Risk – Chasing Tales

Risk – IX: Microlives to Micromorts, or why risk makes so little sense

The previous posts in this series examined how risk operates in energy markets, social systems, national security, and military infrastructure. This one asks why do humans fail to act on risks we can measure, price, and see coming?

I was once trying to explain risk as a concept to my students, and to demonstrate it, confidently asked- okay, would you sky dive? Because reader, I would not throw myself out of a plane. I had forgotten there was an army officer in that class, who stuck a pin to my example by casually answering yes. Yes he would indeed jump out of an airplane, no problem Ma’am.

We were both being entirely rational too, and that is the problem with communicating risk to humans. Everyone perceives risk through the sieve of their lives and personalities. We are surrounded by risk data. We have extraordinarily sophisticated tools to measure, price, and manage some types of risk. And yet, individually and collectively, we routinely ignore the risks that will actually kill us, panic about risks that likely won’t, and remain completely unmoved by risks that threaten the existence of life on our beautiful space rock.

Units
Risk resists measurement. Therefore, it naturally repels measurement units.

We tried anyway.

Ronald Howard, a Stanford engineer, created a unit called micromort in 1989: a unit equal to a one-in-a-million chance of death.¹ The prefix is simply the metric micro-, which means one millionth attached to the word mortality. One micromort is a tiny, almost abstract sliver of the possibility of dying. But the power of the unit is in comparison. So, riding a motorcycle for 9 kilometres costs 1 micromort (UK data)¹, running a marathon costs about 7 micromorts, and skydiving once– just one more micromort at 8². Climbing the Everest: somewhere in the region of 37,000 micromorts, which means your odds of dying even on a successful ascent are roughly 1 in 27.³ ⁴ The numbers are drawn from epidemiological ^{(relating to the study of how diseases spread, who gets sick, and why, within a specific population}⁵⁾data, which just means that you take the population who did an activity, count deaths, and divide. They are approximations, not laws, and they vary by country, era, age, and fitness. But it’s something concrete. Certainly I wouldn’t have thought my aversion to falling would be comparable to my aversion to running.

The second was David Spiegelhalter, Cambridge statistician who invented Microlives in 2012.⁶ One microlife is half an hour of life expectancy, derived by dividing a roughly 57-year adult lifespan into one million equal parts. Every microlife you spend is thirty minutes of your future, gone. It measures the relationship between an individual’s habits and their lifespan, so the daily choices they make and how long they are likely to live.⁷ Longitudinal studies (the kind that follow the same person over many years) have found that watching an extra hour of television is akin to burning up half a microlife, but smoking two cigarettes equals two. You can earn two back with twenty minutes of moderate exercise though.⁸

A micromort measures acute risk. The word “acute” comes from the Latin acutus, meaning sharp, or sudden. A discrete^{(the statistical word meaning single, or individual}⁹⁾ event with a clear before and after: you jump out of the plane, or you don’t. A microlife measures chronic risk, from the Greek chronos, meaning time. Slow, accumulating, invisible, with no clean moment of crisis.⁶

Mathematics says that for someone in their late twenties with roughly one million half-hours of adult life ahead of them, one micromort of acute risk is almost exactly equal to one microlife, or thirty minutes of expected life.¹⁰

Actuaries
There is, unsurprisingly, an entire profession built around calculating risk.¹¹ These people are called actuaries, and they calculate the probability of death or loss across different groups, and price it. They usually work for insurance companies.¹²

Actuarial science establishes something important: risk that is chaotic at the individual level becomes orderly at scale.¹³ No actuary can tell you whether you will die this year. But they can tell you, with considerable confidence, what percentage of a million people like you will. This is why, when you try to buy term insurance in India, you are asked about tobacco use, your pin code, your gender, your profession, your income- so that a calculation can be made about how likely someone like you is to die soon.¹⁴

This is called risk pooling.¹⁵ Insurance companies accumulate risk from many people because they know the chances of all insured events occurring simultaneously are vanishingly small. It is why premiums are lower for younger people- not because the young are invincible, but because the numbers say they are less likely to die right now than someone older.¹⁶

However, while the mathematics works, it is meant for populations. You are not a population. You are a person. And people are usually terrible at thinking about risk.

Risk Perception
A few years ago, before my life lost its plot, I went to Goa. I’m afraid of heights, so I decided to go parasailing- because I was so afraid of it, but also because I knew the instructor would be up there with me. I was terrified all the way up and while I was in the air, but while descending, I started to enjoy myself. So I went up a second time, and enjoyed that entire redo much more.

I was reminded of this recently when I came across a podcast where a Para SF veteran described the moment of hesitation at the gate before his first jump- not fear exactly, but his rational mind asking: why am I doing this?

Two people, two completely different risk profiles, the same pause. The same risk perception.

The difference between this person and me wasn’t in the physics of the fall. Gravity is an equaliser. The difference lay in the “internal weighting” we gave to the danger. To the officer, the risk was a managed variable, mitigated by years of training and a parachute he knew how to use. To me, the risk was an existential threat, unmitigated and visceral. We weren’t looking at the same event; we were looking at two different versions of the future, shaped by our pasts.

This gap between risk as it exists mathematically and risk as it lives in the human mind has a name in behavioural economics: cognitive bias. There are several that are particularly relevant to risk, and between them they explain most of the grand collective failures that follow. Here’s a short list:

The first is the affect heuristic¹⁷: we judge risk by how something feels, not by its actual probability.
The second is availability bias¹⁸: we judge how likely something is by how easily we can recall an example.
The third, and the most important for what comes next in this article, is psychic numbing¹⁹: The psychologist Paul Slovic spent decades documenting a deeply uncomfortable finding: human compassion and concern do not scale with numbers. We feel genuine, mobilising distress for one identified person in danger. As the numbers grow from ten people, to a hundred, then a million, emotional engagement does not grow with them. It collapses. “The more who die, the less we care,” is how Slovic summarises it.
And the fourth is temporal discounting²⁰: we systematically undervalue future outcomes relative to present ones. A certain reward today is worth more to us than a larger reward next year.

Between 7.1 – 33 Million Dead²¹
These are the people we lost to the pandemic.

Official confirmed deaths from COVID-19 stand at approximately 7.1 million, as recorded by the WHO. Excess mortality estimates (the gap between how many people died and how many would have died anyway) put the real figure somewhere between 14.9 million and 33 million.²² ²³

COVID-19 was, for a large part of the global population, the first time in living memory that ordinary people walked around consciously calculating their own mortality risk. It did not make us more rational. It made us more anxious.²⁴

Research published during and after the pandemic found that prolonged exposure to mortality risk increased temporal discounting²⁴, the bias that makes us prioritise the present over the future. People under pandemic stress didn’t become careful, long-term thinkers- they became more impulsive, more present-focused, more likely to reach for the immediate reward over the future benefit. One study found that greater temporal discounting directly predicted lower compliance with masks and social distancing, the behaviours that would actually reduce risk.²⁵

Psychic numbing compounded this.²⁶ In the early weeks, when COVID deaths were in the hundreds, there was genuine grief, and that specific terror of the unknown. By the time the death tolls reached hundreds of thousands, then millions, our emotional machinery had largely switched off, because our brains cannot hold a million deaths the way they holds one. The numbers became, in Slovic’s phrase, mere statistics.¹⁹

The pandemic taught us something important and uncomfortable: mass risk awareness does not produce mass rational behaviour. It produces mass emotional behaviour- fear, denial, exhaustion, and the very human tendency to make the anxiety stop by pretending, at some level, that the threat is not quite as real as the numbers say. We had all the data. We had the micromort equivalent of a daily death budget displayed on every news channel in the world. And we still, collectively, could not think clearly about it.

