1

INSE 6320 -- Week 3

Risk Analysis for Information and Systems Engineering

• Random Variables
• Discrete Probability Distributions
• Continuous Probability Distributions
• Bayesian Analysis

Dr. M. AMAYRI Concordia University

 2

What does Risk Management mean?

One wants to modify the profit distribution in order to satisfy the
preferences of the decision maker
Probability
0.20

0.18 x-axis (Profit ) represents different possible profit values

y-axis (Probability) represents how likely each profit value is
0.16
•
]
Bars show the probability of different profit levels occurring. OR…
0.14 INCREASE THESE
FREQUENCIES
REDUCE 0.12

THESE 0.10
FREQUENCIES 0.08

0.06

0.04

0.02

0.00
-300 -200 -100 0 100 200 300 400 500 600 700 800

Profit ξ

Risk management is about modifying risk so that it aligns with the decision maker’s
goals. In this case, the decision maker wants to reduce financial losses and increase
OR
profitable outcomes. So we need to be modeled (e.g profit) using statistical distributions BOTH!!!!
 3
Risk Analysis
Understanding uncertainty and making informed decisions in situations where
outcomes are uncertain. To do this, we use concepts from probability and
statistics.

1- Random Variables: A random variable represents uncertain quantities in risk analysis. For
example, the number of defective products in a batch (discrete) or the time until the next
equipment failure (continuous). These variables help us model uncertain events mathematically.
2- Discrete Probability Distributions: Discrete distributions describe the probabilities of
outcomes for random variables that take on specific values (like the number of defective items, 0,
1, 2, etc.). For instance, the binomial distribution might tell us the probability of getting 2
defective items out of 10.
3- Continuous Probability Distributions: These distributions describe the probabilities of
outcomes for random variables that can take on any value within a range. For example, the time to
failure of a machine might follow an exponential distribution, or a project's cost might follow a
normal distribution.
4- Bayesian Analysis: Bayesian analysis allows us to update probabilities as new information
becomes available. In risk analysis, this helps refine predictions. For example, if initial data
suggests a 10% chance of equipment failure, Bayesian methods can adjust this probability if new
inspection data indicates more wear than expected.
Random Variables and Probability Density Functions 4
In risk management, random variables help us quantify uncertainty. A random variable is a numerical value that
represents an uncertain outcome, such as profit, loss, or other financial metrics.
A random variable is a quantity whose value is not known exactly but its probability distribution is known.
The value of the random variable will vary from trial to trial as the experiment is repeated. The variable’s
probability density function (PDF) describes how these values are distributed (i.e. it gives the probability that
the variable value falls within a particular interval).

Continuous PDFs

f(t) f(t)
All values between 0
and 1 are equally likely Smallest values
are most likely

0 1 0 t
t
Uniform distribution Exponential distribution
(e.g. soil texture) (e.g. event rainfall)
0.3
f (t)

0.2 0.25 Probability that t = 2

0.15
A Discrete PDF 0.1 Only discrete
values (integers)
are possible
0 1 2 3 4 t
Discrete distribution
(e.g. number of severe storms)
 5
Mean and Variance of a Discrete Random Variable
mean and variance of a discrete random variable are crucial concepts in risk analysis because
they help quantify expected outcomes and uncertainty.

The mean (μX) represents the

expected value of a random
variable X

The variance (σ²) measures how

much the values of X deviate
from the mean
 6

Expected Returns

• Expected returns are based on the probabilities of possible outcomes

n
E ( R ) = ∑ pi Ri
i =1

• In this context, “expected” means average if the process is repeated

many times
• The “expected” return does not even have to be a possible return

In risk analysis, this tells us the average or most likely outcome over time.

Risk analysis involves evaluating different investment or project options by looking at their
potential returns and probabilities.

If an investment has a high expected return, it may be attractive, but risk must also be
considered.
 7

Example: Expected Returns

This example demonstrates how expected returns are calculated for two stocks (C and T) based
on different economic conditions (Boom, Normal, and Recession). Let's analyze this in the
context of risk analysis.

