Risk assessment

Risk assessment is necessary in individual cases, including patient and physician interactions.[3] Individual judgements or assessments of risk may be affected by psychological, ideological, religious or otherwise subjective factors, which impact rationality of the process.[3]

A systematic review of patients and doctors from 2017 found that overstatement of benefits and understatement of risks occurred more often than the alternative.[3][4]

There is a tendency for individuals to be less rational when risks and exposures concern themselves as opposed to others.[3] There is also a tendency to underestimate risks that are voluntary or where the individual sees themselves as being in control, such as smoking.[3] A 2017 systematic review from the Cochrane collaboration suggests “well-documented decision aids” are helpful in reducing effects of such tendencies or biases.[3][5] The ways statistics are expressed and communicated, both through words and numerically also impact the interpretation of benefit and harm. For example, a fatality rate may be interpreted as less benign than the corresponding survival rate.[3]

Risk assessment can also be made on a much larger "systems" scale, for example assessing the risks of a nuclear power plant (an interactively complex mechanical, electronic, nuclear, and human system) or a hurricane (a complex meteorological and geographical system). Systems may be defined as linear and nonlinear (or complex), where linear systems are predictable and relatively easy to understand given a change in input, and non-linear systems unpredictable when inputs are changed.[6] As such, risk assessments of non-linear/complex systems tend to be more challenging.

In the engineering of complex systems, sophisticated risk assessments are often made within safety engineering and reliability engineering when it concerns threats to life, environment, or machine functioning. The agriculture, nuclear, aerospace, oil, railroad, and military industries have a long history of dealing with risk assessment.[7] Also, medical, hospital, social service,[8] and food industries control risks and perform risk assessments on a continual basis. Methods for assessment of risk may differ between industries and whether it pertains to general financial decisions or environmental, ecological, or public health risk assessment.[7]

Risk assessment from a financial point of view.

To see the risk management process expressed mathematically, one can define total risk as the sum over individual risks, ${\displaystyle R_{i}}$, which can be computed as the product of potential losses, ${\displaystyle L_{i}}$, and their probabilities, ${\displaystyle p(L_{i})}$:

${\displaystyle R_{i}=L_{i}p(L_{i})\,\!}$

${\displaystyle R_{total}=\sum _{i}L_{i}p(L_{i})\,\!}$

Even though for some risks ${\displaystyle R_{i},R_{j}}$, we might have ${\displaystyle R_{i}=R_{j}}$, if the probability ${\displaystyle p(L_{j})}$ is small compared to ${\displaystyle p(L_{i})}$, its estimation might be based only on a smaller number of prior events, and hence, more uncertain. On the other hand, since ${\displaystyle R_{i}=R_{j}}$, ${\displaystyle L_{j}}$ must be larger than ${\displaystyle L_{i}}$, so decisions based on this uncertainty would be more consequential, and hence, warrant a different approach.

Financial decisions, such as insurance, express loss in terms of dollar amounts. When risk assessment is used for public health or environmental decisions, loss can be quantified in a common metric such as a country's currency or some numerical measure of a location's quality of life. For public health and environmental decisions, loss is simply a verbal description of the outcome, such as increased cancer incidence or incidence of birth defects. In that case, the "risk" is expressed as

${\displaystyle R_{i}=p(L_{i})\,\!}$

If the risk estimate takes into account information on the number of individuals exposed, it is termed a "population risk" and is in units of expected increased cases per a time period. If the risk estimate does not take into account the number of individuals exposed, it is termed an "individual risk" and is in units of incidence rate per a time period. Population risks are of more use for cost/benefit analysis; individual risks are of more use for evaluating whether risks to individuals are "acceptable".

In quantitative risk assessment an annualized loss expectancy (ALE) may be used to justify the cost of implementing countermeasures to protect an asset. This may be calculated by multiplying the single loss expectancy (SLE), which is the loss of value based on a single security incident, with the annualized rate of occurrence (ARO), which is an estimate of how often a threat would be successful in exploiting a vulnerability.