Now consider what happens when the risk is neither immediate, nor personal, and communicated about constantly using statistics and numbers.

Our Beautiful Space Rock
Climate change is risk that has been engineered, almost perfectly, to defeat every cognitive tool we have. It is chronic, not acute- there is no single moment of crisis, just accumulation. It is global in scale and feels distant even when it isn’t.²⁷ It is statistical, not personal, because it kills in aggregates, not with faces.²⁸ Its worst consequences arrive in timelines beyond our natural planning horizon.²⁹ And it requires collective action at precisely the moment when individuals are most inclined to discount, deny, and defer.³⁰

To this, add that people often believe that weather is made by the gods, which means both- that we are unable to interfere with it (so no anthropogenic climate change)³⁰ ³¹ ³², and that anything we do is also going to be useless- because it is god’s wish for it to be so³³. To this worldview, even if climate were changing, the right response would be to accept it, because it cannot be changed by humans.

This is the central tragedy of climate risk communication. Climate communication has, for the most part, been built for spreadsheets, not for minds. It relies on scale, statistics, and long timelines- exactly the conditions under which human intuition fails. We communicate climate risk in parts per million, degrees of warming, and deaths by the million, and then wonder why it does not move behaviour.³⁴

Climate change is not just an environmental problem. It is a risk communication problem- more specifically, a chronic risk problem. It is literally a million and one small events all over the planet cascading into one big final boss problem.

Solutions
Here is how I would tackle this problem:

Localise the risk: People respond to risks they have seen, or can imagine happening to people like them. Climate communication that begins at the global level fails; communication that begins with lived, local experience has a chance. In India at least, many communities have experienced climate-origin loss. Start there. Explain climate change to them through their own frame of reference.
Shorten the time horizon: As long as climate change is framed as a 2050 or 2100 problem, it will be systematically deprioritised. Communication that highlights present-day impacts such as heatwaves, air quality, food prices aligns with how we actually make decisions.
Use social proof, not just data: Behaviour is contagious. If we are able to change what one person does, especially someone influential in the community, the rest of the community are more likely to follow. Community-level interventions, whether it is water management, crop choices, or energy use, scale because they are visible, repeatable, and socially reinforced.
Understand that only agency beats risk: People do not act on risks they feel powerless to change. Effective communication pairs risk with action which is specific, achievable, and immediate.

None of this is sufficient. The scale of the problem dwarfs every communication strategy we have. But the alternative- continuing to recite statistics into the void and wondering why nothing changes- is not working either.

I was able to overcome my fear of heights, however briefly, only because I felt empowered to do it, had the means to do it, had the right guidance in the parasailing instructor, and felt motivated about it.

These are inherently human traits.

Those conditions- agency, means, guidance, motivation, are the same conditions under which people act on any risk. And they are exactly what is missing from most climate communication.

Climate risk is the ultimate jump. It is a “god-sized” problem, yes, but it is one that will be solved in the very human terrain of local communities, social proof, and individual agency. We have to stop treating people like calculators that have failed a maths test and start treating them like the both the army officers in this post: individuals who can face immense risk, provided they have a mission, a team, and a plan.

Sources

Risk – VIII: A Hidden Vulnerability- Civilian Infrastructure in War

In October 2023, Sikkim suffered a Glacial Lake Outburst Flood (GLOF)¹, which means that the Teesta River surged after the South Lhonak glacial lake burst, destroying the Chungthang dam, sweeping away 11 bridges, damaging NH-10² ³, and disrupting mobile coverage across northern Sikkim.⁴ Rescue operations were immediately hampered because road access, communications, and power failed at the same time. The government’s own situation reports noted that teams from multiple ministries had to be deployed simultaneously because all three systems had gone down together.⁵ Twenty-three Army personnel were among the missing.⁶ ⁷

In my previous post, I explored how climate change was affecting India’s national security with a broad brush, but while doing this I realised that civilian infrastructure is also, often, military infrastructure. And as everyone knows, India’s well known for the upkeep of her civilian infrastructure, and mild climate, so this post was born.

Systemic failure cascading through civil infrastructure is a danger to Indians and to India’s national security.

What Is Happening
Climate can damage infrastructure in two ways:

Disaster events, which are sudden unforeseen shocks, or the more mundane,
Daily stress due to newer ambient conditions, that among other impacts also compresses the window between maintenance cycles.

The former is usually visible, localised, and patched up through specially sanctioned money.

The Science

Chemistry
Most infrastructure is built from steel and concrete. Climate change affects both through several chemical processes.

Corrosion is the oxidation of steel, which is the process that produces rust. It is driven by a reaction that speeds up as temperature and humidity increase.⁸ Higher ambient temperatures and higher humidity therefore accelerate the corrosion of exposed steel and of steel reinforcement bars inside concrete.⁹ Studies have found that this reduces structural resistance and threatens the safety of buildings and infrastructure.¹⁰ ¹¹
For India’s coastal infrastructure, corrosion is intensified by chlorides from seawater and sea spray. Chloride ions penetrate concrete and break down the protective chemical layer on the steel reinforcement inside it.¹² Once that protective layer is lost, corrosion accelerates. As sea levels rise and storm surges push saltwater further inland, more structures are exposed to chloride-rich conditions than they were originally designed for.¹³ ¹⁴
Carbonation is another process affecting concrete.¹⁵ Carbon dioxide from the atmosphere reacts with calcium hydroxide in concrete, gradually lowering the concrete’s alkalinity. Concrete normally protects embedded steel because its high alkalinity creates a passive film on the rebar. When carbonation reduces that alkalinity, the steel loses that protection and becomes vulnerable to corrosion. Research suggests that under climate change, carbonation can advance much further than expected over a structure’s lifetime, potentially causing corrosion-related failure 15 to 20 years earlier than expected.

Physics
Climate change also affects infrastructure through physical processes.

Materials such as steel, concrete, and asphalt expand when heated and contract when cooled through a process called thermal expansion. Roads, bridges, and railway lines are designed with this in mind, using expansion joints and stress tolerances based on the historical temperature range of the area.¹⁶ When temperatures exceed those historical ranges more often, the materials expand more than expected. This can cause bridge cracking, road deformation, and rail distortion. India’s National Disaster Management Authority identifies all of these as current extreme heat risks.¹⁷
Thermal cycling fatigue is when repeated expansion and contraction over months and years creates cumulative mechanical stress.¹⁸ Tiny cracks form, widen, and eventually reduce the strength of the structure.¹⁹ This is especially important in regions with large temperature swings, including mountain areas where freeze-thaw and heat-cold cycles can be intense.²⁰
Freeze-thaw damage is a physical mechanism relevant to Himalayan infrastructure. Water enters small cracks in concrete or rock-supported structures.²¹ When it freezes, it expands and exerts pressure on the surrounding material.²² Repeated freeze-thaw cycles gradually widen cracks and weaken the structure. Roads, retaining walls, bridges, and tunnels in mountain zones are especially vulnerable to this.²³
Electrical infrastructure is also affected by basic physics. Transmission lines sag more in high heat because the metal expands.²⁴ ²⁵ Transformers and cables become less efficient as ambient temperature rises and can operate closer to their thermal limits for longer periods.²⁶ This reduces efficiency and can shorten equipment lifespan for equipment rated for a maximum ambient of 40°C, a threshold India’s plains now routinely exceed.²⁷
The troposphere, which is the lowest layer of the atmosphere, is getting wetter and more turbulent as climate change increases evaporation and convective activity.²⁸ ²⁹ Water vapour absorbs and scatters microwave signals. This creates what’s called tropospheric delay so that signals from GPS and navigation satellites arrive slightly later than they should because they’re passing through a more moisture-loaded atmosphere.³⁰ For civilian navigation this is a minor annoyance. For precision-guided systems, artillery corrections, or drone navigation that depend on GPS accuracy, accumulated error matters.³¹
Heavier rainfall also causes direct signal attenuation for satellites operating in the Ku and Ka frequency bands³², which are commonly used for broadband and military communications satellites³³. During intense monsoon rain events, which are becoming more intense, the signal can degrade significantly.³⁴ This is called rain fade.³⁵ Climate change is making extreme rainfall events more frequent, which means rain fade events are also more frequent.³⁶

Biology
Climate change changes biological conditions in ways that matter for infrastructure.

