What has time to do with risk? A preliminary communication

The reliability of risk techniques is of concern to academics and practitioners: if techniques are not reliable in their design, they cannot give reliable results. This paper briefly discusses risk velocity, which is a way of providing specificity to an understanding of risk through applying time as a lens. The research is a preliminary communication from initial Masters research. Risk velocity has been identified in the limited literature as being divided into three sections: time to cause, time to impact, and time to recover; each of which can assist an organisation to better understand their risk landscape and how risks link with business continuity planning. However, risk velocity has been the subject of limited research to validate the concept and reliability in practice, suggesting this a ‘white space’ meriting investigation (Cherry, 2010).

practitioner is "making choiceswhich might be conscious or notabout what to do and how to do it" (Cherry, 2010, p. 14). One of the "white spaces" in risk management is a lack of research into how the velocity of risk is represented to decision makers: a lack of understanding of the influence of time on risk increases uncertainty,

What has time to do with risk?
Risk velocitythe speed that a risk actsis an emerging concept in enterprise risk management that may reduce uncertainty concerning how quickly changes may occur in business. However, there is a lack of research in the concept of risk velocity, and whether it is more than a qualitative judgement on the part of a risk assessor.
The limited literature consists of a small number of mentions in practitioner publications (Davis & Lukomnik, 2010;Dunning, 2014;Mandel, 2009;Ossinger, 2019;Ramamoorti et al., 2017;Ramamoorti et al., 2019;Sobel, 2010;Tattam & Esteban, 2013), one Masters' thesis (Chaparro, 2013) and a very short mention in a report by the Committee of Sponsoring Organizations (COSO) of the Treadway commission (2016), that identifies how the concept of risk velocity may be of use in managing enterprise-level risks. Some peer-reviewed articles applied the risk velocity concept to the share market following the impact of the Covid-19 pandemic (AlAli, 2020;Winck, 2020), and in a wider consideration of overall risk management activities in operational banking (Grimwade, 2019). Anecdotal evidence suggests that risk velocity is also used by fire engineers as a time/temperature curve to assess the time from ignition to full fire involvement and then decay (C. Peace, personal communication, 2021).
Risk velocity is a concept that exists in the white spaces of occupational health and safety research; it is an area that has not been sufficiently academically researched, or tested in application by practitioners. Although COSO (2016) identifies that it could be of use in enterprise risk management, the concept of risk velocity could be used more widely in considering system-wide risks, including those with occupational health and safety-related consequences.
Velocity is not a discussion of probability; it is concerned with changes over time. The practitioner publications and thesis referenced above that have carried out the furthest thinking in this area suggest that there are three parts: time to cause, time to impact, and time to recover (Chaparro, 2013;Sobel, 2010;Tattam & Esteban, 2013), as shown in Table 1. The time that a risk event takes to occur

Risk velocity time to impact
The time taken for a risk to cause an identifiable impact on an activity or business objectives

Risk velocity time to recover
The time required for an activity or business to recover from the impact of a risk These three parts of risk velocity encourage a wider understanding of risk, helping to clarify some of the "white spaces" around decisions on how to manage risks.
Analysis using risk velocity may help decision-makers by providing a clearer view of the risk landscape, which is not limited to risk exposures within a business. The business context is important as well (International Standards Organisation, 2018). For example: • Would White Island Tours have chosen to continue visits to Whakaari when the volcano was at Volcanic Alert Level 2 if they had considered the risk velocity of a volcano? The time to impact was very fast, even instantaneous, and time to recover very long, or not at all (Radio NZ, 2020).
• A busy port or manufacturing site will have many hundreds of mobile plant movements in a day. The inherent risk of interaction with pedestrians is high; a mobile plant-pedestrian accident would be expected within days or weeks if there were no controls in place (short risk velocity time to cause). Risk velocity time to impact would be nearly instantaneous as the mobile plant collided with a person, and risk velocity time to recover is likely to be months or years, for the person to recover from their injuries, and the same for the business to recover from any external investigation by a regulator and the reputational damage that may result (see, for example, "Worksafe NZ v Toll Networks NZ Ltd" 2018).
An example of how risk velocity information might be displayed is shown in Table 2. These may seem unlikely table-mates but risk velocity is their commonality. Applying the three parts of risk velocity shows how these time factors could influence risk management. Consideration of time might then make more evident the need for planning. For example, a risk with a very short time to impact would be managed differently from one that takes a long time before its impact is fully felt (Ho & Li, 2019). Risk velocity might both support better risk management and strengthen existing links between risk management and horizon scanning for events that may impact on business objectives.

What does risk have to do with time?
The author's work in the white spaces of risk management as a long-term practitioner and early-career researcher has identified that the impact of time on risk has not been adequately addressed in the risk management literature and research.
Risks and their controls are affected by time: how long the risk takes to occur (time to cause), the period of time before its impact is felt (time to impact), and the time to recover from a risk. An understanding of risk velocity in a business can help reduce uncertainty and give a better understanding of how the velocity of each risk exposure may impact on business objectives.