Risk Analysis, Vol. 34, No. 9, 2014
DOI: 10.1111/risa.12304
From the Editors
PROFILE OF YACOV HAIMES
not overly restrict fish habitats; and to highlight specific knowledge and data gaps (especially about where trout spawn) that would be especially valuable to reduce in adaptively managing risks to wild trout populations. Maul provides an important methodological warning that exposure assessment studies used in microbial risk assessment must consider heterogeneity (e.g., the shape of the frequency distribution for microbial loads), rather than relying on single-number summaries of exposure “levels” (e.g., means or medians of the exposure distributions), since heterogeneity can either diminish or greatly inflate the risk associated with a given summary level of exposure, depending on the shape of the underlying exposure distribution and on whether the dose–response relation has a threshold. Quantitative microbial risk assessment (QMRA) methods, including stochastic simulation modeling of exposures and response probabilities, have become increasingly sophisticated and widely used in recent years. In this issue, Evers et al. use a stochastic simulation QMRA model to estimate the annual number of cases of campylobacteriosis arising from petting zoos in the Netherlands as about 187 cases per year among children and 52 cases per year among adults (in a population of about 16 million). These numbers are small compared to the roughly 12,000 cases per year attributed to chicken fillets and 1,000 cases per year attributed to drinking water in previous studies. Nonetheless, the authors note that cleaning goat fences could be a practical, low-cost way to prevent many of the cases originating from petting zoos. Cox and Popken also develop a stochastic simulation QMRA model to quantify the cases of methicillin-resistant Staphylococcus aureus (MRSA) among people in the United States caused by transmission from pigs or pig meat. They conclude that, despite much publicity and concern over the threat of MRSA “superbug” infections being spread from pigs to people, the quantitative risks are probably between zero and approximately one excess human infections per year among all U.S. pig farm workers, and between zero and one human infections per 31 years among the rest of the U.S. population.
Risk Analysis occasionally publishes profiles, written by Michael Greenberg and Karen Lowrie, of those who have helped to define and shape the field, the society, and the journal. This issue begins with a profile of Yacov Haimes, past president of the Society for Risk Analysis and an enormously creative and influential contributor to the journal and to the discipline of engineering risk analysis. (The current Editor-in-Chief remembers well learning about multiobjective optimization of water systems in the early 1980s from Yacov’s clear and exciting books and articles.) As described in the Profile, Yacov’s early years held many personal encounters with dramatic risks and unpredictability while his subsequent thoughts and ideas, and his generations of students, have helped to make increasing sense of risks and complex systems on large scales. This work grows ever more vital as social, economic, and technological systems and infrastructures become more pervasive and interconnected.
INFECTIOUS DISEASES, BIOLOGICAL HAZARDS AND MICROBIAL RISK ASSESSMENTS People and animals are threatened by infectious diseases that may spread geographically and over time via complex mechanisms whose behaviors are hard to predict. Practical risk management of such diseases requires acknowledging and modeling uncertainty about how quickly and how far they will spread if different risk management options are deployed. Ayre et al. consider the probability of whirling disease—a disease caused by parasites that spend part of their life cycles in fish and part in worm hosts—spreading among Colorado and Rio Grande cutthroat trout throughout their range in the Southwest United States. They use Bayesian belief network (BBN) models and spatial data to identify locations with the greatest risk of infection; to show that hydrological barriers might help to reduce risks to native trout populations, if they do 1581
C 2014 Society for Risk Analysis 0272-4332/14/0100-1581$22.00/1
1582 Ryan et al. apply QMRA to available information on human exposures to H. pylori in drinking water to propose a maximum contaminant level of less than one organism per liter as a potential guideline for drinking water to protect people from risks of ulcers and gastrointestinal cancers. They show that an annual infection risk exceeding one in ten thousand is unlikely for any of the dose–response models considered (based on both monkey and human data), but note that the mean and 95th percentiles for estimated lifetime cancer risk slightly exceed the conventional one-in-a-million level for triggering regulatory concern. They therefore recommend further investigation of dose–response relations for humans, concentrations of H. pylori in municipal drinking water and in other surface and groundwater sources, and treatment removal efficiencies. Two articles examine risks from plants. Fowler et al. develop a probabilistic pathway analysis of the risk that potatoes exported to Mexico from the United States will be diverted from their intended use as table stock to unintended use as seed for planting, with consequent increases in risks of establishing viral, bacterial, and worm pests in Mexico. They conclude that the threat is extremely small, with probable times-to-first-establishment measured in tens of thousands of years under all scenarios analyzed. BuiKlimke and Wu study the current “mystery of Balkan endemic nephropathy” (BEN). BEN is a chronic, wasting kidney disease occurring among people in their fifties in some rural areas of the Balkan nations. Its causes have been debated, sometimes vigorously, for half a century without clear resolution, and numerous possible causes have been hypothesized. BuiKlimke and Wu investigate whether the qualitative weight-of-evidence considerations of Sir Bradford Hill more strongly favor a toxin produced by weeds, aristocholic acid (AA), or a fungal toxin, ochratoxin A (OTA), as a possible cause of BEN. They conclude that both the qualitative pattern of associations and other considerations for judging potential causality favor the hypothesis of AA as a cause of BEN. At a time when QMRA models are becoming increasingly prevalent, powerful, and impactful in policymaking, this analysis of a current epidemiological mystery provides a valuable reminder that hazard identification—that is, identifying specific exposures that might cause human health harm—is still a vital and challenging part of both epidemiology and risk assessment.
