Federal Solutions

Supporting Risk-Based Allocation with Analytics

Today, managing risks is generally recognized as an imperative for Federal government investment decisions and program performance management.  While this mandate exists, though, many organizations need guidance and structure to define what risk-based resource allocation is for them and how to build effective programs to support it.  Digital Sandbox has extensive experience working with government organizations to tailor risk-based allocation and analytics processes to meet their specific mission needs.

Department, agency, or program RBA requires organizations to build an underlying risk management capability that involves analyzing specific risks in terms of threats, vulnerabilities, and consequences and using the results of that analysis to inform decision-making. Effective risk-based allocation programs are built on four essential building blocks, all of which are necessary for long-term success: data, risk analytics, using results of analysis, and business process and governance.

DATA is the raw material that drives risk analysis. A key component of analytic risk management is assuring the quality, comprehensiveness, and management of data inputs.  Relevant data sources include threat and hazard data for natural and man-made hazards, critical infrastructure asset information, vulnerability and security assessment results, and consequence data.  While all RBA programs are iterative, a mature risk analytics capability will include data sets that are comprehensive and have been validated, and data management processes, systems, and data management tools that are integrated across the entire federal enterprise.

RISK ANALYTICS are the specific tools and methodologies used to generate findings about a particular entity’s risk. Risk analytics allow programs to transform raw data inputs into knowledge that can support decision-making.  Risk analytics can vary in scope, considering risk to individual assets or systems or entire programs.  Digital Sandbox can help you build an effective risk analytics system that documents and correlates a range of inputs: 

• Subjective, broad, rules of thumb: Relatively subjective and broad analytical methodologies are often employed, with varying degrees of effectiveness. These approaches use simple “rules of thumb” and general indicators of risk to reveal critical issues.  They do not consider the unique characteristics of specific assets relative to specific hazards.
• Structured, qualitative methodologies: Structured, qualitative scoring models are used to evaluate risk, typically for specific assets. These methods enable repeatable processes for evaluating risk through a standardized approach.
• Formula-based, quantitative, with greater precision: Risk formulas are used to analyze threat, vulnerability, and consequence data in the context of different scenarios. These approaches generate more accurate and precise quantitative results. They also include evaluation of mathematical findings by subject matter experts to support validity.
• Modeling and simulations: These risk analytics are the most rigorous and sophisticated.  They feature scenario-based risk that is informed by structural and operational analysis, hazard and consequence modeling, and scenario simulations.

ANALYSIS RESULTS provide the actionable information to apply risk measures to strategic, programmatic, and day-to-day decision-making. Examples of decisions that can be informed by risk include establishing strategic priorities, updating operational plans, identifying preparedness capability requirements, requesting and allocating resources, and conducting real-world operations.  Risk analytic results can be useful in a broad range of decision contexts:

• Reactive and limited: Risk analysis results are used in a limited way to react to externally-driven priorities or to conduct specific tactical operations.
• Establish high-level priorities: Risk analysis results are used to frame strategic priorities for a particular organization or mission’s stakeholders.
• Support select strategic and operational decisions: Risk analysis results are used to support select but not all strategic, programmatic, or day-to-day operational decisions.
• Inform broad range of ongoing decisions: Risk analysis results drive a broad range of strategic, programmatic, and operational decisions for federal programs.  Results are used repeatedly to shape strategic priorities, establish capability targets and assessment strategies, update operational plans in light of risk, and request and allocate resources from and to federal, international, state, and local partners.

BUSINESS PROCESS AND GOVERNANCE are the mechanisms that help implement and institutionalize an RBA program in an organization or mission area over the long term. They help create transparency, stakeholder commitment, and repeatable processes for data, risk analytics, and decision-making.  Digital Sandbox has a proven track record of helping our government customers build and sustain the operational processes and community of interest governance standards needed to make RBA work.