State Probability C T

Boom 0.3 0.15 0.25

Normal 0.5 0.10 0.20
Recession 0.2 0.02 0.01

• RC = .3(.15) + .5(.10) + .2(.02) = .099 = 9.99%

• RT = .3(.25) + .5(.20) + .2(.01) = .177 = 17.7%
◦ Stock T has a higher expected return (17.7%) than Stock C (9.99%).
◦ If an investor only considers returns, Stock T would be the better choice.

Higher returns usually come with higher risk, we need variance and standard deviation to measure risk
 8

Variance and Standard Deviation

• Variance and standard deviation still measure the volatility of returns, it
means how numbers in a data set are spread

• Using unequal probabilities for the entire range of possibilities

• Standard deviation as a risk measurement metric only shows how the

annual returns of an investment are spread out, and it does not necessarily
mean that the outcomes will be consistent in the future.

• Standard deviation measures how far apart numbers are in a data set.
Variance, on the other hand, gives an actual value to how much the
numbers in a data set vary from the mean.
n
2 2
σ = ∑ pi ( Ri − E ( R))
i =1
 9

Example: Variance and Standard Deviation

• Consider the previous example. What are the variance and standard
deviation for each stock?

State Probability C T

Boom 0.3 0.15 0.25

Normal 0.5 0.10 0.20
Recession 0.2 0.02 0.01
 10
Example: Variance and Standard Deviation
• Consider the previous example. What are the variance and standard
deviation for each stock?

• Stock C
▪ σ2 = .3(.15-.099)2 + .5(.1-.099)2 + .2(.02-.099)2 = .002029
▪ σ = .045

• Stock T
▪ σ2 = .3(.25-.177)2 + .5(.2-.177)2 + .2(.01-.177)2 = .007441
▪ σ = .0863
Stock T has a much higher variance than Stock C

Variance and standard deviation measure financial risk by showing how much returns
deviate from the expected value.
Lower standard deviation = lower risk and more predictability.
Higher standard deviation = higher risk and greater uncertainty.

Investors use these metrics to balance risk and return before making decisions.
 11

Binomial Distribution
In many Geographic studies, we often face a situation where we deal with a random
variable that only takes two values, zero-one, yes-no, presence-absence, over a given
period of time. Since there are only two possible outcomes, knowing the probability of one
knows the probability of the other.

P(1)=p
P(0)=1-p

If the random experiment is conducted n times, then the probability for the event to
happen t times follow binomial distribution:

⎛n⎞ t n −t n!
P(t ) = ⎜ ⎟ p (1 − p ) = p t (1 − p )n −t
⎝t⎠ x !(n − t )!

Where n! the factorial of n. e.g. 5!=5*4*3*2*1=120.

 12
Binomial Distribution Example
For example, the presence-absence of drought in a year directly influences
the profit of agriculture due to irrigation costs added in a dry year. Suppose a
geographer is hired to do risk analysis for an Ag. Company whether a piece
of land is profitable for agriculture. Past experience shows that irrigation can
be afforded only one year in five. According to weather records, 4 out of the
last 25 years suffered from drought in the area.

What is the probability of profitable agriculture?

What is the Risk in 5 years?
 13
Binomial Distribution Example
For example, the presence-absence of drought in a year directly influences
the profit of agriculture due to irrigation costs added in a dry year. Suppose a
geographer is hired to do risk analysis for an Ag. Company whether a piece
of land is profitable for agriculture. Past experience shows that irrigation can
be afforded only one year in five. According to weather records, 4 out of the
last 25 years suffered from drought in the area.

Let 1 denote drought presence, and 0 denote drought absence, then

P(1)=4/25=0.16, probability of drought in any given year

so P(0)=1-0.16=0.84.

For 5 years, there are six possibilities of drought occurrence: 0, 1, 2, 3, 4, 5.

Poisson Probability Distribution 18

The Poisson distribution is a probability model used to describe the number of occurrences of a
particular event within a fixed interval of time or space. It is widely applied in risk analysis when
events happen randomly and independently.

The Poisson distribution is

e−λ λ t
f (t ) = t = 0,1, 2,...
t!

