Method and system for risk control optimization

[00002] The present invention is directed to a method and system of selecting an optimal set of management and risk controls for a given set of risks within a variable control budget. Specifically, optimization according to the present invention is defined using a method and system to calculate the greatest reduction in an organization's risk exposure with the minimum investment in cost and time as measured by the economic value added of the risk system change.

[00003] Organizations exist for a purpose. They have a vision, goals and specific objectives aimed at achieving the goals and realizing the vision. Risks are those factors that jeopardize the achievement of the organizational objectives, goals, or vision—that create uncertainty that the desire results will be achieved. Organizations must identify risks that put their objectives in jeopardy and deploy controls to reduce the risk exposure.

[00004] Risks are created by underlying hazards. Risk is the measure of the uncertainty in both time and severity that a hazard will cause a loss. The proper measure for risk is exposure, which is the product of the probability of the loss and the severity of the loss. Since risk is a stochastic phenomena, the best representation of risk is a loss distribution function showing the probability of various severities of loss.

[00005] FIG. 1 shows a sample risk distribution for a single hazard. The total risk is equal to the area under the curve, the sum of all the individual probabilities(Likelihood) times severity(Size of single loss). Risk controls operate to reduce the area under the curve. However, these risk controls have an associated cost. In an ideal world the resources available for risk control are infinite and risks can be reduced to zero. In the real world, resources are limited. The risks can only be reduced to zero by abandoning the objective and a balance must be struck between the “good” to be achieved and the cost of risk controls and potential loss from the residual risk (risk remaining after risk controls are applied).

[00006] Furthermore, realization of the organizational vision requires the achievement of numerous objectives, all exposed to a vast number of different risks that need to be managed by a complex array of risk controls. Currently, most organizations manage these risks utilizing disconnected processes that are controlled by different functional areas within the organization. Evaluation by the organization's senior management of the efficiency and effectiveness of these various risk management efforts is hampered by at least two shortcomings.

[00007] Management is hampered by the lack of consistent methods for (a) identifying and measuring the risk exposures and (b) measuring the performance of the associated risk controls. This makes it extremely difficult for the organization to set priorities and to achieve an optimal allocation of resources toward risk control across the entire enterprise. This failure to establish an integrated enterprise-wide risk management system exposes an organization to two potentially dire consequences.

[00008] First, a major risk may be overlooked that will prevent the achievement of the organization's objectives. Second, resources will be wasted on inefficient and/or ineffective risk control efforts.

[00009] One of the necessary and primary objectives of any organization is that economic value be added. The organization's efforts need to create additional economic value or the organization will eventually exhaust its capital and wither away without having realized its vision. This is true of all organizations whether they be private or public corporations or non-corporate organizations.

[00010] One measure of economic performance is Stern Stewart & Co.'s Economic Value Added (EVA™) methodology. The basic theory states that economic value is added when future revenue cash flows exceed the expense and capital cash flows necessary to produce the revenue, more simply stated:
EVA™=Operating Profit (OP)−Cost of Capital (CC), where Cost of Capital (CC)=Capital×Cost of Capital Rate (C*)
Operating Profit can be further broken into two components:
Operating Profit (OP)=Operating Revenue (OR)−Operating Expense (OE)
So that the Economic Value Added (EVA) becomes: $\begin{array}{c}{\mathrm{EVA}}^{\mathrm{TM}}=\left(\mathrm{Operating}\mathrm{Revenue}-\mathrm{Operating}\mathrm{Expense}\right)-\\ \left(\mathrm{Capital}\times C^{*}\right)\\ =\left(\mathrm{OR}-\mathrm{OE}\right)-\left(\mathrm{Capital}\times C^{*}\right)\end{array}$

[00015] The aforementioned methodology requires that all of the cash flows should be adjusted for taxes, time and risk. The EVA™ methodology was originally developed as a performance metric for explaining the valuation of public stocks. Stern Stewart & Co. has further expanded its application as a guide for large-scale resource allocation when considering “profit center” investments and as the basis for tying management compensation to increases in shareholder value.

[00016] Before an organization can evaluate the performance of risk controls it must first identify and measure the risk exposures. This is a large, complex task, since organizations are faced with a huge number of hazards that generate varying degrees of risk exposure. Organizations generally divide responsibility for various risks among different functional groups within the organization in order to manage these risks.

[00017] The basis for the distribution of the responsibility varies from organization to organization and within the same organization. In many instances a functional group will be responsible for managing the risks that jeopardize the operations that they are responsible for. An example is the responsibility of the treasurer for the foreign currency exchange risk. In other instances a manager will have responsibility for risks that span across multiple functional areas where the manager does not have responsibility for the underlying operations. An example is the environmental manager whose is responsible for managing the environmental risks across the entire organization. Frequently responsibility is shared for various portions of the basic risk management process even if the distribution of responsibility is not well defined. FIG. 2 shows a basic risk management process of the related art.

[00018] Due to the historical distribution of responsibility for managing risks to isolate functions, the methodologies developed for the identification and measurement of risks vary greatly in their design, assumptions and outputs. Often management of the risks is performed using arcane technical language that varies from one functional area to another. Although the managers of these various risk are generally aware that the risk exposure has a probability and a severity component, they rarely use exposure to measure the risks and even more rarely use loss distribution functions to define the risk exposures.

[00019] Normally the manager considers the issues of probability and severity separately. Accordingly, sufficient data to define the loss distribution function is rarely available. This makes it extremely difficult for organizations to place consistent valuations on the risks and subsequently to determine how to optimize the allocation of resources across the entire enterprise. Frequently resources are allocated based upon either (a) Historical happenstance, i.e. the organization is aware of a recent large loss that increases its sensitivity to the risk associated with a particular hazard; or, (b) The organizational strength of the manager, i.e. a strong manager gathers more resources within the organization.

[00020] More sophisticated managers use various subjective ranking systems to order the relative severity, probability and control cost. Labels are attached to each hazard indicating a subjective valuation of the severity and probability. For example severity may be ranked as “high”, “medium”, or “low”. Probability may be ranked as “certain”, “likely”, “unlikely”, or “rarely”. The cost to control the risk is similarly ranked as “high”, “moderate” or “low”. A few of the ranking methodologies attempt to apply across all risks in the organization, but without establishing consistent operational definitions and measurement methodologies across the various functional areas. “High” and “Likely” frequently mean different things to different people. These methodologies also do not recognize the interdependencies that exist between various risk controls, nor do they tie back to the question of whether economic value is being created by the risk control efforts.

[00021] A few organizations use sophisticated mathematical analysis to define loss distribution functions for risks within a particular functional area. These efforts, however, are restricted to a handful of risks due to the effort to rigorously define the loss distribution functions. Currently there are a number of historical forces at work that are moving organizations toward a more systematic management of risks across the entire enterprise. Broadly speaking these are:

• • [00022] The Corporate Governance movement,
  • [00023] COSO's (Committee of Sponsoring Organizations) Internal Control—Integrated Framework,
  • [00024] The 1991 Federal Sentencing Guidelines for Organizations,
  • [00025] The Imperatives of World Class Performance

[00026] Under the Stern Stewart & Co. methodology, a company will often allocate resources to activities that produce the greatest EVA and will reward those managers who generate EVA. Activities and managers, who do not produce EVA, will be easily identified and will provide a company with the opportunity to free up capital and direct it towards those who utilize it most effectively.

