaving early is the obvious mitigation or policy to address this, but leaving even substantially earlier will only reduce my probability score by one row. So yellow stays yellow, even though leaving early is clearly a magnificent mitigation for this risk.


  • Models must be goal-oriented and actionable
  • They take their point of departure in decisions and objectives
  • Models should be predictive and stochastic
  • They are couched in the language of intervention and explicitly embrace uncertainty
  • Causal mapping is intuitive and accessible
  • It exploits causal intuition and provides accessible basis for rigorous mathematical modelling
  • Causal mapping is (virtuously) simple, scalable and fit-for-purpose
  • Models can be rolled up or folded out as required for decisions (and modelling detail)
  • Causal mapping provides a direct link to data and are verifiable
  • Models are built around available data
  • Models are checked and refined against prediction

Appendix: Details of the cycling model

Meeting someone is a Bernoulli event (I don’t stop twice) and the “probability” (really a frequency, but they’re nearly the same when they’re small) is just set to the historical rate at which I have met people.



Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Graeme Keith

Graeme Keith


Mathematical modelling for business and the business of mathematical modelling. See stochastic.dk/articles for a categorized list of all my articles on medium.