Where the parameter λ>0 is the mean number of successes in the interval.
λ (lambda) is the expected number of occurrences (mean)

The mean and variance of the Poisson distribution are both equal
µ =λ and σ2 =λ
Poisson Probability Distribution 19

The Poisson distribution is useful in modelling risks associated with rare but independent
events. Some key applications include:
A. Risk in Cybersecurity (System Failures or Cyberattacks)

• Suppose an organization experiences an average of 5 cyberattacks per month

• The Poisson distribution can help estimate the probability of:
◦ Zero attacks in a month (good outcome).
◦ More than 10 attacks (high risk requiring additional security measures).
• Helps organizations plan cybersecurity investments.

B. Risk in Insurance and Accident Claims

• An insurance company knows that on average, 3 car accidents occur per day in a city
(λ=3)
• Using the Poisson model, they can calculate:
◦ The probability of 0 accidents in a day.
◦ The risk of having more than 5 accidents, requiring additional claim handling
resources.
C. Reliability Engineering (Machine Failures)

◦ The probability of no failures in a week.

◦ The risk of more than 4 failures in a week, which would require urgent maintenance.
 20

Poisson Distribution: Example Hailstorms

A geographer is analyzing the risk of hailstorms in a region where summer wheat

yields can be affected.
Historical Data (35 years) Shows;

10 years had 0 hailstorms

13 years had 1 hailstorm

8 years had 2 hailstorms

3 years had 3 hailstorms

1 year had 4 hailstorms

Q1: What is the risk of extreme hailstorm activity three or more hailstorms

Q2: Discuss the Risk in hailstorm problem

 23
Normal Probability Distribution
• The normal probability distribution is the The normal distribution is
most important distribution for describing 1 −
( t − µ )2
2σ 2
f (t ) = e −∞<t <∞
a continuous random variable. σ 2π
• It has been used in a wide variety of with mean µ and variance σ
2

applications: 2
▪ Heights and weights of people The normal distribution is: T ~ N ( µ , σ )
▪ Test scores The visual appearance of the normal
▪ Scientific measurements distribution is a symmetric, unimodal or
▪ Amounts of rainfall bell-shaped curve as shown in the figure.
• It is widely used in statistical inference
 24
Normal Probability Distribution
The normal distribution is widely used in risk management, finance, and engineering because
many real-world uncertainties follow this pattern.
A. Financial Risk and Stock Returns

• Stock prices and returns are often modeled using normal distribution.
μ) represents expected return, while the standard deviation σ) represents risk (volatility).
• If a stock has a higher standard deviation, it is more risky and volatile.
B. Quality Control in Manufacturing

• In manufacturing, product dimensions (e.g., weight, size) follow a normal distribution.

• Variance and standard deviation help ensure products meet quality standards.
• Lower variance = more consistent quality.
C. Weather and Climate Risk

• Rainfall, temperature, and natural disasters can follow a normal distribution.

• Risk analysis uses mean and standard deviation to predict extreme weather events.
D. Credit Risk in Banking

• Banks use the normal distribution to assess loan default risks.

• Borrowers with higher risk scores have a higher standard deviation, meaning greater
uncertainty in repayment
 25
Calculating Normal Probabilities

We can use the following function to convert any normal random variable to a
standard normal random variable…
Any normal distribution can be converted into a standard normal distribution (Z-distribution) using the
Z-score formula:

0
X −µ
Z=
σ

Some advice: always

draw a picture!
 26
Calculating Normal Probabilities
P(45 < T < 60) ?
…mean of 50 minutes and a
standard deviation of 10 minutes…

X −µ
Z=
0 σ

P(45 < T < 60) =

⎛ 45 − 50 T − µ 60 − 50 ⎞
P⎜ < < ⎟=
⎝ 10 σ 10 ⎠
P( −0.5 < Z < 1)
 27
Using the Cumulative Standard Normal Table to Find Probabilities

Examples:

Φ (0.76) = 0.776373
Φ (1.3) = ?
Φ (−3) = 1 − Φ (3) = ?
Φ (3.86) = ?
Lognormal Distribution 28

The Lognormal Distribution is a probability distribution of a random variable whose

logarithm follows a normal distribution.
This makes it useful for modelling positive, skewed data often seen in finance, risk
management, and environmental science.