[00027] EVA analysis was first applied to decisions regarding investments in the context of “profit centers.” For instance, managers are now asked in advance to evaluate the efficacy (i.e. does the activity produce positive EVA) of expanding production capacity for a particular product line? Similarly, EVA is now being applied to “cost centers” as well. Managers of “cost centers” are being asked to justify new activities or even the existence of their function on the basis of EVA.

[00028] At first glance this may seem difficult because by definition a “cost center” does not generate revenue and it would appear that only a reduction in the operating expense and capital requirements to zero would improve the situation. According to the EVA methodology, the best result that can be achieved with respect to a cost center is a reduction in its negative impact on EVA. Therefore, a cost center or activity lacking revenue generating capabilities, would seemingly lack the ability to achieve a positive EVA.

[00029] For example, consider the annual cost of preventative maintenance on a piece of machinery. The expenditure of capital to maintain the piece of machinery does not produce new revenue nor does it decrease the operating expense. Therefore, the conventional EVA methodology teaches that managers should evaluate the impact of preventative maintenance activities on EVA as producing a negative result. However, it appears that the wrong questions are being asked in the evaluation of the Economic Value Added.

[00030] The division of a productive system into “profit” and “cost” centers is an arbitrary allocation of operating revenues to only a portion of the system that is required to produce and sell the product or service to the customer. For example, the evaluation of an investment in a new piece of machinery reveals the following:

[00031] (1) An initial capital outlay either produces a new revenue stream with a given operating cost over the life of the machine, or

[00032] (2) The initial capital outlay replaces an existing revenue stream at a reduced operating cost or

[00033] (3) A combination of the two.

[00034] In either case, one must be careful to capture the total operating expense over the lifetime of the machine. In order to capture the total operating expense over the lifetime of the machine, an accurate evaluation should include the preventive maintenance cost necessary to keep the machine productive over its expected lifetime.

[00035] Cash flows equally need to be adjusted for risk. However, methodologies and systems of the background art fail to provide a single system that offers the operator or manager the ability to accurately assess the Economic Value Added of all activities within an organization.

[00036] For instance, cost allocation and activity-based costing are additional examples of accounting systems that assign or link some cost(s) with related cost objectives. Salaries for a group of employees in an operating unit are indicative of costs (salaries) associated with the maintenance of a cost objective (the operating unit). Similarly, raw materials costs are often assigned or allocated to a product or group of products (cost objective). However, as in all of the foregoing examples, the preventative maintenance costs associated with a machine in an manufacturing process would be considered “negatives” under all of the previous approaches.

[00037] The present invention overcomes the shortcomings associated with the approaches of the prior art and achieves other advantages not realized by the prior art.

[00038] An object of the present invention is to provide organizations with a method and system for consistently identifying and measuring risks across the entire enterprise or any subpart of the enterprise.

[00039] A further object of the present invention is to provide organizations with a method and a system for identifying potential controls for any given set of identified risks.

[00040] A further object of the present invention is to provide a method and system for evaluating the economic value added of risk controls.

[00041] A further object of the invention is to provide organizations with, a method and system for selecting risk controls, setting control priorities, and establishing an optimal control budget so that the economic value added is maximized.

[00042] An object of the present invention is to integrate management controls and risk controls into a single system or methodology that will provide managers or operators with a tool to most efficiently allocate an organization's resources.

[00043] These and other objects are accomplished by a method for optimizing a selection of risk controls based upon maximizing the economic value added within a client's given risk control budget, wherein said method comprises the following steps: identifying and measuring risks; creating at least one risk control system based upon said risks; determining the economic value added of each risk control system; and selecting an optimal risk control system that has a maximum economic value added based upon the determining step.

[00044] These and other objects are further accomplished by a computer-based data processing system to enable an operator to create a risk control system providing a maximum economic value, wherein said system comprises: means for storing risk models, wherein said risk models include risks and corresponding risk exposures; means for storing specific risk control models further classified and arranged by at least industry type, organizational structure, and functional segments within each industry type; means for storing management risk control models further classified and arranged by at least industry type, organizational structure, and functional segments within each industry type; means for developing risk control systems by combining said specific risk and management risk controls into at least one client specific risk control system; and means for determining an optimum risk control system by calculating an Economic Value Added (EVA) of each client specific risk control system so that said operator can select the optimum risk control system that demonstrates a maximum Economic Value Added (EVA).

[00045] Advantages of the present invention will become more apparent from the detailed description given hereinafter. However, it should be understood that the detailed description and specific examples, while indicating preferred embodiments of the invention, are given by way of illustration only, since various changes and modifications within the spirit and scope of the invention will become apparent to those skilled in the art from this detailed description.

[00055] FIG. 3 shows a partial organizational chart of a manufacturing company. Each department of the company is further broken down into activities or functional segments. The maintenance department within the factory-service department of the company would be involved in daily activities that affect the performance of each of the remaining departments. However, many systems in the background art would focus on the decisions and budget of the maintenance department as primarily being a “cost center.”

[00056] The present invention provides a method and system that effectively calculates what the economic value added is of individual activities and processes throughout the entire organization, such as the maintenance department. The present invention provides the specific utility of integrating management and risk controls, whether applied by the president or the manager of the maintenance department, into a single system that can be applied to the individual functional segments (i.e., toward an individual maintenance procedure). The results are indications of the economic value added of each activity, process, or department that operates within the company's organizational structure.

[00057] As seen in the following example of the present invention applied toward an individual machine in a manufacturing process, the present invention provides an opportunity to calculate the real economic value added to a company and directly/indirectly resulting from the allocation of resources toward an activity. For instance, without preventive maintenance efforts, the expected lifetime of a machine is shorter and the probability that the expected revenue will be achieved is less. As discussed with respect to the background art, an evaluation of the cash flows without consideration or alleviation of risk produces estimates that are likely to be inaccurate.

[00058] The EVA impact of preventative maintenance can only be answered as part of a larger question involving the original investment in the machine. Similarly, the capital resources expended to maintain a safety management program are analogous to the capital expended on preventative maintenance. The whole question of safety efforts and EVA are more properly part of a larger question concerning the EVA calculation on the productive system in which the investment was originally made.

[00059] Employees or producers are additional necessary assets in a productive system. The protection of these productive assets is a necessary operating expense as well that would likely be viewed as a cost center without the possibility of generating a positive EVA.

[00060] It is often helpful when examining a productive system to focus on a particular set of processes and treat those processes as an “independent” subsystem that provides inputs to the rest of the productive system.

[00061] Examples in a typical organization, as seen in FIG. 2, include the maintenance department and its preventative maintenance program; the purchasing department and its system for procuring raw materials; the human resource department (Personnel) and its hiring processes; and the safety/inspection department and its safety system. However, each of these subsystems, despite their individual characteristics and requirements, is not truly separate from and “independent” of the total productive system.

[00062] When analyzing the safety system as an “independent system”, it is important to capture all of the cash flows in both the safety system and the productive system. Due to the lack of safety management, a certain level of anticipated operating expense for workers compensation, lost production efficiencies and governmental fines over the lifetime of the productive system, must be factored into the base EVA calculation for a productive system.

[00063] We can then evaluate the EVA impact of establishing a safety system by examining the impact of the system upon the base operating expense of the “non-safety managed” productive system versus the “safety managed” system. The EVA of the safety management system is the reduction in the productive system operating expense minus the cost necessary to implement the safety management system.

