Case Studies On Risk Management

Markus Porthin
Advanced Case Studies in Risk Management
Master’s thesis submitted in partial fulfilment of the requirements for the degree of
Master of Science in Technology
Espoo, 2 August 2004
Supervisor: Professor Ahti Salo

Instructor: Professor Ahti Salo
HELSINKI UNIVERSITY OF TECHNOLOGY ABSTRACT OF MASTER'S THESIS
DEPARTMENT OF ENGINEERING PHYSICS AND MATHEMATICS
Author: Markus Porthin

Department: Department of Engineering Physics and Mathematics
Major subject: Systems and Operations Research
Minor subject: Strategy and International Business
Title: Advanced Case Studies in Risk Management
Title in Swedish: Avancerade fallstudier i riskhantering
Chair: Mat-2 Applied Mathematics

Supervisor: Professor Ahti Salo
Instructor: Professor Ahti Salo
Abstract:
The word risk is used to describe a situation that involves a possibility of something undesired
to happen. The systematic process of identifying, evaluating and reducing risks is usually
referred to as risk management (RM). The forerunner applications of modern RM emerge from
the military, nuclear power production and finance from where the methods have subsequently
spread to every field where significant unwanted uncertainties exist. Although risk is pervasive,
the methods and their usage depend on the context. Therefore, the case method is a powerful
tool in teaching RM.
This thesis presents four educational RM case studies compiled by the author. The studies are
aimed to show graduate students how some central RM methods may be used in practice and
give insight in the general principles of RM. The whole process from risk identification to
evaluation of implemented solutions is described. To give a multifaceted view, the cases include
risk situations from different fields: poultry production, electricity retailing, mining and pension
insurance business. Also a comparative analysis of the cases is conducted, where causal
relationships between different properties are identified. Using the insight learnt from the cases,
general guidelines and structural outlines concerning risk management are suggested.
A comparative analysis of the cases highlight that the RM method selection does not only
depend on the modelling properties of the phenomena and the type of loss, but also on the
traditions in each field. Seemingly different fields dealing with mathematically similar
phenomena could gain from interaction and exchanging of methods. Based on the type of
available information, rough guidelines for when to use frequentist, Bayesian or expert
elicitation methods in probability assessments is drawn. The precautionary principle should be
practised in cases with significant incertitude, where a formal risk assessment cannot be
conducted. The comparative analysis supports also the intuitive assumption that the extent of
governmental RM through regulations depends on the ubiquity and influence of the risk. The
case studies can be found at http://www.sal.hut.fi/Web-Activities/RM/.
Number of pages: 57 Keywords: Risk Management, Case Study, Risk Measures,

Comparative Analysis, Risk Management Process
Department fills
Approved: Library code:
i
TEKNISKA HÖGSKOLAN SAMMANDRAG AV DIPLOMARBETE
AVDELNINGEN FÖR TEKNISK FYSIK OCH MATEMATIK
Utfört av: Markus Porthin

Avdelning: Avdelningen för teknisk fysik och matematik
Huvudämne: System- och operationsanalys
Biämne: Företagsstrategi och internationell marknadsföring
Arbetets namn: Avancerade fallstudier i riskhantering
Title in English: Advanced Case Studies in Risk Management
Professur: Mat-2 Tillämpad matematik

Övervakare: Professor Ahti Salo
Handledare: Professor Ahti Salo
Sammandrag:
Ordet risk används för att beskriva en situation med möjliga oönskade följder. Den systematiska
processen som består av identifiering, evaluering och reducering av risker kallas vanligen för
riskhantering. De första tillämpningarna av modern riskhantering härstammar från armén,
kärnkraftsproduktionen och finansvärlden varifrån metoderna numera har spridit sig till alla
områden var betydande oönskad osäkerhet förekommer. Fastän risker finns överallt, beror
metodvalet och tillämpningarna på sammanhanget. Därför är fallstudier ett ypperligt sätt att lära
riskhantering.
Detta diplomarbete presenterar fyra undervisningsfallstudier sammansatta av skribenten. Syftet
var att visa för universitetsstuderande, hur vissa centrala riskhanteringsmetoder kan användas i
praktiken samt ge en inblick i riskhanteringens allmänna principer. Hela processen från
riskidentifiering till utvärdering av implementerade tillvägagångssätt beskrivs. För att ge en
mångsidig syn, behandlas exempel från olika områden: hönsproduktion, återförsäljning av
elektricitet, gruvverksamhet och pensionsförsäkring. En jämförande analys av exemplen utförs,
var kausalförhållanden mellan olika egenskaper identifieras. Utgående från exemplen föreslås
riktlinjer och grunddrag för riskhantering.
En jämförande analys av fallstudierna visar att valet av riskhanteringsmetod inte enbart beror på
fenomenets egenskaper och förlusttyp utan också på traditionerna inom branschen. Till synes
olika områden, som handskas med matematiskt sett liknande fenomen, kunde dra nytta av
växelverkan och utbyte av metoder. Utgående från typen av tillgänglig information, dras grova
riktlinjer för tillämpandet av frekvens-, Bayes- och expertelicitationsmetoder för bestämmandet
av sannolikheter. I fall med betydande oklarhet kan en formell riskbedömning inte utföras, utan
då bör försiktighetsprincipen tillämpas. Den jämförande analysen stöder även det intuitiva
antagandet, att graden av statlig riskhantering genom reglering beror på riskens utbredning och
influensgrupper. Fallstudierna finns på WWW-sidan http://www.sal.hut.fi/Web-
Activities/RM/.
Sidoantal: 57 Nyckelord: riskhantering, fallstudie, riskmått, jämförande

analys, riskhanteringsprocess
Ifylles på avdelningen
Godkänd: Bibliotek:
ii
Preface
This work was carried out at the Systems Analysis Laboratory at Helsinki University of
Technology. I thank Professor Ahti Salo, my instructor and supervisor, for guidance and
invaluable feedback throughout the writing of this thesis. I am also grateful to Research
Professor Urho Pulkkinen at VTT Technical Research Centre of Finland, who put his
expertise on risk analysis at my disposal. I thank the whole personnel at the Systems
Analysis Laboratory for a great working atmosphere.
I thank Ph.D. Jukka Ranta and Professor Riitta Maijala at the National Veterinary and
Food Research Institute for sharing their time and giving me further insight in the
National Salmonella Control Programme.
Most of all, I wish to thank my fiancée Elina Karp, who helped me in many ways.
Discussions with her cleared up my thoughts during the writing and she kindly proofread
the thesis. I am grateful for her love and support as well as patience and understanding
although the final revisions of the manuscript took time from our wedding preparations.
Helsinki, 2 August 2004.
Markus Porthin
iii
Table of Contents
Preface.............................................................................................................................................iii
1 Introduction ...........................................................................................................................1
1.1 Background .................................................................................................................. 1
1.2 Objectives of the Thesis............................................................................................. 2
1.3 The Case Method in Teaching Risk Management ................................................. 2
1.4 Structure of the Study................................................................................................. 4
2 Risk..........................................................................................................................................5
2.1 Definitions of Risk...................................................................................................... 5
2.2 Risk Measures .............................................................................................................. 6
2.2.1 Qualitative measures.......................................................................................... 6
2.2.2 Quantitative measures ....................................................................................... 7
2.3 Risk Analysis and Risk Management...................................................................... 10
2.4 Risk Management in Different Fields .................................................................... 13
2.4.1 Finance .............................................................................................................. 13
2.4.2 Process Industry............................................................................................... 13
2.4.3 Insurance ........................................................................................................... 14
2.4.4 Society and Foresight ...................................................................................... 14
2.4.5 Environment and Health ................................................................................ 14
3 Case Studies......................................................................................................................... 16
3.1 Salmonella Case......................................................................................................... 17
3.1.1 Background....................................................................................................... 17
3.1.2 Risk Assessment Model .................................................................................. 19
3.1.3 Risk Management Process .............................................................................. 20
3.1.4 Lessons from the Case .................................................................................... 22
3.2 Electricity Retailer Case............................................................................................ 23
3.2.1 Background....................................................................................................... 23
3.2.2 Value Tree Framework.................................................................................... 24
3.3 Mining Case ............................................................................................................... 28
3.3.1 Background....................................................................................................... 28
3.3.2 Safety Assessment of Air Recirculation System .......................................... 29
3.4 Pension Insurance Case ........................................................................................... 34
3.4.1 Background....................................................................................................... 34
3.4.2 Main Risks of a Pension Insurance Company ............................................. 35
3.4.3 Stochastic Programming Model for Asset Liability Management ............ 37
iv
4 Comparative Analysis of the Cases.................................................................................. 40
4.1 Risk Influence and Decision Makers...................................................................... 40
4.2 Type of Loss .............................................................................................................. 42
4.3 Modelling of Probabilities and Interrelationships ................................................ 42
4.4 Guidelines for Selection of Probability Assessment Method............................. 45
4.5 Types of Risk Management Decisions................................................................... 46
5 Conclusions......................................................................................................................... 49
6 References ........................................................................................................................... 51
7 Web References.................................................................................................................. 57
v
1 Introduction
1.1 Background
The word risk is used to describe a situation that involves a possibility of