A random variable x is said to have the Lognormal

Distribution with parameters µ and σ, where µ > 0 and σ >
0, if the probability density function of x is:

, for x >0

f(t)

0 t
Lognormal Distribution 29

A lognormal distribution is a type of probability distribution used when a variable grows

multiplies over time (like money, bacteria, or material strength). It is called lognormal
because if you take the natural logarithm (ln) of the variable, it follows a normal
distribution.
A random variable x is said to have the Lognormal Distribution

If T ~ LN(µ,σ),

then Y= ln (T) ~ N(µ,σ)

⎛ ln t − µ ⎞
F (t ) = P(T ≤ t ) = Φ ⎜ ⎟
⎝ σ ⎠
where Φ(z) is the cumulative probability distribution function of N(0,1)
 30
Lognormal Distribution
Try to remember how to reach this equations !!

➢Mean or Expected Value of T

1 2
µ+ σ
µT = E (T ) = e 2

➢Median of T
median = e µ

➢Standard Deviation of T
1
2
⎡ 2µ + σ 2 ⎛ σ 2 ⎞⎤
σT = ⎢e ⎜e
⎜ − 1 ⎟⎥
⎟
⎢⎣ ⎝ ⎠⎥⎦
Lognormal Distribution 31

A. Financial Risk and Stock Prices

• Stock prices follow a lognormal distribution because returns (logarithmic

changes in price) are normally distributed.
• This ensures prices stay positive.

B. Project Management and Completion Time

• Project completion times often follow a lognormal distribution.

• Delays in tasks accumulate multiplicatively, leading to a skewed timeline.

C. Insurance and Extreme Events

• Insurance claims and natural disasters often follow a lognormal pattern.

• Most claims are small, but there are rare large claims

D. Environmental Risk and Pollution

• Pollution levels, rainfall, and flood damages often follow a lognormal
distribution.
• The majority of days have low pollution, but extreme pollution days (outliers)
are highly
•
 32
Lognormal Distribution - Example
A theoretical justification based on a certain material failure mechanism
underlies the assumption that ductile strength T of a material has a
lognormal distribution.
If the parameters are µ=5 and σ=0.1 (location and scale)
Find:
(a)µT and σT
(b)P(T >120)
(c)P(110 ≤ T ≤ 130)
(d)The median ductile strength
(e)The minimum acceptable strength, If the smallest 5% of strength values
were unacceptable.
Exponential Distribution 38

The Exponential Distribution is widely used in risk analysis, especially for modelling waiting times
between random events (e.g. system failures, arrival times, and reliability analysis). The exponential
distribution is crucial for predicting rare but random events.
A random variable T is defined to be exponential random variable (or say T is
exponentially distributed) with positive parameter λ if its probability density
function is given by:
⎧λ e − λ t if t ≥ 0, λ > 0
f (t ) = ⎨
⎩0 if t < 0
∞ ∞
− λt − λt ∞
Note: ∫ f (t ) dt = ∫ λ e dt = − e =1
−∞ 0 0

λ is the rate parameter (higher λ means faster occurrences).

Thus, f(x) is a probability density function.
The cumulative distribution function:
t
F (t ) = P(T ≤ t ) = ∫ f (τ ) dτ = 0
−∞
0
For t < 0, F (t ) = ∫ 0 dτ = 0
−∞
t
− λτ t
For t ≥ 0, F (t ) = ∫ λ e − λτ
dτ = −e = 1 − e − λt
0 0

⎧1 − e − λt if t ≥ 0
F (t ) = ⎨
⎩0 if t < 0
Exponential Distribution: Example 39

The lifetime of a battery (measured in hours) is exponentially distributed with

λ=0.05 (failure rate per hour). We need to find the probability that a battery lasts
between 10 and 15 hours. Using the Cumulative Distribution Function (CDF)

⎧1 − e − λt if t ≥ 0
F (t ) = ⎨
⎩0 if t < 0

P(10 ≤ T ≤ 15)
Example: solution 40

⎧1 − e − λt if t ≥ 0 P(10 ≤ T ≤ 15)
F (t ) = ⎨
⎩0 if t < 0 = F (15) − F (10)
= e − (0.05)(10) − e − (0.05)(15)
= e −0.5 − e −0.75
= 0.1341
P(10 ≤ T ≤ 15)

There is a 13.41% probability that the battery will last

between 10 and 15 hours.
This is visualized in the blue shaded area in the graph.
Most batteries fail earlier because the exponential
distribution is right-skewed, meaning higher failure rates at
lower times
Exponential Distribution 41

• Reliability Engineering: Helps predict failure rates of

batteries, machines, and electronic components.

