Class 13-14 - Risk Analysis

Reference: Investopedia / Adam Hayes (Updated March 18, 2025), Reviewed by Erika Rasure

What Is Risk Analysis?

• Risk Analysis = the process of assessing the likelihood of an adverse event occurring that may negatively affect a business, investment, or project
• Commonly performed by corporations, governments, and nonprofits
• Helps organizations determine:
  • Whether they should undertake a project or approve a financial application
  • What actions to take to protect their interests
• Facilitates a balance between risks and risk reduction
• Risk analysts often work with forecasting professionals to minimize future negative unforeseen effects

🧠 Analogy: เหมือนการทำ unit test ก่อน deploy — เราไม่ได้หวังว่าทุก bug จะหาย แต่อย่างน้อยรู้ว่ามีอะไรที่อาจพังได้บ้าง

How Risk Analysis Works

• Enables corporations, governments, and investors to assess the probability that an adverse event might negatively impact a business, economy, project, or investment
• Essential for determining the worth of a specific project or investment
• Provides various approaches to assess the risk-reward tradeoff of a potential investment opportunity

The Risk Analyst's Process

• Step 1: Identify what could potentially go wrong
• Step 2: Weigh those negatives against a probability metric (likelihood of the event)
• Step 3: Estimate the extent of impact if the event happens
• Many identified risks (market risk, credit risk, currency risk) can be reduced through hedging or purchasing insurance
• Almost all large businesses require a minimum level of risk analysis
  • e.g., Commercial banks must hedge foreign exchange exposure of overseas loans
  • e.g., Department stores must factor in reduced revenues due to global recession
• Risk analysis allows professionals to identify and mitigate risks — but not completely avoid them

🧠 Analogy: เหมือนการขับรถ — เราใส่ seat belt ไม่ใช่เพราะมั่นใจว่าจะไม่มีอุบัติเหตุ แต่เพราะรู้ว่ามีโอกาสเกิดขึ้นได้

Types of Risk Analysis

There are 5 primary methods of risk analysis

1) Cost-Benefit Analysis

• Compares the benefits a company receives to the financial and non-financial expenses related to those benefits
• The potential benefits may cause other types of potential expenses to occur

2) Risk-Benefit Analysis

• Compares potential benefits with associated potential risks
• Benefits may be ranked and evaluated based on:
  • Likelihood of success
  • Projected impact the benefits may have

3) Needs Risk Analysis

• Looks at the current state of a company
• Used to better understand a need or gap that's already known — or to uncover gaps management isn't aware of
• Helps the company decide where to increase spending or bring more resources in

4) Business Impact Analysis

• Used when a business sees a potential risk looming and wants to determine how it may impact operations
• Example: A real estate developer assessing how each additional day of a concrete worker strike delays and impacts their operations

5) Root Cause Analysis

• Performed because something is happening that shouldn't be — the opposite of needs analysis
• Strives to identify and eliminate processes that cause issues
• Unlike other types that forecast future risks, root cause analysis identifies the impact of things that have already occurred or continue to happen

🧠 Analogy: Root Cause Analysis เหมือนการ debug app ที่ crash — ไม่ใช่แค่ restart แต่ต้องหาว่า stack trace บรรทัดไหนทำให้มันพัง

How to Perform a Risk Analysis

Different types of risk analysis have overlapping steps. Each company may customize, but these are the most common steps:

Step 1: Identify Risks

• Make a list of potential risks you may encounter
• Risks may be internal (within the company) or external (outside forces) — most are external
• Important to involve many members/departments for brainstorming — different perspectives matter
• A company may have already addressed major risks through a SWOT analysis
  • SWOT analysis is broader; a risk analysis often addresses a more specific question

Step 2: Identify Uncertainty

• The riskiest aspects are often undefined (uncertain) areas
• Must understand how each potential risk carries uncertainty and quantify the range of that uncertainty