something undesired to happen. The systematic process of identifying, evaluating
and reducing risks is usually referred to as risk management (RM). It is natural for
people to worry, but managing risks was for a long time considered to be beyond
the power of mankind and only in the hands of the gods. However, one form of
RM, insurances, has been practised for thousands of years. The earliest known
references of a primitive version of marine insurances date back beyond the 18th
century BC. Also farmers set up cooperatives to insure one another against bad
weather. In 1473, a bank in Italy called Monte Dei Paschi was set up to serve as an
intermediary for such arrangements. Perhaps the most famous market place for
insurances was Edward Lloyd’s coffee house in London, opened in 1687. There
marine insurances gained momentum and soon one could also get insurance
policies against almost any kind of risk, including house-breaking and death by gin-
drinking. From mid 17th to mid 18th century, the concept of probability and its
primary properties, the main foundations in risk management, were developed.
(Bernstein, 1996)
Modern risk management started evolving after the Second World War on two
different fields: insurance buying as well as reliability and safety engineering. These
fields grew side by side for decades with very little interaction (Williams et al.,
1998). The lack of interaction can partly be explained by the organisational
structure of most businesses and governments and the different background of the
parties; the technically oriented specialists did not understand the financially
oriented ones, and vice versa. At first, the main duty of the financially oriented
corporate insurance buyers was placement and management of organisations’
insurance portfolios. Later other means of coping with financial uncertainties, such
as self-insurance and different loss prevention activities, have diminished the
relative importance of insurances. The first tasks of reliability and safety
engineering were to increase reliability and reduce maintenance costs of military
equipment (Andrews and Moss, 2002). In the 1970’s the nuclear power industry
became a significant field of application. Later on reliability engineering has been
widely used in process industries.
1
Today risk management on the reliability and financial fields are seen as two parts
of the same problem: reducing undesired uncertainty. Other fields of RM include
e.g. vaccination decisions, legislation on gene manipulated food and software
design. A current challenge is to study all risk factors in an organisation as a whole
and manage those using suitable methods from all available fields (Räikkönen,
2002; Räikkönen and Rouhiainen, 2003). This demands a holistic approach in
studying risks.
1.2 Objectives of the Thesis
This thesis presents four pedagogical risk management case studies compiled by
the author for use at Systems Analysis Laboratory at Helsinki University of
Technology. The studies are narratives that tell how certain risks are managed in
the examples. The purpose of the cases is not to serve as a tutorial, but rather to
show how some risk management methods may be used in practice and to give
insight to the general principles of risk management. The studies are meant to
describe the whole risk management process from risk identification to the
evaluation of implemented solutions. The cases are chosen from different fields in
order to give a multifaceted overview of RM.
A comparative analysis of the case studies is also conducted. The objectives of the
analysis are to find similarities and dissimilarities from the cases and to deliberate
upon their causes as well as to identify causal relationships between different
properties of the cases. Using the insight from the cases, some general guidelines
and structural outlines concerning RM are also suggested.
1.3 The Case Method in Teaching Risk Management
Educational case studies are narratives that are rooted in real events and centre on
key issues of the topic at hand (Wassermann, 1994). The purpose of a case study is
to introduce realistic situations to the student. This method was first used at
Harvard Law School in 1870 and became subsequently a common teaching
method in law, business and medicine (Garvin, 2003). A widely used type of case
studies includes an introduction to the case context followed by a decision
situation or dilemma to be solved by the students. Other case studies are finished
2
stories that either describe a major failure and try to deliberate upon what should
have been done, or tell a success story presenting good or even best practice.
The main advantage of the case method compared to traditional teaching methods
is that it concretises the topic by putting it into a context. Thus, the student gets a
better picture of how the discussed methods are used in practice and learns how to
grapple with messy real-life problems (Herreid, 1994). This gives the student a
deeper understanding about the problem. The disadvantages of case studies are
also strongly linked to the presence of a context. Sceptics claim that case studies
are too bound to the context, making the lessons learned hard to generalise. In
addition, case studies do not necessarily communicate the big picture of the field
of study, but rather give a detailed description of a particular problem.
Furthermore, case-specific information is needed for a study to come to life, which
may not be of any general interest.
Books with case studies in risk management have been published e.g. by Greene
(1983) and the Risk and Insurance Management Society Staff (1988). In 1997, the
University of Calgary1 made a selection of these cases available on the World Wide
Web in html-format. These 14 case studies cover different fields from capital
budgeting and loss control to crisis management and earth movement. The cases
are short narratives of the risky situation of a company or organisation followed by
a set of questions for discussion. Most of the cases leave the end of the story
unfinished and pose questions that help the students to find a solution to the
problem. Philippe Jorion, the author of the book Value at Risk (Jorion, 2001), has
published on his WWW home page a case study about Orange County, which lost
$1.6 billion on the financial market, and describes how the losses might have been
avoided using Value at Risk2 (VaR). He describes the setting that resulted in the
huge loss and asks the reader to do various VaR-related calculations based on the
case information.
Studies of major failures can be found on the WWW, e.g. concerning losses on the
financial market3 and unsuccessful projects4. There exist also comprehensive
collections of case studies for management education5, which include a number of
1 http://www.ucalgary.ca/MG/inrm/Teaching/Cases/case_idx.htm, visited 19.03.2004.

2 http://www.gsm.uci.edu/~jorion/oc/case.html, visited 22.03.2004.
3 http://riskinstitute.ch/Introduction.htm, visited 22.03.2004.
4 http://www.ramprisk.com/riskknowledge/allcasestudies.asp, visited 22.03.2004.
5 e.g. http://www.ecch.cranfield.ac.uk/, visited 22.03.2004.
3
risk management cases, mostly from the financial field. The studies are supplied by
well-known business schools, such as Harvard Business School, The Richard Ivey
School of Business and INSEAD, and are available subject to a fee. The current
trend of increasing use of case studies in education can be seen in the related fields
of operations research / management science, too. There are recent examples of
case studies on e.g. police patrol car allocation (Rump, 2002), decision analysis and
dynamic programming (Rump, 2001) and optimisation of brewery location and
capacity expansion decisions (Koksalan and Salman, 2003).
1.4 Structure of the Study
The reminder of this thesis is structured as follows. Chapter 2 introduces some key
concepts in risk management. Different measures and definitions of risk are
introduced as well as the steps of the risk management process. A classification of
risk management decisions and key characteristics of different application fields
are also discussed. Chapter 3 presents four educational case studies, prepared to
give examples on the risk management practices on different fields. The studies
shed some light on the methods used in poultry production, electricity retailing,
mining and pension insurance companies. In Chapter 4, a comparative analysis of
the cases is conducted. Dissimilarities and their possible causes are identified and
some general guidelines are drawn. Finally, in Chapter 5, the thesis is summarised
and concluded. Future prospects of risk management are also discussed.
4
2 Risk
2.1 Definitions of Risk
In colloquial language the word “risk” refers to the possibility of something

undesirable to happen (Rowe, 1977). The critical words in the sentence describing
the nature of risk are “possibility” and “undesired”. In the literature, there coexist
two parallel definitions of risk:
Definition 2.1a Risk is an uncertain situation with possible negative outcomes. (See e.g.
(Rescher, 1983))
Definition 2.1b Risk is the potential variation in outcomes. The variation can be either
positive (upside risk) or negative (downside risk) (Williams et al., 1998)
Definition 2.1b is mainly used in finance, where both positive and negative
positions in securities are possible. In other fields, definition 2.1a is more
common. In this thesis definition 2.1a will be used.
Risks exist irrespective of whether one is aware of them or not. If a person puts
himself under risk due to a conscious action, he is taking a risk. A situation where
no clear action is involved is referred to as being under risk. Risks can also be
categorised based on by whom the risk is caused and whom it affects. Nicholas
Rescher (1983) identifies four cases (see Table 1). He calls people under risk for
“maleficiaries”, a negative analogue to beneficiaries. In the first case a person puts
himself under risk, e.g. by smoking cigarettes. By his action he increases risk for
lung cancer. However, if there are people in the vicinity of the smoker, so called
passive smokers, the risk is both self- and other-directed (case 2). More non-
standard cases include a person putting others under risk (case 3) and the
circumstantial case (case 4), where no clear agent is present.
5
Table 1 Risk as classified based on agency (Rescher, 1983).
The definition of risk may be expanded to include the annoyance of foregoing the
occurrence of something good. This is called inverted risk or potential regret and
occurs wherever there are potentially lost opportunities (Rescher, 1983). E.g. a
person participating free of charge in a lottery risks not to win. This conception of
inverted risk broadens the set of situations that involve risk to all situations with
uncertain outcomes.
2.2 Risk Measures
The risk definitions are of little use when comparing and measuring risks.
Therefore, several risk measures have been developed, most of them being a
function of a probability measure and a loss measure. A requirement for using
most risk measures is that the potential loss is quantifiable and projectable on a
one-dimensional scale. In order to make different types of losses comparable e.g.
value-tree methods can be used. Next a short summary of the most common risk
measures is presented.
2.2.1 Qualitative measures
The severity of a risk can be quantitatively assessed by mapping the risk on a risk
matrix according to (i) the value of the negativity of the outcome and (ii) its
probability (or frequency of occurrence), see Figure 1. The closer to the upper
right corner the risk is situated, the more critical it is. This is a good tool in risk
identification for a quick overview of risks and in order to determine which to
6
focus on in further analyses. From this graphical point of view, risk management
can be seen as striving to move risks towards the lower left corner by lowering the
probability of the undesired outcomes and/or lowering the severity of their
consequences. Instead of representing a risk by only one point on the risk matrix,
a curve can be drawn. The F-N, or Farmer, curves were introduced by Reg Farmer
in 1967 (Farmer, 1967). The most common improved version of these plots F(C)
against C, where F(C) is the frequency of events with consequences greater than or
equal to C (Ballard, 1993). The use of the curves is often convenient, because
many risky situations might result in variably severe consequences and usually the
less critical ones are more probable.
C
High
rit
ic
al
Se
rio
Probability
us
M
od
er
at
e
M
in
or
N
eg
Low
lig
ib
le
Low High
Consequence
Figure 1 Risk matrix.
2.2.2 Quantitative measures
One of the most basic risk measures is the expected loss. In this method, the
potential consequences, losses, of the undesired events and their probabilities are
quantified. The expected value of the loss is calculated based on this information.
Definition 2.2 Let L∈ℜ be a stochastic variable denoting loss. Expected loss is the expected
value of L:
7
Expected loss = E ( L)
L may be either continuous or discrete, depending on the nature of the potential

losses. The expected loss is usually used only if no positive outcomes are possible.
Otherwise, possible gains could make the measure to zero or negative in cases that
most people, however, consider risky. The measure is most commonly used in
cases where only one possible loss is considered and the expected loss is calculated
simply by multiplying the loss by its probability.
The expected lost utility is an extension of the expected loss, where potential losses
are not considered as such but rather their utility.
Definition 2.3 Let L∈ℜn be a stochastic variable denoting loss and U: ℜn → ℜ a utility
function. Expected lost utility is the expected value of U(L):
Expected lost utility = E (U ( L))
Due to the utility function (von Neumann and Morgenstern, 1944; Bunn, 1984),
the decision maker’s attitude towards risks is included. Thus the measure is
subjective containing the decision maker’s view. For those seeking an objective
risk measure, this is obviously a drawback. As one could expect, another problem
is to find a proper utility function. A slightly different point of view can be gained
by transforming the expected loss and expected lost utility as risk per time unit.
Often risk lies in the uncertainty of a numerical quantity’s future value. A common
example is the share prices on a stock market. When prices are modelled as
stochastic variables, the variance or standard deviation is a natural measure of
fluctuation.
Definition 2.4 Let Y∈ℜ be a stochastic variable, f(y) and E(Y) its density function and
expected value respectively. The variance σ2 and standard deviation σ of Y are:
∞
σ2 = ∫ ( y − E (Y )) f ( y )dy, σ = σ 2
2
−∞
These measures account for both negative and positive deviations from the
expected value and thus treat risk in the manner of the risk definition 2.1b. The
variance is usually estimated from data using the maximum likelihood estimator
8
(see e.g. Milton and Arnold, 2002). On the stock market, the standard deviation of
a market rate is called volatility and is usually reported in percents of the market
rate value.
Value at Risk (VaR) was introduced in the early 1990’s as a tool for measuring
financial risks (Jorion, 2001). VaR measures how low the value of a portfolio could
fall over a given time at a given confidence level, see Figure 2 (Crouhy et al., 2001;
Jauri, 1997). For example, if the daily VaR of a portfolio is 100 000 € at the 99 %
confidence level, there is only 1 % chance that the portfolio will fall more than
100 000 € during the day. In other words, such an event will occur in average once
in 100 days. VaR can be calculated either relative to the initial value of the portfolio,
as in the example, or relative to its expected value (Jorion, 2001). The former is called
absolute VaR, the latter relative VaR. In the following definition the more common
relative VaR is used.
Definition 2.5 Relative Value at Risk measures the maximum loss in portfolio value over a
target horizon T with a given level of confidence 1-α:
VaR(α , T ) = E(W ) − W1*−α = −W0 ( R1*−α − µ ) ,
where W0 is the initial value of a portfolio, E(W) and W1-α* its expected and lowest value at
confidence level 1-α after time T respectively. R1-α* and µ are the corresponding lowest and
expected returns.
(1 - α)
α
f(x)
VaR(α)
Figure 2 Value at Risk.
9
Denoting the relative portfolio value after time T as X = W – E(W) and its
probability density function f(x), the relative VaR at the 1-α confidence level can
be defined as
−VaR (α )
∫
−∞
f ( x)dx = α .
Several modifications and extensions to the VaR measure have been developed.
One of the most promising is the conditional Var (CVaR), which is defined as the
expected value of the portfolio, given that the loss exceeds the VaR (Rockafellar
and Uryasev , 2000; Rockafellar and Uryasev, 2002; Uryasev, 2000). In contrast to
VaR, CVaR is a coherent measure of risk and has shown to be very useful in
portfolio optimisation.
2.3 Risk Analysis and Risk Management
Risk management is an activity identifying existing and threatening risks,