• Insurance and Warranty Analysis: Used to determine

warranty periods based on failure probabilities.

• Cybersecurity Risk: Models time between cyberattacks or

system failures.
Gamma Distribution 42

The Gamma Distribution is a continuous probability distribution used in modelling waiting

times, reliability analysis, and risk assessment.
➢A continuous random variable T is said to have a Gamma Distribution, if
the probability density function of T is t
1 α −1
−
β
α t e for t ≥ 0,
β Γ( α )
f (t ; α , β ) =
0
 43
The Gamma Function Γ (α)
Γ(α) is a generalization of the factorial function for real and complex numbers. It
is widely used in probability, statistics, and risk analysis.

The function is useful in continuous probability distributions,

Gamma Density Functions 44

f (t ; α , β )
Gamma Distribution 45

The Gamma distribution is widely used in reliability engineering, finance, and risk
modelling.
A. Waiting Time Between Events (Reliability Analysis)

• Models the time until failure for machines, batteries, and electronic components.
• Used in predicting failure rates and maintenance schedules.
B. Insurance & Claim Risk Modelling

• Models the time until an insurance claim is filed.

• Used in pricing insurance policies and risk forecasting.
C. Financial Risk & Stock Market Analysis

• Used to model stock price movements and market volatility.

• Helps estimate the probability of extreme market events.
D. Cybersecurity & Network Attacks

• Models time intervals between cyber-attacks or system breaches.

• Helps predict when the next security breach is likely to occur.
 46
Risk Assessment

• Bayesian Analysis

Dr. M. AMAYRI Concordia University

 47

Risk Assessment
Risk assessment is the process of identifying and analyzing potential hazards to minimize their
impact. It helps in decision-making by providing a structured approach to handle uncertainties.

• Hazard: potential source or situation which create damage, harm.

• A hazard analysis is a process used to assess risk.
• The results of a hazard analysis is the identification of unacceptable
risks and the selection of means of controlling or eliminating them.
 48
Probabilistic Risk assessment (PRA)
PRA is a systematic method to quantify risks by considering:
• Severity of possible adverse consequences.
• Probability (likelihood) of occurrence of each consequence.
This helps in making data-driven decisions to reduce risks effectively.

• Probabilistic risk assessment (PRA) is characterized by two quantities:

• Severity of possible adverse consequences.
• Probability (likelihood) of occurrence of each consequence.

This identifies hazards, assesses risks, and helps in creating control measures to minimize harm
 49

Population at risk
Individual Risk
Individual risk is the risk of fatality or injury to any identifiable (named)
individual who lives within the zone impacted by a hazard, or follows a
particular pattern of life, that might subject him or her to the consequences of a
hazard.

Societal Risk
Societal risk is the risk of multiple fatalities or injuries in the society as a whole,
and where society would have to carry the burden of a hazard causing a number
of deaths, injury, financial, environmental, and other losses.
Population at risk 50

• Individual risk can be calculated as the total risk divided by the population at
risk.
• For example, if a region with a population of one million people
experiences on average 5 deaths from flooding per year, the individual risk
of being killed by a flood in that region is 5/1,000,000, usually expressed in
orders of magnitude as 5×10−6.
 51

Example to express risk?

 52

How to express risk?

 53

Why Risk Assessment and Bayesian approach

• For individual risk: A Bayesian model can predict the probability of a worker getting injured
based on past incidents.

• For societal risk: It can assess how likely a wildfire will spread to multiple communities.

