The Probability Specialist: Sam Savage

Could you briefly summarise probability management?

In 2005, Royal Dutch Shell could easily simulate single projects, like oil exploration. However, aggregating those individual simulations together to account for the interrelated uncertainties of the entire portfolio was an issue. Probability management allows you to do that. This technique represents each uncertainty as an array of auditable, simulated outcomes and metadata called a stochastic information packet (SIP), which can be added to simulate the risk-return distribution of the portfolio.

Can you explain that in terms of financial markets?

Think of the efficient frontier in finance. You need a process of optimising the trade-off between risk and return, which can then be applied to individual circumstances. Any point along the efficient frontier depends on your corporate risk attitude, so you need to understand that in order to choose correctly. Risk is in the eye of the beholder.

What about pandemic risk?

Think of several efficient frontiers. Imagine trying to mitigate the risks: safety; liability; and cost. Every efficient frontier is at a different cost, with each curve representing the trade-off curve between residual safety risk and residual liability risk. You really have three stakeholders – safety advocates, liability advocates and financial advocates. They are negotiating.

At one end, there is no risk at all, but it will cost a lot of money. At the other end, the number of deaths will be overwhelming, but the cost would be minimal. There must be a sweet spot. However, if you don’t go through the process of optimising the trade-off between the risk and return, then you could wind up with a suboptimal outcome.

Why is it so hard for organisations to prepare for risks they should have seen coming, like the pandemic?

First of all, I am a free-market guy. Very closely related to the financial markets are the prediction markets. They got Trump wrong, they got Brexit wrong and they got COVID-19 wrong. So, we were blind-sided. And yet, you can be sure the market was picking up some signals as this crisis was unfolding.

For example, if China had been hoarding personal protective equipment before the pandemic really hit, then there would have been signals to reflect that. You can’t hoard something without changing the price of that, right? And you could have picked up on some of these signals. As an efficient market advocate, I think markets are pretty efficient, but they are not completely efficient. There are signals here and there, and we should be watching them very closely.

If there are so many signals, how do you know which ones are important?

Artificial intelligence and machine learning would be my first approach. We have a lot of data. The problem is that, in a lot of cases, they are highly non-linear. And that means they are subject to chaos. So how should you monitor the obvious signals? You are not trying to figure out what is going to happen in the long term – you want to figure out whether things are about to go chaotic. This is essentially the butterfly effect, where minute influences can have huge effects on non-linear systems.

Can financial markets exhibit chaotic behaviour?

They can, absolutely. Typically they don’t, but an example would be the sudden correlation of everything when markets all drop at once: that is a chaotic system. And even though you might not be able to predict it, you can do scenario analysis. You need to know what you would do if an unlikely scenario would happen. At Royal Dutch Shell, they didn’t think the Soviet Union would collapse before it happened but they knew what to do if it did happen. That is scenario analysis.

Cybersecurity attacks present another unpredictable risk. If you can’t predict it, how do you manage it?

This risk is different from all the rest. You cannot treat cybersecurity threats as you would a nuclear meltdown in a power generation plant. It frustrates me and other modellers when we see people modelling cybersecurity like the threat of a nuclear meltdown in a power generation plant. The nuclear reactor is not out to get you. If the core melts down, there is something wrong with the physics. In cybersecurity, you have an intelligent adversary. You simply cannot get through this without invoking game theory.

You mentioned game theory. Can you explain why gamers are generally better at managing risk?

The best risk modellers are gamers because they learned the game by playing the game, not by concentrating on writing down in advance what they were going to do. They didn’t sit there and read a book, and then decide how to do it. They learned to ride a bicycle by riding a bicycle. They didn’t waste time by writing a bicycle mission statement or making sure they have the right bicycle outfit. I often get this when people come to me for assistance: they just want to write about bicycles, they don’t necessarily want to ride a bicycle.

How would you model climate change risk?

With climate change models, I wouldn’t recommend using just one; there are many. They are huge and humongous, and almost collapsing under their own weight, but they contain a lot of valuable information – so long as you don’t use an average. Take economic modelling around the world due to sea level rise. What you can do is write out a SIP library, write it in the cloud in an open, standard way that allows everybody to have access for free.

This global SIP of sea level rise could be accessed by individual regions, which in turn would calculate their own SIPs of economic impact based on local knowledge of factors such as the hydrology, tide basin and storm surges. The resulting SIPs would be coherent in that they reflected the same sea level conditions on each trial and could be added together to estimate the global economic impact. The data and the technology are there, it is a matter of getting everyone on board.