What Is Risk Analysis?

Risk analysis refers to the assessment process that identifies the potential for anyadverse events that may negatively affect organizations or the environment. It's commonly performed by corporations, governments, and nonprofits. Conducting a risk analysis can help organizations determine whether they should undertake a project or approve a financial application and what actions they may want to take to protect their interests.

This type of analysis facilitates a balance between risks and risk reduction. Risk analysts often work with forecasting professionals to minimize future negative unforeseen effects.

How Risk Analysis Works

Risk assessment enables corporations, governments, and investors to assess the probability that an adverse event might negatively impact a business, economy, project, or investment. It's essential for determining the worth of a specific project or investment and the best processes to mitigate those risks. It provides various approaches that can be used to assess the risk and reward tradeoff of a potential investment opportunity.

A risk analyst begins by identifying what could potentially go wrong. These negatives must be weighed against a probability metric that measures the likelihood of the event occurring. Risk analysis then attempts to estimate the extent of the impact if the event happens. Many identified risks such asmarket risk, credit risk, and currency risk can be reduced throughhedging or by purchasing insurance.

Almost all large businesses require a minimum level of risk analysis. Commercial banks must properly hedge the foreign exchange exposure of overseas loans while large department stores must factor in the possibility of reduced revenues due to a global recession. Risk analysis allows professionals to identify and mitigate risks but not completely avoid them.

Types of Risk Analysis

There are five primary methods of risk analysis and they serve varying purposes.

Cost-Benefit Analysis

An analyst compares the benefits a company receives to the financial and non-financial expenses related to the benefits in a cost-benefit analysis. The potential benefits may cause other types of potential expenses to occur.

Risk-Benefit Analysis

A risk-benefit analysis compares potential benefits with associated potential risks. Benefits may be ranked and evaluated based on their likelihood of success or the projected impact the benefits may have.

Needs Risk Analysis

A needs risk analysis looks at the current state of a company. A company will often undergo a needs assessment to better understand a need or gap that's already known. A needs assessment may also be performed if management isn't aware of gaps or deficiencies. This analysis lets the company know where they may consider increasing spending to bring more resources in.

Business Impact Analysis

A business may see a potential risk looming and want to determine how the situation may impact it. Consider the probability of a concrete worker strike and how it would affect areal estate developer. The developer may perform a business impact analysis to understand how each additional day of the delay may impact their operations.

Root Cause Analysis

A root cause analysis is performed because something is happening that shouldn't be. It's the opposite of a needs analysis. It strives to identify and eliminate processes that cause issues. Other types of risk analysis often forecast what needs to be done or what could be done but a root cause analysis aims to identify the impact of things that have already occurred or continue to happen.

How to Perform a Risk Analysis

There are different types of risk analysis and many have overlapping steps and objectives. Each company might choose to add or change the steps below but they outline the most common process of performing a risk analysis.

Step #1: Identify Risks

The first step in many types of risk analysis is to make a list of potential risks you may encounter. These might be internal threats that arise from within a company but most risks will be external, occurring from outside forces. It's important to incorporate many members of a company for this brainstorming session because different departments may have different perspectives and inputs.

A company may have already addressed its major risks through a SWOT analysis. This type of analysis may prove to be a launching point for further discussion but it often addresses a specific question. SWOT analyses are often broader.

Step #2: Identify Uncertainty

The primary concern of risk analysis is to identify troublesome areas for a company. The riskiest aspects are often undefined areas. A critical aspect of risk analysis is therefore to understand how each potential risk has uncertainty and to quantify the range of risk that uncertainty may hold.

Step #3: Estimate Impact

The goal of a risk analysis is often to better understand how risk will financially impact a company. This is usually calculated as the risk value: the probability of an event happening multiplied by the cost of the event.

A company might assess that there's a 1% chance a product defection will occur. It would cost the company $100 million if the event were to occur. The risk value of the defective product would be assigned $1 million.

A single defective product that could ruin brand image and customer trust may put the company out of business if the company only yielded $40 million in sales each year. The company may choose to prioritize addressing this due to the higher stakes.

Step #4: Build Analysis Models

The analysis model takes all available pieces of data and information and attempts to yield different outcomes, probabilities, andfinancial projections of what might occur. Scenario analysis or simulations can determine an average outcome value in more advanced situations. This can be used to quantify the average instance of an event occurring.

Step #5: Analyze Results

It's time to analyze the results with the model run and the data available to be reviewed. Management often takes the information and determines the best course of action by comparing the likelihood of risk, projected financial impact, and model simulations. Management may also request to see different scenarios run for varying risks based on different variables or inputs.