The usefulness of quantitative risk assessment has been questioned, however. Barry Commoner, Brian Wynne and other critics have expressed concerns that risk assessment tends to be overly quantitative and reductive. For example, they argue that risk assessments ignore qualitative differences among risks. Some charge that assessments may drop out important non-quantifiable or inaccessible information, such as variations among the classes of people exposed to hazards, or social amplification.[10] Furthermore, Commoner and O'Brien claim that quantitative approaches divert attention from precautionary or preventative measures.[11] Others, like Nassim Nicholas Taleb consider risk managers little more than "blind users" of statistical tools and methods.[12]

Food risk assessment nomogram

1. Dose-Response Analysis, is determining the relationship between dose and the type of adverse response and/or probability or the incidence of effect (dose-response assessment). The complexity of this step in many contexts derives mainly from the need to extrapolate results from experimental animals (e.g. mouse, rat) to humans, and/or from high to lower doses, including from high acute occupational levels to low chronic environmental levels. In addition, the differences between individuals due to genetics or other factors mean that the hazard may be higher for particular groups, called susceptible populations. An alternative to dose-response estimation is to determine a concentration unlikely to yield observable effects, that is, a no effect concentration. In developing such a dose, to account for the largely unknown effects of animal to human extrapolations, increased variability in humans, or missing data, a prudent approach is often adopted by including safety or uncertainty factors in the estimate of the "safe" dose, typically a factor of 10 for each unknown step.
2. Exposure Quantification, aims to determine the amount of a contaminant (dose) that individuals and populations will receive, either as a contact level (e.g., concentration in ambient air) or as intake (e.g., daily dose ingested from drinking water). This is done by examining the results of the discipline of exposure assessment. As different location, lifestyles and other factors likely influence the amount of contaminant that is received, a range or distribution of possible values is generated in this step. Particular care is taken to determine the exposure of the susceptible population(s).

The results of these steps are combined to produce an estimate of risk. Because of the different susceptibilities and exposures, this risk will vary within a population. An uncertainty analysis is usually included in a health risk assessment.

There are many resources that provide health risk information.

The National Library of Medicine provides risk assessment and regulation information tools for a varied audience.[16] These include:

• TOXNET (databases on hazardous chemicals, environmental health, and toxic releases),[17]
• the Household Products Database (potential health effects of chemicals in over 10,000 common household products),[18]
• TOXMAP (maps of the U.S. Environmental Protection Agency Superfund and Toxics Release Inventory data).

The United States Environmental Protection Agency provides basic information about environmental health risk assessments for the public for a wide variety of possible environmental exposures.[19]

The Environmental Protection Agency began actively using risk assessment methods to protect drinking water in the United States after passage of the Safe Drinking Water Act of 1974. The law required the National Academy of Sciences to conduct a study on drinking water issues, and in its report the NAS described some methodologies for doing risk assessments for chemicals that were suspected carcinogens, recommendations that top EPA officials have described as perhaps the study's most important part.[20]

Considering the increase in junk food and its toxicity, FDA required in 1973 that cancer-causing compounds must not be present in meat at concentrations that would cause a cancer risk greater than 1 in a million over a lifetime. The US Environmental Protection Agency provides extensive information about ecological and environmental risk assessments for the public via its risk assessment portal.[21] The Stockholm Convention on persistent organic pollutants (POPs) supports a qualitative risk framework for public health protection from chemicals that display environmental and biological persistence, bioaccumulation, toxicity (PBT) and long range transport; most global chemicals that meet this criteria have been previously assessed quantitatively by national and international health agencies.[22]

When risks apply mainly to small sub-populations, it can be difficult to determine when intervention is necessary. For example, there may be a risk that is very low for everyone, other than 0.1% of the population. It is necessary to determine whether this 0.1% is represented by:

• all infants younger than X days or
• recreational users of a particular product.

If the risk is higher for a particular sub-population because of abnormal exposure rather than susceptibility, strategies to further reduce the exposure of that subgroup are considered. If an identifiable sub-population is more susceptible due to inherent genetic or other factors, public policy choices must be made. The choices are:

• to set policies for protecting the general population that are protective of such groups, e.g. for children when data exists, the Clean Air Act for populations such as asthmatics or
• not to set policies, because the group is too small, or the costs too high.

