Tornado graphs in @RISK are often thought of as providing an indication of the importance of a variable in determining the amount of variability (risk) in the output of a model). In an earlier posting we briefly described this interpretation (which is generally most valid for linear models where variables are independent of each other).

Perhaps more overlooked is the role of the graphs at different stages of the risk modelling process. The risk modelling process is often thought of as consisting of various stages (usually some variation of the sequence risk identification, risk modelling, and risk management, with the sequence conducted in an iterative way).

During the first pass through this sequence (i.e. the construction of the first qualitative risk model) a tornado graph can provide an idea of which variables are assumed to have the most variability. At this stage the graph can provide a check as to the quality of the model and its calibration. For example, a graph with one very dominant bar would raise questions as to whether in reality there is only one significant source of risk (generally realistic situations have several sources of risk that are of importance). The model may need to be recalibrated or rebuilt in some way to create a more realistic model.

During the second and subsequent passes through the sequence (i.e. the availability of the first “correct” risk model), the graph may provide an idea of where risk mitigation measures may be found. However, generally speaking the model would not contain enough information to make any definitive conclusions. For example, neither the cost of risk mitigation actions nor the issue as to whether there is the possibility to influence the risk factors would generally be included in the model at this stage. Such features may need to be added to the model, and indeed may generally be the subject of additional (perhaps out-of-model) analysis.

Ultimately, the number of passes through the sequence would not be infinite; rather at some point one has deemed that all relevant (worthwhile/economically effective etc) risk mitigation actions have been planned for (and included in the model). Arguably, this is the first time when a model has been built against which risk can truly be measured. The resulting model can be considered to be a “base case” risk model, which in some sense is optimized (i.e. all worthwhile risk mitigation measures and their costs and impacts have been included). At this stage, the notion of risk and its measurement is that of a “residual uncertainty” or something that cannot be efficiently controlled (according to the decision-maker’s own criteria). The tornado graph at this stage provides a description of the sources of the residual risk, but arguably provides no actionable information to the decision-maker.

Dr. Michael Rees

Director of Training and Consulting