estimating their impacts and taking appropriate measures to reduce or hedge the
risks (Pausenberger and Nassauer, 2000). However, also other definitions exist.
Often RM refers only to the management decisions aimed at reducing risk (Lonka et
al., 2002; Haimes, 1998). The risk management process can be divided into five
steps6 (Suominen, 2000) (see Figure 3). First, risks are identified and evaluated,
which is often referred to as risk analysis. Then, potential methods for reducing risk
are developed and evaluated. When all the needed information is gathered,
informed RM decisions can be made. Finally, the iterative process concludes by
evaluation of the implemented solutions. In practice, the steps are seldom isolated,
but may be dealt with simultaneously due to overlapping activities.
6 This is merely one of many divisions suggested in literature. For slightly differing examples see
e.g. (Haimes, 1998), (Pausenberger and Nassauer, 2000), (Rowe, 1977), (Lonka et al., 2002) or
(Weber and Liekweg, 2000).
10
Risk identification
Risk analysis
Risk evaluation
(probability &
consequence)
Development and
evaluation of
RM methods
RM decisions
Evaluation of
implemented RM
solutions
Figure 3 The risk management process.
The purpose of the first RM step is to identify all relevant risks of the situation
under study. There are several techniques available to aid the process. To identify
different risks and to visualise which are already known and properly managed a
risk window may be used (Suominen, 2000). Identifying methods used in the
process industries include e.g. hazard and operability study (HazOp) as well as
failure mode and effect analysis (FMEA) (see e.g. Andrews and Moss, 2002).
When a tentative list of potential risks is gathered, the risks are screened in order
to decide which ones may be neglected and which should be further analysed.
In the second step of the RM process, risk evaluation, the probability of

occurrence and consequences of the relevant risks are assessed. This involves
usually utilisation of models describing the dependencies of the uncertainties and
analysis methods such as simulation.
When risks are known, appropriate managing measures must be chosen. Often the
effect of different potential RM methods can be evaluated using the same models
as in the risk evaluation steps and, therefore, these activities are interlinked.
11
Different risk management decisions may be categorised as follows (Suominen,
2000; Weber and Liekweg, 2000):
1. Avoid. Avoidance of risks is a simple means of risk management. It means

e.g. not to accept a risky transaction, not to develop a new product, not to
travel or not to use a certain product or method. The suitability of this
measure must be carefully considered before applying, although it is
noticeable that avoiding does not always increase costs or reduce
possibilities. If avoidance is, however, not possible or wise, other RM-
means must be considered.
2. Accept. Sometimes it is advisable to accept risks as they are. This is the case
when a risk is a part of the core function of the organisation and the
opportunities overweigh the risks. It is also the most efficient strategy for
very insignificant risks. Large organisations may practice self-insurance; e.g.
in Finland, the state does not have theft insurance for its property, because
insurance policies would be more expensive than paying for the losses.
3. Compensate. Risks may be compensated, or hedged, by taking one risk to

offset another. This is a common method in finance for reducing exposure
e.g. to fluctuations in exchange or interest rates and is realised by trading
derivative instruments such as futures.
4. Transfer. Risk can be transferred to another party through insurances or by

making a contract with a non-insurance party. This is a common procedure
when dealing with transportation risks, but also as a part of agreements for
strategic alliances.
5. Reduction. These measures seek to reduce the probability of an undesired

event or limit its impact. There are various methods and technical means
available, e.g. firewalls, backups, guarding, developing standard operation
procedures and control mechanisms, setting risk limits (especially in
treasury/finance).
After the RM decisions are set into practise, they must be followed-up in order to
determine their appropriateness and cost-efficiency.
12
2.4 Risk Management in Different Fields
In this section a brief description of five application fields of risk management is

presented. The key characteristics of the risks in each field are identified as well as
the most common methods used. The section concludes with a summarising table
(Table 2).
2.4.1 Finance
Financial risks are easy to handle in the respect that the losses are usually well
defined with money as the obvious performance measure, which makes risks
commensurable and easy to valuate. The performance measure is in general
modelled as a one-dimensional real-valued stochastic variable X. The risk analysis
methods are based on finding a good estimate of its probability distribution in one
way or another and identifying which factors influence the distribution and how.
Widely used risk measures include distribution characteristics, such as the standard
deviation (or volatility) and low-end quantiles i.e. Value at Risk and other “worst
case” measures. Another group of risk measures is the sensitivity measures, also
called “the Greeks” (because they are denoted using the Greek alphabet)
(Melnikov, 2004). They are partial derivatives of the portfolio value in respect to
some market parameter (e.g. stock market index, prize of underlying asset,
volatility, interest rate, time). The probabilities are estimated using e.g. historical
data, time series or Monte Carlo simulations.
2.4.2 Process Industry
In process industry, risk management has traditionally focused on considering the

probability of specific events or accidents. Analysts may be interested e.g. in the
probability of the overheating of a nuclear reactor or fire detection system
dysfunction. The severities of different undesired events are not necessarily
compared. In the most important field of application, the nuclear power industry,
probabilistic safety assessments (PSA) have been conducted since the 1970’s
(NEA, 1992). The PSA is a comprehensive, structured approach to identifying
failure scenarios and constituting a conceptual and mathematical tool for deriving
numerical estimates of risk.
The systems in process industry are usually well defined, enabling the development
of sophisticated analysis tools. There are several methods for identifying critical
events or chains of events, e.g. failure mode and effect analysis (FMEA), Hazard
13
and Operability study (HazOp) and reaction matrix, to mention only a few
(Andrews and Moss, 2002). Methods for assessing the probability of an event and
the effect of potential actions include fault tree and event tree analysis. Also
several component importance measures (e.g. Birnbaum’s, Vesely-Fussell’s) can be
useful in trying to improve the reliability of a system (Andrews and Moss, 2002).
2.4.3 Insurance
Insurance is an old way of securing oneself against risk and is based on sharing the
total losses among a large number of policyholders. In this way everyone pays a
share of the losses and no one has to suffer unbearable loss. The philosophy
assumes that the losses can be compensated with money. Although this
assumption often is justified, it may be argued whether money can cover the
damage of death or physical injuries. The prising of insurances is based on the
average damage compensations, risk margins, administration costs and
contribution margins. The insurance brokers do risk studies to find out the risk
profile of the customers in order to be able to offer right insurances. Accident
probabilities are estimated using statistical information.
2.4.4 Society and Foresight
Risks threatening the society in the future are often characterised by high
incertitude and indefinability. Sometimes we just do not know what we do not
know. Because of the unpredictability of the problem, often no sophisticated
scientific analyses are possible. Thus, the studies must rely on different future
scenarios and expert opinions, which in general are nothing more than good
guesses or pure speculations. The risks can be tackled by conducting scenario
analyses and practising the precautionary principle.
2.4.5 Environment and Health
Environmental and health risks include spreading diseases, environmental impacts

of human activities and changes in the ecosystem. Due to the characteristics of the
risks, usually the whole population of a region is exposed and thus the risk
management is handled by governments and supported by civic organisations. The
analysis tools are based on attempts to model the causal relationships of the
phenomena. Examples of these are models for spreading of diseases, and different
population and biosystem models.
14
Table 2 Risk characteristics and common risk management methods in different fields.
Application Finance Process industry Insurance Society and Environment and

field foresight health
Risk Well defined Probabilities of Loss shared among High incertitude Everyone exposed
characteristics performance specific events policyholders
measure (money) considered Causal relationships E.g. spreading
Loss compensated poorly known diseases,
Commensurability Severity of events with money environmental
and comparison of not necessarily impacts of human
15
risks easy compared activities, changes
in the ecosystem
Systems well
defined
Methods Probability Identification Risk profiles Expert elicitation Biosystem models

distribution methods (FMEA, methods
characteristics HazOp, reaction Statistical records
(volatility, VaR…) matrix…) Scenario analysis
Sensitivity measures Probability Precautionary

(“Greeks”) estimation (fault principle
tree, event tree…)
3 Case Studies
This chapter presents four RM case studies compiled by the author based on
articles and publications. The studies are developed to show examples of RM in
practice, the target group being graduate students. The emphasis is rather on
giving practical examples of the use of RM methods in different contexts than
trying to build a proper method tutorial.
To enlighten different views of RM, a cross-section of application fields is chosen.

The cases shed some light on the methods used in finance, process industry,
insurance and health. Although the cases are quite different from each other, they
all have the common basic idea of monitoring and managing unwanted risks. To
support the learning process, the cases are worked into a concise but self-
contained bullet-point format. Comparison of approaches is easy thanks to the
common structure of the case studies.
The cases can be utilised both on introductory and more advanced courses.
Students, who are already familiar with the discussed methods, can attend an
advanced course in RM or read the cases independently without supervision to
obtain a better picture of how the methods are used in practice and which RM
steps need to be carried out. An independent study should take approximately 2 –
4 hours per case study. The cases can also be used in teaching RM methods in
class, either by introducing the methods through the cases together with the basics
of the methods, or serving as motivating application examples. One case study is
estimated to require 90 minutes of lecture time. The cases give also a general
picture of how risks are managed in different fields and which parties are involved
in the process.
Depending on the way of use, students with different backgrounds may profit
from the cases. Basic probability theory and an idea of the key RM concepts give
enough background knowledge, if the cases are complemented with information
about the methods used. However, when a higher level of understanding is
pursued, a broader knowledge background is needed. In the salmonella case, prior
experience on Bayesian analysis and Monte Carlo simulation is recommended. The
electricity case deals with financial risk measures and value tree analysis, and the
16
mining one with fault tree analysis and importance measures. To profit the most
from the pension insurance case, knowledge about portfolio theory, optimisation
and time series are helpful.
After finishing a case study, the student should have a better picture of which risks
are present in the discussed field, how they are managed, which concrete actions
the RM process requires and which parties are involved. The student should have
improved his knowledge about the discussed methods. By studying all four cases,
the student gets an overall view of the application fields and methods of RM and
sees different realisations of the RM process. The student can identify which steps
the RM process requires and gains thus insight into how to approach an RM
problem. He learns which details are relevant and how to choose analysis methods.
With this insight, he will be better prepared if carrying out similar analyses in
practice.
The studies, as well as an introduction to the key concepts of RM, can be found in
pdf-format in the WWW at http://www.sal.hut.fi/Web-Activities/RM/.
3.1 Salmonella Case
3.1.1 Background
The salmonella case describes some of the RM procedures undertaken in Finland

during 1995 – 2001 in order to monitor and reduce the risk of human salmonella
infections transmitted from poultry. Salmonella is a contagious bacterium that can
cause infection via food, animals or the environment (Ranta and Maijala, 2002). A
salmonella infection causes serious sickness, but can be treated by drugs. Fatal
cases are nowadays unusual.
The responsible regulating authority for food production in Finland is the Ministry
of Agriculture and Forestry. In 1995, it set a National Salmonella Control
Programme to limit the number of human salmonella infections obtained from
food. Two of the main interventions of the programme concerning the broiler
production were (i) removal of detected salmonella positive breeding flocks from
the production chain and (ii) heat treatment of the meat from salmonella positive
broiler flocks (Maijala and Ranta, 2004). Without making any formal research,
17
these interventions were assumed to keep the salmonella prevalence on an
acceptable level.
Table 3 Main properties of the salmonella case study.
Application field Salmonella prevalence in the poultry production chain

