|
|
| (One intermediate revision by one other user not shown) |
| Line 1: |
Line 1: |
| {{more footnotes|date=August 2010}}
| | Hi there, I am Alyson Pomerleau and I believe it sounds fairly good when you say it. Credit authorising is where my primary income comes from. I've usually loved living in Kentucky but now I'm contemplating other choices. I am really fond of to go to karaoke but I've been using on new issues lately.<br><br>my weblog; love psychic readings ([http://freeslotsnodeposit.co.uk/members/kdlblair/activity/56703/ http://freeslotsnodeposit.co.uk/]) |
| '''Risk assessment''' is the determination of [[Quantitative property|quantitative]] or [[Qualitative data|qualitative]] value of risk related to a concrete situation and a recognized [[threat]] (also called hazard). ''Quantitative risk assessment'' requires calculations of two components of [[risk]] ''(R)'':, the magnitude of the potential loss ''(L)'', and the probability ''(p)'' that the loss will occur. '''Acceptable risk''' is a risk that is understood and tolerated usually because the cost or difficulty of implementing an effective countermeasure for the associated vulnerability exceeds the expectation of loss.<ref>RFC 4949</ref>
| |
| | |
| In all types of engineering of complex systems sophisticated risk assessments are often made within [[Safety engineering]] and [[Reliability engineering]] when it concerns threats to life, environment or machine functioning. The nuclear, aerospace, oil, rail and military industries have a long history of dealing with risk assessment. Also, medical, hospital, [[social services|social service]]<ref>{{Cite journal
| |
| | last = Lacey
| |
| | first = Peter
| |
| | authorlink =
| |
| | coauthors =
| |
| | title = An Application of Fault Tree Analysis to the Identification and Management of Risks in Government Funded Human Service Delivery
| |
| | journal = Proceedings of the 2nd International Conference on Public Policy and Social Sciences
| |
| | format = pdf
| |
| | volume =
| |
| | issue =
| |
| | pages =
| |
| | publisher =
| |
| | location =
| |
| | year = 2011
| |
| | url = http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2171117
| |
| | issn =
| |
| | doi =
| |
| | id =
| |
| | accessdate = 2013-07-09
| |
| }}</ref> and food industries control risks and perform risk assessments on a continual basis. Methods for assessment of risk may differ between industries and whether it pertains to general financial decisions or environmental, ecological, or public health risk assessment.
| |
| | |
| ==Explanation==
| |
| Risk assessment consists of an objective evaluation of risk in which assumptions and uncertainties are clearly considered and presented. Part of the difficulty in risk management is that measurement of both of the quantities in which risk assessment is concerned - potential loss and probability of occurrence - can be very difficult to measure. The chance of error in measuring these two concepts is large. Risk with a large potential loss and a low probability of occurring is often treated differently from one with a low potential loss and a high likelihood of occurring. In theory, both are of nearly equal priority, but in practice it can be very difficult to manage when faced with the scarcity of resources, especially time, in which to conduct the risk management process. Expressed mathematically,
| |
| :<math>R_i=L_i p(L_i)\,\!</math>
| |
| :<math>R_{total}=\sum_i L_i p(L_i)\,\!</math>
| |
| [[Image:risk.jpg|thumb|300px|Risk assessment from a financial point of view.]]
| |
| | |
| Financial decisions, such as insurance, express loss in terms of dollar amounts. When risk assessment is used for public health or environmental decisions, loss can be quantified in a common metric such as a country's currency or some numerical measure of a location's quality of life. For public health and environmental decisions, loss is simply a verbal description of the outcome, such as increased cancer incidence or incidence of birth defects. In that case, the "risk" is expressed as
| |
| :<math>R_i= p(L_i)\,\!</math>
| |
| If the risk estimate takes into account information on the number of individuals exposed, it is termed a "population risk" and is in units of expected increased cases per a time period. If the risk estimate does not take into account the number of individuals exposed, it is termed an "individual risk" and is in units of incidence rate per a time period. Population risks are of more use for cost/benefit analysis; individual risks are of more use for evaluating whether risks to individuals are "acceptable".