The idea of not increasing lifetime risk by more than one in a million has become commonplace in public health discourse and policy.[23] It is a heuristic measure. It provides a numerical basis for establishing a negligible increase in risk.

Environmental decision making allows some discretion for deeming individual risks potentially "acceptable" if less than one in ten thousand chance of increased lifetime risk. Low risk criteria such as these provide some protection for a case where individuals may be exposed to multiple chemicals e.g. pollutants, food additives or other chemicals.

In practice, a true zero-risk is possible only with the suppression of the risk-causing activity.

Stringent requirements of 1 in a million may not be technologically feasible or may be so prohibitively expensive as to render the risk-causing activity unsustainable, resulting in the optimal degree of intervention being a balance between risks vs. benefit. For example, emissions from hospital incinerators result in a certain number of deaths per year. However, this risk must be balanced against the alternatives. There are public health risks, as well as economic costs, associated with all options. The risk associated with no incineration is potential spread of infectious diseases, or even no hospitals. Further investigation identifies options such as separating noninfectious from infectious wastes, or air pollution controls on a medical incinerator.

Intelligent thought about a reasonably full set of options is essential. Thus, it is not unusual for there to be an iterative process between analysis, consideration of options, and follow up analysis.

For audits performed by an outside audit firm, risk assessment is a crucial stage before accepting an audit engagement. According to ISA315 Understanding the Entity and its Environment and Assessing the Risks of Material Misstatement, "the auditor should perform risk assessment procedures to obtain an understanding of the entity and its environment, including its internal control". Evidence relating to the auditor's risk assessment of a material misstatement in the client's financial statements. Then, the auditor obtains initial evidence regarding the classes of transactions at the client and the operating effectiveness of the client's internal controls. Audit risk is defined as the risk that the auditor will issue a clean unmodified opinion regarding the financial statements, when in fact the financial statements are materially misstated, and therefore do not qualify for a clean unmodified opinion. As a formula, audit risk is the product of two other risks: Risk of Material Misstatement and Detection Risk. This formula can be further broken down as follows: inherent risk × control risk × detection risk.

In the context of public health, risk assessment is the process of characterizing the nature and likelihood of a harmful effect to individuals or populations from certain human activities. Health risk assessment can be mostly qualitative or can include statistical estimates of probabilities for specific populations. In most countries the use of specific chemicals or the operations of specific facilities (e.g. power plants, manufacturing plants) is not allowed unless it can be shown that they do not increase the risk of death or illness above a specific threshold. For example, the American Food and Drug Administration (FDA) regulates food safety through risk assessment.[24]

In project management, risk assessment is an integral part of the risk management plan, studying the probability, the impact, and the effect of every known risk on the project, as well as the corrective action to take should an incident implied by a risk occur.[25] Of special consideration in this area are the relevant codes of practice that are enforced in the specific jurisdiction. Understanding the regime of regulations that risk management must abide by is integral to formulating safe and compliant risk assessment practices.

Information technology risk assessment can be performed by a qualitative or quantitative approach, following different methodologies. One important difference in risk assessments in information security is modifying the threat model to account for the fact that any adversarial system connected to the Internet has access to threaten any other connected system.[26] Risk assessments may therefore need to be modified to account for the threats from all adversaries, instead of just those with reasonable access as is done in other fields.

Megaprojects (sometimes also called "major programs") are extremely large-scale investment projects, typically costing more than US$1 billion per project. They include bridges, tunnels, highways, railways, airports, seaports, power plants, dams, wastewater projects, coastal flood protection, oil and natural gas extraction projects, public buildings, information technology systems, aerospace projects, and defence systems. Megaprojects have been shown to be particularly risky in terms of finance, safety, and social and environmental impacts.

Studies have shown that early parts of the system development cycle such as requirements and design specifications are especially prone to error. This effect is particularly notorious in projects involving multiple stakeholders with different points of view. Evolutionary software processes offer an iterative approach to requirement engineering to alleviate the problems of uncertainty, ambiguity and inconsistency inherent in software developments.

