The Global Centre for Risk and Innovation (GCRI)
Risk assessment uses numbers where data support them and structured judgement where they do not. Probabilistic models, loss distributions, expert elicitation, bow-tie diagrams and risk matrices each answer different questions and fail in different ways. This page sets out how the main methods work, when each is fit for purpose, and how combining them keeps an assessment honest about what is known and what is assumed.
GCRI · In development · service level R0
Risk assessment methods are the techniques used to identify, analyse and evaluate risk, from probabilistic models and loss distributions to expert elicitation, bow-tie diagrams and risk matrices. Each answers different questions and fails differently. Combining them, and recording data, assumptions and ranges, keeps an assessment honest about what is known.
For quantitative and qualitative methods, in GCRI's spatial-intelligence reading, the map opens on true-colour imagery, land cover and night lights, framed on Asia; every other NASA layer, live feed and forecast waits in the layer list.
The interactive map needs JavaScript; the layer list and sources are below.
Layers 3
Hazards and exposure, for this page
Keyboard, with the map focused
Hold Ctrl or ⌘ and scroll to zoom
Latest available
NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Blue Marble (NASA) · © OpenStreetMap contributors (ODbL) · Natural Earth
Loading the latest NASA imagery.
Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.
For quantitative and qualitative methods, in GCRI's spatial-intelligence reading, the map opens on true-colour imagery, land cover and night lights, framed on Asia; every other NASA layer, live feed and forecast waits in the layer list.Satellite and model products as NASA publishes them, each with its own date; indicators, not assessments of any place; claim ceiling INTEGRATED.
Layers and dates
The working screen behind this subject: its structure, terms and states. Names are placeholders and values illustrative.
Quantitative and qualitative methods · National system · Scenario SC-40
red: failed in scenario
Probability, uncertainty and judgment. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Frequency and severity models work where events are numerous and recorded consistently. For rare, novel or changing risks the data are thin, and a precise-looking number can carry more assumption than evidence.
Experts anchor on recent events, overestimate their own precision and converge in groups. Structured elicitation reduces these effects by separating estimates, asking for ranges and scoring calibration.
Likelihood and consequence matrices are quick to use, but they rank risks coarsely, can reverse orderings and hide correlated losses. They suit screening, and need other methods before a major decision.
Fault trees, event trees and bow-tie diagrams link causes, controls and consequences. They provide a frame into which quantitative estimates and expert judgement can be placed and checked.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Risk matrix | A grid that ranks risks by combining likelihood and consequence categories, useful for screening. |
| Bow-tie analysis | A diagram linking the causes of an event, the controls that prevent it, and the consequences and controls that limit them. |
| Structured expert judgement | A formal elicitation method that scores experts on calibration questions and combines their estimates accordingly. |
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Risks assessed with quantitative estimates | percent of principal risks | annual | Assessment records | REPORTED |
| Calibration of expert estimates | calibration score on seed questions | per elicitation | Structured expert judgement records | OBSERVED |
| Loss event records | count of events with cause and amount recorded | continuous | Internal loss databases | OBSERVED |
| Assessment uncertainty range | ratio of upper to lower bound | per assessment | Assessment outputs | ESTIMATED |
| Controls with tested effectiveness | percent of key controls | annual | Control testing records | REPORTED |
| Method documentation completeness | percent of assessments with method, data and assumptions recorded | annual | Assessment files | REPORTED |
The topic as a computational graph: named sources feed the methods, an evidence review gates the outputs, and the decisions stay with the authorities that hold them.
Fig. 02Nodes carry their type, two metric rows and a state; connectors show what feeds what; dashed frames name the owners; the timeline is the cadence. Design of the pipeline, not a record of a run.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| IEC 31010 Risk assessment techniques | Descriptions, strengths and limits of more than forty techniques | Licensed standard, purchase required |
| EM-DAT international disaster database (CRED, UCLouvain) | Disaster events with human and economic impacts | Free for non-commercial use with registration |
| Sendai Framework Monitor and national disaster loss databases | Official reporting of disaster losses against Sendai targets | Public, UN terms of use |
| TU Delft expert judgement database | Past structured expert judgement studies with calibration data | Licence to check |
| Published operational loss data consortia summaries | Aggregate operational loss patterns in financial services | Members only; public summaries (to check) |
Systemic Risk Management prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Risk functions and analysts | Which method fits a given risk and decision | Method selection guides; documentation standards |
| Boards and executives | How much confidence to place in an assessment before acting on it | Uncertainty ranges; method documentation; calibration records |
| Regulators and supervisors | Whether an institution's risk models are fit for the use made of them | Model documentation; validation and back-testing evidence |
Natural variability that persists even with perfect knowledge, such as weather from year to year. Probability handles it well.
Uncertainty that more data or research could reduce. It should be shown, not hidden in a single number.
Where experts disagree on models, probabilities or values. Scenarios and robust decision methods suit it better.
Frequency analysis, extreme value methods and Bayesian inference from probability and statistics. Limits: rare events are poorly sampled, and past data may not reflect a changing system.
Uncertainty quantification and model validation propagates input uncertainty through models and tests them against data. Limits: it cannot capture what the model leaves out.
Formal elicitation protocols that calibrate and combine expert views. Limits: time-consuming, and experts share blind spots.
Scales, matrices and narrative analysis. Useful for communication and screening, but risk matrices can rank risks inconsistently and should not be the only tool.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.