Two Risks, One Budget: Why Expected Value Ranked the Catastrophe Last
The risk register at a specialty chemical plant has three items competing for a single $180,000 capital pool. Item A, manual drum handling at the solvent fill line: six operators, modeled annual probability of a serious burn 4 in 100, modeled severity $350,000. Item B, the anhydrous ammonia receiver: annual probability of a release 3 in 10,000, with a credible outcome of two fatalities plus offsite evacuation; the team's severity figure of $8 million is openly acknowledged as a placeholder. Item C, a missing interlock guard on a packaging conveyor: 14 recordable lacerations last year, roughly $9,000 each, and the fix costs $11,000. The plant manager wants to fund the items in descending order of expected annual loss.
1. Compute the expected annual loss for each item and rank them. Then explain where this ranking is trustworthy and where it is not.
Read the worked answer
Expected annual loss (probability x severity)
- A: 0.04 x $350,000 = $14,000/yr
- B: 0.0003 x $8,000,000 = $2,400/yr
- C: 14 x $9,000 = $126,000/yr
Ranking by expected value: C, A, B.
Where the ranking is trustworthy: C. The frequency estimate rests on 14 observed events in one year, the cost per event is measured, and the fix is $11,000 - payback in about one month. High confidence, low uncertainty, immediate legal exposure for an unguarded machine. Fund it first without further analysis.
Where it fails: B. Expected value multiplies a badly known probability by a clearly understated severity. Two fatalities plus offsite evacuation plus a release investigation and probable enforcement action is not an $8 million event under any conventional valuation; the placeholder is doing arithmetic work it cannot support. Multiply an uncertain, possibly order-of-magnitude-low probability by a low-balled severity and you get a small number that looks like a decision. It is not. Expected value is also risk-neutral: it is indifferent between many small survivable losses and one event that ends the site, and it says nothing about irreversibility.
What is actually true: B is the highest-consequence item on the register, has the least defensible quantification, and is the only one with offsite and fatality potential. A ranking that puts it third is an artifact of the model, not a finding about the plant.
2. The manager proposes funding A, then C, and deferring B for two budget cycles. Give your recommendation and the interim risk treatment for B, with the reasoning you would put in writing.
Read the worked answer
Recommendation: fund C now (cheap, high-frequency, compliance-driven, one-month payback). Fund A, but challenge whether it needs capital at all - a drum-handling change may be delivered by procedure, drum lifts, and re-siting at operating expense, which frees capital. Do not accept deferral of B on the basis of the $2,400 figure.
Reasoning to document for B:
- The number is not a decision input yet. With probability uncertain by an order of magnitude and severity a stated placeholder, the register entry is not quantified in any usable sense. You cannot defend a deferral that rests on a figure the team itself disclaims.
- ALARP and precaution apply to high-consequence hazards. Where the consequence is potentially fatal and offsite, the test is whether risk is reduced as far as reasonably practicable, not whether the expected value beats alternatives. Deferral must be justified by the residual risk being tolerable during the deferral, not by a favorable quotient.
- Interim controls are available now and are cheap relative to the tail. Written operating procedures and requalification for the receiver, ammonia detection with alarm and automatic isolation, water spray or deluge on the receiver, restricted access, updated emergency plan with the local responders, and confirmation that the process is being managed under the process safety management elements that attach to anhydrous ammonia above the threshold quantity.
- Then quantify. A layer-of-protection analysis or HAZOP gives a defensible release frequency and lets you compare safeguard options against a real number. That study is weeks, not a budget cycle.
- Escalate. A decision to carry an unquantified fatality risk for two budget cycles belongs to the person who owns the site's risk acceptance, in writing, not to a capital prioritization meeting.
If the residual risk during deferral cannot be shown tolerable, the recommendation is to reduce inventory or take the receiver out of service - not to wait.