Rethinking Impact Assessment for Emerging Risks: A Paradigm Shift

Executive Summary

This document explores the philosophical and practical challenges in applying traditional risk assessment approaches to emerging risks. Our MCMC Risk Dashboard project deliberately takes a different approach - focusing on probabilistic networks, conditional relationships, and uncertainty characterization rather than definitive impact quantification. This represents a fundamental paradigm shift in how we approach emerging risk analysis, requiring a recalibration of our mental models and communication strategies.

The Traditional Risk Assessment Paradigm

For decades, risk management has been anchored in the probability-impact framework:

• Assess likelihood of risk occurrence
• Assess severity if the risk materializes
• Multiply to get an expected value or plot on a risk matrix
• Prioritize based on combined scores or matrix position

This approach works well for mature risks with:

• Rich historical data
• Well-understood causal mechanisms
• Relatively stable risk parameters
• Clearly quantifiable impacts

Examples include conventional operational risks, routine market risks, and well-studied natural disasters.

The Emerging Risk Challenge

Emerging risks fundamentally differ from mature risks in ways that make traditional impact assessment problematic:

1. Fundamental Uncertainty vs. Measurable Risk

Frank Knight's distinction between risk (measurable) and uncertainty (unmeasurable) is critical here. Emerging risks often exhibit:

• Deep uncertainty about causal mechanisms
• Unknown and potentially novel impacts
• Lack of statistical basis for estimation
• Potential for unprecedented outcomes

2. The Quantification Trap

Attempting premature quantification of impacts for emerging risks creates several problems:

• False precision: Creating an illusion of knowledge where significant uncertainty exists
• Anchoring bias: Early numerical estimates unduly influence subsequent thinking
• Misallocation of resources: Focusing mitigation efforts based on potentially arbitrary impact assessments
• Overlooking systemic effects: Missing complex interactions that may amplify or transform impacts

3. The Significance of Relationships

For emerging risks, the relationships between risks often matter more than isolated impact estimates:

• How risks amplify each other
• Cascade effects through systems
• Feedback loops that either dampen or accelerate risks
• Conditional probabilities that transform the risk landscape

Our Alternative Approach: Why It's Better for Emerging Risks

The Bayesian network approach with MCMC simulation offers several advantages:

1. Embracing Uncertainty

Rather than forcing premature impact quantification, our approach:

• Explicitly represents uncertainty in probabilistic terms
• Updates beliefs as new information emerges
• Maintains the full probability distribution rather than collapsing to point estimates
• Allows for multiple possible scenarios

2. Focusing on Relationships and Conditions

The network structure emphasizes what we often can assess better than impacts:

• Conditional probabilities between risks
• Influence strengths and mechanisms
• Cascade paths and critical nodes
• System leverage points

3. Enabling Dynamic Risk Intelligence

This approach supports:

• Continuous updating as new information emerges
• Scenario exploration rather than single-point forecasts
• Detection of emerging patterns across the risk network
• Identification of key leading indicators

Challenges for Risk Professionals

This paradigm shift creates several challenges for risk professionals accustomed to traditional methods:

1. The Comfort of Quantification

Many risk professionals have been trained to provide concrete impact assessments and may feel uncomfortable with an approach that emphasizes:

• Ranges over point estimates
• Conditional probabilities over definitive impacts
• Network relationships over isolated risk scores
• Evolving scenarios over static assessments

2. Stakeholder Communication Challenges

Executives and board members often expect simple, quantified answers:

• "What's the potential financial impact?"
• "Where does this rank on our risk matrix?"
• "What's the worst-case scenario?"
• "What's our exposure in dollars?"

3. Governance and Compliance Expectations

Existing governance frameworks and regulatory expectations often assume:

• Clear risk categorization
• Quantified impact assessments
• Straightforward prioritization frameworks
• Simple risk rating systems

Strategies for Navigating the Paradigm Shift

To successfully implement this new approach while meeting organizational needs:

1. Reframe the Conversation

When discussing emerging risks:

• Emphasize the different nature of emerging vs. mature risks
• Explain why premature quantification can be misleading or dangerous
• Focus on insights about system behavior rather than isolated impacts
• Use analogies to fields where uncertainty is already well-understood (e.g., early-stage scientific research)

2. Provide Alternative Value Metrics

Instead of impact assessments, focus on:

• Critical dependencies and influence points
• Early warning indicators and thresholds
• Potential intervention strategies and their effects across the network
• Comparative risk evolution scenarios

3. Bridge to Traditional Frameworks When Appropriate

Develop translation approaches to meet governance needs:

• Create qualitative impact categories when quantification isn't feasible
• Provide ranges rather than point estimates when pressed for impact assessments
• Develop conditional scenarios that link to existing risk frameworks
• Show how network risks map to enterprise risk categories

Case Study: AI Risk Assessment

Consider how these approaches differ for emerging AI risks:

Traditional approach might attempt to quantify:

• Financial impact of AI incidents in dollars
• Reputational damage on an arbitrary 1-5 scale
• Regulatory fines based on current frameworks
• Business interruption costs using standard models

Our network approach instead focuses on:

• How AI risks influence and are influenced by other technology risks
• Conditional probabilities of risk materialization given various triggers
• Evolution of risk factors over time as the technology matures
• Key indicators that would signal increasing risk probability

The latter provides more actionable intelligence for truly emerging risks, even without definitive impact quantification.

Moving Forward: A Balanced Perspective

While we're adopting this paradigm shift for emerging risks, we recognize:

1. Quantification has its place - As risks mature and become better understood, more traditional quantification becomes both possible and valuable
2. Hybrid approaches can work - Different assessment methodologies can coexist within a unified risk management framework
3. Translation layers are needed - Creating interfaces between network-based emerging risk assessment and traditional enterprise risk management
4. Evolution is expected - Our methods will continue to develop as our understanding of emerging risks improves

Conclusion: Transforming How We Think About Emerging Risks

The MCMC Risk Dashboard project represents more than just a new tool – it embodies a fundamental shift in how we conceptualize, analyze, and communicate about emerging risks. By focusing on probabilistic networks, relationships, and evolving scenarios rather than static impact assessments, we gain new insights that would be impossible within traditional frameworks.

This approach requires us to embrace a higher level of acknowledged uncertainty while paradoxically providing more sophisticated and useful risk intelligence. It challenges us to move beyond the comfort of definitive impact statements toward a more nuanced understanding of complex, emerging risk landscapes.

As we implement this approach, we'll continue to refine our methods, build bridges to traditional risk frameworks where needed, and develop increasingly sophisticated ways to communicate the insights generated by this new paradigm.

"The greatest risk in times of turbulence is not the turbulence itself, but acting with yesterday's logic." – Peter Drucker