and transmission to humans.
Decision maker The Finnish Ministry of Agriculture and Forestry
Additional Poultry producers

stakeholders
Consumers
Causes for starting the Evaluation of implemented intervention program needed:

study
1) Examination of effect and appropriateness of the
program
2) Political justification of decisions (government, EU)
3) Research interest
Methodology Bayesian probabilistic inference model, MCMC sampling
Also (not covered in the study): Monte Carlo simulation,

cost-benefit analysis
This study describes the actions made to examine the effect and appropriateness
of the intervention program. From a political point of view the research was
needed for justifying the programme, which was stricter than required by the
European Union. Another motivation is pure research interest. The intervention
program was evaluated by the Department of Risk Assessment at the National
Veterinary and Food Research Institute (EELA) on the demand of the Ministry.
The main components of the evaluation include a human health impact analysis,
cost-benefit analysis (Kangas et al., 2003) and a probability model of salmonella
transmission from broiler grandparents to consumers in Finland (Ranta and
Maijala, 2002; Maijala and Ranta, 2004). To keep the case study within reasonable
18
length, but still maintaining a detailed level, the focus is directed to the first part of
the probability model, the Primary Production Inference Model, handling the
other parts on a very general level. The main properties of the case context are
summarised in Table 3.
3.1.2 Risk Assessment Model
The risk assessment model of salmonella in the broiler production chain consists
of three parts: (i) the Primary Production Inference Model (PPIM), (ii) the
Secondary Production Simulation Model (SPSM) and (iii) the Consumption
Inference Model (CIM), see Figure 4 (Maijala and Ranta, 2004). The PPIM models
salmonella prevalence in the production chain from grandparent breeder flocks to
production broilers ready for slaughtering. The model is based on Bayesian
inference and enables assessment of the direct effects of removal of detected
salmonella-positive breeder flocks. The case study focuses on this part of the risk
model. The SPSM models salmonella prevalence in the secondary production
chain from slaughtering to ready food products and takes into account possible
heat treatment of salmonella-positive meat. This part is based on Monte Carlo
simulation. To find the eventual human salmonella cases a consumption model
using Bayesian inference was created.
Primary Production Inference Model (PPIM)

Removal of detected
positive breeder flocks
Secondary Production Simulation Model (SPSM)

Heat treatment
Consumption Inference
Model (CIM)
Human cases
Figure 4 The basic structure of the risk assessment model of salmonella in the broiler
production chain. Modelled interventions are indicated with shaded boxes. (Maijala and
Ranta, 2004)
19
A simplified presentation of the PPIM is showed in Figure 5. It describes
salmonella prevalence in grandparent, parent and production broiler flocks and
takes into account both vertical and horizontal transmissions as well as persisting
infections within a flock. The parameters and prior distributions of the
probabilistic inference model were assessed using available data and expert
opinions. Probability distributions of salmonella prevalence in production broilers
were calculated under different scenarios. The quantitative results show that
removal of detected salmonella positive breeder flocks from the production chain
significantly reduces the salmonella prevalence of the production broilers. All in
all, the whole salmonella risk model indicates that a combination of both removing
of salmonella positive breeding flocks and heat treatment of contaminated meat
provides the best protection against human infections.
horizontal
persisting Grand- transmission (h)
infection (η) parent
vertical
transmission (v2)
environment
horizontal
personnel
persisting transmission (h)
Parent
infection (η) feeding stuffs
etc.
vertical
transmission (v3)
horizontal
Prod. transmission (h3)
broiler
Figure 5 A simplified presentation of the PPIM. The PPIM models salmonella prevalence
in grandparent, parent and production broiler flocks. Both vertical and horizontal
transmissions are taken into account as well as persisting infections within a flock.
3.1.3 Risk Management Process
The steps of the risk management process in the salmonella case are summarised
in Table 4. The whole case can be considered as an evaluation of implemented RM
solutions, the last step in the iterative RM process. The primary risk covered in the
study is the risk of human salmonella infections transmitted via broiler meat. The
infection probability was evaluated under several scenarios using the transmission
20
model presented in the previous chapter and the effects of two intervention
procedures were assessed. The health impacts of human infections and their
monetary expenses were evaluated in separate studies.
Table 4 The risk management process of the salmonella case.
Risk identification Risk of human salmonella infections from broiler meat and
monetary loss for producers.
Risk evaluation – Salmonella prevalence and transmission with and without

probability intervention program modelled using Bayesian inference and
Monte Carlo simulation models. Model parameters and prior
distributions assessed using available data and expert
opinions. Computations with WinBUGS software, which is
based on Markov Chain Monte Carlo (MCMC) simulation,
Matlab and @RISK (Monte Carlo simulation).
Risk evaluation – Analysis of health impacts due to human salmonella

consequence infections (not covered in the case study).
Cost and benefit analysis (not covered in the case study).
Development and Analysis of the effects of two interventions on salmonella

evaluation of RM prevalence in the poultry production chain and on the
methods number of infected humans. Interventions:
1) Removal of detected salmonella-positive breeding flocks.
2) Heat treatment of contaminated broiler meat. (Not covered

in the study.)
RM decisions The intervention program continues with only minor

modifications and specifications.
Evaluation of -
implemented RM
solutions
21
3.1.4 Lessons from the Case
The most important observations and conclusions from the salmonella case are:
• Transmission of salmonella from poultry meat to humans is a risk that all

poultry meat consumers are faced with. Most of us have no means to
control the risk, which is largely determined by procedures in the
production chain. Therefore, the Ministry of Agriculture and Forestry has
set a National Salmonella Control Programme, which specifies a set of risk
reducing activities to be followed in different stages of the production
chain.
• In this case study, the effect of two interventions of the salmonella

programme was evaluated. Evaluation of implemented RM solutions is an
important task for determining if the solutions serve the needs and if any
changes should be carried out. In this case, the evaluation was also needed
to justify the programme, which is stricter than required by the EU.
• When designing a risk assessment model, the points of interest and

available information of the system largely dictate the design process.
Information about the salmonella prevalence in the primary broiler
production chain was only received through indicative tests, not revealing
the whole truth. The data being quite scarce, it was inevitable that some
human judgements had to be incorporated. The aim of the model was to
be able to assess the effect of removal of detected salmonella positive
breeder flocks from the production chain, both in current situation and in
some fictional scenarios. Therefore, a Bayesian inference model enabling
studying of directly unobservable variables as well as combining of data
and expert opinions was a natural choice.
• Bayesian inference models are often computationally demanding, but this

challenge was overcome in the case with a software called WinBUGS
(Bayesian Inference Using Gibbs Sampler), based on Markov Chain Monte
Carlo simulation (MCMC). The software is freely available at
http://www.mrc-bsu.cam.ac.uk/bugs/.
• The risk assessment showed that both interventions (flock removal and
heat treatment of contaminated meat) were effective in reducing the
number of human salmonella cases and that the best result was received by
22
combining them. Thus, the process did not result in any major changes in
the programme.
3.2 Electricity Retailer Case
3.2.1 Background
The electricity retailer case describes the selection of appropriate RM methods for
a mid-sized electricity retailer. An electricity retailer faces risks from numerous
sources, including e.g. different market, volume and credit risks. To manage them
in the daily operative actions, the RM specialists and traders need a set of analysis
methods giving enough information. The selection of appropriate RM methods
and setting rules for their usage is therefore a vital part of a company’s risk
strategy. The implementation involves acquiring of new software customised for
the company’s needs, installation into the computer system and training of the
staff. This makes the process costly and means that the decisions must be made
with an at least 5 – 10 years time horizon.
This study describes the development and implementation of a value tree based
framework (Keeny and Raiffa, 1976) for choosing RM methods. The framework is
developed by an RM IT-systems provider in collaboration with prospective end
users. In the model, the main criteria for selecting RM tools are their (i)
information utility, (ii) costs and (iii) usability. Traditional value tree analysis
requires the decision makers to give precise preference statements as well as
precise information about the options, which this was considered to be too an
ambitious task. Thus, a novel method for giving imprecise information was used,
Rank Inclusion in Criteria Hierarchies (RICH) (Salo and Punkka, 2004; Liesiö,
2002) developed at the Systems Analysis Laboratory at Helsinki University of
Technology. The main properties of the case context are summarised in Table 5.
23
Table 5 Main properties of the electricity retailer case study.
Application field Selection of RM methods for an electricity retailer
Decision maker Management of the electricity retail company
Additional stakeholders Electricity retail company staff
IT-provider
Causes for starting the Need to implement new RM methods

study
Methodology Value tree analysis, Rank Inclusion in Criteria

Hierarchies (RICH)
3.2.2 Value Tree Framework
The selection of a set of RM methods can be seen as a trade-off between RM costs

and adverse event costs. The methods must give enough information about risks,
be easy to use and flexible enough to meet the needs of the company’s potentially
changing business environment. In addition they must be cost-efficient. The value
tree framework used in the evaluation is shown in Figure 6. The main decision
criteria, sub-goals, are information utility, method costs and usability. These are
concretised by measurable attributes.
24
Accuracy
Measurement of Intuitiveness
extreme risks
Coherence
Attribution
capability to risk Robustness
factors
Information utility Accuracy
Measurement of
total normal risks Intuitiveness
Attribution Coherence
Method costs capability to pf.
components Robustness
Comparison - Implementation
attributes for RM - Introduction Measurement of Accuracy
methods - Usage sensitivity of risk
- Maintenance to changes in Intuitiveness
Flexibility
parameters and
Coherence
variables
Timeliness
Robustness
Usability Authority
Intuitiveness /
Simplicity /
Transparency
Figure 6 The value tree model. (Ojanen et al., 2004)
Combinations of six RM methods were evaluated:
1. Position reporting
2. Deterministic scenario analysis
3. Sensitivity analysis (greeks)
4. Variance-covariance Value at Risk (VVaR)
5. Simulated Value at Risk (SvaR)
6. Maximum loss model (ML)
Because the value of information of these methods is not additive, the methods
were evaluated in conjunction as collections of methods. Using the evaluation
framework, potentially good combinations were identified and eventually
implementation strategies were suggested. It was concluded that position reporting
should be implemented first, because of its low costs and ability to give basic risk
information. It should be followed by scenario analysis due to its cost-efficiency.
25
In the third phase a decision between simulation VaR, variance-covariance VaR or
Maximum Loss should be made.
Table 6 The risk management process of the electricity retailer case.
Risk identification An array of financial risks (market, volume, operational,

credit and counterparty, system, political)
Risk evaluation – The task is to choose methods for risk evaluation.

probability
Risk evaluation – -
consequence
Development and A thorough value tree –based evaluation of collections of

evaluation of RM potential RM methods, based on their
methods
1) Information utility
2) Costs
3) Usability
RM decisions Sequential implementation of RM methods suggested:
1) Position reporting
2) Scenario analysis
3) Decision between VaR, variance-covariance VaR and