Mold and fungal growth increase when warm temperatures combine with moisture and poor ventilation. More humid conditions, heavier rainfall, and more water intrusion into buildings create better conditions for mold on and inside building materials. Mold does not usually collapse a bridge, but it does damage internal building materials, coatings, insulation, sealants, and indoor air quality, and it increases maintenance burdens in buildings.³⁷ The US Army Corps of Engineers identifies hot, humid conditions and climate-linked flooding as important drivers of mold risk in buildings.³⁸ ³⁹
Termites are another biological stressor. Research has found that termite decomposition activity increases sharply with temperature, with one study reporting an almost sevenfold increase for every 10°C increase in temperature.⁴⁰ Warmer conditions can lengthen termite active seasons and expand their range.⁴¹ In India, where termites are already a major issue in many regions, this can increase damage to wooden structures, fittings, and stored materials.⁴²
However, the most important biological effect may be on people, specifically the people who inspect, repair, and maintain infrastructure. Outdoor workers face direct heat stress. Studies from India show that high heat impairs hydration, reaction time, and cognitive performance, and reduces labour productivity.⁴³ One study found heat stress was associated with impaired cognitive function among outdoor workers in northeast India.⁴⁴ Another found significant productivity losses under high heat conditions in southern India.⁴⁵ Broader modelling suggests work performance in India could decline by 30-40% by the end of the century under high-emissions scenarios because of heat stress.⁴⁶ This matters because infrastructure maintenance is done by human beings. If workers can safely spend fewer hours outdoors, inspections are delayed, repairs take longer, and maintenance backlogs grow.

Why This Matters

Think of a bridge. It’s close to the Western front, but maybe somewhere hot rather than cold. Our troops and civilians use it. When war happens, it risks becoming a chokepoint. This is what climate change is doing to that bridge:

Chemistry

Atmospheric CO₂ rises → carbonation front advances through concrete → alkalinity drops → passive film on rebar breaks down
Simultaneously: Monsoon rainfall carries agricultural fertiliser runoff into the river→ sulfates and chlorides enter river water → they penetrate the concrete of bridge piers standing in the river → chloride ions attack rebar from below while carbonation attacks from above
All of this converges in the same steel. Corrosion begins. The steel expands as it rusts, cracking the concrete around it from the inside. The cracks then let in more water and more chlorides. The process accelerates itself.

Physics

Summer temperatures exceed original design range → expansion joints in the bridge deck are stressed beyond tolerance → micro-cracking at joints
Winter cold → contraction → same joints stressed in the other direction
This thermal cycling repeats every year → cumulative fatigue damage accumulates in the deck and in the connections between the superstructure and the piers
Monsoon floods → river scour around the bridge foundations → soil removed from around pier bases → foundations become more exposed, less supported
The cracks from thermal fatigue now provide entry points for the chloride-rich floodwater. The chemical and physical tracks have merged.

Biology

Heat + humidity + monsoon moisture → mold grows on bearing pads, sealants, and expansion joint filler → these materials degrade faster than designed
Summer wet-bulb temperatures rise → outdoor workers hit safe heat limits earlier in the day → inspection teams spend fewer hours on the bridge → the cracking goes unlogged for longer.
Maintenance is scheduled based on the old assumption of X inspections per year. The bridge now needs X+2. It might get X-1.

The military uses the national grid, national highways, ports, telecom networks, and fuel systems because these already exist at national scale.⁴⁷ Building separate military-only versions of all of them would be costly and, in many cases, impractical.⁴⁸

In forward areas, large fixed installations like wind turbines or solar arrays are visible on satellite imagery and can mark out military positions, a very obvious security liability.

There is also a wider internal security reason for treating civilian infrastructure as a national security issue: power failures, water shortages, and infrastructure breakdowns can contribute to unrest and instability. India has already seen public disorder linked to extended power cuts and water disruptions.⁴⁹ ⁵⁰

This means the military will continue to depend on civilian infrastructure in most cases. As a result, strengthening civilian infrastructure is not separate from strengthening national defence.

Each issue discussed in this post is treated in planning as a separate system with separate vulnerabilities. The problem is that they are not experienced separately.

They fail together.

India has a Ministry of Power, a Ministry of Jal Shakti, a Department of Telecommunications, a Ministry of Petroleum and Natural Gas, a Department of Space, and a Ministry of Road Transport and Highways. Each has its own climate resilience concerns, its own planning horizon, and its own budget. What India does not have is any institution whose job it is to look at all of these physical risks simultaneously and ask what their combined failure would cost during war, or during a 26/11-style attack.⁵¹ ⁵²

The cascade matters because the response to any single infrastructure failure can usually be managed: reroute the convoy, use the satellite phone, run the generator. It is when several failures occur in the same region simultaneously that the workarounds stop working. In a conflict scenario, an adversary that understands India’s infrastructure dependencies does not need to attack each system individually.⁵³ A weather event that the adversary did not cause, hitting infrastructure that climate change has already weakened, can achieve the same effect at no cost.⁵⁴ The Sikkim GLOF was not engineered. But the military vulnerability it exposed- an entire strategically sensitive zone simultaneously cut off by road, by communication, and by power- is exactly the condition a competent adversary would try to manufacture.

Sources

Risk – VII: Climate Change and India’s National Security Emergency

NB: I don’t know anything about national security. I’m a climate person now exploring risk and this seems… obvious. This is the toughest thing I’ve ever written.

Siachen is the world’s highest active battlefield, at approximately 6,300 metres above sea level in the eastern Karakoram range.¹ During a complete ceasefire between 2013 and March 2016, 41 soldiers still died there. This is what the glacier costs India in peacetime.²

Now the glacier is melting.

what is climate change
Over time, the atmosphere of our planet has been composed of different material. How much heat is retained by the planet is determined in part by this. If the atmosphere has more greenhouse gases, it will lead to a hotter planet, which leads to cascading effects.

Example: As temperatures rise, glaciers and polar ice sheets melt causing sea levels to rise and threatening to inundate coastal cities, erode coastlines, and displace millions of people. Concurrently, this warming disturbs weather patterns, resulting in more intense heatwaves, devastating droughts, and stronger, more destructive storms and floods. These physical disruptions destroy ecosystems and agricultural productivity, creating severe food and water shortages, while simultaneously expanding the range of pests and diseases that endanger human health. Ultimately, these interconnected hazards damage critical infrastructure, destabilise economies, and heighten the risk of mass migration, poverty, and conflict over declining natural resources.

What are India’s prevalent national security issues
From what I understand, our main national security issues are external aggression, terrorism, and militancy.

