In this presentation we discuss the liabilities brought to you by Risk Management approaches using “Risk Matrices”, Probability-Impact Graphs, “Heat Maps” (we will use the acronym “PIGs” generically, to also include risk matrices and heat maps). Despite their notoriety, PIGs are considered Standard Practices through the world by Risk practitioners, PIGs have critical and potentially damaging intrinsic problems. That's what Riskope have learned thanks to two decades of Risk Assessments for interesting and unusual projects. When looking at Risk Assessments of financial institutions, industries, operations, plants, networks, we can affirm that PIGs do not fly. They are misleading and could get their users straight in front of a Judge. Riskope is not the only entity to reckon this. Academia, other consultants around the world are indeed starting to or have already published papers going in the same direction. A formal yet simple approach to replace PIGs, called ORE (Optimum Risk Estimates (c)Oboni Riskope Associates Inc.), which avoids the pitfalls and liabilities, is presented. Like PIGs, ORE can be applied to a wide range of potential risks, but leads to a clearer, rational, defensible description of the institution's risk environment (risk horizon). The benefits brought by using ORE are explained in this presentation using a real life Risk Assessment. Happily, ORE can reuse most of the work you have already developed to establish your PIGs. With Riskope's ORE it is possible to upgrade existing corporate Risk Register and to steer your institution/company/project towards a rational, defensible and transparent stance.

1. PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly
Is it true that PIGs can fly?
already in the
'90s
2. Despite being
considered State
No, they do not fly, they are
of the Art PIGs
have problems
misleading you, but Optimum Risk
3. So what can be
Estimates (ORE) will get you back
done to avoid
PIGs problems?
on track.
By Dr. F. Oboni, C. Oboni
Page 1 of 82
(c) Riskope International SA, 2012 page 1 of 35
www.riskope.com

2. PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly
already in the
'90s
2. Despite being
considered State Studies by reputable researchers in the
of the Art PIGs
have problems UK, US, Academia, consultants and
3. So what can be Riskope have
done to avoid
PIGs problems?
repeatedly shown that Probability Impact
Graphs (PIGs) actually may
fail to deliver, and
can mislead the decision making
process..
Page 2 of 82
(c) Riskope International SA, 2012 page 2 of 35
www.riskope.com

3. PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly
qualitative, hybrid, quantitative
already in the
'90s
”Heat maps”,
2. Despite being
considered State
“PIGs=Probability Impact Graphs”
of the Art PIGs
have problems and Industrial Depot
3. So what can be
done to avoid
Usual risk matrices like this one
PIGs problems?
Will not answer a number of clients' questions:
Page 3 of 82
(c) Riskope International SA, 2012 page 3 of 35
www.riskope.com

4. PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
How to deal with risks from multiple
1. PIGs did not fly
already in the hazards along thousands of kilometres
'90s
2. Despite being of railroad without being overwhelmed?
considered State
of the Art PIGs
have problems
3. So what can be
done to avoid
PIGs problems?
Page 4 of 82
(c) Riskope International SA, 2012 page 4 of 35
www.riskope.com

5. PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly
How to prioritize risks among thousands of
already in the potentially hazardous areas in the aftermath
'90s
2. Despite being of a conflict where landmines were deployed?
considered State
of the Art PIGs
have problems
3. So what can be
done to avoid
PIGs problems?
Page 5 of 82
(c) Riskope International SA, 2012 page 5 of 35
www.riskope.com

6. PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly
Is it possible to compile a map where local
already in the hazards are transformed into risks (to
'90s
2. Despite being population, infrastructure), and these are
considered State
of the Art PIGs
consolidated by region?
have problems
3. So what can be
done to avoid
PIGs problems?
Page 6 of 82
(c) Riskope International SA, 2012 page 6 of 35
www.riskope.com

7. PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly How can we show in a rational and
already in the
'90s
transparent way the potential effects of
2. Despite being terrorism? And reasonably mitigate them?
considered State
of the Art PIGs
have problems
3. So what can be
done to avoid
PIGs problems?
Page 7 of 82
(c) Riskope International SA, 2012 page 7 of 35
www.riskope.com

8. PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly How can we include in a plant's Risk
already in the
'90s Assessment possible effects from unrelated
2. Despite being
considered State
plants, handling hazardous matters and
of the Art PIGs using the same infrastructure?
have problems
3. So what can be
done to avoid
PIGs problems?
Page 8 of 82
(c) Riskope International SA, 2012 page 8 of 35
www.riskope.com

9. PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly
PIGs do not fly because:
already in the
'90s
2. Despite being 1) Too many hazards,
considered State
of the Art PIGs
have problems
3. So what can be
2) Too many targets,
done to avoid
PIGs problems?
3) They lack of “definition” and are
“arbitrary”
by nature, blurring reality
4) They expose clients to unsustainable
mitigation expenses
Page 9 of 82
(c) Riskope International SA, 2012 page 9 of 35
www.riskope.com

10. PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly
Polls have shown a discrepancy
already in the between users needs and PIGs results.
'90s
2. Despite being
considered State
of the Art PIGs
Users would like an approach:
have problems
3. So what can be
done to avoid
- covering dominoes effects (cascading
PIGs problems? failures),
- including multiparameter
consequences,
- allowing continuous updates,
- allowing the study of new risks as
they arise on corporate's radar
screen and evaluating their impact in
the risk landscape.
Page 10 of 82
(c) Riskope International SA, 2012 page 10 of 35
www.riskope.com

11. PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
PIGs do not allow any of that!
1. PIGs did not fly
already in the Too many people mistakenly think that using
'90s PIGS is doing Risk Management!
2. Despite being
considered State
Try tell where your operation stands in the plot
of the Art PIGs below using PIGs...You cannot!
have problems
3. So what can be
done to avoid
PIGs problems?
Page 11 of 82
(c) Riskope International SA, 2012 page 11 of 35
www.riskope.com

12. PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly
With PIGs it is not possible to
already in the “explicitly and formally” use multiple
'90s
2. Despite being criteria to define the impact.
considered State
of the Art PIGs
have problems Often instructions say: “between
3. So what can be
done to avoid physical and human losses, apply the
PIGs problems?
highest consequence”.
Absolutely nonsensical!
Especially if the “average scenario” is
used!
Page 12 of 82
(c) Riskope International SA, 2012 page 12 of 35
www.riskope.com

13. PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
This is a real PIG from a large
1. PIGs did not fly
already in the environmental project
'90s
2. Despite being
considered State
of the Art PIGs
have problems
3. So what can be
done to avoid
PIGs problems?
Page 13 of 82
(c) Riskope International SA, 2012 page 13 of 35
www.riskope.com

14. PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly Large consequence risks
already in the
'90s
(for example catastrophic accident,
2. Despite being successful Cyber-warfare attack on
considered State
of the Art PIGs critical infrastructure, etc...)
have problems
3. So what can be
done to avoid all fall in the “top consequence cell”, but
PIGs problems?
cannot be discerned one from another.
The habit of reducing scenarios to their
“average” p, C only adds to this
problem.
Page 14 of 82
(c) Riskope International SA, 2012 page 14 of 35
www.riskope.com

15. PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
Let's use a historic and recent set of
1. PIGs did not fly
already in the tolerability criteria...
'90s
2. Despite being
considered State
of the Art PIGs
have problems
3. So what can be
done to avoid
PIGs problems?
Page 15 of 82
(c) Riskope International SA, 2012 page 15 of 35
www.riskope.com

16. PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly
...and plot the PIG on top. The non sense
already in the becomes evident...because....
'90s
2. Despite being
considered State
of the Art PIGs
have problems
3. So what can be
done to avoid
PIGs problems?
Page 16 of 82
(c) Riskope International SA, 2012 page 16 of 35
www.riskope.com

17. PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly
already in the 1) Risks that are very different can fall in
'90s
2. Despite being the same category.
considered State
of the Art PIGs
have problems 2) Cells limits are arbitrary.
3. So what can be
done to avoid
PIGs problems?
3) PIGs can only differentiate risks if
there are macroscopic differences in p
and C.
CONCLUSION:
PIGs critically lack of “resolution”..
Page 17 of 82
(c) Riskope International SA, 2012 page 17 of 35
www.riskope.com

18. PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly PIGs give:
already in the
'90s
2. Despite being
considered State
1) a false sense of confidence,
of the Art PIGs 2) cannot prioritize risks properly,
have problems
3. So what can be
3) do not allow comparisons among
done to avoid alternatives/projects.
PIGs problems?
Thus cannot be used for sensible ERM,
create a fuzzy “risk landscape” in studies
where
numerous scenarios, possibly linked by
interdependency, threatened by multiple
hazards are present.
Page 18 of 82
(c) Riskope International SA, 2012 page 18 of 35
www.riskope.com

19. PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly
already in the
The number of cells in the matrix will
'90s not change these results, because
2. Despite being
considered State tolerability is not explicitly defined.
of the Art PIGs
have problems
3. So what can be It is way better to work with properly
done to avoid
PIGs problems? approximated quantitative estimates
than with “precise” semi-qualitative
PIGs!
It is better to be generally right rather
than precisely wrong!
Page 19 of 82
(c) Riskope International SA, 2012 page 19 of 35
www.riskope.com

20. PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly
already in the
'90s For rational decision making we
2. Despite being
considered State
cannot rely on:
of the Art PIGs
have problems
3. So what can be
done to avoid
-arbitrary cells' limits,
PIGs problems? -arbitrary tolerability defined by
“steps” in the cells!
Page 20 of 82
(c) Riskope International SA, 2012 page 20 of 35
www.riskope.com

21. PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly
already in the
'90s
2. Despite being
considered State
of the Art PIGs We need to go back to raw data...
have problems
3. So what can be
done to avoid
PIGs problems?
...and use
Optimum Risk Estimates (ORE)
Page 21 of 82
(c) Riskope International SA, 2012 page 21 of 35
www.riskope.com

22. PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly
already in the As we do not want to waste time
'90s
2. Despite being and resources, let's use client's
considered State
of the Art PIGs PIGs (if they have been developed
have problems
3. So what can be
already).
done to avoid
PIGs problems?
But...
Page 22 of 82
(c) Riskope International SA, 2012 page 22 of 35
www.riskope.com

23. PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly
already in the
'90s
2. Despite being
...develop a rational and scientific
considered State
of the Art PIGs
prioritization criteria based on
have problems explicit tolerability.
3. So what can be
done to avoid
PIGs problems?
ORE are the only rational way,
better than any ranking, top ten
list, etc...to plan your mitigations.
Page 23 of 82
(c) Riskope International SA, 2012 page 23 of 35
www.riskope.com

24. PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly
already in the
'90s
2. Despite being
considered State
of the Art PIGs
have problems
3. So what can be We will use a real life
done to avoid
PIGs problems? example to show you how
ORE are done:
One client's operation had
a PIG based prioritization
as follows:
Page 24 of 82
(c) Riskope International SA, 2012 page 24 of 35
www.riskope.com

25. PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly
already in the
'90s 50 risks which split into:
2. Despite being
considered State
of the Art PIGs
have problems -0 Severe
3. So what can be
done to avoid
-14 High
PIGs problems? -25 Medium
-11 Low risks
They called us in because they
did not know how to tackle 14
high, 25 medium...too costly!!!
Page 25 of 82
(c) Riskope International SA, 2012 page 25 of 35
www.riskope.com

26. PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly
already in the
'90s
2. Despite being
considered State
of the Art PIGs Let's see how focus can be
have problems
3. So what can be
increased with ORE so that
done to avoid
PIGs problems?
client gets a clearer
roadmap for managing
risks, decision making, etc...
Page 26 of 82
(c) Riskope International SA, 2012 page 26 of 35
www.riskope.com

27. PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
Let's build a tolerability curve: we display it here
1. PIGs did not fly
already in the ontop of the original PIG's cells, for comparison
'90s
2. Despite being
considered State
of the Art PIGs
have problems
3. So what can be
done to avoid
PIGs problems?
Page 27 of 82
(c) Riskope International SA, 2012 page 27 of 35
www.riskope.com

28. PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly For each risk let's evaluate the intolerable part
already in the
'90s (orange) vs. tolerable part (blue).
2. Despite being
considered State
of the Art PIGs
have problems
3. So what can be
done to avoid
PIGs problems?
Page 28 of 82
(c) Riskope International SA, 2012 page 28 of 35
www.riskope.com

29. PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
Top 20 Total Risks prioritization,
1. PIGs did not fly however we can do better than that!
already in the
'90s
2. Despite being
considered State
of the Art PIGs
have problems
3. So what can be
done to avoid
PIGs problems?
Page 29 of 82
(c) Riskope International SA, 2012 page 29 of 35
www.riskope.com

30. PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
Risks prioritization with the
1. PIGs did not fly
already in the intolerable part as discriminant
'90s
2. Despite being constitute the core of ORE
considered State
of the Art PIGs because...
have problems
3. So what can be
done to avoid ...the only
PIGs problems?
risks that
actually matter
are the ones
that extend
above your
tolerability.
Page 30 of 82
(c) Riskope International SA, 2012 page 30 of 35
www.riskope.com

31. PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly
Now it is possible to take rational decisions in
already in the allotting mitigative funds, plan ahead!
'90s
2. Despite being
considered State
of the Art PIGs
have problems
3. So what can be
done to avoid
PIGs problems?
ORE show that only 5 scenarios count for 83%
of the total intolerable risks. Concentrating on
them will greatly improve the situation.
Five instead than 14 (+25) suggested by PIG!
Page 31 of 82
(c) Riskope International SA, 2012 page 31 of 35
www.riskope.com

32. PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly Because of poor Hazard
already in the
'90s Identification, we noticed that the
2. Despite being
considered State client had omitted some scenarios,
of the Art PIGs
have problems so we had to include them in the
3. So what can be
done to avoid
ORE.
PIGs problems?
How can new results be integrated
in the ORE?
What is the impact on decision
making?
Page 32 of 82
(c) Riskope International SA, 2012 page 32 of 35
www.riskope.com

34. PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly
The results of ORE are to be seen
already in the dynamically, through cyclical updates.
'90s
2. Despite being
considered State
of the Art PIGs
They allow “what-if” analyses and the
have problems cost-benefit evaluation of mitigative
3. So what can be
done to avoid
alternatives.
PIGs problems?
ORE are a tool for day-to-day
consultation which become richer with
time, meanwhile offering a clear
understanding of the evolution of risks
and crises throughout the system.
Page 34 of 82
(c) Riskope International SA, 2012 page 34 of 35
www.riskope.com

35. PIGs cannot fly! Optimum Risk Estimates (ORE) will get you back on track.
Prologue
1. PIGs did not fly
already in the
'90s
2. Despite being
considered State
ORE are the key to your
of the Art PIGs
have problems
business prosperity,
3. So what can be
done to avoid
survival and
PIGs problems?
sustainability.
CONTACT: Cesar Oboni
coboni(a)riskope.com
Page 35 of 82
(c) Riskope International SA, 2012 page 35 of 35
www.riskope.com