[00064] Considering the basic EVA formula:
EVA=(OR−OE)_AT−CC

[00066] OR=Operating Revenues

[00067] OE=Operating Expenses.

[00068] AT—Indicates that the calculation of Net Operating Profit must be adjusted for taxes
CC=Cost of Capital=Capital (C)×Capital Rate (C*)
Note that the cost of the investment shows up in two areas, OE & CC. A capital expenditure will have a depreciation component in OE and a cost of capital component in CC. However, this is not a double accounting. The capital is consumed over a period of time and allowance for its replacement is provided by the depreciation component. The true cost of the capital is the blended cost of debt and equity.

[00071] A breakout of the EVA factors associated with a Safety System will aid in considering the impact of the Safety System on the Total Productive System. The superscript “P” designates cash flows associated with the total Productive System and the superscript “S” designates cash flows associated with the Safety System in the following formulas demonstrating the effects of the Safety System on the Total Productive System:
EVA=([OR^P+OR^S]−[OE^P+OE^S])_AT−[CC^P+CC^S]
Since the only subsystem that generates changes in revenue is Sales, one can set the Total Revenue, TR, equal to [OR^P+OR^S], as a constant.
EVA=(TR·[OE^P+OE^S])_AT−[CC^P+CC^S]
The next step is to measure the cost of the current safety (cs) system (OE^S_CS & CC^S_CS). The “CS” subscripts denote cash flows associated with the current safety system; the “NS” subscripts denote cash flows associated with the productive system without the safety system; and the “I” subscripts denote cash flows associated with improvements to the safety system.

[00076] Next, the safety risk cost of the productive system being served by the current safety program (RC^P_CS) is measured. The safety risk cost of the productive system without the safety program (RC^P_NS) is then estimated. However simplified these steps may appear conceptually, one of ordinary skill in the art will appreciate that this is not a trivial exercise.

[00077] The ΔEVA (ΔEVA^CS) of the Current Safety System is the difference between the Productive System EVA without a Safety Subsystem (EVA^P_NS) and the Productive System EVA with the current Safety Subsystem (EVA^P_CS), in summary the ΔEVA^CS is defined by:
ΔEVA^CS=(EVA^P_CS)−(EVA^P_NS)
The productive operating expense can then be separated into the Risk Cost component (RC^P) and all other operating expenses (AOE^P)
EVA^Pcs=(TR−[AOEPcs+RCPcs+OEScs])^AT−[CC^Pcs+CC^Scs]
EVA^Pns=(TR−[AOE^Pns+RC^Pns)AT−[CCPns)

[00082] wherein OE^Sns & CC^Sns=0

[heading-00083] Since the only impact on the cost of capital of adding a safety system is the addition of the capital cost of the safety system, CC^Pcs=CC^Pns. Therefore
ΔEVA^CS=([AOE^Pns−AOE^Pcs]+[RC^Pns−RC^Pcs]−OE^Scs)_AT−CC^Scs

[00085] AOE^Pns−AOE^Pcs=Improvements in the Productive System Efficiencies, due to the introduction of better work methods and/or equipment to prevent injuries. We frequently find such improvements when introducing ergonomic improvements.

[00086] RC^Pns−RC^Pcs=Reductions in the Risk Cost. This would include reduced workers' compensation cost incurred for injured employees, reducing lost productivity efficiencies for injured employees on restricted duty and replacement workers and avoidance of fines that would be incurred in the absence of a safety system.

[00087] OE^Scs and CC^Scs are the total cost of the safety system.

[heading-00088] Since a decrease in the expenses results in an increase profit, thus an increase tax, we can make the tax adjustment by multiplying the expense adjustments by (1−Corporate Tax Rate). The final formula for safety EVA^S is:
ΔEVA^CS={(([AOE^Pns−AOE^Pcs]+[RC^Pns−RC^Pcs]−OE^Scs)·(1−CTR)}−[C^Scs·C*]
Similar reasoning shows that the ΔEVA for safety improvements is:
ΔEVA^IS={([AOE^Pcs−AOE^Pis]+[RC^Pcs−RC^Pis]−OE^Sis)·(1−CTR)}−[C^Sis·C*]

[00092] where

[00093] [AOE^Pcs−AOE^Pis] is the efficiency gain in the general productive system,

[00094] [RC^Pcs−RC^Pis] is the reduction in risk cost,

[00095] OE^Sis, is the annual operating expense required for the safety improvement,

[00096] CTR is the corporate tax rate,

[00097] C^Sis is the capital cost of the safety improvement and

[00098] C* is the cost of capital rate,

[00099] In summary, the change in EVA associated with an improvement in the safety system is equal to

• • [00100] Any improvements in the productive system efficiencies, plus
  • [00101] The reduction in risk cost, minus
  • [00102] The expense cost of the safety improvement,
  • [00103] All adjusted for tax, minus
  • [00104] The cost of capital for any capital cost associated with the safety improvement.

[00105] As an example consider a change in work layout and the addition of lift tables to control a material handling risk on an assembly line.

[00106] If the assembly line generates $10,000,000 in sales per year.

[00107] Operating profit is $500,000.

[00108] Materials and Supplies cost $4,500,000.

[00109] Labor costs are $3,500,000. Safety Risk Costs are $500,000.

[00110] Other GA&O are $1,000,000.

[00111] The corporate tax rate is 0.38 and the cost of capital rate is 0.095

[00112] The work layout redesign and lift tables have a capital cost of $200,000 and an expected lifetime of five years. $40,000 in annual depreciation and CC^sis=$200,000×0.095=$19,000 (cost of capital of the improvements).

[00113] There is an 80% probability that the safety improvements will reduce the safety risks costs by $200,000 per year, resulting in a $160,000 reduction in exposure (Probability of Success×Risk Costs=0.80*200,000).

[00114] In addition we expect a 5% reduction in labor cost because of the improved layout and ease of handling materials equal to $175,000.

[00115] Accordingly, to calculate the ΔEVA^IS for the expected five year lifetime of the investment we layout the EVA cash flows for each of the five years. $\begin{array}{c}\mathrm{Year}\mathrm{One}\mathrm{EVA}=\left[\mathrm{\$175}\text{,}000+\mathrm{\$160}\text{,}000-\mathrm{\$40}\text{,}000\right]\times \mathrm{.62}-\mathrm{\$19}\text{,}000\\ =\mathrm{\$163},900\end{array}$

[00116] Year Two EVA=$163,900

[00117] Year Three EVA=$163,900

[00118] Year Four EVA=$163,900

[00119] Year Five EVA=$163,900

[heading-00120] The net present value of these cash flows using a 9.5% discount rate is $629,328.27.

[00121] Therefore, the ΔEVA^IS=$629,328.27, and if the stock price earnings ratio is 21, then the Market Value Added (MVA) is $13, 215, 894.

[heading-00122] Optimizing the Economic Value Added of Risk Controls

[00123] The present invention involves a methodology for selecting a set of risk controls that provides the optimal economic value added for a given control budget. The present invention relies on the following unique combination of features to produce a risk optimization method, system, and software that maximizes the economic value added of each functional segment of an organization:

[00124] One aspect of the present invention provides assistance in identifying risks at multiple levels of an organization from an organization-wide analysis to a narrowly focused study of specific functional area such as environmental or treasury risk. The present invention provides exposure benchmark data to assist in quantification of the risks for clients or organizations that have not attempted similar analysis in the past. This is accomplished by the pre-development of risk models according to various business classes and functional segments. For instance, risk models for a variety of safety measures common within the paper manufacturing industry can be created, stored and reapplied across multiple organizations or departments within the same industry group or class.