In July 2010, shipping companies agreed to use standardized procedures in order to assess risk in key shipboard operation. These procedures were implemented as part of the amended ISM Code.[27]

Formal risk assessment is a required component of most professional dive planning, but the format and methodology may vary. Consequences of an incident due to an identified hazard are generally chosen from a small number of standardised categories, and probability is estimated based on statistical data on the rare occasions when it is available, and on a best guess estimate based on personal experience and company policy in most cases. A simple matrix is often used to transform these inputs into a level of risk, generally expressed as unacceptable, marginal or acceptable. If unacceptable, measures must be taken to reduce the risk to an acceptable level, and the final outcome of the risk assessment must be accepted by the affected parties before a dive commences. Higher levels of risk may be acceptable in special circumstances, such as military or search and rescue operations when there is a chance of recovering a survivor. Diving supervisors are trained in the procedures of hazard identification and risk assessment, and it is part of their planning and operational responsibility. Both health and safety hazards must be considered. Several stages may be identified. There is risk assessment done as part of the diving project planning, on site risk assessment which takes into account the specific conditions of the day, and dynamic risk assessment which is ongoing during the operation by the members of the dive team, particularly the supervisor and the working diver.[28][29]

In recreational scuba diving, the extent of risk assessment expected of the diver is relatively basic, and is included in the pre-dive checks. Several mnemonics have been developed by diver certification agencies to remind the diver to pay some attention to risk, but the training is rudimentary. Diving service providers are expected to provide a higher level of care for their customers, and diving instructors and divemasters are expected to assess risk on behalf of their customers and warn them of site-specific hazards and the competence considered appropriate for the planned dive. Technical divers are expected to make a more thorough assessment of risk, but as they will be making an informed choice for a recreational activity, the level of acceptable risk may be considerably higher than that permitted for occupational divers under the direction of an employer.[30][31]

In outdoor activities including commercial outdoor education, wilderness expeditioning and outdoor recreation, risk assessment refers to analysis of the probability and magnitude of unfavorable outcomes such as injury, illness, or property damage due to environmental and related causes, compared to the human development or other benefits of outdoor activity. This is of particular importance as school programs and others weigh the benefits of youth and adult participation in various outdoor learning activities against the inherent and other hazards present in those activities. Schools, corporate entities seeking team-building experiences, parents/guardians, and others considering outdoor experiences expect or require[32] organizations to assess the hazards and risks of different outdoor activities—such as sailing, target shooting, hunting, mountaineering, or camping—and select activities with acceptable risk profiles.

Outdoor education, wilderness adventure, and other outdoor-related organizations should, and are in some jurisdictions required, to conduct risk assessments prior to offering programs for commercial purposes[33][34][35].

Such organizations are given guidance on how to provide their risk assessments[36] and external consultancy services provide these assessments as well[37][38][39].

Environmental Risk Assessment (ERA) aims to assess the effects of stressors, usually chemicals, on the local environment. A risk is an integrated assessment of likelihood and severity of an undesired event. In ERA, the undesired event often depends on the chemical of interest and on the risk assessment scenario.[40] This undesired event is usually a detrimental effect on organisms, populations or ecosystems. Current ERAs usually compare an exposure to a no-effect level, such as the Predicted Environmental Concentration/Predicted No-Effect Concentration (PEC/PNEC) ratio in Europe. Although this type of ratio is useful and often used in regulation purposes, it is only an indication of an exceeded apparent threshold.[41] New approaches start to be developed in ERA in order to quantify this risk and to communicate effectively on it with both the managers and the general public.[40]

Ecological risk assessment is complicated by the fact that there are many nonchemical stressors that substantially influence ecosystems, communities, and individual plants and animals. Defining the undesired (adverse) event is a political or policy judgment, further complicating applying traditional risk analysis tools to ecological systems. Much of the policy debate surrounding ecological risk assessment is over defining precisely what is an adverse event. [42]