Bayesian analysis is used in finance, cybersecurity, healthcare, and artificial

intelligence.
 54

The Bayesian approach

• Represent uncertainty by
probabilities
• Use Bayes’ theorem:
h = hypothesis
e = evidence
Starting
belief=‘prior’
P(h|e) = P(e|h) × P(h)
New belief P(e)
The Rev. Thomas Bayes
1702?-1761
Bayes’ theorem tells us – we start off with a belief in a hypothesis H, we get some information (e), we can
compute a new conditional probability, which becomes our new belief given that evidence
Bayes’ Theorem for Estimating Risk 55

Suppose:
•h = “the athlete is taking steroids”
•e = “test result is positive”
And:
•P(h) = 0.01 (one in 100 people)
•P(e|h) = 0.8 (true positive rate)
•P(e|not h) = 0.1 (false positive rate)

What is P(h|e)?
Bayes’ Theorem for Estimating Risk 56

Suppose:
•h = “the athlete is taking steroids”
•e = “test result is positive”
And:
•P(h) = 0.01 (one in 100 people)
•P(e|h) = 0.8 (true positive rate)
•P(e|not h) = 0.1 (false positive rate)

What is P(h|e)? 0.0748

 57
Bayes’ Formula
▪ To deal with multiple probabilities mathematically we need to refer to Bayes
theorem. This type of modelling has become increasingly popular in areas such
as modelling for operational risk where there are a large number of variables
to consider.
▪ Bayes theorem says that if there are n disjoint events (events that have no
elements in common) that cover the sample space, then:
P(A | B i )P(B i )
P(B i | A) =
P(A | B 1 )P(B 1 ) + P(A | B 2 )P(B 2 ) + ⋅ ⋅ ⋅ + P(A | B k )P(B k )
 58
Probability And Risk - A Bayes Theorem Example
▪ Two branches of a retail bank, C and D, have each reported eight
transactions to risk management for review.

▪ Of these, four of the transactions reported by branch C have actually

been found to represent errors, whereas six of the transactions
reported by branch D were errors.

▪ The question, which we shall answer, is given that an error has been
identified by senior management as requiring special attention, what is
the probability that this originated from branch C?

This example applies Bayes’ Theorem to assess the probability that an identified error came from Branch C.
 59
Probability And Risk - A Bayes Theorem Example
▪ Two branches of a retail bank, C and D, have each reported eight
transactions to risk management for review.

▪ Of these, four of the transactions reported by branch C have actually

been found to represent errors, whereas six of the transactions
reported by branch D were errors.

▪ The question, which we shall answer, is given that an error has been
identified by senior management as requiring special attention, what is
the probability that this originated from branch C?

It is known that:
Prob (error|C) = 4/8 = 0.5
Prob (error|D) = 6/8 = 0.75
Prob (C) = Prob (D) = ½ (since each branch reports the same number of
transactions)
 60
Probability And Risk - A Bayes Theorem Example
P(A | B i )P(B i )
P(B i | A) =
P(A | B 1 )P(B 1 ) + P(A | B 2 )P(B 2 ) + ⋅ ⋅ ⋅ + P(A | B k )P(B k )
P rob(C )P rob(error | C )
P rob(C | error) =
P rob(C )P rob(error | C ) + P rob( D)P rob(error | D)
0.5 × 0.5
=
0.5 × 0.5 + 0.5 × 0.75
= 0.4
There is a 40% chance that it originated from Branch C. Even though both
branches reported an equal number of transactions, Branch D had more
errors, making it more likely that any randomly selected error came from
there.

This provides the required result, however we have only so far

considered how to combine the results of two branches. The same
approach could have been taken for any number of branches, say 70,
just by using a greater number of clauses.
 61
Probability And Risk - A Bayes Theorem Example
Transactions are reported to risk management from three departments (M1, M2, M3)
according to the following table

M1 M2 M3

Percentage supplied 60 30 10
Probability transaction .95 .8 .65
not resulting in a loss

▪ If a transaction is found to actually resulting in a loss, what is the probability that

department M1 supplied it?
From the table the probabilities of actual losses are 0.05, 0.20 and 0.35 respectively.
Now using Bayes Theorem,
 63

Bayes’ Formula Example

• A drilling company has estimated a 40% chance of striking oil for their new
well.
• A detailed test has been scheduled for more information. Historically, 60%
of successful wells have had detailed tests, and 20% of unsuccessful wells
have had detailed tests.
• Given that this well has been scheduled for a detailed test, what is the
probability that the well will be successful?