[00125] A management system approach to risk that greatly enhances control effectiveness and reliability is further integrated into the present invention. This enables senior management to develop a proactive strategy designed to facilitate organizational goals, rather than respond in a reactive mode to demands from an outside party such as an insurance company or government agency. The approach is in conformity with the COSO framework and various governmental standards regarding risk management.

[00126] Any of the risk or management models developed or applied in the present invention, must allow client interaction, editing, and customization. This allows a client or manager the ability to define critical “value” parameters and to customize the risk and control model to fit their unique culture and situation. This is especially important as risk/management control models proposed in the present invention may be generic to the industry type or business class. By allowing the client or individual manager to structure their risk management system according to their own prioritized goals and experiences, the present invention will permit risk models that most accurately represent the unique characteristics of each organization or company.

[00127] The risk modeling and risk control optimizing methodology is designed so that it can meet the needs of many different segments of the client market. There are at least four ways of segmenting the client market that are useful for evaluating client demand:

[00128] Industry class—the system allows a client/operator to model risks and their associated control sets for different industry classes, such as general manufacturing, healthcare, transportation, telecom, utilities, etc.

[00129] Client size/complexity classes—The client market can be further divided based upon market size or revenue. For instance, the client market can be divided into four (or more broadly or narrowly if desired) size/complexity segments, which are roughly categorized by their sales value:

[00130] 1. Major Risk Management (>$5 billion)

[00131] 2. Risk Management ($1-5 billion)

[00132] 3. Middle Market ($0.25-1 billion)

[00133] 4. Commercial lines (<$0.25 billion)

[00134] Client Internal Organizational Customers—the system also allows an operator to structure/modify individual risk models so that they meet the needs of different customer segments within a client's organization. These customer segments might include A Board of Directors, Internal Auditers, Executive Management, Chief Compliance Officers, Various Functional Managers (Risk Managers, Environmental Managers, Safety Managers, Fleet Managers, Property Managers, etc.) or Department Heads.

[00135] Country Classification—The country in which the customer is located will have an impact on perceived need and value. Countries such as Canada, Australia, New Zealand, Great Britain have regulatory requirements for corporate governance and risk management that work to highlight the need for better risk identification and a management system approach to risk controls. To a lesser extent in the United States the accounting profession, large stockholders and various legal and regulatory agencies are also highlighting the need for better risk identification and a management system approach to risk controls. Various tax structures may be present according to the country in which an individual company resides or operates that may severely affect the manner in which Economic Value Added can be calculated.

[00136] Furthermore, it is assumed that these aforementioned classifications will not be limiting of the possible organization or structure of the methodology or system according to the present invention. For instance, clients may desire that risk controls and management controls be classified by their duration (time it takes to implement a measure, short term versus long term strategies), labor requirements (labor intensive or not), etc. . . . It is therefore possible to further examine the needs of various market segments that are currently recognized by the customer and produce or identify additional needs that exist, but are not currently recognized by the customer.

[00137] The customer inherently values solutions that satisfy recognized needs. The present invention provides a useful tool to identify needs that were never even realized by a customer until the Economic Value Added of a decision is adequately explained and accepted.

[00138] Once accurate risk models and their associated risk and management control strategies have been applied/developed in the foregoing aspects of the present invention, one of the final steps is to determine if the risk model is actually ideal. The risk model approach once optimized for EVA answers the question of whether there is any value to a particular set of control activities using a recognized valuation methodology. It enables senior management to assure that scarce resources are only allocated in a fashion that provides optimal benefit for the entire organization.

[00139] Changes and comparisons can also be accomplished by further analyzing the effects of various models that may each come close to producing the same optimized Economic Value Added through more than one approach. The risk model and its associated risk and management controls can then be selected according to additional preferences such as available cash flows or scheduling requirements.

[00140] The last critical element of the present invention includes completing the risk management method or system through the optimization of the economic value added by applying a variety of control efforts. This effort requires selecting a mix of management controls and risk controls that will maximize the reduction in the exposure with the minimum investment in cost and time. Optimization is complicated by the fact that separate controls are often interdependent with regard to their ability to reduce the risk exposure.

[00141] In order to proceed with a solution to this problem the present inventors have categorized the necessary controls as management risk controls (Mi) and specific risk controls (Sj), wherein the total set of risk controls (U) collectively includes both types.

[00142] Management risk controls (Mi) are those controls that are part of the risk management system and effect the whole universe of risk. These controls also influence the effectiveness of other controls that are targeted at specific risks. An example would be a safety audit program.

[00143] Specific risk controls (Sj) are those controls that are targeted at specific risks. These controls are dependent upon the management controls, but are independent of other risk controls. An example would be provision of lift tables to reduce the likelihood of back injury arising out of the lifting risk.

[00144] The present invention incorporates a methodology, system, and software for selecting a set of controls that optimizes the economic value added within a given budget. The methodology needs to be theoretically rigorous and practical in its application.

[00145] The present invention considers the master set of risk controls, U, that is applied to a set of risk exposures, E^R(e1, e2, e3, . . . er), where r=the total number of risk exposures, associated with a set of risks R(r1, r2, r3, . . . rq), where q=the total number of risks. The total exposure, E_T is:
E_T=Σer, where 1<r<q

[00147] Risk exposure er is defined as the product of the risk likelihood (i.e., the likelihood of the occurrence, for instance, 50% chance that worker will injure his/her back without proper load handling training) times the sum of the worst case severity for all consequence of that risk (i.e., $25,000 in worker's compensation and medical expenses).

[00148] Now the master set of risk controls U is separated into a set of management risk controls M_i that operate (work to reduce) on the entire set of risk exposures, E_R,. This set of management risk controls, M_i (m₁, m₂, M₃, . . . m_n), where n=the total number of management risk controls; and a set of specific risk controls that operate on a specific risk exposure, er, call it S_j (s₁, s₂, s₃, . . . s_j), j=the total number of risk controls. As aforementioned, the master set of risk controls U is defined by the sum of the sets of management risk and specific risk controls:
U=Mi+S_j
M_i and S_{j a}re interdependent with regard to their ability to reduce E_T. In other words, specific risk controls are not fully effective without management risk controls. Management risk controls have limited impact without well thought out and implemented risk controls. For instance, management risk controls operate at two levels on the risk exposure. They have a small direct effect on the entire risk exposure, E_T. They also work to make the individual risk controls s_j of each set of specific risk controls Sj, operate more efficiently.

[00151] The first effect on the risk exposure E_T is d_i, which produces a reduction of the entire risk exposure E_T and is quantified as a % reduction to be applied to E_T. The second effect on the risk exposure x_i, is measured and quantified as an effectiveness % to be multiplied times the 100% effective reduction %, b_j, of each individual risk controls, s_j, which are defined hereinafter. This effectiveness multiplier “x_i”, or second effect on the risk exposure, x_i is described in greater detail hereinafter.

[00152] There are two additional factors that the present inventors have incorporated into the present invention. In order to optimize the benefit obtained from a particular set of controls, the cost of the control (c_i) and the time necessary to implement the control (t_i) are considered. Note that in the preferred embodiment, t_i is a measure of the time duration to complete the task and not a measure of the man-hour cost required to complete the task.

