While I written this post about compliance risks in the past, I later applied exactly the same math and logic to any non financial risk, including intellectual property, legal, environmental, ESG and most other risks you can think of. Follow this step by step guide to quantify most non financial risks or if you want to automate quantitative risk analysis use Archer Insight.
Bow-ties allow us to quantify most risks and this methodology is developed in line with the requirements of ISO 31022:2020 Risk management — Guidelines for the management of legal risk and Compliance Risk Management: Applying the COSO ERM Framework. Just kidding, it’s light years ahead.
Risk identification
The purpose of identifying compliance or any other non financial risks is to find, recognize and describe the risks that can help or prevent an organization to achieve or from achieving its objectives.
To have a comprehensive understanding of relevant risks, organisations may do the following:
- Review relevant laws and regulations across all of the countries of operation.
- Review claims and incident statistics captured across the organization.
- Review claims against industry peers and other relevant organizations in the countries of operation.
- Consult with relevant legal and compliance advisors and service providers.
- Review information and guidelines from regulators and government authorities.
Risk Analysis
The following information should be collected and recorded for each identified risk:
- Possible consequence scenarios as described in the legislation or other regulatory requirements (usually includes fines, 3rd party claims, criminal prosecution, temporary production closure, sanctions and so on)
- Range of possible values for each of the consequence scenario (for example, according to the legislation fines may vary from 100K to 1M, production closure can be for a period between 0 and 90 days, etc.)
- The logical relationship between each consequence scenario (for example, large fines are much more likely once the small fines have been already received or for some risks it could be the opposite, if small fines haven’t been issued over the last 2+ years this could mean that the large fine is imminent and so on)
- Historical incident and claims data, known court cases or other relevant information.
- Risk owner and key stakeholders.
- Current controls and assessment of their effectiveness, if available.
Step 1. Represent each risk as a bow-tie diagram
Each risk can be graphically represented as a bow-tie diagram. A bow tie is a graphical depiction of pathways from the causes of an event or risk to its consequences in a simple cause-consequence diagram. It is a simplified combination of a fault tree that analyses the cause of an event or risk, the left hand side of the diagram, and an event tree that analyses the consequences, the right hand side. I borrowed some diagrams and generic words from a wonderful article by Broadleaf https://broadleaf.com.au/resource-material/bow-tie-analysis/
The focus of bow tie analysis is on the barriers or controls depicted to the left-hand side of the knot that can change the likelihood of the event or circumstance, or on those on the right-hand side that can change its consequences. It is used when assessing the completeness of controls, to check that each pathway from cause to event and event to consequence has effective controls, and that factors that could cause controls to fail (including management systems failures) are recognized:
- The most effective controls usually address causes, generally to stop them arising or leading to the risk (preventive controls). They should match the causes, in extent and nature.
- On the right of the bow tie, controls should provide appropriate responses to consequences being felt or create barriers to the consequences developing. They might either influence the consequences on business objectives directly (corrective or reactive controls), or detect changes quickly and provide triggers for contingency plans (detective controls).
Any compliance risk can be depicted as a bow-tie diagram by following these steps:
- Select the risk to be examined in the bow tie analysis.
- Describe the risk, in the form [something happens] and leads to [a consequence for our objectives], and note the main risk analysis outcomes from the risk register.
- List the causes of the risk on the left and the consequences of the risk on the right, using the information from the regulations as well as through consultation with risk owners and subject matter experts.
- List the existing controls on the causes (preventive controls) below the causes on the left, and the controls on the consequences (corrective controls) below the consequences on the right. If a control acts on both causes and consequences, then show it twice, on each side of the template.
- Identify options for enhancing existing controls, to improve their effectiveness or to fill gaps. This may include enhanced monitoring and more frequent review, for example using control self-assessment.
Step 2. Identify causes and consequence scenarios
Causes and consequences for the bow-tie diagram are normally derived from the regulations as well as through consultation with risk owners and subject matter experts.