Biodiversity Risk Assessments evaluate risks to biological diversity, specially the risk of species extinction or the risk of ecosystem collapse. The units of assessments are the biological (species, subspecies or populations) or ecological entities (habitats, ecosystems, etc.), and the risk are often related to human actions and interventions (threats and pressures). Regional and national protocols have been proposed by multiple academic or governmental institutions and working groups,[43] but global standards such as the Red List of Threatened Species and the IUCN Red List of Ecosystems have been widely adopted, and are recognized or proposed as official indicators of progress toward international policy targets and goals, such as the Aichi targets and the Sustainable Development Goals.[44][45]

• Dorne, Jean-Lou C. M.; Kass, George E. N.; Bordajandi, Luisa R.; Amzal, Billy; Bertelsen, Ulla; Castoldi, Anna F.; Heppner, Claudia; Eskola, Mari; Fabiansson, Stefan; Ferrari, Pietro; Scaravelli, Elena; Dogliotti, Eugenia; Fuerst, Peter; Boobis, Alan R.; Verger, Philippe (2011). "Chapter 2. Human Risk Assessment of Heavy Metals: Principles and Applications". In Astrid Sigel; Helmut Sigel; Roland K O Sigel (eds.). Metal Ions in Toxicology. Metal Ions in Life Sciences. RSC Publishing. pp. 27–60. doi:10.1039/9781849732116-00027. ISBN 978-1-84973-091-4.
• Mumtaz, Moiz M.; Hansen, Hugh; Pohl, Hana R. (2011). "Chapter 3. Mixtures and Their Risk Assessment in Toxicology". In Astrid Sigel; Helmut Sigel; Roland K O Sigel (eds.). Metal Ions in Toxicology. Metal Ions in Life Sciences. RSC Publishing. pp. 61–80. doi:10.1039/9781849732116-00061. ISBN 978-1-84973-091-4.
• Committee on Risk Assessment of Hazardous Air Pollutants (1994), Science and judgment in risk assessment, Washington, D.C: National Academy Press, ISBN 978-0-309-04894-1, retrieved 27 September 2010
• Barry Commoner. "Comparing apples to oranges: Risk of cost/benefit analysis" from Contemporary moral controversies in technology, A. P. Iannone, ed., pp. 64–65.
• Hallenbeck, William H. Quantitative risk assessment for environmental and occupational health. Chelsea, Mich.: Lewis Publishers, 1986
• Harremoës, Poul, ed. Late lessons from early warnings: the precautionary principle 1896–2000.
• John M. Lachin. Biostatistical methods: the assessment of relative risks.
• Lerche, Ian; Glaesser, Walter (2006), Environmental risk assessment : quantitative measures, anthropogenic influences, human impact., Berlin: Springer, ISBN 978-3-540-26249-7, retrieved 27 September 2010
• Kluger, Jeffrey (November 26, 2006), "How Americans Are Living Dangerously", Time, retrieved 27 September 2010. Also published as December 4 cover title: "Why We Worry About the Wrong Things: The Psychology of Risk" |work=Time
• Congressional Research Service; Subcommittee on Science, Research, and Technology (1983), A Review of risk assessment methodologies, Washington: U.S: report / prepared by the Congressional Research Service, Library of Congress for the Subcommittee on Science, Research, and Technology; transmitted to the Committee on Science and Technology, U.S. House of Representatives, Ninety-eighth Congress, first sessionCS1 maint: multiple names: authors list (link)
• Deborah G. Mayo. “Sociological versus metascientific views of technological risk assessment” in Shrader-Frechette and Westra.
• O'Brien, Mary (2002), Making better environmental decisions: an alternative to risk assessment, Cambridge, Massachusetts: MIT Press, ISBN 978-0-262-15051-4, retrieved 27 September 2010. Paperback ISBN 0-262-65053-3
• Shrader-Frechette, Kristin; Westra, Laura, eds. (1997), Technology and values, Lanham, Maryland: Rowman & Littlefield, ISBN 978-0-8476-8631-5, retrieved 27 September 2010