[00153] Therefore, the above additional factors collectively are represented by considering each management risk control to be defined by four parameters M_i(d_i, x_i, c_i, t_i).

• • [00154] M_i=Management risk controls
  • [00155] d_i=First Effect on Risk Exposure, ET, % reduction
  • [00156] x_i=Second Effect on Risk Exposure, ET, % reduction (effectiveness multiplier, really varies the effectiveness of the risk control benefit, bj, of individual risk controls)
  • [00157] c_i=Individual Cost of the Control, $
  • [00158] t_i=Time Duration, time necessary to complete the task

[00159] Specific risk controls, S_j, work at a single level on specific risk exposures, e_r. The benefit to be obtained by the risk control, b_j, is defined as a % reduction in exposure that could be obtained by the risk control, if it were 100% effective over the entire life of the control. For example, if the control works perfectly as designed one might expect a 50% reduction in the exposure. This risk control benefit “b_j” is the same benefit that is interdependent on the Second Effect on Risk Exposure, x_i defined previously. As with management risk controls two other factors are important in evaluating the value of the control, cost (ε_j) and time (T_j).

[00160] Accordingly, each specific risk control can therefore be defined by three parameters:
S_j (b_j, ε_j, T_j).
For a particular subset of management risk controls, M(m₁, m₃, M₅, . . . m_a) and specific risk controls, S(s₂, s₅, s₆, s₉, . . . s_n) we can calculate the decrease in exposure, ΔE, as follows:
ΔE=[(d₁+d₃+d₅+ . . . +d_a)·E_T]+[(x₁+x₃+x₅+ . . . +x_a)·(b₂·e₂+b₅·e₅+b₆·e₆+b₉·e₉+ . . . +b_n·e_n)]
Now note that three boundary conditions apply. (1) A management system cannot make an activity more than 100% effective, Σ x_i≦1; (2) A system cannot reduce the total exposure below zero, ΔE≦E_T; and (3) no matter how many risk controls one applies to a risk exposure, it cannot be reduced below zero:

• • [00165] (1) Σx_i≦1,
  • [00166] (2) ΔE≦E_T
  • [00167] (3) (x₁+x₃+x₅+ . . . +x_a)·(b₁·e_m)≦e_m, wherein b₁ is the benefit parameter of the set of risk controls operating on a risk exposure “e_m.”
    The cost of the controls is therefore defined by:
    Cost=(c₁+c₃+c₅+ . . . +c_a)+(ε₂+ε₅+ε₆+ε₉+ . . . ε_n)
    Further, Cost is controlled by the following boundary condition:
     Cost≦Control Budget
    As aforementioned, there were two different time parameters defined hereinabove, t_i and T_j. The total time required to implement the controls is the controlling parameter or value of these two. In other words, the greatest value of t_i or T_j applies.

[00173] The application of this model in the present invention is an invaluable tool in efforts to solve the optimization problem and to incorporate EVA analysis into the model.

[00174] The first step is to specify for a particular set of risks, R_p, a set of potential management risk controls, M_p, and a set of potential specific risk controls, S_p. The above model assumes that management risk controls have an equal effect upon all specific risk controls and that a specific risk control is specific to a single risk. These assumptions will influence how management and specific risk controls are defined.

[00175] If one examines the equation for ΔE, one can see that a system with no management controls has a ΔE=0, regardless of the number of risk controls that are in place. Since a situation where management has a complete lack of interest in risk exposures is rarely encountered, only three levels of basic non-systematic management control are defined (more or less can be added/removed as desired):

• • [00176] m_i=basic management interest, the minimum level of management involvement, where d_i=0.01 and x_i=0.05
  • [00177] m₂=average management interest, where d₂=0.02 and x₂=0.15
  • [00178] m₃=high management interest, where d₃=0.03 and x₃=0.25

[00179] Every set of management risk controls will include one of the above basic non-systematic management controls applied to the overall risk model. Note that at this point in time the values of d_i and x_i are arbitrary. They are only established to reflect that there is some basic value even in ad hoc management efforts. As desired by the operator applying the present invention, these values can be preset and remain unchanged for a particular organization or enterprise, and the operator can select the parameter or variable each time the present invention is applied.

[00180] Having listed out M_p and S_p, the next step is to establish the values of the control parameters d_i, x_i, c_i, t_i, b_i, ε_n, and T_j. Now the cost and time parameters are unique to each situation and must be established for each application. However, it would be helpful, and is included within the details of the present invention, that preset estimates or industry norms for these values can be utilized as baseline figures.

[00181] One of the means of implementing the present invention, involves the development of a computerized database(s) that capture the cost and time parameters along with such factors as would allow one to estimate the parameters for different situations. Included in the database are values of all of the various control parameters, with individual values. of each parameter being associated with respective risk and management controls.

[00182] Initially, before the present invention has enjoyed the customization and ability to adapt and incorporate “real world” data and values of the various control parameters aforementioned, the nearly endless types of risk control and management control strategies that are presently applied in modern business systems along with their control parameters can be created and preset, baselined, or pre-established according to various market and industry classifications that might be available through corporate experiences, customer/client interview and surveys, etc. . . . These values and information can be utilized to develop a knowledge base, in the form of tables or computerized databases that lend themselves to editing and variation in accordance with client customization and changes in approach.

[00183] For example, the present inventors have pre-established by class of business the values of d_i, x_i and b_j, so that the values have some statistical validity. This can be accomplished by surveys, customer feedback, accident reports, insurance claims, etc. across several organizations in a particularly market. In addition, the organizations applicable to the present invention are not limited to corporations or private endeavors, but can equally be applied to any organization, public or private, non-profit, governmental agencies, corporations, or small entity companies, etc. . . .

[00184] The present invention incorporates all of the aforementioned information, and applies it into a unique form of EVA analysis to further optimize the model(s). For example, the model as aforementioned is structured around percentage reductions in exposure. However, exposure is not defined with regard to its time span, i.e. the likelihood is not specified for a particular period of time. In estimating the exposures the present inventors apply consistent time periods for the defining the likelihood of success. In the following example and illustration of the EVA methodology of the present invention, an annual time span for the likelihood of success is used.

[00185] In order to maintain some practical simplicity in the following example, it is assumed that all factors involved in selecting a change in controls are constant over the time period that the investment is being evaluated over. However, with the benefit of computer-aided analysis, it will be obvious that the following methodology, even in it final form presented hereinafter, can be further expanded on to incorporate additional parameters, controls of varying time duration, and controls which associate cyclical trends as opposed to a single reduction in exposure (i.e., % reduction might vary from 19% to 45% over various time periods or might achieve a sinusoidal/cyclical responses).

[00186] In the following example, when evaluating a control improvement over a five-year period, then the exposures and control parameters will be held constant over the five-year period.

[00187] The safety improvement discussed hereinabove introduced portions of the methodology that is hereinafter developed in greater detail.