| |
| | |
| ==Risk assessment in public health==
| |
| In the context of [[public health]], risk assessment is the process of quantifying the probability of a harmful effect to individuals or populations from certain human activities. In most countries the use of specific chemicals or the operations of specific facilities (e.g. power plants, manufacturing plants) is not allowed unless it can be shown that they do not increase the risk of death or illness above a specific threshold. For example, the American [[Food and Drug Administration]] (FDA) regulates food safety through risk assessment.<ref>Merrill, Richard A. "Food Safety Regulation: Reforming the Delaney Clause" in ''Annual Review of Public Health'', 1997, 18:313-40. This source includes a useful historical survey of prior food safety regulation.</ref> The FDA required in 1973 that cancer-causing compounds must not be present in meat at concentrations that would cause a cancer risk greater than 1 in a million lifetimes. The US Environmental Protection Agency provides basic information about environmental risk assessments for the public via its risk assessment portal.<ref>[http://www.epa.gov/risk/ EPA.gov]</ref> The [[Stockholm Convention]] on [[persistent organic pollutants]] (POPs) supports a qualitative risk framework for public health protection from chemicals that display environmental and biological persistence, bioaccumulation, toxicity (PBT) and long range transport; most global chemicals that meet this criteria have been previously assessed quantitatively by national and international health agencies.<ref>{{cite journal |author=Szabo DT, Loccisano AE,|title= POPs and Human Health Risk Assessment|journal=Dioxins and Persistent Organic Pollutants |volume=3rd |issue=Edition |pages=John Wiley & Sons|date=March 30, 2012| DOI= 10.1002/9781118184141.ch19 |url= http://onlinelibrary.wiley.com/doi/10.1002/9781118184141.ch19/summary }}</ref>
| |
| | |
| ===How the risk is determined===
| |
| [[Image:Risk Based Sampling Nomogram (3yr).png|right|200px|thumb|Food risk assessment [[nomogram]]]]
| |
| In the estimation of risks, three or more steps are involved that require the inputs of different disciplines:
| |
| | |
| # ''Hazard Identification'', aims to determine the qualitative nature of the potential adverse consequences of the contaminant (chemical, radiation, noise, etc.) and the strength of the evidence it can have that effect. This is done, for chemical hazards, by drawing from the results of the sciences of [[toxicology]] and [[epidemiology]]. For other kinds of hazard, engineering or other disciplines are involved.
| |
| #''Dose-Response Analysis'', is determining the relationship between dose and the probability or the incidence of effect (dose-response assessment). The complexity of this step in many contexts derives mainly from the need to extrapolate results from experimental animals (e.g. [[mouse]], [[rat]]) to humans, and/or from high to lower doses. In addition, the differences between individuals due to [[genetics]] or other factors mean that the hazard may be higher for particular groups, called susceptible populations. An alternative to dose-response estimation is to determine a concentration unlikely to yield observable effects, that is, a [[no effect concentration]]. In developing such a dose, to account for the largely unknown effects of animal to human extrapolations, increased variability in humans, or missing data, a prudent approach is often adopted by including safety factors in the estimate of the "safe" dose, typically a factor of 10 for each unknown step.
| |
| #''Exposure Quantification'', aims to determine the amount of a contaminant (dose) that individuals and populations will receive. This is done by examining the results of the discipline of [[exposure assessment]]. As different location, lifestyles and other factors likely influence the amount of contaminant that is received, a range or distribution of possible values is generated in this step. Particular care is taken to determine the exposure of the susceptible population(s).
| |
| | |
| Finally, the results of the three steps above are then combined to produce an estimate of risk. Because of the different susceptibilities and exposures, this risk will vary within a population.
| |
| | |
| ===Small subpopulations===
| |
| When risks apply mainly to small sub-populations, there is uncertainty at which point intervention is necessary. For example, there may be a risk that is very low for everyone, other than 0.1% of the population. It is necessary to determine whether this 0.1% is represented by:
| |
| * all infants younger than ''X'' days or
| |
| * recreational users of a particular product.