From the Editors OTHER HEALTH RISKS Ikegami et al. investigate the presence of heavy metals in soil particles of different sizes collected from playgrounds in Japan. They find that heavy metals tend to be found disproportionately among smaller particles, which also stick to children’s hands, and conclude that the practice of using 2-mm sieving to prepare soil samples probably leads to underestimation of heavy metal exposure via small soil particles.
MANAGING RISKS OF COMPLEX TECHNOLOGICAL SYSTEMS: HUMAN ERRORS Safe operation of complex systems, from submarines to nuclear power plants to air traffic control, requires fallible human beings to perform reliably even under unusual and stressful conditions. Liu and Li use a three-screen microworld simulator of a simplified pressurized water reactor to study how human error probability varies with factors such as experience, time availability, and task complexity. They compare the resulting empirical data to predictions from the Standard Plant Analysis RiskHuman Reliability Method (SPAR-H). As might be expected, more experience and time availability decrease the rates of several types of errors; moreover, both factors affect how error rates vary with task complexity. Worrisomely, the observed error rates are higher in this study than those predicted by SPAR-H, consistent with the results of other empirical studies. The authors discuss implications of these results for human errors and safety in managing nuclear power plants. Borener and Guzhva examine real-world radar track data following unplanned outages in air traffic management communication and surveillance services near 15 major airports in 2010 and 2011. They find that service outages, which occur several times per year on average for most major hubs, significantly increase the likelihood of aircraft approaching each other too closely (possibly requiring pilot action), by a factor of about 1.3, especially in the first 15 minutes following the start of the outage. The regression models developed in this paper can be viewed as showing how accident precursors—loss of recommended separation between planes—respond to infrastructure outages.
From the Editors IMPROVING ORGANIZATIONAL AND POLICY RISK MANAGEMENT DECISIONS Choptiany and Pelot develop a high-level decision analysis and risk assessment model for carbon dioxide capture and storage (CCS) technologies that capture CO2 from fossil fuel power plants and inject them into geological reservoirs for storage. The model takes a multicriteria decision analysis (MCDA) approach to help inform decisions such as where and how to store the captured CO2 . This work presents realistic examples to show how to use decision trees and Monte Carlo simulation, among other techniques, to support choice among alternative CCS projects. It considers risk analysis as one of several complementary tools that can help to inform, and perhaps improve, large-scale policy decisions with multiple stakeholders, politically and technically complex issues, and substantial uncertainties. Busby and Collins examine how organizations make sense of risks and of possible risk controls, including risk analyses, risk management plans and rules, and risk management responsibilities. They point out that perceived acceptability of controls may be as important as perceived acceptability of risks in shaping what gets done. They use results of interviews with five off-shore oil and gas companies and their regulator to understand different ways in
1583 which people in organizations perceive risk controls and act on those perceptions. They conclude that a balance of optimistic and pessimistic views about the capacities of social organizations to control largescale physical risks emerges in most organizations, steering risk management practices between the extremes of hubris and cynicism in seeking to control risks while acknowledging that this is not easy and requires perpetual vigilance. The final article in this issue applies probabilistic risk assessment (PRA) methods to cybercrime attacks on online banking and financial services. Preventing, detecting, and responding effectively to attacks based on impersonation, deception (e.g., “Nigeria letters” that fool account holders and induce them to initiate transactions), and serverside attacks requires timely and informative risk assessment. The authors propose incident response trees (IRTs), using ideas from event tree analysis, to meet these needs. They illustrate the proposed risk modeling approach using realistic data, and conclude that it complements existing methods (such as attack trees and protection trees) and allows PRA methods and insights to be extended to the increasingly important domain of cybercrime attacks against online financial services. Tony Cox and Karen Lowrie
DOI: 10.1111/risa.12304
From the Editors
PROFILE OF YACOV HAIMES
not overly restrict fish habitats; and to highlight specific knowledge and data gaps (especially about where trout spawn) that would be especially valuable to reduce in adaptively managing risks to wild trout populations. Maul provides an important methodological warning that exposure assessment studies used in microbial risk assessment must consider heterogeneity (e.g., the shape of the frequency distribution for microbial loads), rather than relying on single-number summaries of exposure “levels” (e.g., means or medians of the exposure distributions), since heterogeneity can either diminish or greatly inflate the risk associated with a given summary level of exposure, depending on the shape of the underlying exposure distribution and on whether the dose–response relation has a threshold. Quantitative microbial risk assessment (QMRA) methods, including stochastic simulation modeling of