Common consequence scenarios for compliance risks (just a quick example, there is more) include:
| Risk area | Examples of consequence scenarios |
| Licensed activities and subsoil use |
|
| Environmental management (ecology) |
|
| Sanctions compliance |
|
| Anti-monopoly compliance |
|
| Tax compliance |
|
| Fire supervision, emergency protection |
|
| Labor and industrial safety |
|
| Covenant compliance |
|
| Economic and information security, state secret |
|
| Land and property relations |
|
| Construction and reconstruction of hazardous facilities |
|
| Physical security of production facilities and vehicles |
|
An example for a bow-tie for a typical compliance risk is presented below:
Where, V – means several events can occur at the same time, and XOR means the variability of either one event or the other. For example, fines can be either for three days of water pollution (small), or for a year (moderate) or three years (large), and criminal prosecution and termination of business can occur simultaneously.
Step 3. Determine the range of consequences for each scenario
In order to quantitatively assess compliance risks the next step involves defining the possible range of values for each consequence scenario. Typical consequences can involve the following factors:
| Consequence scenario | Range of consequences |
| A. Small fine for violation, for example a fine for three days of water pollution |
|
| B. Moderate fine calculated cumulatively for the year using extrapolation of supervisory audit results | |
| C. Large fine calculated cumulatively for the three years using extrapolation of supervisory audit results | |
| D. Suspension of business |
|
| E. Criminal prosecution of company management |
|
Depending on the availability and reliability of the data various severity distributions can be used (only examples, relax, could be others):
- Lognormal distribution – where the range of consequences is not bounded and there is a small probability of catastrophic losses.
- PERT distribution – for simulating consequences based on expert opinions where historical data may not be available or the range of consequences is bounded by regulation.
- Discrete distribution – for simulating a select number of well defined scenarios.
- Fitted distributions – wherever historical data is available it can be used to fit a distribution suitable for the specific loss profile.
For each consequence scenario a distribution is selected and the range of possible values are determined, for example minimum, expected loss and maximum loss.
Step 4. Allocate weights to each scenario
In order to determine the weight allocated to each consequence scenario of events triggered by compliance risk, historical data, modelling, as well as expert opinions, can all be used, individually or in combination.
Weight of each scenario can involve the following factors:
- the range of laws, along with enforcement practices and conventions by the relevant regulatory authorities;
- the improvement of, and compliance with, the existing framework for the management of legal risk, including strategies, governance, internal rules and policies;
- employees’ and contractors’ demonstrated compliance with laws, and the rules and policies of the organization;
- the frequency and number of activities related to legal risk occurring within a certain period;
- failure to record, analyse and learn from previous events;
- benchmarking the frequency and number of activities related to legal risk occurring within a certain period against other organizations.
Wherever possible historical data on each of the consequence scenarios is collected. When no historical data is available or no claims have been made against the company in the past, we use Bayesian statistics to estimate the weights for the scenario. Depending on the availability and reliability of the data various distributions can be used to estimate the weight of each of the consequence scenarios:
- Bernoulli or discrete distribution – where there limited historical data and the probability of a single or multiple consequences needs to be estimated.
- Poison distribution – where we have historical data to estimate the frequency of each of the consequence scenarios.
Current controls, their effectiveness and other factors affecting the probability of claims against the company have to be accounted for when allocating weights to each of the scenarios.
Step 5. Measure the effect of risks on decisions
In order to account for the uncertainty both in the consequences of each scenario and its weight, consequence distributions are multiplied by weight distributions using the Monte-Carlo simulation method. Normally 10000 simulation runs should be sufficient for most compliance risks, however more simulation runs may be required for highly unlikely and catastrophic events.