| |
| | |
| If the risk is higher for a particular sub-population because of abnormal exposure rather than susceptibility, strategies to further reduce the exposure of that subgroup are considered. If an identifiable sub-population is more susceptible due to inherent genetic or other factors, public policy choices must be made. The choices are:
| |
| * to set policies for protecting the general population that are protective of such groups, e.g. for children when data exists, the Clean Air Act for populations such as asthmatics or
| |
| * not to set policies, because the group is too small, or the costs too high.
| |
| | |
| ===Acceptable risk criteria===
| |
| The idea of not increasing lifetime risk by more than one in a million has become commonplace in public health discourse and policy. It is a heuristic measure. It provides a numerical basis for establishing a negligible increase in risk.
| |
| | |
| Environmental decision making allows some discretion for deeming individual risks potentially "acceptable" if less than one in ten thousand chance of increased lifetime risk. Low risk criteria such as these provide some protection for a case where individuals may be exposed to multiple chemicals e.g. pollutants, food additives or other chemicals.
| |
| | |
| In practice, a true zero-risk is possible only with the suppression of the risk-causing activity.
| |
| | |
| Stringent requirements of 1 in a million may not be technologically feasible or may be so prohibitively expensive as to render the risk-causing activity unsustainable, resulting in the optimal degree of intervention being a balance between risks vs. benefit. For example, emissions from hospital incinerators result in a certain number of deaths per year. However, this risk must be balanced against the alternatives. There are public health risks, as well as economic costs, associated with all options. The risk associated with no [[incineration]] is potential spread of infectious diseases, or even no hospitals. Further investigation identifies options such as separating noninfectious from infectious wastes, or air pollution controls on a medical incinerator.
| |
| | |
| Intelligent thought about a reasonably full set of options is essential. Thus, it is not unusual for there to be an iterative process between analysis, consideration of options, and follow up analysis.
| |
| | |
| ==Risk assessment in auditing==
| |
| For audits performed by an outside audit firm, risk assessment is a very crucial stage before accepting an audit engagement. According to ISA315 ''Understanding the Entity and its Environment and Assessing the Risks of Material Misstatement'', "the auditor should perform risk assessment procedures to obtain an understanding of the entity and its environment, including its internal control."<evidence relating to the auditor’s risk assessment of a material misstatement in the client’s financial statements. Then, the auditor obtains initial evidence regarding the classes of transactions at the client and the operating effectiveness of the client’s internal controls.In auditing, audit risk includes [[inherent risk]], [[control risk]] and [[detection risk]].
| |
| | |
| ==Risk assessment and human health==
| |
| There are many resources that provide health risk information.
| |
| | |
| The [[National Library of Medicine]] provides risk assessment and regulation information tools for a varied audience.<ref>{{cite web|title=Risk Assessment and Regulation Information from the NLM|url=http://sis.nlm.nih.gov/enviro/riskinformation.html|publisher=[[National Library of Medicine|NLM]]|accessdate=9 June 2013}}</ref> These include:
| |
| * TOXNET (databases on hazardous chemicals, environmental health, and toxic releases),<ref>{{cite web|title=Databases on toxicology, hazardous chemicals, environmental health, and toxic releases|url=http://toxnet.nlm.nih.gov|work=TOXNET|publisher=[[National Library of Medicine|NLM]]|accessdate=9 June 2013|date=May 2012}}</ref>
| |
| * the Household Products Database (potential health effects of chemicals in over 10,000 common household products),<ref>{{cite web|title=Household Products Database|url=http://hpd.nlm.nih.gov/|publisher=U.S. Dept. of Health & Human Services|accessdate=9 June 2013|date=January 2013}}</ref>
| |
| * [[TOXMAP]] (maps of the [[Superfund|U.S. Environmental Protection Agency Superfund]] and [[Toxics Release Inventory]] data).
| |
| The [[United States Environmental Protection Agency]] provides basic information about environmental risk assessments for the public.<ref>{{cite web|title=Risk Assessment Portal|url=http://www.epa.gov/risk/|publisher=[[United States Environmental Protection Agency|EPA]]|accessdate=9 June 2013|date=13 May 2013}}</ref>
| |
| | |
| ==Risk assessment in information security==
| |
| {{Main|IT risk management#Risk assessment}}
| |
| | |
| [[IT risk]] assessment can be performed by a qualitative or quantitative approach, following different methodologies.