exposures and response probabilities, have become increasingly sophisticated and widely used in recent years. In this issue, Evers et al. use a stochastic simulation QMRA model to estimate the annual number of cases of campylobacteriosis arising from petting zoos in the Netherlands as about 187 cases per year among children and 52 cases per year among adults (in a population of about 16 million). These numbers are small compared to the roughly 12,000 cases per year attributed to chicken fillets and 1,000 cases per year attributed to drinking water in previous studies. Nonetheless, the authors note that cleaning goat fences could be a practical, low-cost way to prevent many of the cases originating from petting zoos. Cox and Popken also develop a stochastic simulation QMRA model to quantify the cases of methicillin-resistant Staphylococcus aureus (MRSA) among people in the United States caused by transmission from pigs or pig meat. They conclude that, despite much publicity and concern over the threat of MRSA “superbug” infections being spread from pigs to people, the quantitative risks are probably between zero and approximately one excess human infections per year among all U.S. pig farm workers, and between zero and one human infections per 31 years among the rest of the U.S. population.
Risk Analysis occasionally publishes profiles, written by Michael Greenberg and Karen Lowrie, of those who have helped to define and shape the field, the society, and the journal. This issue begins with a profile of Yacov Haimes, past president of the Society for Risk Analysis and an enormously creative and influential contributor to the journal and to the discipline of engineering risk analysis. (The current Editor-in-Chief remembers well learning about multiobjective optimization of water systems in the early 1980s from Yacov’s clear and exciting books and articles.) As described in the Profile, Yacov’s early years held many personal encounters with dramatic risks and unpredictability while his subsequent thoughts and ideas, and his generations of students, have helped to make increasing sense of risks and complex systems on large scales. This work grows ever more vital as social, economic, and technological systems and infrastructures become more pervasive and interconnected.
INFECTIOUS DISEASES, BIOLOGICAL HAZARDS AND MICROBIAL RISK ASSESSMENTS People and animals are threatened by infectious diseases that may spread geographically and over time via complex mechanisms whose behaviors are hard to predict. Practical risk management of such diseases requires acknowledging and modeling uncertainty about how quickly and how far they will spread if different risk management options are deployed. Ayre et al. consider the probability of whirling disease—a disease caused by parasites that spend part of their life cycles in fish and part in worm hosts—spreading among Colorado and Rio Grande cutthroat trout throughout their range in the Southwest United States. They use Bayesian belief network (BBN) models and spatial data to identify locations with the greatest risk of infection; to show that hydrological barriers might help to reduce risks to native trout populations, if they do 1581
C 2014 Society for Risk Analysis 0272-4332/14/0100-1581$22.00/1
1582 Ryan et al. apply QMRA to available information on human exposures to H. pylori in drinking water to propose a maximum contaminant level of less than one organism per liter as a potential guideline for drinking water to protect people from risks of ulcers and gastrointestinal cancers. They show that an annual infection risk exceeding one in ten thousand is unlikely for any of the dose–response models considered (based on both monkey and human data), but note that the mean and 95th percentiles for estimated lifetime cancer risk slightly exceed the conventional one-in-a-million level for triggering regulatory concern. They therefore recommend further investigation of dose–response relations for humans, concentrations of H. pylori in municipal drinking water and in other surface and groundwater sources, and treatment removal efficiencies. Two articles examine risks from plants. Fowler et al. develop a probabilistic pathway analysis of the risk that potatoes exported to Mexico from the United States will be diverted from their intended use as table stock to unintended use as seed for planting, with consequent increases in risks of establishing viral, bacterial, and worm pests in Mexico. They conclude that the threat is extremely small, with probable times-to-first-establishment measured in tens of thousands of years under all scenarios analyzed. BuiKlimke and Wu study the current “mystery of Balkan endemic nephropathy” (BEN). BEN is a chronic, wasting kidney disease occurring among people in their fifties in some rural areas of the Balkan nations. Its causes have been debated, sometimes vigorously, for half a century without clear resolution, and numerous possible causes have been hypothesized. BuiKlimke and Wu investigate whether the qualitative weight-of-evidence considerations of Sir Bradford Hill more strongly favor a toxin produced by weeds, aristocholic acid (AA), or a fungal toxin, ochratoxin A (OTA), as a possible cause of BEN. They conclude that both the qualitative pattern of associations and other considerations for judging potential causality favor the hypothesis of AA as a cause of BEN. At a time when QMRA models are becoming increasingly prevalent, powerful, and impactful in policymaking, this analysis of a current epidemiological mystery provides a valuable reminder that hazard identification—that is, identifying specific exposures that might cause human health harm—is still a vital and challenging part of both epidemiology and risk assessment.