The output of risk analysis can be represented as a distribution or box plot as shown below:
The distribution of the possible outcomes shows:
- Reasonable optimistic scenario (usually minimal or no financial consequences)
- Expected scenario (50th percentile)
- Reasonable pessimistic scenario (financial consequences which would not be exceed 95% of the time, 5% probability that impact may be even greater).
An integral part of the risk analysis is a tornado diagram showing which of the consequence scenarios is having the most effect on the overall risk exposure level. An example is shown below:
In the situation where the risk exposure is deemed significant, risk mitigation measures need to be discussed and agreed upon.
Often it may be insufficient to just estimate the compliance risk exposure, instead it may be required to measure how compliance risks would affect an investment decision, a performance target or business plan or budget. In such cases it may be necessary to estimate how compliance risks change the project NPV / other decision making metric or how compliance risks change the probability of successfully finishing the project on time and budget.
Risk mitigation and trade-off
The treatment of compliance risks refers to the corresponding strategies implemented by an organization to deal with its risks. A risk treatment plan should consider a range of treatment options, which may include legal remedies as well as financial, operational and reputational remedies for each prioritized risk.
The following factors should be considered when choosing an appropriate option for the treatment of compliance risks:
- the organizational risk management policy, strategic objectives, core values and legal responsibility of the organization;
- a cost benefit analysis of responding to compliance risk;
- the stakeholders’ perception and their values, attitude to risk and tolerance levels, as well as their preferences on certain compliance risk treatment strategies;
- the availability and allocation of resources needed to manage the risk;
- a legal review (including scope and depth) of laws, contractual commitments and limiting risk contractually;
- legal opinions;
- the extent to which the compliance risk can under law be transferred, delegated or insured against;
- the level of risk awareness and maturity level within the organization.
Different mitigation and treatment strategies can be tested to determine which option provides the best value in risk reduction for the cost involved. Different mitigation strategies can be graphically represented as on the diagram below:
Reporting and monitoring
The monitoring and review of the management of compliance risks includes the following:
- staying abreast of changes in the environment, such as the introduction of new laws and the enforcement of such laws, in order to adjust the organization’s strategy accordingly;
- monitoring events triggered by compliance risk, analysing their frequency and patterns, and drawing conclusions from them (including potential correlation with and amplification of other risks);
- considering an early warning system with key stakeholders to identify warning signals for significant compliance risks that could arise;
- monitoring and reviewing:
- outcomes following risk treatment;
- changes in the environment;
- the building of integrated risk treatment plans;
- the designation of the responsible and accountable parties;
- comparing progress with the risk treatment plan, reviewing and updating the risk treatment plan periodically and in a timely manner to seek assurance on its adequacy, suitability and effectiveness in relation to the management of compliance risk.
An organization should consider the following issues in relation to record-keeping and reporting:
- legal professional privilege, attorney–client privilege and work product (or their equivalent concepts and terms under the relevant national law);
- destruction, retention and privacy policies, in accordance with data protection laws;
- the availability and accessibility of documentation for stakeholders to improve decision-making and for internal or external audit purposes.
- whether the relevant documentation needs to be maintained securely, with a chain of evidence process documenting that no alterations have been made to the documents, information or evidence;
- confidentiality and security measures in relation to documentation of a confidential nature, such as setting up limited and authorized access to such documentation.
An organization should report on the progress of changes in implementing the management of compliance risks and adherence to the measures.
RISK-ACADEMY guides and templates:
Check out other risk management books
RISK-ACADEMY offers online courses
Informed Risk Taking
Learn 15 practical steps on integrating risk management into decision making, business processes, organizational culture and other activities!
ISO31000 Integrating Risk Management
Alex Sidorenko, known for his risk management blog http://www.riskacademy.blog, has created a 25-step program to integrate risk management into decision making, core business processes and the overall culture of the organization.
Advanced Risk Governance
This course gives guidance, motivation, critical information, and practical case studies to move beyond traditional risk governance, helping ensure risk management is not a stand-alone process but a change driver for business.