[heading-00188] The ΔEVA for safety improvements is:
ΔEVA^IS={(([AOE^P_cs−AOE^P_is]+[RC^P_cs−RC^P_is]−OE^S_is)·(1−CTR)}−[C^S_is·C*]

[00190] where [AOE^P_cs−AOE^P_is] is the efficiency gain in the general productive system,

[00191] [RC^P_cs−RC^P_is] is the reduction in risk cost,

[00192] OE^S_is, is the annual operating expense required for the safety improvement,

[00193] CTR is the corporate tax rate,

[00194] C^Sis is the capital cost of the safety improvement and

[00195] C* is the cost of capital rate,

[00196] However, this equation can be generalized and applied for any set of risk improvements as follows:
ΔEVA^IR={(([AOE^P_cr−AOE^P_ir]+[RC^P_cr−RC^P_ir]−OE^R_ir)·(1−CTR)}−[C^R_ir·C*]
Now for a management risk control m_i being evaluated over y years
C^R_ir=c_i and OE^R_ir=c_i/y

[00200] Note that the management control cost must be set equal to the total operating expense and capital cost for the y period of years. Also note that y must be constant for all management and specific risk controls being considered.

[heading-00201] The reduction in risk cost is set equal to the reduction in total exposure.
[RC^P_cr−RC^P_ir]=d_i·E_T
If the Corporate Tax Rate and the Cost of Capital are known (or simply supplied as default values), then the general equation becomes
ΔEVA^IR={(([AOE^P_cr−AOE^P_ir]+[d_i·E_T]−c_i/y)·(1−CTR)}−[c_i·C*]

[00205] However, the current optimization model fails to account for any improvements in the efficiency of the general productive system, [AOE^P_cr−AOE^P_ir]. Therefore, a fifth parameter is added to the management risk controls, ρ_i, and a fourth parameter is added to the specific risk controls, θ_j. Generally the effect on the general productive system efficiency will be negligible. However, both parameters are defined in terms of dollars saved per year.

[00206] Therefore, when considering each management risk control to be defined by five parameters M_i (ρ_i, d_i, c_i, t_i) and each specific risk control to be defined by four parameters S_j (θ_j, b_j, ε_j, T_j). In the revised model for a particular subset of management risk controls, M (m₁, m₃, m₅, . . . M_a) and specific risk controls, S(s₂, s₅, s₆, s₉, . . . s_n) we can define the total benefit ΔB, as the general productivity gain ΔP, plus the decrease in exposure ΔE as follows:

[heading-00207]  ΔB=ΔP+ΔE, where
ΔE=[(d₁+d₃+d₅+ . . . +d_a)·E_T]+(x₁+x₃+x₅+ . . . +x_a)·(b₂·e₂+b₅·e₅+b₆·e₆+b₉·e₉+ . . . +b_n·e_n)
and,
ΔP=(ρ₁+ρ₃+ρ₅+ . . . +ρ_a)+(x₁+x₃+x₅+ . . . +x_a)·(θ₂+θ₅+θ₆+θ₉+ . . . +θ_n)

[00211] Similarly, three boundary conditions still apply. Wherein, (1) A management system cannot make an activity more than 100% effective, Σ x_i≦1; (2) A system cannot reduce the total exposure below zero, ΔE≦E_T; and (3) no matter how many risk controls one applies to a risk exposure, it cannot be reduced below zero:

• • [00212] (1) Σ x_i≦1,
  • [00213] (2) ΔE≦E_T
  • [00214] (3) (x₁+x₃+x₅+ . . . +x_j)·(b₁·e_m)≦e_m, wherein b₁ is the benefit parameter of the set of risk controls operating on a risk exposure “e_m.”
    The cost of the controls remains unchanged and the total time required to implement the controls is still governed by the controlling time parameter, i.e., the greater value of t_i or T_j. Accordingly,
    Cost=(c₁+c₃+c₅+ . . . +c_a)+(ε₂+ε₅+ε₆+ε₉+ . . . ε_n)
  • [00217] where, Cost s Control Budget
    Returning to the calculation of ΔEVA^IR_m for a management risk control,
    ΔEVA^IR_m={([AOE^P_cr−AOE^P_ir]+[d_i·E_T]−c_i/y)·(1−CTR)}[c_i·C*]
    where [AOE^P_cr−AOE^P_ir]=ρ_i
    or
    ΔEVA^IR_m={(ρ_i+[d_i·E_T]−c_i/y)·(1−CTR)}−[c_i·C*]
    Therefore, for an individual specific risk control sj being evaluated over y years,
    C^R_ir=ε_j and OE^R_ir=ε_j/y

[00225] The reduction in risk cost is set equal to the reduction in exposure, so that
RC^P_cr−RC^P_ir=(x₁+x₃+x₅+ . . . +x_a)·(b_j·e_j)
[AOE^P_cr−AOE^P_ir]=(x₁+x₃+x₅+ . . . +x_a)·θ_j
If given the Corporate Tax Rate and the Cost of Capital, then
ΔEVA^IR_m={(([(x₁+x₃+x₅+ . . . +x_a)·θ]+[x₁+x₃+x₅+ . . . +x_a)·(b_j·e_j)]−[ε_j/y])·(1−CTR)}−[ε_j·C*]

[00230] Optimization of the EVA through Integration of Risk and Management Controls

[00231] An examination of the economic value added (EVA) of the above methodology, indicates that the EVA contribution of a risk control can only be evaluated in the context of the management risk controls that are in place or currently being implemented. In addition, the introduction of a new management risk control improves the effectiveness of not only new risk controls, but also the existing risk controls.

[00232] Therefore, the Δ^IEVA of the new set of management risk controls and specific risk controls being proposed as part of a risk improvement can only be calculated by comparing the ΔEVA of the current set of controls to the ΔEVA of the current set plus the new controls.

[00233] The total ΔEVA ^CR_T for the current set of controls is equal to the sum of ΔEVA ^CR_m for all current management risk controls and Δ EVA ^CR_c for all current specific risk controls.

[00234] The total Δ EVA ^IR_c for a risk improvement for all risk controls after implementation of the new controls becomes (in simplified form):
Δ ^IEVA=Δ EVA ^IR_T−Δ EVA ^CR_T

