Lessons from the World War 2

Eleanor Roosevelt once said "Learn from the mistakes of others. You can't live long enough to make them all yourself." I think this analogy perfectly applies to an organizational perspective too, the art & science of decision-making focuses on learning from across the environment to make sure we do not just learn from our mistakes but from the mistakes of the entire ecosystem too.

My thinking goes, why it should be any different for GRC (Governance, risk and compliance) professionals? Do we always need the actual lost event data to enable us potentially to predict the future?

History has interesting takes and lessons for us…

Development of the First Atomic Bomb:

Manhattan Project was a research and development effort undertaken during World War II to create the first atomic bombs. Scientists working on the project needed a way to simulate the behaviour of neutrons in a nuclear reactor, but the equations involved were too complex to solve analytically.

They needed a model to predict the behavior of neutrons in the reactor core, which were responsible for triggering the fission reactions that produced plutonium. Monte Carlo simulation allowed scientists to model the behavior of the reactor under different scenarios and optimize the reactor design for maximum efficiency and safety.

So What is Monte Carlo Simulation?

In a nutshell, Monte Carlo simulation is a computational technique that uses random sampling to model and analyzes complex systems or processes. It generates multiple scenarios with varying inputs to estimate the probability of different outcomes. Today it is extensively used to solve problems in physics, finance, engineering, and many other fields.

Another interesting trivia is that Monte Carlo simulation is named after the famous casino city in Monaco. The method was named after the city because it involves generating many random samples, like the chance outcomes in gambling. The name "Monte Carlo" was coined in the 1940s by physicists working on the Manhattan Project.

Why does it matter to us, the GRC professionals?

We all have been using the Likelihood and Impact matrix to assess risks. But I guess we all would agree that subjective risk and likelihood analysis relies heavily on expert judgment, which can be influenced by personal biases and assumptions.

Still, how can Monte Carlo help us?

By quantifying the outputs of the limited sample data, combining it with Monte Carlo simulation and generating events can estimate the probability of different outcomes and their likelihood of occurrence, which can help decision-makers understand the potential risks and make informed choices. In contrast, subjective risk and likelihood analysis may rely on qualitative or vague estimates that can be difficult to compare or interpret.

Let’s Compare the difference between the two methods using a case study of analyzing data of accidents relating to Oil pipelines in USA between 2010 to 2017:

There were close to 2,777 reported incidents and analysis of variables highlighted below key parameters impacting the total loss in case of an accident:

It starts off with the probability of occurrence of the accident and in case it occurs, the probability and impact of variables on losses i.e. where the pipeline is located, potential causes and probabilities and impact of ignition of fuel

We can utilize the above data using Monte Carlo Simulation and create 1,000 iterations or samples to identify and quantify potential losses. A cumulative distribution function (CDF) of these iterations or samples can quantify the probability of losses beyond the appetite. Assuming the entity’s appetite of losses was USD 20 Mn, it quantifies the probability of times it would be beyond the specified appetite. (In this scenario 3%)

What do you think how would fare against our qualitative impact matrix which could have looked something like below?

What do you think how would fare against our qualitative impact matrix which could have looked something like this?

Is it really that difficult to implement?

While multiple surveys highlight complexities of quantification as one of the major bottlenecks of implementation, general experience has been that the advancement of technology has made it much more easier than it seems. For developing this article, for example, I used an Excel plugin to perform these operations. I would be happy to share this case study and you can register your interest over this link.