Maximum Loss
Evaluation of -
implemented RM
solutions
26
The different steps of the RM process of the case are summarised in Table 6. The
risk identification is not too a demanding task since the main risk drivers in the
electricity field are well known. As the task of the case was not to deal with daily
RM of the operative activities but, rather, to select tools for it, no actual risk
evaluation was done. On the contrary, the study focused on the development and
evaluation of RM methods. Because the main challenge was to compare different
solutions, a value tree framework was used. The process did not result in any real
decisions as such, but gave suggestions which methods to consider. As no RM
methods were implemented yet, an evaluation of their performance in action could
not be done. However, it is an important task to be performed in the future.
The most important observations and conclusions from the electricity case are:
• Electricity retailing entails considerable monetary risks, which in many

respects are similar to those in other trading activities. However, the non-
storability of electricity sets its own flavour to the situation.
• There are many financial risk analysis tools well suited for electricity
companies.
• While usage of the analysis tools is a part of the every day work of the risk
management specialists, choosing a suitable set of risk analysis methods
for the company is a strategic decision with a several years time horizon.
Changing the set of methods is both costly and time consuming, because
any analysis solution available on the market must be customised to fit the
needs and IT-system of the company and the personnel must be trained to
use the new software.
• When there are many available analysis methods, whose properties in

respect of e.g. information value and costs are more or less known,
decision analysis tools can be successfully used to clarify the needs of the
company. The objectives of the company were structured using a value
tree model. The elicitation of weights for the sub-goals forced the decision
makers to consider the RM method selection in a rational manner and not
base the entire decision on intuition solely. However, as assessment of
precise preference statements was seen to be too a demanding and even
27
unrealistic aim, a method called RICH was used, enabling the use of
imprecise preference statements.
• When searching a suitable set of risk analysis tools, the candidates cannot
be evaluated in isolation one by one, because of the partial overlap of the
risk information given by the different methods. Thus, the value gained by
utilising a new method depends on the methods already in use. This
obstacle was overcome by considering the methods in sets.
• Using the RICH method, it was possible to identify potentially good

combinations and eventually a three-step implementation plan was
recommended.
3.3 Mining Case
3.3.1 Background
The mining case describes a reliability assessment of a safety system of an undersea

mine using fault tree analysis (Andrews and Moss, 2002). Air ventilation is
important in mines; its main function is to dilute mine gases and dust
concentration and to maintain reasonable working temperature. Conventional
ventilation methods approach their practical limits when the undersea working
goes further than 10 km from the shafts. To overcome this problem, air
recirculation is used to boost the ventilation capacity. However, the recirculation
has its own risks and must be shut down in abnormal situations, e.g. in the case of
fire. Therefore the safety authorities require a safety system with environmental
monitoring and automatic control systems in mines with air recirculation. In this
case study the reliability of such a safety system is assessed using fault tree analysis.
The main properties of the case context are summarised in Table 7.
28
Table 7 Main properties of the mining case study.
Application field Quantitative safety assessment of the ventilation

recirculation system of an undersea mine
Decision maker Management of the mining company
Additional Safety authorities

stakeholders
Miners
Causes for starting 1) Required by safety authorities

the study
2) Safety and monetary concerns
Methodology Fault tree analysis
3.3.2 Safety Assessment of Air Recirculation System
A schematic picture of the air recirculation system is shown in Figure 7. The

recirculation fan transporting air from the return roadway back to the intake must
be automatically shut down in certain abnormal situations. The monitored critical
properties are:
• Methane entering the mine from the ground. High methane levels
constitutes a sever fire risk.
• Carbon monoxide, which is a reliable indicator of fire (monitored at two

locations).
• Air recirculation factor (must not be too high, due to regulations)
• Fan vibration
• Activation of water curtain (fire control)
29
• Emergency stop buttons
Whenever one of the monitored properties satisfies its trip condition, the
recirculation fan should stop. This system can fail in two ways: (i) to fail to shut
down the recirculation fan when a trip condition is fulfilled or (ii) to switch off the
fan when no trip condition is fulfilled. The former is more critical and may have
severe health impacts. Although the latter is less critical, a spurious fan stoppage is
inconvenient, deteriorating the conditions in the mine due to high dust and heat
levels.
Air recirculation (Methane monitor)

(CO monitor)
(Pressure monitor)
Figure 7 The air recirculation system. (Andrews and Moss, 2002)
Fault trees were constructed and quantified for both failure modes. The system
was divided into eight sub-systems according to different trip conditions, which
resulted in a total of 16 fault trees. As an example of the trees, Figure 8 shows the
fault tree for unrevealed failure in one of the carbon monoxide detection systems.
30
2
Figure 8 The fault tree for unrevealed failure in one of the carbon monoxide detection
systems. (Andrews and Moss, 2002)
The different steps of the RM process of the case are summarised in Table 6. The
two failure modes of the system discussed in the previous chapter are easy to
identify. Risk drivers causing the failures were identified using failure mode and
effect analysis (FMEA) (Andrews and Moss, 2002). This part was not, however,
covered in the case study. The security system consists of a structured collection of
components that, in general, fail independently of each other. Some of the
components may shut down the system by themselves, while others cause a
malfunction only in conjunction with other component failures. Fault tree analysis
is a powerful tool in situations like this. A fault tree structures basic failures in a
tree-like manner, with logical gates describing their logical relationships. The
system failure probabilities, as well as the effects of suggested modifications, were
31
assessed by fault trees. The analysis lacks, however, a formal assessment of the
consequences of a system failure. It was only stated that failing to detect high
levels of methane or carbon monoxide were the most critical failures, and thus the
safety improvement study was focused on measures that would improve the
reliability on these fields. The reliability assessment concluded that the system
reliability was at a fairly good level. However, if improvements were needed, the
most effective action would be shortening of inspection intervals of the methane
and carbon monoxide monitoring systems.
Table 8 The risk management process of the mining case.
Risk identification Two failure modes:
1) Safety system unable to function on demand
2) Spurious (gratuitous) activation of the safety system under

normal, healthy conditions
Failure mode and effect analysis (FMEA) (not covered in the

case study)
Risk evaluation – A thorough fault tree analysis of the safety system. System
probability failure modelled as combinations of specific component
failures. Component failure rates assessed using general
component failure databases and maintenance records, repair
times estimated by engineers at colliery. System reliability was
concluded to be on a reasonable level.
Risk evaluation – No formal consequence evaluation made. Failure to detect

consequence high methane or carbon monoxide levels most critical of the
studied failures.
32
Development and Three safety improvement strategies considered and evaluated
evaluation of RM using fault trees:
methods
1) Variations in system design
2) Inspection interval changes (maintenance)
3) Shortened repair times
RM decisions Should safety improvements be necessary, best effect is

attained by shortening the inspection intervals of the methane
and carbon monoxide monitoring systems.
Evaluation of -
implemented RM
solutions
The most important observations and conclusions from the mining case are:
• The authorities try to improve workers’ safety in mines by demanding the

use and evaluation of certain safety systems. In order to make sure that the
mining companies do not jeopardise the miners’ lives by saving money in
wrong places.
• From a systems’ reliability point of view, a safety system is very similar to

other systems in the process industry for which there are well established
analysis methods available. In analysing the reliability of a well defined
system of independently failing components, fault tree analysis is a
powerful tool.
• For many components used in industry, general component failure

databases are available. For more specialised components, reliability
estimates must rely on internal maintenance records or estimates given by
33
the component suppliers. In some cases, the only way to find information
is to interview experienced working personnel.
• A safety assessment is benefited most when performed in the planning

stage of the system because the potential structural changes are
considerably easier to do. As the safety system in this case study was
already installed, it ruled out major structural changes as financially non-
realisable.
• The best safety improvement turned out to be shortening of the

maintenance intervals of certain important components that, in contrast to
the majority of components, do not fail safe7. Safety improvements do not
always require improvements of the system itself. Sometimes well directed
changes in maintenance procedures are more efficient.
3.4 Pension Insurance Case
3.4.1 Background
The pension insurance case gives a presentation of the main risks a Finnish
pension insurance company is facing and how they are managed. It also presents a
new stochastic programming approach to asset allocation, with a vital role in the
management of investment risk. The model has been developed by researchers at
Mutual Pension Insurance Company Ilmarinen and Helsinki School of Economics
(Hilli et al., 2004). The main properties of the case context are summarised in
Table 9.
The main activities of a mutual pension insurance company are underwriting

business and investment. The most important function of the company is, of
course, to pay pensions to retired employees. To finance the pensions, the
company raises pension contributions from its policyholders, i.e. the employers
and employees. Yearly pensions are partly financed by contributions paid during
the very same year and partly by assets accrued from earlier contribution
payments. Thus, the pension insurance companies hold substantial investments
7 The conclusion depends on the component failure model used.
34
needed for future pensions. A part of the surplus from the investment activities is
paid back to the policyholders as bonuses.
Table 9 The main properties of the pension insurance case study.
Application field Pension insurance, investment asset allocation
Decision maker The Company
(The Ministry of Social Affairs and Health)
Additional stakeholders Finnish pension insurance policyholders
Causes for starting the Improving models for strategic investment allocation
study decisions
Methodology Stochastic programming
3.4.2 Main Risks of a Pension Insurance Company
The risks of the underwriting business are linked with the sufficiency of the
company’s pension contribution incomes and technical reserves to cover present
and future pensions. The technical reserves are minimum requirements for the
company’s assets and correspond to the present value of future pension
expenditures. In the long term, the main risk factor is the uncertainty associated
with life expectancy, affecting the length of old-age pensions. The uncertainty
associated with pension starts and sizes are the main short term risk factors (see
Figure 9). The companies are obliged to monitor and control the risks of uncertain
future pension expenditures.
In Finland, the pension insurance business is quite strictly regulated. The pension
contributions are common regardless of company as set by the Ministry of Social
Affairs and Health. Shortfall in the underwriting business within one company will
ultimately affect the policyholders in form of smaller or no bonuses, while
systematic shortfall in all pension insurance companies results in raised pension
contributions.
35
Risks of a
mutual pension
insurance company
Underwriting Investment
business risk activities risk
Length of pensions (life Market risk

expectancy)
Number of Counterparty
pension starts risk
Size of Liquidity
pensions risk
Exchange rate
risk
Figure 9 Main risks of a mutual pension insurance company.
The main risks of the investment activities are market, counterparty, liquidity and
exchange rate risks (see Figure 9). Market risk is managed by diversifying between
different asset types, countries, sectors and companies. Pension insurance
companies may allocate the assets in cash, bonds, stocks, real estate and loans to
policyholders. The allocation mix affects the risk as well as the expected return of
the investment portfolio. Counterparty risk is managed by analysing the
creditworthiness of bond issuers and by limiting investments in one issuer’s bonds.
Guarantees are also used to secure the investments. Liquidity risk can be managed
easily since pension expenditure can be accurately forecast. Exchange rate risk is
controlled using derivatives (Figlewski and Levich, 2002; Hull, 2002; Luenberger,
1997).
The value of the assets of a pension insurance company must always exceed the
technical reserves. The Ministry of Social Affairs and Health has set several target
values and borders for the solvency capital, i.e. the excess of investments over the
technical reserves. The target values taking into account the amount of money
invested in different asset types are meant to secure the value of the investments
from falling below the technical reserves. The challenge in the allocation of assets
36
is to pursue maximum revenue under prevailing market conditions in order to be
able to pay bonuses to policyholders. In the same time, the solvency capital must
be secured in the target zones set by the Ministry.
3.4.3 Stochastic Programming Model for Asset Liability Management
Researchers at Mutual Pension Insurance Company Ilmarinen and Helsinki School

of Economics have developed a new stochastic programming model to support
the strategic asset allocation decisions of a pension insurance company (Hilli et al.,
2004). In the multistage model decisions about e.g. asset allocation and bonus
payments are interlaced with observations of random variables such as asset
returns. The investment decisions for each time period are optimised with the help
of the model in order to maximise a target utility function. The function takes into
account the size of the solvency capital and bonus payments at each stage as well
as the fulfilment of the target levels for the solvency capital given by the Ministry.
The underlying random econometric factors are modelled using a Vector
Equilibrium Correction (VEqC) time series model, a generalisation of Vector
Autoregression (VAR) models. In addition, to the observed history of the
modelled econometric factors, the VEqC model contains user specified
parameters, enabling the incorporation of expert opinions concerning long term
equilibria and current trends.
The pension insurance case does not describe a distinguished fulfilment of a risk
management process as such, but rather depicts the current risk situation in
pension insurance companies and introduces the idea of a new asset allocation
model. Therefore, it is not meaningful to conclude this case as in the other cases
using the RM process framework. Instead, the case is summarised by listing the
key points regarding risk management in a pension insurance company in general
and regarding the presented stochastic programming model.
Risk management in a pension insurance company
• The main activities of a pension insurance company are underwriting