From the Editors OTHER HEALTH RISKS Ikegami et al. investigate the presence of heavy metals in soil particles of different sizes collected from playgrounds in Japan. They find that heavy metals tend to be found disproportionately among smaller particles, which also stick to children’s hands, and conclude that the practice of using 2-mm sieving to prepare soil samples probably leads to underestimation of heavy metal exposure via small soil particles.
MANAGING RISKS OF COMPLEX TECHNOLOGICAL SYSTEMS: HUMAN ERRORS Safe operation of complex systems, from submarines to nuclear power plants to air traffic control, requires fallible human beings to perform reliably even under unusual and stressful conditions. Liu and Li use a three-screen microworld simulator of a simplified pressurized water reactor to study how human error probability varies with factors such as experience, time availability, and task complexity. They compare the resulting empirical data to predictions from the Standard Plant Analysis RiskHuman Reliability Method (SPAR-H). As might be expected, more experience and time availability decrease the rates of several types of errors; moreover, both factors affect how error rates vary with task complexity. Worrisomely, the observed error rates are higher in this study than those predicted by SPAR-H, consistent with the results of other empirical studies. The authors discuss implications of these results for human errors and safety in managing nuclear power plants. Borener and Guzhva examine real-world radar track data following unplanned outages in air traffic management communication and surveillance services near 15 major airports in 2010 and 2011. They find that service outages, which occur several times per year on average for most major hubs, significantly increase the likelihood of aircraft approaching each other too closely (possibly requiring pilot action), by a factor of about 1.3, especially in the first 15 minutes following the start of the outage. The regression models developed in this paper can be viewed as showing how accident precursors—loss of recommended separation between planes—respond to infrastructure outages.
From the Editors IMPROVING ORGANIZATIONAL AND POLICY RISK MANAGEMENT DECISIONS Choptiany and Pelot develop a high-level decision analysis and risk assessment model for carbon dioxide capture and storage (CCS) technologies that capture CO2 from fossil fuel power plants and inject them into geological reservoirs for storage. The model takes a multicriteria decision analysis (MCDA) approach to help inform decisions such as where and how to store the captured CO2 . This work presents realistic examples to show how to use decision trees and Monte Carlo simulation, among other techniques, to support choice among alternative CCS projects. It considers risk analysis as one of several complementary tools that can help to inform, and perhaps improve, large-scale policy decisions with multiple stakeholders, politically and technically complex issues, and substantial uncertainties. Busby and Collins examine how organizations make sense of risks and of possible risk controls, including risk analyses, risk management plans and rules, and risk management responsibilities. They point out that perceived acceptability of controls may be as important as perceived acceptability of risks in shaping what gets done. They use results of interviews with five off-shore oil and gas companies and their regulator to understand different ways in
1583 which people in organizations perceive risk controls and act on those perceptions. They conclude that a balance of optimistic and pessimistic views about the capacities of social organizations to control largescale physical risks emerges in most organizations, steering risk management practices between the extremes of hubris and cynicism in seeking to control risks while acknowledging that this is not easy and requires perpetual vigilance. The final article in this issue applies probabilistic risk assessment (PRA) methods to cybercrime attacks on online banking and financial services. Preventing, detecting, and responding effectively to attacks based on impersonation, deception (e.g., “Nigeria letters” that fool account holders and induce them to initiate transactions), and serverside attacks requires timely and informative risk assessment. The authors propose incident response trees (IRTs), using ideas from event tree analysis, to meet these needs. They illustrate the proposed risk modeling approach using realistic data, and conclude that it complements existing methods (such as attack trees and protection trees) and allows PRA methods and insights to be extended to the increasingly important domain of cybercrime attacks against online financial services. Tony Cox and Karen Lowrie