Threat multiplier³ ⁴
Climate change doesn’t create new conflicts. It takes every single problem in the list above, such as water, food, borders, internal stability, regional rivalry, and makes it harder to manage, more frequent, and more explosive through resource stress. For example, it tightens the supply of water and food, which increases competition for both, which drives displacement, which destabilises borders and communities, which creates the conditions in which existing conflicts (ethnic, political, territorial) escalate. A drought isn’t just an agricultural event. It is, potentially, a political one, which can always make it a military one too.

Let’s explore how:

I. Internal Security

1. Water
India is the 13th most water-stressed country in the world⁵, and climate-change-driven precipitation changes are projected to worsen this dramatically, with more rain falls in violent bursts, and the moderate, sustained rainfall that actually recharges groundwater becoming rarer⁶. A 2024 peer-reviewed study in AGU Geophysical Research Letters found that monsoon drying combined with winter warming has already caused massive groundwater loss between 2002 and 2021- and that this trend will worsen as irrigation demand rises and recharge declines.⁷ A 2018 Niti Aayog report found that states performing poorly on the water index are home to about 40% of India’s population and account for 40% of its agricultural output, creating a cascading risk for food and economic security.⁸ By 2050, the water crisis is projected to cost India nearly 6% of its GDP.⁹

Similarly, communal tensions in water-stressed regions are increasingly animated by resource competition.¹⁰ As river flows decline and groundwater depletes, communities that share or contest watersheds become sites of conflict.¹¹ The state-level Cauvery riots are a visible example; but beneath the surface, a growing number of smaller, less-reported water conflicts are simmering across India, and their frequency is directly tied to climate variability.

The Cauvery water dispute between Tamil Nadu and Karnataka is a preview of what’s coming. The 2016 riots¹², triggered in large part by what was the worst drought Tamil Nadu had experienced in 140 years¹³, left people dead, millions of rupees in damages, and required significant law enforcement mobilisation. While water disputes between Indian states date back to the colonial era, climate change is ratcheting up the intensity by making droughts more frequent and more severe. he Water, Peace and Security (WPS) partnership’s conflict early-warning tool, which uses machine learning across 15–20 indicators and claims 86% accuracy, has consistently flagged large parts of India and Pakistan as high-risk zones for water-driven conflict.¹⁴

2. Heat
Famously, at the moment the world’s 95 hottest cities are in India¹⁵, rompting Redditors to calculate that you’d need 4.3 million ten-metre tunnels — stacked eighteen rows high across the entire mountain range, ideally with RGB lighting — to reduce India’s temperature by 5°C ^{(Favourite comment: “Would it not be easier to just raise India? Put it on some tire jacks or something? Pixar’s Up but with India maybe?”}¹⁶⁾.¹⁷ ¹⁸

This has an internal security dimension that rarely gets discussed: heat is an economic catastrophe. India’s agricultural workforce, which still constitutes roughly 46%¹⁹ of total employment, is almost entirely outdoor and informal. When a heat event destroys a harvest, it doesn’t just create hunger. It destroys livelihoods, triggers distress migration into already-strained cities, and adds pressure to communities where other tensions already exist.²⁰

3. Food Security
India feeds 1.4 billion people largely through rain-fed agriculture- and rain-fed agriculture accounts for 60%²¹ ²² of all cultivated land in India. This is the singular vulnerability that makes climate change so existential: a disruption of the monsoon is a disruption of the nation’s food supply. And that disruption is already underway.

Erratic rainfall, increased droughts, and more intense floods are reducing crop yields, pushing up food prices, and deepening malnutrition, particularly among the most marginalised communities. Staple crops are losing nutrients as rising CO₂ speeds up photosynthesis while reducing protein and mineral content.²³ Lower yields lead to food scarcity, which leads to price spikes, which lead to social unrest, which is a feedback loop that historically has destabilised governments and ignited conflicts. The most recent example is the Syrian civil war, which multiple studies have linked to a catastrophic 2007-2010 drought that drove 1.5 million Syrian farmers into cities.²⁴

4. Disease
Climate change expands both the geographic range and the seasonal window of vector-borne diseases such as malaria, dengue, chikungunya, and others, by making previously inhospitable environments hospitable to the mosquitoes that carry them.²⁵ As temperatures rise, these mosquitoes move to higher altitudes and higher latitudes: places that were, until recently, simply too cold for them to survive and reproduce year-round.²⁶

This matters for India’s security because the Indian Army already manages significant morbidity from malaria in its northeastern and jungle deployments.²⁷ ²⁸ The Northeast is already one of the most malaria-endemic regions in the country, and it is also one of the most militarily active, with ongoing counterinsurgency operations across Manipur, Nagaland, and Arunachal Pradesh (during World War II in Manipur and Nagaland, malaria casualties far exceeded those from Japanese aggression)²⁹. Climate change will extend both the altitude and the season of that disease burden, moving it upward into Himalayan deployment zones that were previously disease-free, and lengthening the transmission window in zones that already carry it.³⁰

5. Migration
Between 2015 and 2024, 32.32 million people were internally displaced in India due to natural disasters (mostly floods and storms).³¹ In 2024 alone, the figure was 5.4 million: the highest single-year displacement in over a decade.³² Nearly half of those 5.4 million were in Assam, which experienced its most intense floods in more than a decade.³³ Cyclone Dana, which tore through Odisha and West Bengal in October 2024, added another million on top of that.³⁴ The World Bank projects that South Asia could see up to 40 million internal climate migrants by 2050 in a worst-case scenario.³⁵

So where are our people moving? Cities, it seems. This means that people are fleeing climate-stressed rural areas and moving into climate-stressed cities.³⁶ The downstream effects are predictable: “expanding informal settlements, rising unemployment, worsening public health, increased competition for water and space, and communities under pressure in the exact ways that historically precede unrest.”³⁷ Research on climate-induced displacement in India found that discrimination, violence, and the lack of basic amenities in urban areas meant that migrants who arrived seeking economic survival found themselves in conditions of compounded vulnerability.³⁸

Distress migration does not produce stable, integrated urban populations. It produces large numbers of people with very little to lose.

And the thing to note here is that security issues like insurgency and climate change share a common engine: desperation- witnessed as the regions most vulnerable to rainfall variability often overlapping with areas prone to Left-Wing Extremism (LWE).³⁹ ⁴⁰ As climate change degrades agricultural livelihoods and forces displacement, it provides fertile recruiting ground for insurgent movements that thrive on grievance.⁴¹ The relief web analysis on India and climate security explicitly highlights how climate change’s adverse interaction with insurgencies could “create or exacerbate national security threats” across multiple domains.⁴²

II. External Security

1. Water
China is building what will be the largest hydroelectric dams in human history on the Yarlung Tsangpo (Brahmaputra) river in Tibet, near Arunachal Pradesh.⁴³ This dam, alongside several others upstream, would give China enormous water storage capacity and the ability to control the flow of the Brahmaputra into India’s northeast.⁴⁴ During the 2017 Doklam standoff, China demonstrated its willingness to use water coercively by stopping the sharing of hydrological data with India, impeding India’s ability to predict and manage downstream floods.⁴⁵ In fact, no such data has been shared since 2022.⁴⁶

India itself responded to the Pahalgam attacks by weaponising water. On 23 April 2025, forty-eight hours after the Pahalgam attack killed 26 civilians in Baisaran valley, India formally notified Pakistan that the Indus Waters Treaty (IWT) of 1960 was being “held in abeyance with immediate effect”, until Pakistan “credibly and irrevocably” ends cross-border terrorism.⁴⁷ In early May 2025, India physically cut off water flow through the Baglihar Dam on the Chenab River and announced it was planning identical measures at the Kishanganga Dam on the Jhelum- both rivers that under the IWT belonged to Pakistan’s allocation.⁴⁸ Pakistan’s foreign minister called any withholding of water “an act of war.”⁴⁹

What happens when a desperate, water-starved, nuclear-armed Pakistan faces internal collapse that starts affecting its ruling classes? Does it start bombing us? Because Climate change isn’t just about “resource competition”- it’s about state failure, and Pakistan’s per capita water availability has fallen by 83% since 1951.⁵⁰

Water is already a coercive instrument in our region.