business and investment of capital. Pension insurance companies hold
substantial financial investments, because pensions are partly funded in
advance.
37
• The main risks of the underwriting business are related with the average
length of pensions as well as pension starts and sizes. The insurance
portfolios of the major companies are so large that reinsurance is not
justifiable financially. As a result of regulations and governmental
guarantees, the underwriting risks of a pension insurance company are
ultimately carried by policyholders and the Finnish taxpayers.
• The main investment risks are market, counterparty, liquidity and exchange
rate risks, the most significant one being the market risk. It is managed by
diversifying between different types of assets (cash, bonds, shares, real
estate and loans to policyholders) and within each asset type by country,
sector and company. The asset allocation mix affects both the return
expectations and the risk level of the portfolio.
• With the purpose of securing the employers’ future pensions, the Ministry
of Social Affairs and Health restrict financial risk taking of pension
insurance companies by setting target zones for their solvency capital. The
most important of the limits, the solvency border, includes a buffer that, in
theory, corresponds to the one year 97.5% Value at Risk of the investment
portfolio. By placing money in less risky asset types (e.g. bonds), a
company can lower the solvency limits.
Stochastic programming model
• The strategic investment decisions of a pension insurance company can

successfully be modelled with a multistage stochastic program as a
sequence of decisions interlaced with a sequence of observations of
random variables.
• The model considered in the case results in a nonlinear (convex)

optimisation problem, where the discounted cumulative utility of the
company reflecting its values and goals is optimised. The function takes
into account returns, bonus payments to policyholders and staying within
the target zones set by the Ministry of Social Affairs and Health. The
constraints consist of facts and limitations concerning inventory, budget,
portfolio weights and transactions as well as statutory regulations. The
economic factors, considered as random variables, are modelled by a time
series model called Vector Equilibrium Correction (VEqC). It enables the
combination of statistical information and expert views about growth rates
38
and long-term equilibria. The approach is especially well suited when the
available data displays characteristics that are believed to change in the
future.
• With the support of the model, the company can plan its strategic
investment actions such that it efficiently utilises the profitability potentials
of the investments without exceeding the risk limits.
39
4 Comparative Analysis of the Cases
The four case studies presented in chapter 3 give examples of different kinds of
risks in different fields and organisations and present methods for managing them.
Both similarities and dissimilarities can be found in the case studies, deriving from
their different characteristics. In the following, the cases are compared, aiming to
capture causal relationships between different case properties and to find general
RM guidelines.
4.1 Risk Influence and Decision Makers
Rescher (1983) proposes a classification of risks in terms of agents and those

influenced by the risk (see Table 1, page 6). The salmonella and pension insurance
cases are similar in this respect: The activity of a small group (parties in the broiler
production chain and pension insurance company staff) affects almost the whole
nation (broiler consumers, tax-payers; policyholders, tax-payers). Thus, it is natural
for the government to have the power and interest to act as a “risk manager”, at
least to some extent. In Finland, these activities are handled by the Ministries and
the primary ways of action are to impose regulations and statutory restrictions.
Thereby, the Ministry makes the actors on the field to follow certain best practises
and limits the possibility of unhealthy risk taking. The risk influences and decision
makers of the cases can be seen in Table 10. The table supports the intuitive
conclusion that the government seeks to limit risk taking in cases with nationwide
ubiquity and at least partly other-directed risks.
In the salmonella case, the Ministry of Agriculture and Forestry tries to protect
people from salmonella infections originating from broilers. It obliges the actors in
the broiler production chain to follow certain procedures found to reduce
effectively the probability of contaminated meat. The consumers do not only
benefit from the risk management, but also pay a part of the costs. Thus,
redundant risk management is not in the public interest. However, in this case, the
ordinary consumer does not probably worry too much about the rise in consumer
prizes: The National Salmonella Control Programme is estimated to cost 0.02 €/kg
of broiler meat produced (Kangas et al. 2003).
40
Table 10 The instance making RM decisions depends on the ubiquity and influence of the
risk.
Salmonella Energy Mining Pension

insurance
Ubiquity National Within Workers in the Policy holders,

company mine Finnish tax
payers
Risk Both self- and (Wholly) (Wholly) self- Both self- and
influence other-directed self- directed other-directed
directed
Decision Ministry of Company Company Ministry of

makers Agriculture and Social Affairs
Forestry Health and and Health
Safety
Executive Company
Level of Fairly high Low Intermediate High

regulation
In the pension insurance case, the Ministry of Social Affairs and Health wants to
make sure that the companies are able to fulfil their obligations towards present
and future pensioners and that every employee is served on equal terms. The
Ministry has set up regulations on how to calculate the amount of assets needed
for future pension payments (the technical reserves) and how large buffer the
companies should have (solvency border) to secure themselves against fluctuations
in the value of their investments. These regulations form, however, only a set of
minimal requirements for the company; every properly run pension insurance
company have their own risk management functions which aim to run the
company as profitably as possible while maintaining a reasonable risk level.
In the mining case, Great Britain’s Health and Safety Executive requires security
control systems in mines with air recirculation systems. Although the possible
health impacts affect only people within the mining company, the miners do not
decide about the safety actions themselves and therefore, it is natural that the
miners’ safety is guarded by an external body.
41
In contrast to the other cases, the electricity company carries its risks mainly alone.
In situations like this, no strict governmental regulations are needed. The firm can
manage the risks itself in the most suitable way. If something goes wrong, it can
only blame itself and no innocent people are hurt.
4.2 Type of Loss
The type of possible loss sets its own flavour to the analysis and management of
risks. From a technical point of view, it is easier to handle with monetary loss than
damage concerning e.g. human health or the nature. In the case of monetary loss,
as we see in the energy and pension insurance cases, the loss is well defined and
the expenses of undesired events and preventive measures are easily
commensurable. When everything is measured in monetary terms, it makes sense
to use probability distributions and covariances as well as sensitivity measures like
Value at Risk and partial derivatives to describe the situation.
When dealing with health issues, as in the salmonella and mining cases, it is not
always obvious how to measure loss and how to compare different expenses and
health hazards. In such cases, values and opinions play a greater role and plain
numbers and probability distributions should be used more carefully. Although it
is for several reasons seldom outspoken, the question “What is the monetary value
of human life?” often underlies precautionary security decisions. Political and
industrial leaders are careful not to address the question in public, because of the
emotionally charged debates it would evoke. Still, it is often possible to estimate
the number of lives saved by a preventive security investment. Thus, the decision
maker implicitly values the expected saved lives. In the cost-benefit analysis of the
salmonella case, the monetary value of a death caused by salmonella is derived
from data calculated for alcohol-induced deaths (Kangas et al., 2003), whereas the
mining case does not address the valuing issue.
4.3 Modelling of Probabilities and Interrelationships
In the cases different approaches to modelling probabilities and relationships can

be seen. Different models are chosen depending on the nature of the interrelations
and on the available data and knowledge (see Table 11).
42
The primary prevalence inference model in the salmonella case uses Bayesian nets
for modelling the relationships between variables. The probability distributions are
estimated by combining expert judgements and available data in a Bayesian
manner. This is a natural selection since the unknown quantities (e.g. true
prevalence) are represented by stochastic variables, but cannot be directly
observed. Using information about related observable indicators, conclusions
about the underlying variables can be made. On the other hand, in the secondary
production model of the same case, Monte Carlo simulation is used. It is a simpler
model for “forward simulation” which does not allow inference, i.e. probabilistic
learning “backwards” (Maijala and Ranta, 2004).
Table 11 The RM methods to be used are chosen on the basis of the characteristics and
focus of the problem as well as the available knowledge.
Salmonella Energy Mining Pension

insurance
Characteristics • Interrelated • Variation • Simultaneous • Variation in

of uncertainty infection of market failure of revenue and
variables rates statistically dividend for
independent different
• Unknown components asset types
infection
rates and • System
test structure
sensitivity well defined
and known
Data • Some data • Track • Maintenance • Time series

available for records records of economic
indirect factors
indicators • General
component • Expert
failure opinions
databases
43
Expert opinion Prior Inputs to Some Economic
distributions the value maintenance equilibria and
tree (scores estimates trends
and
weights)
Main Risk Selection of Risk Strategic asset

challenge assessment risk assessment allocation
and assessment and evaluation decisions
evaluation of tools of preventive
preventive among measures
measures several
candidates
Method used • Bayesian • Value tree • Failure tree • Stochastic

inference analysis analysis programming
model
• Monte
Carlo • Regulations
simulation and statutory
restrictions
The mining case shows how fault trees can capture the relationships in a network
of independently failing components. Most of the input probabilities in the model
are derived from the data in a frequentist manner, whereas others are estimated in
quite an ad hock way by maintenance personnel. For modelling variation in market
rates and portfolio values, quite established methods exist. As the uncertain
quantities form sequential series, forecasting utilises often time series models such
as ARMA (Autoregressive Moving Average) and GARCH (Generalised
Autoregressive Conditional Heteroscedastic). In the pension insurance case, the
econometric factors that serve as inputs to the asset valuation model are forecast
using a Vector Equilibrium Correction (VEqC) model, a generalisation of Vector
Autoregressive (VAR) models. The model contains manually fixed parameters (e.g.
drift factors), enabling the use of expert knowledge in order to better forecast
patterns not derivable from historical data.
The risk management problem is slightly different in the electricity case: an array
of risk analysis methods exists for monitoring electricity related risk. Every method
44
gives a slightly different view of the situation; usability and cost of use vary also.
Since the characteristics of the methods are well known the challenge is to find a
set of methods that best fits the needs of the company. This calls for the use of
multiple criteria decision analysis (MCDA) methods, and the decision problem is
indeed tackled with value tree analysis.
4.4 Guidelines for Selection of Probability Assessment