| |
| | |
| ==Risk assessment in project management==
| |
| In [[project management]], risk assessment is an integral part of the risk management plan, studying the probability, the impact, and the effect of every known risk on the project, as well as the corrective action to take should that risk occur.<ref>[http://www.pmhut.com/managing-project-risks Managing Project Risks] - Retrieved May 20th, 2010</ref>
| |
| | |
| == Risk assessment for megaprojects ==
| |
| [[Megaprojects]] (sometimes also called "major programs") are extremely large-scale investment projects, typically costing more than US$1 billion per project. Megaprojects include bridges, tunnels, highways, railways, airports, seaports, power plants, dams, wastewater projects, coastal flood protection, oil and natural gas extraction projects, public buildings, information technology systems, aerospace projects, and defence systems. Megaprojects have been shown to be particularly risky in terms of finance, safety, and social and environmental impacts.
| |
| | |
| ==Quantitative risk assessment==
| |
| {{Further|Quantitative Risk Assessment software}}
| |
| Quantitative risk assessments include a calculation of the [[single loss expectancy]] (SLE) of an asset. The single loss expectancy can be defined as the loss of value to asset based on a single security incident. The team then calculates the [[Annualized Rate of Occurrence]] (ARO) of the threat to the asset. The ARO is an estimate based on the data of how often a threat would be successful in exploiting a vulnerability. From this information, the [[Annualized Loss Expectancy]] (ALE) can be calculated. The annualized loss expectancy is a calculation of the single loss expectancy multiplied by the annual rate of occurrence, or how much an organization could estimate to lose from an asset based on the risks, threats, and vulnerabilities. It then becomes possible from a financial perspective to justify expenditures to implement countermeasures to protect the asset.
| |
| | |
| ==Risk assessment in software evolution==
| |
| | |
| Studies have shown that early parts of the system development cycle such as requirements and design specifications are especially prone to error. This effect is particularly notorious in projects involving multiple stakeholders with different points of view. Evolutionary software processes offer an iterative approach to requirement engineering to alleviate the problems of uncertainty, ambiguity and inconsistency inherent in software developments.
| |
| | |
| ==Criticisms of quantitative risk assessment==
| |
| [[Barry Commoner]], [[Brian Wynne]] and other critics have expressed concerns that risk assessment tends to be overly quantitative and reductive. For example, they argue that risk assessments ignore qualitative differences among risks. Some charge that assessments may drop out important non-quantifiable or inaccessible information, such as variations among the classes of people exposed to hazards. Furthermore, Commoner and O'Brien claim that quantitative approaches divert attention from precautionary or preventative measures.<ref>Commoner, Barry. O'Brien, Mary. Shrader-Frechette and Westra 1997.</ref> Others, like [[Nassim Nicholas Taleb]] consider risk managers little more than "blind users" of statistical tools and methods.<ref>The fourth quadrant: a map of the limits of statistics [9.15.08] Nassim Nicholas Taleb An Edge Original Essay</ref>
| |
| | |
| ==Risk assessment in shipping industry==
| |
