WATCH REPLAY: Duncan Harwood – Why every risk manager must be using Monte Carlo modelling to evaluate effect of risks

Given the uncertainties businesses have faced as result of the Covid-19 pandemic, it’s hardly surprising many are looking to improve how they do risk management.

According to Duncan Harwood, managing director of 2020 Risk Management, introducing Monte Carlo simulation one of the best steps a business can take to improve its risk management processes.

Giving a presentation at Risk Awareness Week 2020, he said: “If your organisations is using heat maps and 1-5 scoring matrices to assess risk, then I guarantee there is scope for improvements. Including Monte Carlo simulations in your toolkit would be a quick, simple, cheap way for the risk management function to bring real benefits to the organisation.”

What is Monte Carlo and why should we be using it?

Put simply, Monte Carlo is the name given to a mathematical technique that allows you to replace numbers with ranges and then generates the likelihood of the possible scenarios which might occur.

The software takes different values based on probabilities – each time producing a different result – tens of thousands of times in just a few seconds.

It means you can add uncertainty into your models, spreadsheets and schedules and identify those factors which would have the greatest impact on your business’ success.

Why are heat maps no longer fit for purpose?

Most risk managers are familiar with heat maps and matrices and plenty still use them for risk assessments.

However, according to Harwood, these approaches have significant flaws which make them unsuitable and could even mean that they are dangerous for your organisation.

He explained: “If you are using heat maps, have you ever actually thought about the quality of the information that it tells you? Everything is arbitrary and subjective, there’s no actionable information, and the outputs can’t be used to help inform and improve decision making.

“Organisations don’t set budgets or make decisions on the basis of colours or labels like high or orange, they need information and data.”

Why are people resisting Monte Carlo techniques?

Harwood identified several of the common objections to Monte Carlo simulations and explained why he believes them to be incorrect.

Some examples of the objections include:

  • We don’t have the data – Harwood says: There is always enough data available to get value from a Monte Carlo model.
  • It’s too advanced for our needs – Harwood says: Monte Carlo can be used with the simplest decisions and spreadsheets – in fact, anywhere there is uncertainty and where people have made assumptions about numbers.
  • It doesn’t apply to our industry – Harwood says: Monte Carlo can be used in every industry sector and organisation. It’s not just useful for heavily quantitative sectors such as science economics and financial services.
  • Everyone already understands heatmaps – Harwood says: Heat Maps are subjective and so are the messages they communicate. Different people can interpret the results differently and they may only serve to introduce confusion.
  • We don’t have the budget – Harwood says: Monte Carlo software is available free so there’s no issue about not having sufficient budget for it. There will be a cost associated with training people in your organisation or hiring external supports to use it however.
  • The numbers are all guesses anyway – Harwood says: While it’s true that the usefulness of Monte Carlo will depend upon the quality of the inputs, these can be improved through training people and calibrating them.

He added: ““These often come from auditors, managers and even people calling themselves risk managers. The good news is that none of these arguments are true.

“The only real obstacle to using Monte Carlo is having software available, having people that are able to use it, and those people being able to understand how to build good quality models, interpret the results, and communicate them in an understandable way to other people.”

What sort of insights can Monte Carlo bring?

During his presentation, Harwood ran a Monte Carlo simulation on a company’s projected business plan. The data showed various insights including that likelihood that the company would make a loss in the next year.

He commented: “This is the sort of information which allow boards to make appropriate decisions and allocate resources effectively. If someone told you that there was a one in five chance that you’d make no money next year, how do you think that could change your planning?”

He also used a tornado diagram to demonstrate the positive and negative effects that each item had upon the total profit count. In Harwood’s example it showed that a factory burning down was the single greatest uncertainty, followed by a product recall.

He said: “This information can be used justify decisions which address these events such as upgrading the sprinkler system, where to build a new factory, or whether to increase the level of insurance cover. These measures could all be costed and put through the model leading to better informed decision making and hopefully an improved bottom line.”

What kind of scenario does Monte Carlo suit?

Harwood identified several scenarios in which a Monte Carlo simulation could improve business outcomes.

These included:

  • Project management – cost and schedule
  • Introducing new projects and strategy
  • Setting strategy
  • Setting budgets
  • Setting targets
  • Setting KPIs
  • Impacts of uncertain events
  • Results of trials
  • Changing control measures
  • Replacing the need for separate scenarios

He concluded: “The risk team should have the knowledge, skills and competences to influence decision making at the highest levels, but they need to make the board understand what benefits they can bring.

“As data drives more decisions, boards and executives will need and expect robust, timely, actionable, information and risk managers will need to be able to do this rather than offering up colourful but ultimately pointless heat maps.”

RISK-ACADEMY offers online courses


Informed Risk Taking

Learn 15 practical steps on integrating risk management into decision making, business processes, organizational culture and other activities!


ISO31000 Integrating Risk Management

Alex Sidorenko, known for his risk management blog, has created a 25-step program to integrate risk management into decision making, core business processes and the overall culture of the organization.


Advanced Risk Governance

This course gives guidance, motivation, critical information, and practical case studies to move beyond traditional risk governance, helping ensure risk management is not a stand-alone process but a change driver for business.


Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.