Method
A certain amount of information is needed to be able to assess probabilities and

other inputs for a risk assessment model with a reasonable accuracy. If the needed
information is not available, any attempt to estimate the probabilities would be
inaccurate. In such cases, alternative approaches, such as scenario analysis and the
precautionary principle must be considered (Harremoës et al., 2002; Klinke and
Renn, 2002; Renn and Klinke, 2001; Stirling, 2001). The needed information can
be either qualitative, in form of human experience and opinions, or quantitative,
e.g. in form of historical track records. The two information types are somewhat
complementary: If extensive representative data is available, expert opinions are
barely needed. When firm expert knowledge is present, the estimations can be
done even if there is little or no data available.
In the case studies presented in this thesis, different methods for assessing
probabilities have been used. In general, the selection of the assessment method
depends on the proportions of available representative data and expert knowledge.
A rough division is presented in Figure 10. If very little data is available, but
experts have knowledge and experience about the phenomena, the most suitable
approach is to use some expert elicitation method (Ayyub, 2001; Cooke, 1991;
Hora and Iman, 1989; Keeny and von Winterfeldt, 1991; Porthin et al., 2002). If
more data is available, but not quite enough to solely rely on, methods that
combine opinions and data are used. The most recognised and theoretically
justified of these is the Bayesian methodology, where prior distributions, often set
using expert knowledge, are updated using available data. The beauty of the
Bayesian approach is that after making the needed model assumptions, all results
can be derived using available observations and well-established probability rules
only. The disadvantage is the requirement of significant computational resources.
If sufficient data regarded as representative is available, expert opinions become
redundant and probabilities are most efficiently estimated in a frequentist manner.
45
This does not mean that the Bayesian approach would be incorrect in any way.
However, the frequentist approach is computationally less demanding and results
in the more or less same outcome. Stirling (2001) suggests a similar guideline for
method selection in his outline of different levels of incertitude, but does not
recognise the use of expert elicitation methods.
Expert opinions
Data
Method for Expert Bayesian Frequentist

probability elicitation probabilities probabilities
assessment: methods and other
combination
methods
Figure 10 Selection of probability assessment method depends on the availability of data

and expert knowledge.
If a sequence of stochastic variables forms a time series, as in the pension

insurance case, then this property should of course be utilised. It is recognised that
historical data does not fully explain the behaviour of the variables and that expert
opinions could improve the forecasts. Thus, the problem is situated in the middle
section of Figure 10. Indeed, the VEqC model combines observed sequences of
the variables with expert opinions regarding trends and long term equilibria.
4.5 Types of Risk Management Decisions
As described in Section 2.3 on page 12, risk management decisions can be

categorised as avoidance, acceptance, compensation, transfer or reduction. The
cases show examples of all of these, except avoidance (see Table 12). The absence
of examples of risk avoidance does not mean that it is never used; it is just that
simple a means that a case study describing it would be uninteresting. When
talking about risk management, most people first think about risk reduction, i.e.
46
controlling the severity of a risk by reducing its probability or impact. This means
is seen in all case studies. In the salmonella case, the probability of human
salmonella infections is reduced by various interventions. The risk impacts of the
investment activities of a pension insurance company and an electricity retailer are
reduced by setting risk limits. The impacts of abnormal situations in the mine are
reduced by installing a safety monitoring system and the probability of its
malfunction is assessed and reduced, if needed, by shortening the maintenance
intervals.
Table 12 Types of RM decisions.
Salmonella Energy Mining Pension insurance
Reduction: Compensate: Reduction: 1) Accept:

Salmonella Hedging Impact of abnormal Underwriting risks
probability situations reduced accepted
reduced using Reduction: with safety system. 2)
interventions Risk limits Probability of safety Compensate: Credit
system malfunction risk hedged
reduced.
Transfer: 1)
Pensions guaranteed
by the state 2) Risk
transfer by adjusting
bonuses and
insurance premiums
Reduction:
Investment risk limits
As already stated in the categorisation on page 12, risk compensation is common

in finance. Hedging is used in the electricity retailer and pension insurance cases to
compensate the unwanted impacts of changing electricity prices or exchange rates.
Hedging is only possible when a compensating risk is available behaving in the
opposite way to the original risk, i.e. is (perfectly) negatively correlated. Another
requirement is that the outcomes of the risks can really compensate each other.
Therefore, compensation is not present in the other cases involving risks without
upside potentials and health issues that are hard to compensate.
47
Although not explicitly reported, risk acceptance is definitely practiced in all cases,
as it is the only rational response to insignificant risks. Risk bearing and acceptance
is the core function of insurance companies making money by taking others’ risks
on their behalf. This is also the case in the pension insurance study for the
uncertainties concerning pension payments. A part of the company’s risks are
although transferred to employers, employees and Finnish tax payers through
pension guaranties given by the state (in case of bankruptcy) and adjustments of
insurance premiums and bonus payments.
48
5 Conclusions
This thesis presented four RM case studies compiled by the author. The aim was
to develop studies that describe the steps of the RM process and give examples of
methods used on different fields. The target group was university level students
with basic knowledge in operations research and risk analysis wanting to learn how
risks are managed in practice. A comparison of the cases resulted in several
observations and conclusions of dependencies of risk characteristics. Some general
guidelines for choosing probability estimation methods in different risk evaluation
situations were drawn, too.
The cases support the intuitive assumption that the level of regulatory RM
depends on whether the risk affects also others than the ones causing it and on the
ubiquity of the risk. The regulatory bodies regard the protection of people under
risk without being able to affect the situation themselves as their duty.
The RM approaches differ from field to field. The differences depend not only on
the modelling properties of the phenomena and the type of loss but also on the
traditions in each field. When the potential loss is purely financial, the monetary
loss is considered as a stochastic variable whose probability distribution is sought.
The risk is described using distribution characteristics such as volatility and VaR,
as well as various sensitivity measures. From a mathematical point of view, the
situation is quite similar to the salmonella case, but instead of money, the interest
was focused on the number of human salmonella infections. However, despite the
similarity, the risk was presented only by showing the estimated distribution
function and giving the median and the confidence interval. It would be interesting
to apply the financial risk measures in this kind of situations. Measures like
“Health at Risk” and those of sensitivity to changes in underlying factors could
give yet another point of view of the risk.
When the risk cannot be inherently modelled as a stochastic variable, analysis

focuses usually on estimating the probability of certain loss scenarios. The possible
causes of the loss are identified and the probabilities estimated using them.
49
A general rule for choosing a probability estimation approach according to the
amount of available data and expert knowledge was proposed. If enough
representative data is available, a frequentist approach is the most efficient one.
On the contrary, when expert opinions are needed for further insight, Bayesian
approaches are appropriate. Finally, if hardly any data is available, expert elicitation
methods are suitable. A similar distinction between frequentist and Bayesian
methods was presented by Stirling (2001), but he did not acknowledge the use of
expert elicitations. In many cases, there just is not enough available information to
perform an informed probability and risk assessment. In such cases, application of
a formal risk assessment method will most probably result in biased results.
Instead, scenario analyses and precautionary principles should be applied.
The main purpose of risk analysis is to serve as a basis for risk informed decisions
and actions. One of the objectives when developing the cases was to depict the
whole RM process from risk identification to decisions and evaluation of actions.
This goal was best achieved in the salmonella case. It showed that a risk
assessment does not always result in significant changes, but may as well confirm
the appropriateness of current practices.
Different types of management actions are suited in different risk situations. Risk
reducing activities, either by lowering the probability of losses or limiting the
potential damages, were observed in all cases. Risk compensating, or hedging, and
setting risk limits are important tools in finance. The main idea in insurance
business is not to reduce the risk, but to transfer it to a party willing to accept part
of the risk. A successful company uses all five strategies (avoidance, acceptance,
compensation, transfer and reduction) to manage its risks.
The current trend in risk management is to aim at a holistic approach taking into
account also the correlations and interdependencies of an organisation’s risks
instead of independent risk management of different sectors. This is a challenge
for RM professionals, demanding high modelling skills as well as the ability to
comprehend and manage large complex systems.
50
6 References
Andrews J. D. and Moss T. R. (2002): Reliability and Risk Assessment. Second

Edition. Professional Engineering Publishing Limited, London and Bury St
Edmunds, UK. ISBN 1-86058-290-7.
Ayyub Bilal M. (2001): Elicitation of Expert Opinions for Uncertainty and Risks. CRC
Press. ISBN 0-8493-1087-3.
Ballard G. (1993): Guest editorial: Societal risk – progress since Farmer. Reliability and
System Safety, Vol. 39, pp. 123-127.
Bernstein Peter L. (1996): Against the gods: The remarkable story of risk. John Wiley &
Sons, Inc. USA. ISBN 0-471-29563-9.
Bunn Derek W. (1984): Applied Decision Analysis. McGraw-Hill, Inc. ISBN 0-07-
008292-8.
Cooke R. M. (1991): Experts in Uncertainty. Opinion and Subjective Probability in Science.

Oxford University Press, Inc. New York.
Crouhy Michel, Galai Dan and Mark Robert (2001): Risk Management. McGraw-
Hill. ISBN 0-07-135731-9.
Farmer F.R. (1967): Siting criteria – a new approach. IAEA SM-89/34; reprinted in
Nuclear Safety, 8 (1967) 539-48.
Figlewski Stephen, Levich Richard M. (eds.) (2002): Risk Management. The State of the
Art. Kluwer Academic Publishers. ISBN 0-7923-7427-4.
Garvin David A (2003): Making the Case: Professional education for the world of practice.
Harvard Magazine, September-October. Volume 106, Number 1, Page 56. Online:
http://www.harvard-magazine.com/on-line/090322.html, visited 25.05.2004.
51
Greene Mark Richard (1983): Risk Management: Text and Cases. Brady ISBN
0835967360.
Haimes Yacov Y. (1998): Risk Modeling, Assessment, and Management. John Wiley &
Sons, Inc. USA. ISBN 0-471-24005-2.
Harremoës Poul, Gee David, MacGarvin Malcolm, Stirling Andy, Keys Jane,
Wynne Brian and Guedes Vaz Sofia (eds.) (2002): The Precautionary Principle in the
20th Century. Late Lessons from Early Warnings. European Environment Agency.
Earthscan Publications Ltd. ISBN 1-85383-893-4.
Herreid Clyde Freeman (1994): Case Studies in Science: A Novel Method of Science
Education. Journal of College Science Teaching, February issue (pp. 221-229).
Hilli Petri, Koivu Matti, Pennanen Teemu, Ranne Antero (2004 to appear): A
stochastic programming model for asset liability management of a Finnish pension insurance
company. Annals of Operations Research.
Hora S. C. and Iman, R. L. (1989): Expert Opinion in Risk Analysis: The NUREG-
1150 Methodology. Nuclear Science and Engineering, Vol. 102, pp. 323-331.
Hull John C. (2002): Options, Futures, and Other Derivatives. 5th edition. Prentice Hall.
ISBN 0-13-009144-8.
Jauri Osmo (1997): Riskienhallinta uudesta näkökulmasta. Kauppakamari Oy,

Yrityksen tietokirjat, Helsinki. ISBN 951-640-946-6.
Jorion Philippe (2001): Value at Risk. The New Benchmark for Managing Financial Risk.
2nd edition. McGraw-Hill. ISBN 0-07-135502-2.
Kangas Susanna, Lyytikäinen Tapani, Peltola Jukka, Ranta Jukka and Maijala Riitta
(2003): Economic impacts of the Finnish Salmonella Control Programme for broilers. National
Veterinary and Food Research Institute, EELA, Finland. EELA Publication
02/2003 ISSN 1458-6878.
Keeny R. and Raiffa H. (1976): Decisions with Multiple Objectives: Preferences and Value
Tradeoffs. John Wiley & Sons.
52
Keeny Ralph L. and von Winterfeldt Detlof (1991): Eliciting Probabilities from Experts
in Complex Technical Problems. IEEE Transactions on Engineering Management,
Vol. 38, pp. 191-201.
Klinke Andreas and Renn Ortwin (2002): A New Approach to Risk Evaluation and
Management: Risk-Based, Precaution-Based, and Discourse-Based Strategies. Risk Analysis,
Vol. 22, No. 6, pp 1071-1094.
Koksalan M. and Salman F.S. (2003): Beer in the Classroom: A Case Study of Location
and Distribution Decisions. INFORMS Transactions on Education, Vol. 4, No 1,
Online: http://ite.pubs.informs.org/Vol4No1/KoksalanSalman/, visited
22.03.2004.
Liesiö Juuso (2002): RICH – A decision support software. Student research project at
SAL/Helsinki University of Technology. Online:
http://www.sal.tkk.fi/Opinnot/Mat-2.108/pdf-files/elie02.pdf, visited 25.2.2004.
Lonka Harriet, Hjelt Mari, Vanhanen Juha, Raivio Tuomas, Vaahtoranta Tapani,
Visuri Pekka, Väyrynen Mikko, Frinking Erik, O’Brien Kevin (2002): Riskien
hallinta Suomessa. Esiselvitys. Sitran raportteja 23, Edita Prima Oy, Helsinki. ISBN
951-563-428-8. Online: http://www.sitra.fi/, visited 25.3.2004.
Luenberger David (1997): Investment Science. Oxford University Press, New York.
ISBN 0-19-510809-4.
Maijala Riitta and Ranta Jukka (2004): Salmonella in Broiler Production in Finland – a
Quantitative Risk Assessment. National Veterinary and Food Research Institute,
EELA, Finland. EELA Publication 04/2003 ISSN 1458-6878.
Melnikov Alexander (2004): Risk Analysis in Finance and Insurance. Translated and
edited by Alexei Filinkov. Chapman & Hall/CRC Monographs and Surveys in
Pure and Applied Mathematics 131. ISBN 1-58488-429-0
Milton J. S. and Arnold Jessie C. (2002): Introduction to Probability and Statistics:

