Intro to Jacobson’s Window Risk Analysis
By: Ken Camp
Tags: Risk Assessment, Jacobsons Window, Risk, Risk Management, Risk Analysis

Intro to Jacobson’s Window Risk Analysis

The dictionary defines risk as “a chance of encountering harm or loss” and defines chance as “an unknown agency, assumed to account for unusual or unexplained events.” In other words, risk management has to do with harm or loss caused by unusual events. At a more practical level, it is helpful to think of risk losses as those that are not considered a part of normal operations.

Jacobson’s Window

Many organizations have adopted a. simple risk assessment methodology that is widely used throughout the tech sector known as Jacobson’s Window. The model assumes that a risk can be characterized by its frequency (or probability, but that suggests that a risk event may never occur) of occurrence, and the consequences of each occurrence. The model makes the simplifying assumption that all risks have either a low or high frequency (or likelihood) of occurrence, and a low or high consequence. Figure 1 represents these assumptions as a two-by-two matrix of four possible classes of risk.

Figure 1

Using this approach, we manage four classes of risk — low-low, high-low, low-high, and high-high. These four are easily broken down into either inconsequential or significant risk classes.

Inconsequential Risk Classes

The low-low can be ignored. Statistically it does not matter. Given low likelihood of occurrence and low impact these risks represent minimal impact on the organization. A risk that occurs every 10 years with an impact of one-dollar can easily be accepted as a part of normal business.

Likewise, high-high risks can be ignored. Jacobson suggests they never occur in the real world. In his example, if 50-ton meteorites crashed through the roofs of computer rooms every day (an extreme example), we would not attempt to use computers. In broad terms, high-probability, high-loss risks are quickly mitigated as lessons learned during the course of business.

Significant Risk Classes

This narrows our focus to two significant risk classes: high-low and low-high. A good example of a high-low risk is spam e-mail. There’s a very high probability you will receive spam e-mail every day, but in most cases, the resulting loss is a low loss of productivity. Since we’re exploring telecommunications, Jacobson’s example of a low-high risk presents a perfect example. A major fire that destroys a telephone company central office has low probability of occurrence, but a high consequential loss.

In the real world, there’s a spectrum of risks from high-low to low high, as shown in Figure 2. Over time, losses across this spectrum tend to have similar organizational impact. From an actuarial standpoint, the notion of annualized loss expectancy, or ALE, is used to quantify risk. This is often expressed in terms of occurrences per year and the loss resulting from a single occurrence.

Figure 2

While ALE is useful for comparing risks, it’s difficult to achieve credible estimates of occurrence rate for low-occurrence risks. It’s fairly easy to estimate the consequences, but not as easy to estimate occurrence rate. Computer network risks frequently stem from human actions like fraud, sabotage, virus distribution, malicious attack, or simple errors. These occurrence rates are difficult to quantify.

Another factor with low-occurrence risks is driven by human nature. Jacobson postulates that “People tend to dismiss risks that they have not experienced themselves within the last 30 years.” 30 years seems arbitrary, but may be related genetically to human life experience, and what we remember happening in out lifetime. There are plenty of examples of Jacobson’s “30 Year Law” at work, but they’re easily identified. How often have we heard senior managers or public officials say, “who could have anticipated this event? We’ve taken steps to see that it never happens again.” Human nature shows some lessons will only be relearned by direct experience.

Low-probability, high consequence risks present a problem. It’s difficult to quantify the likelihood of occurrence, making it difficult to achieve management concern that the risk is tangible.

Weighting of Risks to Mitigate

Because high-low risks are likely to occur, they are generally weighted more heavily than low-high risks. Risks that have low rates or likelihood of occurrence require management review to consider the consequences on a case-by-case-basis.