| In July 2010, shipping companies agreed to use standardized procedures in order to assess risk in key shipboard operations. These procedures were implemented as part of the amended ISM code.<ref>{{cite web|title=ISM CODE - Amendments from 1st July 2010 Risk Assessment|url=http://www1.veristar.com/veristar/dps_info.nsf/veristar/Dps_info.nsf/AllByDateInternal/353FC02A22D59873C1257734003EC51C?opendocument}}</ref>
| |
| | |
| ==See also==
| |
| {{cmn|2|
| |
| *[[Acceptable loss]]
| |
| *[[Benefit risk]]
| |
| *[[Control self-assessment]]
| |
| *[[Cost risk]]
| |
| *[[Digital Continuity]]
| |
| *[[Edwards v. National Coal Board]]
| |
| *[[Extreme risk]]
| |
| *[[Flood risk assessment]]
| |
| *[[Form 696]]
| |
| *[[Green Globe]]
| |
| *[[HACCP]]: hazard analysis and critical control points, risk assessement in food
| |
| *[[Hazard (risk)]]
| |
| *[[Hazard Identification]]
| |
| *[[Health Impact Assessment]]
| |
| *[[Information assurance]]
| |
| *[[List of auditing topics]]
| |
| *[[ISO 28000]]
| |
| *[[ISO 31000]]
| |
| *[[ISSOW]]
| |
| *''[[Megaprojects and Risk]]''
| |
| *[[Network Theory in Risk Assessment]]
| |
| *[[Optimism bias]]
| |
| *[[PIMEX]] a video exposure monitoring method
| |
| *[[Probabilistic risk assessment]]
| |
| *[[Probit model]]
| |
| *[[Reference class forecasting]]
| |
| *[[Risk]]
| |
| *[[Risk aversion]]
| |
| *[[Risk management]]
| |
| *[[Risk management tools]]
| |
| *[[Risk Matrix]]
| |
| *[[RiskAoA]]
| |
| *[[Security risk]]
| |
| *[[Strategic misrepresentation]]
| |
| *[[Risk based auditing]]
| |
| }}
| |
| | |
| ==References==
| |
| | |
| ===Footnotes===
| |
| {{reflist}}
| |
| | |
| ===General references===
| |
| * {{cite book|last=Jean-Lou |first=C. M. |coauthors=Dorne, George E. N. Kass, Luisa R. Bordajandi, Billy Amzal, Ulla Bertelsen, Anna F. Castoldi, Claudia Heppner, Mari Eskola, Stefan Fabiansson, Pietro Ferrari, Elena Scaravelli, Eugenia Dogliotti, Peter Fuerst, Alan R. Boobis and Philippe Verger |title=Metal Ions in Toxicology|editor=Astrid Sigel, Helmut Sigel, Roland K O Sigel|year=2011|publisher=RSC Publishing|pages=27–60|chapter=Chapter 2. Human Risk Assessment of Heavy Metals: Principles and Applications|doi=10.1039/9781849732116-00027}}
| |
| * {{cite book|last1=Mumtaz|first1=Moiz M. |last2=Hansen|first2=Hugh |last3=Pohl |first3=Hana R. |editor=Astrid Sigel, Helmut Sigel, Roland K O Sigel |title=Metal Ions in Toxicology|year=2011|publisher=RSC Publishing|pages=61–80|chapter=Chapter 3. Mixtures and Their Risk Assessment in Toxicology|doi=10.1039/9781849732116-00061}}
| |
| *{{citation |year=1994 |title=Science and judgment in risk assessment |author=Committee on Risk Assessment of Hazardous Air Pollutants, Board on Environmental Studies and Toxicology, Commission on Life Sciences, [[United States National Research Council|National Research Council]] |place=Washington, D.C |publisher=[[National Academy Press]] |isbn=0-309-04894-X |url=http://books.google.com/books?id=k9mKUyfHakcC&printsec=frontcover&dq=Science+and+judgment+in+risk+assessment#v=onepage&q&f=false |accessdate=27 September 2010}}
| |
| * [[Barry Commoner]]. “Comparing apples to oranges: Risk of cost/benefit analysis” from ''Contemporary moral [[controversies]] in technology'', A. P. Iannone, ed., pp. 64–65.
| |
| * Hallenbeck, William H. ''Quantitative risk assessment for environmental and occupational health.'' Chelsea, Mich.: Lewis Publishers, 1986
| |
| * Harremoës, Poul, ed. ''Late lessons from early warnings: the [[precautionary principle]] 1896–2000''.
| |
| * John M. Lachin. ''Biostatistical methods: the assessment of relative risks''.