Principles and Applications for Engineering and the Computing Sciences. 4th Edition.
McGraw-Hill. ISBN 0-07-119859-8.
53
NEA (1992): Probabilistic safety assessment: an analytical tool for assessing nuclear safety.
NEA Issue Brief: An analysis of principal nuclear issues. Nuclear Energy Agency.
No. 8, January 1992. Online: http://www.nea.fr/html/brief/brief-08.html, visited
20.10.2003.
Ojanen Otso, Makkonen Simo and Salo Ahti (2004): A Multi-Criteria Framework for
the Selection of Risk Analysis Methods at Energy Utilities. Unpublished working paper.
Pausenberger Ehrenfried and Nassauer Frank (2000): Governing the Corporate Risk
Managenet Function: Regulatory Issues. Justus-Liebig University, Giessen , Germany.
Published in: Frenkel Michael, Hommel Ulrich and Rudolf Markus (Eds): Risk
Management, Challenge and Opportunity. Springer, Germany 2000. ISBN 3-540-
67134-X.
Porthin Markus, Lanne Laura, Mattila Heli (2002): Asiantuntija–arvioprosessin

toteuttaminen. Operaatiotutkimuksen projektityöseminaarin loppuraportti. Helsinki
University of Technology. Online: http://www.sal.tkk.fi/Opinnot/Mat-
2.177/loppuraportit/Loppurap_VTT_B_-_Asiantuntija-arviot.PDF, visited
30.07.2004.
Ranta Jukka and Maijala Riitta (2002): A Probabilistic Transmission Model of Salmonella
in the Primary Broiler Production Chain. Risk Analysis, Vol. 22, No. 1.
Renn Ortwin and Klinke Andreas (2001): Risk Evaluation and Risk Management for
Institutional and Regulatory Policy. Published in: Stirling A. (ed.): On Science and
Precaution in the Management of Technological Risk. Volume II, Case studies.
European Commission, Joint research center. Report EUR 19056/EN/2.
Rescher Nicholas (1983): Risk : a philosophical introduction to the theory of risk evaluation
and management. Lanham, MD : University Press of America. ISBN 0-8191-2269-6.
Risk and Insurance Management Society Staff (1988): Case Studies in Risk
Management. Risk Insurance Management. ISBN 0937802255.
Rockafellar R.T. and Uryasev S. (2000): Optimization of Conditional Value-at-Risk.

The Journal of Risk, Vol. 2, No. 3. Online:
http://www.ise.ufl.edu/uryasev/CVaR1_JOR.pdf, visited 02.07.2004.
54
Rockafellar R.T. and Uryasev S. (2002): Conditional Value-at-Risk for General Loss
Distributions. Journal of Banking and Finance, 26/7, 1443-1471. Online:
http://www.ise.ufl.edu/uryasev/cvar2_jbf.pdf, visited 02.07.2004.
Rowe W. (1977): An anatomy of risk. John Wiley & Sons, New York.
Rump C.M. (2001): Who Wants to See a $Million Error? INFORMS Transactions on
Education, Vol. 1, No. 3, Online: http://ite.informs.org/Vol1No3/Rump/, visited
22.03.2004.
Rump C.M. (2002): COPS: Whatcha Gonna Do? INFORMS Transactions on Education,
Vol. 2, No. 2, Online: http://ite.informs.org/Vol2No2/Rump/, visited
22.03.2004.
Räikkönen Timo (2002): Riskienhallinnan kehityskaari ja vaikuttavuusarviointi.

Turvallisuus- ja ympäristöriskit (The development of risk management and evaluation of its
impacts. Safety and environmental risks). VTT Tiedotteita - Research Notes 2156.
Technical Research Centre of Finland.Otamedia Oy, Espoo Finland. ISBN 951-
38-6071-X. Online: http://www.vtt.fi/inf/pdf/, visited 28.11.2003.
Räikkönen Timo and Rouhiainen Veikko (2003): Riskienhallinnan muutosvoimat.

Kirjallisuuskatsaus (Risk management; prospects and challenges. Literary survey). VTT
Tiedotteita - Research Notes 2208. Technical Research Centre of
Finland.Otamedia Oy, Espoo Finland. ISBN 951-38-6167-8. Online:
http://www.vtt.fi/inf/pdf/ visited 28.11.2003.
Salo Ahti and Punkka Antti (2004 to appear): Rank Inclusion in Criteria Hierarchies.
European Journal of Operational Research.
Stirling A. (2001): On ’Precautionary’ and ’Science Based’ Approaches to Risk Assessment

and Environmental Appraisal. Published in: Stirling A. (ed.): On Science and
Precaution in the Management of Technological Risk. Volume II, Case studies.
European Commission, Joint research center. Report EUR 19056/EN/2.
Suominen Arto (2000): Riskienhallinta. WSOY, Finland. ISBN 951-0-21693-3.
55
Uryasev S. (2000): Conditional Value-at-Risk: Optimization Algorithms and Applications.
Financial Engineering News, No. 14, February, 1-5. Online:
http://www.ise.ufl.edu/uryasev/FinNews.pdf, visited 02.07.2004.
von Neumann J. and Morgenstern O. (1994): Theory of Games and Economic Behavior.
Princeton University Press.
Wassermann Selma (1994): Introduction to Case Method Teaching, A Guide to the Galaxy.
New York: Teachers College Press.
Weber Jürgen and Liekweg Arnim (2000): Statutory Regulation of the Risk-Management
Function in Germany: Implementation Issues for the Non-Financial Sector. Published in:
Frenkel Michael, Hommel Ulrich and Rudolf Markus (Eds): Risk Management,
Challenge and Opportunity. Springer, Germany 2000. ISBN 3-540-67134-X.
Williams C. Arthur Jr, Smith Michael L, Young Peter C (1998): Risk management and
insurance, 8th ed. McGraw-Hill, Singapore. ISBN 0-07-115639-9.
56
7 Web References
European Case Clearing House. http://www.ecch.cranfield.ac.uk/, visited

22.03.2004.
IFCI International Financial Risk Institute. ”Case Studies”.

http://riskinstitute.ch/Introduction.htm, visited 22.03.2004.
Risk Analysis and Management for Projects (RAMP).” Risk management case
studies”. http://www.ramprisk.com/riskknowledge/allcasestudies.asp, visited
22.03.2004.
Technical Research Centre of Finland (VTT). ”Pk-yrityksen riskienhallinta”. A web

site on risk management for small and mid-sized firms (in Finnish).
http://www.pk-rh.com/, visited 15.1.2004
Technical Research Centre of Finland (VTT). “Riskianalyysit”. A web site on

qualitative risk analysis methods (in Finnish). http://riskianalyysit.vtt.fi/, visited
14.1.2004
University of Calgary, Risk Management & Insurance. “Risk Management, Index

to Cases”. http://www.ucalgary.ca/MG/inrm/Teaching/Cases/case_idx.htm,
visited 19.03.2004.
University of California, Irvine, Graduate School of Management. “Philippe

Jorion's Orange County Case: Using Value at Risk to Control Financial Risk”.
http://www.gsm.uci.edu/~jorion/oc/case.html, visited 22.03.2004.
57

Case Studies On Risk Management

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Case Studies On Risk Management

Uploaded by

Copyright:

Available Formats

Markus Porthin

Advanced Case Studies in Risk Management

Supervisor: Professor Ahti Salo

DEPARTMENT OF ENGINEERING PHYSICS AND MATHEMATICS

Author: Markus Porthin

Title in Swedish: Avancerade fallstudier i riskhantering

Chair: Mat-2 Applied Mathematics

Number of pages: 57 Keywords: Risk Management, Case Study, Risk Measures,

AVDELNINGEN FÖR TEKNISK FYSIK OCH MATEMATIK

Utfört av: Markus Porthin

Title in English: Advanced Case Studies in Risk Management

Professur: Mat-2 Tillämpad matematik

Sidoantal: 57 Nyckelord: riskhantering, fallstudie, riskmått, jämförande

Helsinki, 2 August 2004.

The word risk is used to describe a situation that involves a possibility of

1.2 Objectives of the Thesis

1.3 The Case Method in Teaching Risk Management

1 http://www.ucalgary.ca/MG/inrm/Teaching/Cases/case_idx.htm, visited 19.03.2004.

1.4 Structure of the Study

2.1 Definitions of Risk

In colloquial language the word “risk” refers to the possibility of something

2.2 Risk Measures

2.2.1 Qualitative measures

Figure 1 Risk matrix.

2.2.2 Quantitative measures

L may be either continuous or discrete, depending on the nature of the potential

Expected lost utility = E (U ( L))

VaR(α , T ) = E(W ) − W1*−α = −W0 ( R1*−α − µ ) ,

Figure 2 Value at Risk.

2.3 Risk Analysis and Risk Management

Risk management is an activity identifying existing and threatening risks,

Figure 3 The risk management process.

In the second step of the RM process, risk evaluation, the probability of

1. Avoid. Avoidance of risks is a simple means of risk management. It means

3. Compensate. Risks may be compensated, or hedged, by taking one risk to

4. Transfer. Risk can be transferred to another party through insurances or by

5. Reduction. These measures seek to reduce the probability of an undesired

In this section a brief description of five application fields of risk management is

2.4.2 Process Industry

In process industry, risk management has traditionally focused on considering the

2.4.4 Society and Foresight

2.4.5 Environment and Health

Environmental and health risks include spreading diseases, environmental impacts

Application Finance Process industry Insurance Society and Environment and

Methods Probability Identification Risk profiles Expert elicitation Biosystem models

Sensitivity measures Probability Precautionary

To enlighten different views of RM, a cross-section of application fields is chosen.

3.1 Salmonella Case

The salmonella case describes some of the RM procedures undertaken in Finland

Table 3 Main properties of the salmonella case study.

Application field Salmonella prevalence in the poultry production chain

Decision maker The Finnish Ministry of Agriculture and Forestry

Additional Poultry producers

Causes for starting the Evaluation of implemented intervention program needed:

2) Political justification of decisions (government, EU)

Methodology Bayesian probabilistic inference model, MCMC sampling

Also (not covered in the study): Monte Carlo simulation,

3.1.2 Risk Assessment Model

Primary Production Inference Model (PPIM)

Secondary Production Simulation Model (SPSM)

3.1.3 Risk Management Process

Table 4 The risk management process of the salmonella case.

Risk evaluation – Salmonella prevalence and transmission with and without

Risk evaluation – Analysis of health impacts due to human salmonella

VaR(α , T ) = E(W ) − W1−α = −W0 ( R1−α − µ ) ,