## 3 ALARP and CAPM. A Model for the Investment Risk Management
### Phases of the Risk Assessment Model  
The investment risk management model follows the logical and operational steps of the risk management process described in Figure 1.  
Step 1: Establish the contextIn this first phase, it is first required to establish the objective that the financial operator intends to achieve, i.e., to prevent the investment failure. Therefore, the costs and benefits of the project are estimated, the analysis period is determined and the return on investment is assessed, using financial performance indicators such as Net Present Value (NPV), Internal Rate of Return (IRR), Payback Period, and Benefit-Cost ratio. Step 2: Risk assessmentThis phase consists of the following three steps: identification of risk variables; risk analysis; risk estimation. Figure 5: Risk analysis steps in the economic evaluation of the projects. _Step 2.1. Identification of risk variables._ This can be done by applying sensitivity analysis, which enables the identification of those project variables whose variations (positive or negative) have the greatest impact on the financial performance of the initiative. * _Step 2.2. Risk analysis,_ first qualitative then quantitative. The qualitative risk analysis comprises a list of the adverse events to which the project is vulnerable and the resulting definition of the risk matrix. From this matrix it is then possible to interpret, for each adverse event, the relative level of risk based on the probability of occurrence and the severity of the impact. The quantitative risk analysis requires first the attribution of the probability distribution for each risk variable. This distribution can be derived from experimental data, similar cases in the literature or expert consultations. Implementing Monte Carlo analysis, using specific software, we then derive the probability density function and the cumulative probability distribution of the financial performance indicator. The former provides the expected or average value of the indicator, while the cumulative probability distribution shows the probability of having an IRR above or below a certain critical value. * _Step 2.3. Risk estimation,_ in which the acceptability of the investment risk is verified. In this phase, the concepts of risk acceptability threshold and risk tolerability threshold derived from ALARP logic are applied. So, here we find the main novelty of the model. The tolerability threshold separates the region of unacceptable risk from the region where the risk is tolerable as ALARP. We therefore assume that an investment whose return is equal to the return expected from a project with an average risk profile, i.e., one that is on average representative of civil enterprises of a given socio-economic context, is tolerable. The acceptability threshold, on the other hand, separates the ALARP risk region from the region in which the risk is broadly acceptable to the investor. Since the expected return of the project increases as the investment risk rises, we assume that an investment whose average return is at least equal to the return expected from a project with a high-risk profile, i.e., representative of first-quartile civil enterprises--namely those with the lowest returns and consequently the riskiest of a given territorial context--is acceptable to the economic operator. Having conceptually defined the thresholds of acceptability and tolerability, it is possible to assess the riskiness of the project in terms of expected IRR, starting from the probability density function of the profitability index. As shown in Figure 6, we have that:  
* The project initiative is widely acceptable to the investor if E(IRR) \(>r_{a}\), i.e., if the expected IRR of the project is higher than the return expected from a project with an average risk profile.