| |
| *{{citation |year=2006 |author1=Lerche, Ian |author2=Glaesser, Walter |title=Environmental risk assessment : quantitative measures, anthropogenic influences, human impact. |place=Berlin |publisher= Springer |isbn=3-540-26249-0 |url=http://books.google.com/books?id=qB54qgpA_fEC&printsec=frontcover&dq=Environmental+risk+assessment#v=onepage&q&f=false |accessdate=27 September 2010}}
| |
| *{{citation |date=November 26, 2006 |author=Kluger, Jeffrey |authorlink=Jeffrey Kluger |title=How Americans Are Living Dangerously |url=http://www.time.com/time/magazine/article/0,9171,1562978,00.html |accessdate=27 September 2010 |postscript= Also published as December 4 cover title: [http://www.time.com/time/magazine/0,9263,7601061204,00.html "Why We Worry About the Wrong Things: The Psychology of Risk"] |work=Time}}
| |
| *{{citation |year=1983 |title=A Review of risk assessment methodologies |author=Library of Congress. Congressional Research Service. & United States. Congress. House. Committee on Science and Technology. Subcommittee on Science, Research, and Technology |publisher=report / prepared by the [[Congressional Research Service]], Library of Congress for the Subcommittee on Science, Research, and Technology; transmitted to the Committee on Science and Technology, U.S. House of Representatives, Ninety-eighth Congress, first session |place=Washington: U.S }}
| |
| * Deborah G. Mayo. “Sociological versus metascientific views of technological risk assessment” in Shrader-Frechette and Westra.
| |
| * Nyholm, J, 2009 "[http://umu.diva-portal.org/smash/get/diva2:216812/FULLTEXT01 Persistency, bioaccumulation and toxicity assessment of selected brominated flame retardants]"
| |
| *{{citation |year=2002 |author=O’Brien, Mary |title=Making better environmental decisions: an alternative to risk assessment |place=Cambridge, Massachusetts |publisher=[[MIT Press]] |isbn=0-262-15051-4 |url=http://books.google.com/books?id=LtCOEN9HWIcC&printsec=frontcover&dq=Making+better+environmental#v=onepage&q&f=false |accessdate=27 September 2010 |postscript= Paperback ISBN 0-262-65053-3}}
| |
| *{{citation |year=1997 |editor1-last=Shrader-Frechette |editor1-first=Kristin |editor2-first=Laura |editor2-last=Westra |title=Technology and values |place=Lanham, Maryland |publisher=Rowman & Littlefield |isbn=0-8476-8631-0 |url=http://books.google.com/books?id=y5BfvU6uMQMC&printsec=frontcover&dq=Technology+and+values#v=onepage&q&f=false |accessdate=27 September 2010}}
| |
| | |
| ==External links==
| |
| * [http://www.pmhut.com/wp-content/uploads/2008/01/risk_management.pdf Risk Assessment Worksheet and Management Plan] A comprehensive guide to risk assessment in project management, includes template - ''By John Filicetti''
| |
| <!--========================({{No More Links}})============================
| |
| | PLEASE BE CAUTIOUS IN ADDING MORE LINKS TO THIS ARTICLE. WIKIPEDIA |
| |
| | IS NOT A COLLECTION OF LINKS NOR SHOULD IT BE USED FOR ADVERTISING. |
| |
| | |
| |
| | Excessive or inappropriate links WILL BE DELETED. |
| |
| | See [[Wikipedia:External links]] & [[Wikipedia:Spam]] for details. |
| |
| | |
| |
| | If there are already plentiful links, please propose additions or |
| |
| | replacements on this article's discussion page, or submit your link |
| |
| | to the relevant category at the Open Directory Project (dmoz.org) |
| |
| | and link back to that category using the {{dmoz}} template. |
| |
| =======================({{No More Links}})=============================-->
| |
| | |
| {{DEFAULTSORT:Risk Assessment}}
| |
| [[Category:Evaluation]]
| |
| [[Category:Impact assessment]]
| |
| [[Category:Probability assessment]]
| |
| [[Category:Risk factors]]
| |
| [[Category:Risk management]]
| |
| [[Category:Hazard analysis]]
| |
| [[Category:Technology assessment]]
| |
| [[Category:Safety engineering]]
| |
| [[Category:Reliability engineering]]
| |