[00236] Applying this principle to a current (initial set of management risk controls) set of management controls M_c(m₂, m₅, m₆) and a current set of specific risk controls, S_c(s₁, s₃, s₄, s₅) and a proposed improved set of management risk controls, M^I(m₃, m₄, m₅, m₆, m₇, m₈)ⁱⁱ and an improved set of specific risk controls, S^I(s₁, s₃, s₄, s₅, s₆, s₇, s₈, s₉), then the equation becomes: $\begin{array}{c}{\Delta }^{I}EVA=[\{\{(\left[{\rho }_3+{\rho }_4+{\rho }_5+{\rho }_6+{\rho }_7+{\rho }_8\right]+\\ \left[\left(d_3+d_4+d_5+d_6+d_7+d_8\right)·E_T\right]-\\ \left[\left(c_3+c_4+c_5+c_6+c_7+c_8\right)/y\right])·\left(1-CTR\right)\}-\\ {\left[\left(c_3+c_4+c_5+c_6+c_7+c_8\right)·C^{*}\right]\}}_m+\\ \{\{(\left[x_3+x_4+x_5+x_6+x_7+x_8\right)·\\ \left({\theta }_1+{\theta }_3+{\theta }_4+{\theta }_5+{\theta }_6+{\theta }_7+{\theta }_8+{\theta }_9\right)]+\\ [\left(x_3+x_4+x_5+x_6+x_7+x_8\right)·\\ (b_1·e_1+b_3·e_3+b_4·e_4+b_5·e_5+b_6·e_6+b_7·\\ e_7+b_8·e_8+b_9·e_9)]-\\ \left[\left({\varepsilon }_1+{\varepsilon }_3+{\varepsilon }_4+{\varepsilon }_5+{\varepsilon }_6+{\varepsilon }_7+{\varepsilon }_8+{\varepsilon }_9\right)/y\right]·\left(1-CTR\right)\}-\\ {\left[\left({\varepsilon }_1+{\varepsilon }_3+{\varepsilon }_4+{\varepsilon }_5+{\varepsilon }_6+{\varepsilon }_7+{\varepsilon }_8+{\varepsilon }_9\right)·C^{*}\right]\}}_{\mathrm{Imp}}-\\ [\{\{(\left[{\rho }_2+{\rho }_5+{\rho }_6\right]+\left[\left(d_2+d_5+d_6\right)·E_T\right]-\\ \left[\left(c_2+c_5+c_6\right)/y\right])·\left(1-CTR\right)\}-[\left(c_2+c_5+c_6\right)·\\ {C^{*}]\}}_m+\{\{[\left(x_3+x_4+x_5+x_6+x_7+x_8\right)·\\ \left({\theta }_1+{\theta }_3+{\theta }_4+{\theta }_5+{\theta }_6+{\theta }_7+{\theta }_8+{\theta }_9\right)]+\\ [\left(x_3+x_4+x_5+x_6+x_7+x_8\right)·\\ (b_1·e_1+b_3·e_3+b_4·e_4+b_5·e_5+b_6·e_6+b_7·e_7+b_8·\\ e_8+b_9·e_9)]-[({\varepsilon }_1+{\varepsilon }_3+{\varepsilon }_4+{\varepsilon }_5+{\varepsilon }_6+{\varepsilon }_7+{\varepsilon }_8\\ +{\varepsilon }_9)/y]·\left(1-\mathrm{CTR}\right)\}[({\varepsilon }_1+{\varepsilon }_3+{\varepsilon }_4+{\varepsilon }_5+{\varepsilon }_6+{\varepsilon }_7+\\ {{{\varepsilon }_8+{\varepsilon }_9)·C^{*}]\}}_c]}_{\mathrm{Cur}}\end{array}$

• • [00237] where, Imp designates the Improved set of controls and Cur designates the Current set of controls

[00238] This equation can be further generalized and applied to calculate the change in EVA of a proposed improvement, Δ ^IEVA, as $\begin{array}{c}{\Delta }^{I}EVA=[\{\{\left({\left[\sum {\rho }_i\right]}^I+\left[{\left(\sum d_i\right)}^I·E_T\right]-\left[{\left(\sum c_i\right)}^I/y\right]\right)·\\ {\left(1-CTR\right)\}-\left[{\left(\sum c_i\right)}^I·C^{*}\right]\}}_m+\\ \{\{(\left[{\left(\sum x_i\right)}^I·{\left(\sum {\theta }_i\right)}^I\right]+\left[{\left(\sum x_i\right)}^I·{\left(\sum b_j·e_j\right)}^I\right]-\\ {{\left[\left(\sum {\varepsilon }_j^I\right)/y\right])·\left(1-CTR\right)\}-\left[\left(\sum {\varepsilon }_j^I\right)·C^{*}\right]\}}_c]}_{\mathrm{Imp}}-\\ [\{\{\left({\left[\sum {\rho }_i\right]}^C+\left[{\left(\sum d_i\right)}^C·E_T\right]-\left[{\left(\sum c_i\right)}^C/y\right]\right)·\\ {\left(1-CTR\right)\}-\left[{\left(\sum c_i\right)}^C·C^{*}\right]\}}_m+\\ \{\{(\left[{\left(\sum x_i\right)}^C·{\left(\sum {\theta }_i\right)}^C\right]+\left[{\left(\sum x_i\right)}^C·{\left(\sum b_j·e_j\right)}^C\right]-\\ {{\left[\left(\sum {\varepsilon }_j^C\right)/y\right])·\left(1-CTR\right)\}-\left[\left(\sum {\varepsilon }_j^C\right)·C^{*}\right]\}}_c]}_{\mathrm{Cur}}\end{array}$
Accordingly, the present inventors have succeeded in expressing the Δ ^IEVA in terms of the risk exposure, a set of control parameters, the control budget, the corporate tax rate and the cost of capital rate. The optimal set of controls is that set having the greatest Δ ^IEVA.

[00240] The present invention therefore relies on the creation, storage, reuse, and modification of risk and management controls in order to create a knowledge base for risk models. Table I and Table II demonstrate sample applications of the aforementioned methodology wherein Management Risk and Specific Risk Controls are defined along with their respective control parameters.

[00241] A system according to one preferred embodiment of the present invention would include a computerized database for storing and editing risk models, wherein the risk models are classified by industry type, organizational structure, and functional segments within each industry type. Additional classifications can be incorporated into the knowledge base. For instance, the risk models can be developed and classified according to their respective countries. For instance, a company or organization operating within countries that belong to the European Union may be subject to unique codes, tax rates, management/risk control sets, etc.

[00002]

TABLE I
MANAGEMENT CONTROLS
			ρi/unit		di	xi
			Production		Direct	Mgmt
			Efficiency		Exposure	Efficiency	ci-unit		ti
	Management Control	Dependency	Factor	ρi-unit	Reduction	Factor	Cost	ci-unit	Time
m1	Basic Non-Systematic Management		$0		.01	.05	$0		0 wks
m2	Average Non-Systematic		$0		.02	.15	$0		0 wks
	Management
m3	Good Non-Systematic Management		$0		.03	.25	$0		0 wks
m4	Form Risk Steering Group		$10,000	Business	.10	.15	$2,000	member	4 wks
				Unit
m5	Appoint Risk Manager		$0		.05	.25	$50,000	billion sales	16 wks
m6	Define Operational Performance		$0		.05	.25	$25,000	billion sales	26 wks
	Standards
m7	Distribute Responsibility for		$1,000	Business	.05	.20	$10,000	billion sales	4 wks
	Performance			Unit
m8	Establish Risk Prioritization System		$0		.05	.05	$10,000	billion sales	12 wks
m9	Establish Risk Identification		$0		.10	.00	$10,000	billion sales	26 wks
	Procedure
m10	Audit Compliance with	m6	$0		.05	.25	$50,000	billion sales	52 wks
	Performance Standards
m11	Establish Exposure Based Cost		$0		.05	.15	$10,000	billion sales	16 wks
	Allocation
m1	Additional Management Controls		$	unknown	unknown	unknown	unknown	unknown	unknown

[00002]

TABLE II
RISK CONTROLS
			θi/unit		bi
			Production		% Exposure
			Efficiency		Reduction	εi/unit		Ti
	Risk Control	Risk	Increase	θi-unit	Factor	Cost	εi-unit	Time
s1	Provide Machine Guards	r1	$0		.9	$150	machine	4 wks
s2	Provide Fall Protection	r2	$0		.9	$25	situation	4 wks
s3	Provide Lift Tables	r3	$200	table	.75	$200	table	8 wks
s4	Supervisors Perform Weekly	r4	$0		.3	$1,250	supervisor	4 wks
	Hazard Inspection
s5	Label Hazardous Materials	r5	$0		.1	$1,000	plant	16 wks
s6	Lock out/tag out program	r6	$0		.8	$250	machine	8 wks
s7	Train Employees in correct	r3	$100	employee	.5	$1	employee	16 wks
	lifting procedure
si	Additional Risk Controls	ri	$		unknown	$	unknown	unknown

[00242] As seen in the foregoing Tables (I-II), any risk model can be built by selecting pre-selected risk and management controls. However, if the knowledge base is inadequate for a particular task, the database should be fully capable of allowing an operator to manipulate existing controls and to add/edit additional controls (risk or management). Furthermore, the same risk control may have different parameters for separate organizations or functional segments. Accordingly, an operator may wish to simply adjust the values associated with a pre-existing risk or management control.