Step 3: Estimate Impact

• Goal: understand how risk will financially impact the company
• Usually calculated as the Risk Value:

$\boxed{\text{Risk Value} = \text{Probability of Event} \times \text{Cost of Event}}$

• Example: 1% chance of product defect × $100M cost = **$1M risk value**

Step 4: Build Analysis Models

• Takes all available data/information and attempts to yield:
  • Different outcomes
  • Probabilities
  • Financial projections
• Scenario analysis or simulations can determine an average outcome value
• Used to quantify the average instance of an event occurring

Step 5: Analyze Results

• Management compares:
  • Likelihood of risk
  • Projected financial impact
  • Model simulations
• May request different scenarios run for varying risks based on different variables or inputs

Step 6: Implement Solutions

• Options range from doing nothing (risk acceptance) to eliminating the risk
• Sometimes it makes more financial sense to simply live with the risk and deal with it if/when it occurs
• Other potential solutions:
  • Buying insurance
  • Divesting from a product
  • Restricting trade in certain geographical regions
  • Sharing operational risk with a partner company

⚡ Fast Fact: Implementing solutions doesn't necessarily mean risk avoidance — a company can decide to simply accept the current risks it faces.

Quantitative vs. Qualitative Risk Analysis

Quantitative Risk Analysis

• A risk model is built using simulation or deterministic statistics to assign numerical values to risk
• Inputs are mostly assumptions and random variables
• The model generates a range of outputs/outcomes for any given range of input
• Risk managers analyze the output using:
  • Graphs
  • Scenario analysis
  • Sensitivity analysis

⚡ Fast Fact: Separating outcomes from best to worst provides a reasonable spread of insight for a risk manager

• Example: A global American company might use a sensitivity table to see how its bottom line changes if exchange rates of select countries strengthen
• A sensitivity table shows how outcomes vary when one or more random variables or assumptions are changed
• A portfolio manager might use a sensitivity table to assess how changes in each security's value impact portfolio variance
• Other risk management tools: decision trees, break-even analysis

Qualitative Risk Analysis

• Does not use numerical/quantitative ratings
• Instead involves:
  • A written definition of the uncertainties
  • An evaluation of the extent of impact if the risk occurs
  • Countermeasure plans in case of a negative event
• Examples of qualitative risk tools:
  • SWOT analysis
  • Cause-and-effect diagrams
  • Decision matrixes
• Example use case: A firm wanting to measure the impact of a security breach on its servers may use qualitative risk technique to prepare for any lost income from a data breach

⚡ Important: Most investors are concerned about downside risk, but technically risk = mathematical variance both to the downside and the upside

Advantages of Risk Analysis

1. Informed Decision-Making & Contingency Planning

   • Allows companies to plan for contingencies before bad things occur
   • Not all risks materialize, but understanding potential scenarios helps avoid potential losses

2. Quantifies Risk for Management

   • Helps quantify risk when management may not know the financial impact of potential events
   • May help companies avoid unprofitable projects
   • Reduces the likelihood of events that would cause financial stress

3. Detects Early Warning Signs

   • Can identify early signs of potentially catastrophic events (e.g., inadequate data security)
   • Leads to:
     • Better processes
     • Stronger documentation
     • More robust internal controls
     • Risk mitigation

Disadvantages of Risk Analysis

1. Relies heavily on estimates — may be difficult to perform for certain risks
2. Cannot predict truly unpredictable events (black swan events)
3. May underestimate risk magnitude or occurrence — leading to overconfident operations

Main Components of Risk Analysis

Risk analysis is sometimes broken into 3 components:

• These three components work in tandem to identify, mitigate, and communicate risk

Why Is Risk Analysis Important?

• Guides company decision-making
• Helps safeguard company assets
• Risk is present everywhere — proprietary data, physical goods, employee wellbeing
• Companies must be mindful of:
  • Where risk is most likely to occur
  • Where it's most likely to have strong, negative implications