Step #6: Implement Solutions

It's time to put a plan into action when management has digested the information. Sometimes the plan is to do nothing. A company has decided to change course in risk acceptance strategies because it makes more financial sense to simply live with the risk of something happening and deal with it after it occurs. Management may want to reduce or eliminate the risk in other cases.

Quantitative vs. Qualitative Risk Analysis

Risk analysis is either quantitative or qualitative.

Quantitative Risk Analysis

A risk model is built using simulation or deterministic statistics to assign numerical values to risk under quantitative risk analysis. The inputs are mostly assumptions and random variables.

The model generates a range of outputs or outcomes for any given range of input. Risk managers analyze the model's output using graphs, scenario analysis, and/or sensitivity analysis to make decisions about mitigating and dealing with the risks.

AMonte Carlo simulation can generate a range of possible outcomes of a decision or action. The simulation is a quantitative technique that repeatedly calculates results for the random input variables using a different set of input values. The resulting outcome from each input is recorded and the final result of the model is aprobability distribution of all possible outcomes.

These outcomes can be summarized on a distribution graph showing some measures of central tendency such as the mean and median and assessing the variability of the data throughstandard deviation and variance. The outcomes can also be assessed using risk management tools such as scenario analysis and sensitivity tables. A scenario analysis shows the best, middle, and worst outcome of any event.

An American company that operates globally might want to know how its bottom line would fare if the exchange rate of select countries strengthened. A sensitivity table shows how outcomes vary when one or more random variables or assumptions are changed.

Aportfolio manager might use a sensitivity table to assess how changes to the different values of each security in a portfolio will impact the portfolio's variance. Other types of risk management tools include decision trees and break-even analysis.

Qualitative Risk Analysis

Qualitative risk analysis doesn't identify and evaluate risks with numerical and quantitative ratings. It involves a written definition of the uncertainties, an evaluation of the extent of the impact if the risk ensues, and countermeasure plans in the case of a negative event.

Examples of qualitative risk tools includeSWOT analysis, cause-and-effect diagrams, decision matrixes, and game theory. A firm that wants to measure the impact of a security breach on its servers may use a qualitative risk technique to help prepare it for any lost income that might occur from a data breach.

Value at Risk (VaR)

Value at risk (VaR) is calculated by shifting historical returns from worst to best assuming that returns will be repeated, especially where risk is concerned.

VaR measures and quantifies the level of financial risk within a firm,portfolio, or position over a specific time frame. Investment and commercial banks often use this metric to determine the extent and occurrence ratio of potential losses in their institutional portfolios. Risk managers use VaR to measure and control the level of risk exposure. VaR calculations can be applied to specific positions or whole portfolios or they can measure firm-wide risk exposure.

Advantages and Disadvantages of Risk Analysis

Pros of Risk Analysis

Risk analysis allows companies to make informed decisions and plan for contingencies before bad things occur. Not all risks may materialize but a company should understand what might occur so it can make plans ahead of time to avoid potential losses.

Risk analysis also helps quantify risk because management may not know the financial impact of something that might happen. The information may help companies avoid unprofitable projects. The information may help put plans in motion that reduce the likelihood of something happening that would have caused financial stress on a company.

Risk analysis can help detect early warning signs of potentially catastrophic events. It may identify that customer information isn't being adequately secured. Risk analysis can lead to better processes, stronger documentation, more robustinternal controls, and risk mitigation.

Cons of Risk Analysis

Risk is a probabilistic measure. It can never tell you for sure what your precise risk exposure is at a given time but only what the distribution of possible losses is likely to be if and when they occur. There are no standard methods for calculating and analyzing risk and even VaR can have several ways of approaching the task. Risk is often assumed to occur using normal distribution probabilities which rarely occur in reality and can't account for extreme or "black swan" events.

The financial crisis of 2008 exposed these problems as relatively benign VaR calculations that greatly understated the potential occurrence of risk events posed by portfolios ofsubprime mortgages.

Risk magnitude was also underestimated and this resulted in extremeleverage ratios within subprime portfolios. The underestimations of occurrence and risk magnitude left institutions unable to cover billions of dollars in losses when subprime mortgage values collapsed.

The Bottom Line

Risk analysis is the process of identifying risk, understanding uncertainty, quantifying the uncertainty, running models, analyzing results, and devising a plan. It may be qualitative or quantitative and different types of risk analysis address various situations.