[00243] As further seen in the accompanying Tables, the exposures associated with each risk are also defined within the computerized database. If possible, a baseline of unit exposures that can be extended against some scaling factor may be used initially. As the operator learns more about a particular client or industry, then the specific parameters associated with each control can be further optimized.

[00244] FIG. 4 shows a flow chart of a methodology according to an embodiment of the present invention. FIG. 5 shows a flow chart of a portion of the methodology shown in FIG. 4. FIG. 6 shows a flow chart of a portion of the methodology shown in FIG. 4. FIG. 7 shows a flow chart of a portion of the methodology shown in FIG. 4. FIG. 8 shows a flow chart of a portion of the methodology shown in FIG. 4.

[00245] As seen generally in FIG. 4, one embodiment of the present invention is shown that incorporates several steps in the process of defining an optimal client risk control system. When the process of optimization of a set of risk control begins (100), the first step required is to identify and measure applicable client risks (200), then to create and customize risk control models (300) based on the client risks identified in the previous step (200). The client's control budget is then optimized by one of two approaches: optimization of a control system within a given budget (400) or optimization of a control system and budget (500). Upon completion of either of these approaches, the optimal client risk control system can then be selected. The individual portions of the methodology according to an embodiment of the present invention will be described hereinafter with reference to the accompanying figures.

[00246] As seen in FIG. 5, identification and measuring of risks applicable to each client can involve several complicated and detailed steps. In order to create an applicable, client-specific risk profile, the operator must create and store lists of parameterized risks that are applicable to a particular client. If current risks already stored within a given knowledge base satisfy the client's' objectives and/or characteristics, this step is reduced to a simpler process of simply extracting those risks that are predefined. However, it is more likely that a client's objectives will require the operator of the present invention to create and store lists of parameterized risks based on the client's individual characteristics.

[00247] For instance, factors considered in modeling client risk profiles may include the industry type, organizational structure, organizational/client objectives and functional segments within each industry type. The operator at this point in the process may find it advantageous to ensure that a corresponding risk has been identified for each of the client's objectives. If a risk has not been identified, then it is more likely than not that the operator/client still needs to identify the risk associated with the client objective.

[00248] Once an operator determines that all of the applicable risks have been identified and measured, the operator inputs client characteristics and applies appropriate scaling factors. Tables I and II of the present application, help to demonstrate some of the applicable management risk and specific risk controls and their associated parameters and characteristics. The operator can then calculate and classify a client's risk exposures (for each identified risk in the client risk profile) based upon the scaled client risk profile just created.

[00249] Accordingly, the operator can then create and store client specific risk models. For a specific client, the operator has identified and measured all of the applicable client-specific risks once a client composite risk model (201) has been created and stored that requires no further adjustment and incorporates all of the actual risks affecting an individual client.

[00250] Once the client composite risk model (201) has been created (objective of step 200), the operator must create and customize all corresponding risk controls that work to reduce a client's risk exposures. As seen in more detail in FIG. 6 and discussed hereinabove, the risk control models are created from parameterized sets of Management Risk Controls (M_i) and Specific Risk Controls (S_j). In this step (300), the operator must create and store sets of both types of risk controls in order to create the master set of risk controls (U).

[00251] This involves creating and storing (if not already in the knowledge base or database) sets of parameterized Management Risk Control Models (M_i) and Specific Risk Control Models (S_j) for every risk model identified in the Client Composite Risk Model (201) created in the previous step (200). The operator then applies client specific scaling factors and time parameters to the control models [ for instance, M_i(ρ_i, d_i, x_i, c_i, t_i) and S_j (θ_j, b_j, ε_j, T_j)].

[00252] The operator and/or client can then select and determine which control models must be included or excluded from the final Risk Control System (301). This is accomplished by at least one of the two processes shown in more detail in FIG. 7 (400) and FIG. 8 (500). At this branch in the inventive process, the operator must determine if the client wishes to optimize the final Risk Control System (301) for a given budget (400) or if the budget amount is part of the optimization output (500).

[00253] As seen in FIG. 7, the control budget amount may already be preset or limited for the client. In this case, the operator creates and stores a first Risk Control Model (302) for the Client Composite Risk Model (201). The operator then can calculate and store the economic value added of the first Risk Control Model (302). The operator can then create a comparative/additional (i.e, different than the first model 302) Risk Control Model (303) for the client risk. This allows the operator to calculate and store the economic value added of additional (as many as desired by the client/operator) risk control models incorporating various control strategies, emphasizing one client objective over another, etc. . . . The operator ensures that all of the additional and comparative Risk Control Models (302, 303) have been evaluated and the client/operator is thereby well suited to select the final Risk Control System (301) that produces the greatest economic value added. This comparative process has been already discussed in a preferred embodiment hereinabove (See Optimization the EVA through Integration of Risk and Management Controls).

[00254] Alternatively, the client/operator may have the advantage of being able to first select the final Risk Control System (301) and then allocate funding for its implementation. One of ordinary skill in the art will appreciate that the alternative process defined in FIG. 8 (500) is very similar to that shown in FIG. 7 (400), with the exception of the point in the process where the control budget is introduced. Optimization of the Control System and the budget is accomplished in the second approach (500). In the first approach, the operator is working within a predefined budget.

[00255] In addition, the present invention will incorporate a computer-based data processing system to enable an operator to create the final risk control system providing a maximum economic value, wherein the system will comprise a means for storing risk models, wherein the risk models include risks and corresponding risk exposures. The system must include means for storing specific risk control models and means for storing management risk control models further classified and arranged by at least industry type, organizational structure, and functional segments within each industry type. The system should further include means for developing risk control systems by combining the specific risk and management risk controls into at least one client specific risk control system.

[00256] The various means for implementing the aformentioned computerized data processing system can incorporate a series of electronic databases or a single database that incorporates all of the information into a large tabular format, with the fields permitting characterization of the data into risk models, specific risk controls and management risk controls. One of ordinary skill in the art will appreciate that a standalone system can be created using known programming languages (i.e., Dbase) and database software or the data processing system can incorporate links to or operate within one of several known operating systems or software suites (i.e., MS Access, MS Office, etc. . . . ).

[00257] In addition, the system must incorporate a means for determining the optimum risk control system by calculating the Economic Value Added (EVA) of each client specific risk control system so that said operator can select the optimum risk control system that demonstrates a maximum Economic Value Added (EVA). This can be accomplished by any known computer aided mathematical analysis, stored functions within a database structure, or dedicated microprocessor.

[00258] In addition, it is a feature of the present invention that a processor-readable article of manufacture be utilized to store the method of the present invention. This can be a program having embodied thereon software comprising a plurality of code segments that implements the method of any one or all of the steps defined by FIGS. 4-8, in order to enable an operator to optimize a selection of risk controls based upon maximizing the economic value added within a given risk control budget, wherein

[00259] The invention being thus described, it will be obvious that the same may be varied in many ways. Such variations are not to be regarded as a departure from the spirit and scope of the invention, and all such modifications as would be obvious to one skilled in the art are intended to be included within the scope of the following claims.