2. Heat
We have a coastline of 11,098.81 kilometers⁵¹, with several economically important and culturally vibrant city-civilisations on them. Rising sea levels and intensifying cyclones are putting all of this at risk.

The surface temperature of the tropical Indian Ocean has already increased by 1°C between 1951 and 2015, higher than the global average sea surface temperature rise.⁵² Higher ocean temperature contributes directly to cyclones.⁵³ During Cyclone Hudhud in 2014, the Indian Navy suffered infrastructure damage worth ₹2,000 crore at Visakhapatnam.⁵⁴ Rising seas threaten dry docks, repair infrastructure, and coastal logistics networks. The frequency of very intense cyclones in the post-monsoon period has increased significantly during 2000–2018.⁵⁵ Each such event doesn’t just damage physical infrastructure — it pulls naval and military assets away from their primary strategic responsibilities and into disaster relief, degrading operational readiness.

Meanwhile, sea level rise in the North Indian Ocean accelerated from 1.06–1.75mm per year during 1874–2004 to 3.3mm per year during 1993–2017.⁵⁶ A 2025 study published in Nature Scientific Reports confirmed that Mumbai, Kolkata, and Chennai face “intensified risks across all emission projections” due to their low elevation and high population concentration.⁵⁷ Mumbai has already witnessed the maximum rise in sea levels of any Indian city (4.44 cm between 1987 and 2021), and that figure is projected to increase sharply by 2100.⁵⁸

3. Migration
India shares a 4,000+ kilometre border with Bangladesh.⁵⁹ That’s a long border. Bangladesh is also the world’s seventh most climate-vulnerable country⁶⁰, and climate change is projected to submerge approximately 17% of its landmass, displacing roughly 13 percent of its population by 2050⁶¹.

When Bangladesh floods, its people move north and west- into India. India has already spent billions⁶² constructing border fencing, but field reports from the West Bengal border describe fencing on the Bangladesh side with crossing as compromised⁶³, and crossings are facilitated by narrow canals that cannot be fully monitored.⁶⁴ Migration pressure is unlikely to be evenly distributed- it concentrates in Bengal and the Northeast, regions already marked by ethnic tension⁶⁵, political volatility, and a complex history with Bangladeshi migration dating back to 1971⁶⁶.⁶⁷

What transforms this from a humanitarian issue into a security one is the documented presence of banned militant organisations like Jamaat-ul-Mujahideen Bangladesh near the border⁶⁸– groups that can exploit mass migration events for infiltration.

Climate Trigger	The “Climate” Impact	The “Security” Result	Why it matters for National Security
Glacial Melt	Retreating snouts; unstable moraine; GLOFs (floods).	Tactical Instability	Traditional borders (like the AGPL in Siachen) physically shift; supply routes disappear.
Monsoon Shift	Extreme rainfall or prolonged drought.	Economic Despair	44% of the workforce loses income; rural “desperation” becomes a recruitment tool for insurgents.
Extreme Heat	45°C+ days in the plains and high-altitude zones.	Operational Decay	Soldiers face physiological limits; equipment (engines/ammo) fails; training routines are halted.
Sea Level Rise	Coastal inundation and salt-water intrusion.	Base Degradation	Strategic naval assets (like Visakhapatnam) face infrastructure damage; dry docks become unusable.
Water Stress	Depleting groundwater and drying river basins.	Inter-state Riots	Water becomes a “zero-sum” game; leads to internal unrest (Cauvery) or external “Water Wars.”
Crop Failure	Reduced yields and nutrient loss in staples.	Food Riots	High food prices historically lead to urban instability and the potential collapse of state legitimacy.
Migration	Millions displaced by floods (Assam) or cyclones.	Border Pressure	“Distress migration” creates dense, vulnerable urban slums and pushes people across sensitive borders.
Vector Shift	Mosquitoes moving to higher altitudes.	Morbidity Burden	High malaria/dengue rates in active zones (Northeast/Himalayas) reduce troop readiness.

Cheat Sheet

Military Readiness
The April 2026 Planetary Security Initiative report produced by the Clingendael Institute in collaboration with India’s Institute of Peace and Conflict Studies offers this analysis of how climate change degrades military readiness across four core pillars: personnel, infrastructure, platforms, and equipment.⁶⁹

Personnel: Extreme heat is degrading recruitment pools and training routines. India is already experiencing record-breaking heat events across the Indo-Gangetic Plain, and soldiers training in 45°C heat in Rajasthan or operating in flooded terrain in Assam face physiological limits that reduce performance and increase casualties.
Infrastructure: Naval bases, Himalayan forward posts, and logistical nodes are threatened by sea-level rise, cyclones, and flash floods. The 2014 Kashmir floods, which damaged over 40 km of three-tier border fencing and flood-lighting LoC fencing⁷⁰, are a preview of a recurring problem.
Platforms: Extreme temperature fluctuations and humidity degrade armour, engines, and vehicles. The US military has already begun designing vehicles for higher heat and cold tolerance- India must follow suit.⁷¹
Equipment: Ordnance and ammunition have defined storage and operational temperature ranges. A changing climate expands the operational environments beyond these ranges.

Climate change is also squeezing the defence budget from two directions. India already spends about 5.6% of its GDP managing climate change impacts- a share expected to grow.⁷² A Stanford University study found that climate change had a negative 31% impact on India’s GDP per capita from 1961 to 2010.⁷³ Defence spending as a share of GDP has declined steadily, falling below 2 percent in 2024–25 for the first time in over a decade.⁷⁴ As climate disasters redirect more public spending toward relief and rehabilitation, the defence budget will face even greater compression, precisely at a time when India faces two active, nuclear-armed rivals on its borders.

Despite all this evidence, India’s strategic doctrine has been slow to formally integrate climate change into its national security framework. The 2008 National Action Plan on Climate Change (NAPCC)⁷⁵ and the Prime Minister’s Council on Climate Change were early institutional steps, but as a 2024 Tandfonline study noted, India has “remained opposed to discussing security implications of climate change in the UNSC.”.⁷⁶ The Indian strategic discourse, as the Planetary Security Initiative’s 2026 report notes, “remains primarily focused on civilian-centric impacts” rather than hard military readiness⁶⁹, and as recently as March 2026, the Ministry of Defence released its ‘Defence Forces Vision 2047’ — a comprehensive modernisation blueprint that makes no explicit mention of climate change as a security variable⁷⁷.

When the UNSC debate “Maintenance of International Peace and Security: Climate and Security” was convened, India’s permanent representative, TS Tirumurti, voted against a draft resolution in December 2021 on the grounds that it “attempted to securitise climate action and undermine the hard-won consensual agreements” reached at Glasgow COP26.⁷⁸ India’s position, restated across multiple UNSC sessions over 15 years, is philosophically coherent: securitising climate change risks bringing militarised solutions to problems that are inherently non-military in nature;⁷⁹ the UNSC, with its five veto-wielding permanent members who are historically the world’s largest emitters, is not a legitimate forum to decide climate governance;⁸⁰ and the right place for climate action is the UNFCCC, the UNGA, and ECOSOC, which are more representative and participatory⁷⁸.

