Risk-Based Decisions

A risk-based decision is one made by explicitly weighing how likely an uncertain event is against how much it would cost, rather than by comparing expected benefits alone. The shift is from “which option has the best outcome?” to “which option has the best outcome given what could go wrong?”

The phrase is general decision analysis rather than a standardized term, so it carries no fixed method. What makes it worth a glossary entry is that some regulators ask for this shape of reasoning rather than a fixed checklist — two examples appear further down.

The steps, and what each one is for

1. Name the uncertain events. Not “things might go wrong” but specific events — this dependency is unavailable, this dataset is wrong, this key leaks. Unnamed risks cannot be assessed or assigned.
2. Assess likelihood and consequence separately. Keeping them apart is what lets you distinguish the frequent nuisance from the rare catastrophe, which is the entire value of the exercise.
3. Quantify where you honestly can. Expected value multiplies probability by impact — a 10% chance of a \$1M loss is a \$100k expected loss — and the next section is about when that number should drive the decision.
4. Compare options against a stated appetite. “Acceptable risk” is meaningless without someone having said what they will accept, in advance, for this class of decision.
5. Decide the treatment. Avoid it, reduce it with controls, transfer it (insurance, contract), or accept it — and accept is a legitimate answer that has to be recorded as a decision rather than reached by default.

The fifth item is where a risk process can quietly fail. If a register records only the risk and its rating, a risk that nobody decided to accept, but which nobody treated either, can look the same as one that was consciously accepted. A register that records decision status and approval separately keeps the two apart — and the difference matters enormously when the risk materializes.

When expected value is not enough

Expected value is a probability-weighted average of possible outcomes, defined even for a decision taken once. With linear utility and credible probabilities, comparing expected monetary outcomes can be appropriate. For example, a one-time choice paying 0 or 100 with equal probability has expected value 50, above a guaranteed 40; it will not actually pay 50. Repeated outcomes can support a long-run average under suitable assumptions, but repetition does not remove dependence, loss limits, or the possibility of ruin.

The mean alone can be insufficient when consequences, preferences, or constraints make different parts of the distribution matter.

• The outcome is unsurvivable. A 1% chance of insolvency can violate a survival constraint even when the expected monetary loss is small. Examine tail losses and risk tolerance alongside the mean.
• The decision is irreversible. A one-time choice still has an expectation, but nonlinear utility, limited recovery options, or hard constraints can make maximizing that expectation inappropriate. State those reasons rather than rejecting the calculation because the choice happens once.
• The cost falls on someone other than the decider. A cheap expected loss to an organization can be a severe harm to a specific person, and averaging across people hides exactly the thing a fairness or safety review is looking for.

A related trap is the risk matrix. Ranking likelihood and consequence as High, Medium, and Low is a useful communication device and an invalid basis for arithmetic — those labels are ordinal, so multiplying or ranking their products has no defensible meaning. Use the matrix to sort attention, and keep the numbers for cases where you have actual numbers.

Two places it is required rather than recommended

The reason this appears in a governance glossary is that some rules specify the shape of the reasoning instead of the answer, which puts the burden of judgment on the institution.

Customer due diligence. The US rule requires covered institutions to “understand the nature and purpose of customer relationships to develop customer risk profiles,” and then to “conduct ongoing monitoring to identify and report suspicious transactions.” The FinCEN summary of the rule does not enumerate which customers get which treatment, so differentiating between them rests on the institution’s own risk judgment — a risk-based instruction. One reading of that structure is that the customer risk profile gives ongoing monitoring a baseline to work from. See KYC.

Changes to regulated software. The FDA states that it reviews and clears modifications to medical devices, including AI-enabled software functions, that “could significantly affect the safety or effectiveness of a device,” and it points to guidance on a risk-based approach for 510(k) software modifications. Here too the axis is risk to safety or effectiveness rather than a fixed list of permitted changes, so the change has to be assessed against it. See medical AI.

Both examples point to something worth drawing out: where a rule is risk-based, a recorded basis for the decision can help show how it was reached, but it supplements the controls the applicable rule requires and the evidence that they operate; it does not replace them. A conclusion with no recorded basis is hard to defend even when it is correct.

In data and model work

One example that often goes unrecognized as a risk decision is a threshold. Choosing where to cut a classifier’s score is a risk decision dressed as a tuning parameter: it trades false positives against false negatives, which usually have different costs borne by different parties. Optimizing it for a single accuracy figure is choosing a risk posture without saying so.

Two more, briefly. Deciding how much to invest in a control — encryption, redundancy, review — is a comparison of the cost of prevention against probability times consequence, and is worth writing down because the numbers are guesses that should be revisited. And deciding how often to re-examine a deployed model is itself risk-based, using evidence about change rates, detection delays, and consequences; elapsed time alone does not establish that exposure has increased. The mechanism for noticing is drift detection, but how often and how urgently is a judgment about consequence.

Four process failures are worth watching for, and none of them is about arithmetic: assessing risks once at project start and never again; treating a register as the deliverable rather than the decisions in it; letting the person who benefits from a decision be the one who rates its risk; and accepting risks by silence. The last can be especially costly, because an accepted risk that nobody named has no owner when it arrives.

References:

• FinCEN, Customer Due Diligence (CDD) Final Rule
• FDA, Artificial Intelligence-Enabled Medical Devices
• Stanford Encyclopedia of Philosophy, Normative Theories of Rational Choice: Expected Utility