This is not entirely wrong. The securitisation of climate change at the UN level has real risks- it can be used to justify military interventions dressed up as climate responses, and it gives P5 countries disproportionate control over a global problem they caused.⁸¹ ⁸² India’s resistance carries the moral weight of the Global South.

But there is a distinction that India has repeatedly failed to make cleanly. There is a difference between opposing the international securitisation of climate change (arguing that the UNSC shouldn’t police it) and failing to integrate climate risks into your own domestic security planning (refusing to acknowledge it as a threat to your own military).

India’s 2017 Joint Doctrine of the Armed Forces labels climate change a “non-traditional security issue”⁷⁶, a categorisation that is both technically accurate and practically meaningless, since it places glacier melt in the same administrative drawer as piracy and pandemics⁸³. That framing, non-traditional, therefore not urgent, is the problem.

This is a critical gap. Peer militaries, particularly in the US and within NATO, have been conducting disaster war games, climate risk audits of military installations, and equipment redesign programmes for years.⁸⁴ ⁸⁵ India’s CLAWS has called for the Integrated Defence Staff (IDS) to become the nodal body for climate security planning⁸⁶, and for a “risk-risk” orientation in policy one that weighs the cost of climate inaction against the cost of adaptation (A “risk-risk”⁶⁹ a decision-making approach used to analyze the trade-offs between different risks, specifically comparing the risk reduced by a particular action (e.g., regulation, mitigation) against new risks created by that same action).

So what about Siachen?
ISRO and the Wadia Institute of Himalayan Geology have documented a recession of approximately 800 metres from the Siachen Glacier’s snout over the last 20 years.⁸⁷ As glaciers retreat, the terrain they leave behind is not clean, empty ground. It is unstable moraine^{(Moraine is the debris (rock, sediment, dirt) that a glacier picks up and deposits as it retreats. It is loose, unconsolidated, and structurally unreliable. It also tends to form dams across glacial meltwater, creating glacial lakes that can burst suddenly and catastrophically, these are called glacial lake outburst floods, or GLOFs})⁸⁸ prone to collapse, to sudden flooding, to avalanche patterns that have no historical precedent because the ice that shaped them is no longer there. Old military positions may find themselves sitting on terrain that is physically changing beneath them.⁸⁹ Routes that were stable for decades become lethal. Strategic high points, held at enormous human cost, may shift in their tactical value as the topography itself rearranges.

Can troops continue to serve there? Technically, they currently do despite conditions that would be described, in any other context, as incompatible with human habitation. But the question climate change forces is not just whether they can- it’s whether the positions they hold will still make military sense as the glacier retreats and new terrain emerges. The Army will have to continuously reassess which positions are defensible, which supply routes remain viable and, what seems more frightening to me, which points are downstream of newly forming glacial lakes that could burst without warning.

All over our country, the ground is changing, shifting, melting under our feet. To ignore the security dimension of climate change is to believe that a nation can be “secure” even if its cities are underwater and its breadbasket is a dust bowl, and its soldiers don’t know where to stand. True autonomy in the coming century won’t just be measured by the size of our arsenal, but by the resilience of our resources. If national security is preparing for the worst case scenarios, it is time to acknowledge that climate change is also our war theatre.

Sources

Risk VI – How Disasters Amplify Systemic Injustice

The previous pieces in this series looked at how risk is priced, transferred, and hedged. This one looks at who absorbs it when none of those mechanisms work, and why that’s never random.

When devastating floods hit Kerala in 2018, a Dalit family walked three kilometres to the nearest relief centre at a temple, only to be told they were not allowed to enter.¹ A year later, when Cyclone Fani ravaged Odisha, another Dalit family walked to a relief shelter and was also turned away.¹ ²

Both were excluded by caste.

As activist Sangram Mallick put it: “Your caste determines what kind of treatment you will get during a disaster.”¹

These are often described as failures of disaster response. They are not. They are examples of how disaster response works.

Environmental stress (floods, heatwaves, droughts, cyclones, etc.) appears neutral, but its effects are not. Repeatedly, across countries and across hazards, harm clusters along pre-existing social lines: caste, race, gender, income, disability, age. The World Meteorological Organization puts it plainly:³ inequality and disaster vulnerability are “two sides of the same coin.” Climate change, in this sense, is not an external shock landing on a functioning system. It is a multiplier applied to a system that is already unequal.

To understand how that multiplication works, it helps to look at disasters not as singular events, but as a process, one that unfolds in three stages:

Who is exposed before the event.
Who is able to survive during it.
And who is able to recover after it.

I. Pre-Event: Who is placed in harm’s way
Across contexts, marginalised groups are systematically pushed into what are, in effect, sacrifice zones- places that are cheaper precisely because they are more dangerous.

In India, research published in the journal Demography found that marginalised caste groups experience 25–150% higher heat exposure at work than dominant caste groups, even after controlling for income, education, and geography, a pattern the authors described as “thermal injustice.”⁴ Separately, a 19-year study published in the journal Temperature found that India recorded nearly 20,000 heatstroke deaths between 2001 and 2019, a figure researchers say is an undercount given systemic underreporting.⁵

The same structural logic appears elsewhere. In the United States, racially segregated housing patterns have concentrated Black communities in urban heat islands with less tree cover and higher exposure to extreme temperatures.⁶ ⁷ Indigenous communities, displaced from ancestral land through colonial processes, are now disproportionately located in areas more exposed to climate hazards such as drought, wildfire, and extreme heat.⁸

Income reinforces this exposure. A global study of 573 flood events found that higher inequality within a country correlates with higher flood mortality, and that the protective effect of economic growth disappears once inequality is accounted for.⁹ So GDP growth appears protective in simple models but that effect vanishes when inequality is held constant: for the more than 80% of workers in low- and lower-middle-income countries employed in the informal sector, exposure is not just about where they live, but how they work.¹⁰ In Delhi, daily surveys of informal workers during peak summer showed that each 1°C increase in wet-bulb^{(Wet bulb temperature is the lowest temperature air can reach by evaporating water into it. It measures how effectively sweat evaporates to cool bodies, thus accounting for both heat and humidity. Unlike standard temperature, high wet bulb temperatures mean sweat cannot evaporate, making it difficult for the body to cool down, because high humidity means sweat cannot evaporate as easily.)}¹¹ temperature reduced earnings by 19%, with losses reaching 40% during heatwaves.¹² Medical expenses also rose 14% per degree, reaching 25% on heatwave days.¹² For them, heat is not a background condition, it is a direct constraint on survival.

II. During the Event: Who absorbs the shock
When a disaster hits, it does not affect everyone equally. It interacts with existing vulnerabilities, whether physiological, social, and/ or economic, and amplifies them.

For many women, the danger is not only environmental but social. A systematic review across 15 countries found that disasters increase violence against women through three pathways: economic entrapment, unsafe displacement environments, and shifts in household power dynamics.¹³ After Hurricane Katrina, intimate partner violence among displaced women in Mississippi nearly tripled within two years (went from 12.5% to 34.4%).¹³

Displacement itself often creates conditions where harm becomes easier. Camps without lighting, locks, or private sanitation are not just inadequate—they are enabling environments.¹³

For people with disabilities, the barriers are more immediate. In the 2011 Great East Japan Earthquake, persons with disabilities were twice as likely to die.¹⁴ Across disaster types globally, this ratio ranges from two to four times.¹⁵ The reasons are rarely mysterious: evacuation systems that assume mobility, communication systems that assume visibility or hearing, shelters that assume independence.¹⁵

Age compounds vulnerability in different ways. During the 2021 Pacific Northwest heatwave (United States), a majority of those who died were over 65¹⁶: in Oregon alone, approximately two-thirds of the 107 confirmed heat deaths were over that age.¹⁷ Physiological factors, such as reduced thermoregulation, chronic illness, play a role, but so do structural ones: isolation, dependence on caregivers, limited access to timely information.

For informal workers, the choice during a disaster is often binary: stop working and lose income, or continue working and risk physical collapse. A salaried worker may retreat indoors. A day labourer cannot.¹²

The disaster, in other words, does not create vulnerability in the moment. It exposes how unevenly the capacity to withstand shock is distributed.

III. Post-Event: Who is able to recover
If the disaster itself reveals inequality, recovery is where it becomes entrenched.

A 2023 IMF working paper found that income inequality increases after severe disasters across both advanced and developing economies, particularly when shocks are repeated or coincide with downturns.¹⁸ Recovery is not a reset to equality, it is an underlining of pre-existing societal furrows.

This underlining, in the form of aid, often follows the logic of the market. Systems designed to restore property values tend to benefit those who already have property, while offering little to those who do not.¹⁹ The result is that those with assets recover faster and more fully, while those without fall further behind.

At this point it is important to ask what allowed the wealthy asset-owner to build their initial wealth? There are many who truly come from nothing- including no social status, but there are many who do benefit from at least their social background, such as a poor person who nevertheless benefits from a high caste status, or a person who has exactly the same background and qualifications as another, but benefits from their gender or sexual identity.

Migration is one of the clearest outcomes of this gap. Research has shown that marginalised caste groups in India are significantly more likely to be displaced by climate impacts, with many becoming vulnerable to trafficking and forced labour during that process.²⁰ Globally, climate change is expected to displace tens of millions by mid-century, with the most vulnerable populations facing the highest risks during movement and resettlement.²¹

Food security follows a similar pattern. Global assessments show that the majority of the world’s population already lives in countries below the average food security threshold, and warming scenarios are expected to push hundreds of millions more below it.²² Economic growth offers only limited protection, because it raises income (usually along socially-accepted lines⁹) without fundamentally strengthening resilience.²³

Recovery, then, is not simply about rebuilding what was lost. It determines who has the resources to face the next disaster—and who does not.

Isn’t disaster indiscriminate?
It is often said that disasters do not discriminate.

If that were true, their impacts would be randomly distributed.

They are not.

Across countries, across hazards, and across time, the same pattern repeats: those who are already marginalised face greater exposure, suffer greater harm, and recover more slowly. Even major risk models have historically failed to account for these differences, despite extensive evidence that social inequality drives disaster outcomes.²⁴

This consistency is the point. The pattern is not incidental, it is structural. The cycle is Inequality → Disaster → Unequal Recovery → Deeper Inequality → Next Disaster

When that Dalit family in Kerala was turned away from a relief centre, the issue was not access to a building. It was access to protection itself- who is considered entitled to it, and who is not.

Climate change is often framed as a shared crisis. But its impacts are not shared equally, and its costs are not distributed randomly. They follow the structure of the system they move through.

Disasters do not redraw those lines. They deepen them.

Sources

Risk – V: The Strait of Hormuz and The Price of Uncertainty

If you’ve been following this blog’s series on risk, you know by now that risk isn’t just something that happens on a trading screen or inside a bank. Risk lives in the real world — in weather patterns, in election results… and also clearly in the Strait of Hormuz.

Geography
The Strait of Hormuz is a narrow oceanic passage connecting the Persian Gulf to the Gulf of Oman and, from there, to the rest of the world’s oceans. It is bordered on the north by Iran and on the south by the UAE and Oman.¹ At its narrowest, it is just 21 nautical miles wide, with the navigable shipping lanes only about 2 miles wide in each direction.²

Importance
Through this bottleneck flows roughly one-fifth of all global petroleum liquids, which is approximately 21 million barrels per day of crude oil and condensates.³ UNCTAD puts it at around a quarter of all global seaborne oil trade.⁴ The daily value of oil and LNG transiting the Strait is estimated at over $1.3 billion.⁵Annually, trade flows worth approximately $1.2 trillion from five Gulf countries (Iran, the UAE, Qatar, Kuwait, and Bahrain) depend on this waterway remaining open.⁵

So, if this strait is blocked for one single day, between US $2 and $2.3 billion worth of oil trade will be disrupted.⁶

Update, if you live under many rocks
The strait has been blocked since Israel and USA decided to start bombing Iran on 28 February 2026⁷, with the Strait formally closing to most traffic by 4 March⁸ (aside: I feel like March has lasted for 84 years).

Risk
In previous posts on this blog, we’ve talked about risk as the possibility that something unexpected happens, and that the unexpected thing costs you something⁹ ¹⁰ (because when it gifts you something, you’re happy- we only tend to be worried when something bad happens, not when something nice happens by accident/ through uncertainty). That cost could be money, time, safety, or opportunity. But the key insight is always this: risk is not just about bad outcomes. It’s about uncertainty itself.¹¹

Finance has a more precise definition. In financial markets, risk is typically measured as the volatility of returns (how much a price, yield, or value might swing from its expected level).¹² But risk also has a tail dimension¹³ ¹⁴: the small-probability, catastrophic events that are hard to price and even harder to hedge ^{(hedging is a risk management strategy where you take the opposite position from an asset you already own so that if the first asset reduces in value, the opposite hedged position will experience the exact opposite and either maintain value or increase in value, which allows the entity that is using hedging as a strategy to continue to be part of the market rather than sell the first asset which is facing volatility, while also not losing everything if its value falls sharply. It involves the cost of buying the opposite asset, so it is a kind of insurance)}¹⁵. The Strait of Hormuz is the textbook example of this second kind of risk. It sits in the tail, but when the tail wags, it apparently wags the whole dog with it.

Geopolitical Risk Premium (GRP)
Geopolitical risk is the threat, occurrence, or escalation of adverse events, such as wars, terrorism, and international tensions, that disrupt global relations, economies, and supply chains.¹⁶ ¹⁷

Every time tension rises in the Gulf, the price of oil goes up- even before a single barrel is disrupted.¹⁸ This is called the Geopolitical Risk Premium (GRP): the extra cost added to the price of oil simply because the possibility of disruption exists.¹⁹

In early 2026, Oxford Economics estimated this premium at approximately US $9 per barrel.⁵²⁰ That means every barrel of oil being bought and sold globally was US $9 more expensive than it would be in a world without Hormuz tension, and not even because supply had actually been cut, but simply because markets were pricing in the possibility that it might be.

As we know, this is a foundational concept in risk and risk management: people pay for uncertainty (this is how insurance works as a business, for example).²¹ ²² The premium is the market’s way of costing the uncertainty of not knowing what will happen, whether for a term life insurance (which actuarial nerds actually know a lot about) or about Iran closing the Strait of Oil: we don’t know what will happen, and that not-knowing is worth something (priced as the premium).²³ ²⁴

Scenario Analysis
Oxford Economics published a scenario analysis in February 2026 that laid out how it was thinking about Hormuz risk:⁵

20% probability of faster de-escalation, where the risk premium unwinds quickly
45% probability of the Strait stays open, flows remain broadly normal
30% probability of low-level disruption, where repeated interference cuts vessel traffic by 50% for two months, reducing global oil supply by 4 million barrels per day
5% probability of severe disruption, where Iran halts transit for up to a week, pushing oil to $140 per barrel and gas above $40 per MMBtu

So, according to Oxford Economics, the most likely scenario was that nothing would go drastically wrong. Still, that 30% scenario of low-level disruption is not a small number. In finance, a 30% probability event is something you plan for, hedge against, and price into your decisions. And then the 5% tail event happened. In risk-speak, this is called a Grey Rhino²⁴– a highly probable, high-impact threat that is visible and repeatedly warned about but neglected anyway, because acting on it costs money now, and the event is only probable, not certain.

Insurance
One of the most sensitive early-warning signals of financial risk is insurance pricing, because when something becomes riskier, insurers reprice insurance to cover both, the rising uncertainty, and the total risk.²⁵ They’re basically trying to cover all major possibilities that they’ll have to pay you rather than you either swallowing the losses, or you paying them.

Therefore, war risk insurance premiums for ships transiting the Strait have been surging²⁶, which means that freight rates for oil tankers have spiked. Marine fuel costs are rising too, layering cost upon cost.²⁷ Maritime insurance companies have the incentive to be ahead of the news, not behind it.²⁸When they start repricing risk aggressively, or worse, when they start withdrawing cover entirely, ships that are theoretically able to transit the Strait become practically unavailable because they can’t afford or obtain insurance.²⁹³⁰

This is not the first time insurance has been the mechanism that shut down a shipping lane. When Houthi attacks began in the Red Sea in late 2023³¹, the persistent collapse in traffic wasn’t primarily because ships were being sunk- it was because the threat alone made insurers reprice, which made shipowners reroute. War risk premiums for Red Sea voyages rose from effectively zero to between 0.5% and 1.0% of a ship’s hull value, and major carriers including Maersk, MSC, Hapag-Lloyd, and CMA CGM suspended transits entirely, not because their ships couldn’t physically pass, but because the insurance mathematics no longer worked.³² By late 2024, S&P Global reported that Cape of Good Hope reroutes were likely to “persist well into 2025”, and they did.³³ The Hormuz closure is the same mechanism, at a far larger scale.

Cascading Effects
A cascade effect is a sequence of events in which each event produces the circumstances necessary for the initiation of the next event.³⁴ Here are some impacts that we’re all seeing these days:

Higher oil prices are a tax on everything. They raise the cost of transportation, manufacturing, petrochemicals, and heating- essentially every sector of the modern economy.³⁵ ³⁶
Qatar, the world’s largest LNG exporter, ships nearly all its gas through Hormuz. Any disruption to LNG flows hits Europe, Japan, South Korea, and increasingly India. These are countries that have been restructuring their energy systems around gas as a “transition fuel.”³⁷ ³⁸
Fertilisers are made from natural gas and other petrochemical inputs. The Gulf is a major producer. If fertiliser shipments are disrupted, the cost of growing food goes up. Planting decisions change. Crop yields fall, with the most severe consequences falling on developing economies.³⁹
When ships can’t transit the Strait (or won’t, because insurance costs make it uneconomical) they have limited alternatives. The next-best option is to go around the Cape of Good Hope at the southern tip of Africa, which adds roughly 3,500–4,000 nautical miles and about 10–15 days to the journey.⁴⁰ ⁴¹ That means more fuel, higher crew costs, slower delivery times, and, crucially, fewer ships doing more work: Before the crisis, around 150 vessels transited the Strait each day; that figure has since fallen to four or five. The result could be a supply-side squeeze in global shipping capacity.⁴² Freight rates rise not just for oil tankers but for cargo ships, container ships, and bulk carriers.⁴² These higher costs flow through to the price of every manufactured good that depends on components, materials, or energy from the Gulf region.
When oil prices spike, petro-dollar economies gain. Gulf sovereign wealth funds get richer.⁴³ ⁴⁴ The US dollar often strengthens (since oil is priced in dollars).⁴⁵ But for oil-importing nations, the impact is brutal: India, for instance, imports over 85%⁴⁶ of its crude oil, and while it has diversified⁴⁷ supply routes in recent years, roughly 40%⁴⁸ of crude imports and 90%⁴⁸ of LPG imports still transit the Strait. When the Strait closed, the government was forced to issue emergency orders directing refineries to maximise domestic LPG production to stop cooking gas running out in households.⁴⁸ A sustained oil price spike means a widening current account deficit,⁴⁹ a weaker rupee,⁵⁰ imported inflation, and growing pressure on the Reserve Bank of India to raise interest rates^{(to curb inflation and defend the currency because raising interest rates increases borrowing costs for consumers and businesses, reducing demand and slowing down economic activity, which helps bring inflation down)}: even if the domestic economy doesn’t otherwise warrant it.
The cost of jet fuel has more than doubled since the Strait closed.⁵¹ ⁵² The cost to airlines is estimated at $11 billion⁵³ in additional annual fuel costs, which will show up in your flight bills, but also in the cost of any items being transported through air, including, for example organs for transplant⁵⁴ (that’s right, it won’t just impact Amazon deliveries).
UNCTAD⁵⁵⁵⁶⁵⁷ explicitly warned that high debt burdens and rising borrowing costs limit these countries’ ability to absorb new price shocks. When energy bills go up and borrowing costs rise simultaneously, governments face impossible choices: cut subsidies, raise taxes, or default.
- To understand why, you need to know one thing about how developing-country debt works: a significant amount of the $11.4⁵⁸ trillion in external debt owed by developing countries is denominated in US dollars. This means that while these governments collect their taxes and revenues in their own local currencies they must repay their loans in dollars, a currency they don’t control and can’t print.⁵⁹
- When oil prices rise and economic conditions worsen, local currencies tend to weaken against the dollar.⁶⁰ ⁶¹ Think of it this way: if your salary is paid in rupees but your rent is charged in dollars, and the rupee suddenly buys fewer dollars than it did last month, your rent just got more expensive, even though the dollar amount didn’t change. That is exactly the position these governments are in. The debt didn’t grow; their money just became worth less, making the same debt harder to pay.⁵⁶
- The result is a brutal squeeze from three directions at once: energy bills going up, borrowing costs rising, and debt repayments consuming an ever-larger share of government revenue in real terms.⁵⁷ When a government is spending a significant portion of what it earns just to service debt it took on years ago, there is almost nothing left for the things governments are supposed to do: run schools, staff hospitals, maintain roads, and protect its most vulnerable people.⁶² Please note: currently 3.4 billion people live in countries already spending more on debt than on health or education.⁶³ ⁶²
When oil prices spike, the standard central bank response is to raise interest rates to fight inflation, but higher rates, combined with rising energy costs, create the nightmare scenario of stagflation⁶⁴– the sepulchral portmanteau of stagnation + inflation: economies are not growing, are even contracting, and then being hit with inflation.⁶⁵ The 1970s oil shocks produced exactly this scenario, and most Western economies spent nearly a decade fighting it.⁶⁶ ⁶⁷

What happens next?
As of April 12, 2026, US-Iran talks in Islamabad collapsed after 21 hours without a deal⁶⁸, and Trump has announced a naval blockade of the Strait.⁶⁹

According to CNBC’s analysis of oil-shock-induced bear markets, the average duration of a market decline caused by an oil shock is approximately 13 months, with an average drop of around 30%.⁷⁰ But the range is enormous, and duration, more than any other variable, determines how much lasting damage gets done.⁷⁰ Allianz Research has already stated plainly: if the Strait remains blocked for more than three months, the impact on global growth will start to be recessionary.⁷¹ Global GDP growth for 2026 has already been revised down to 2.6%, from 3.1% projected before the conflict.⁷¹

However, the thing to note is that even if the Strait reopens, the effects don’t simply switch off.

Insurance premiums, once repriced upward, tend to stay elevated for years.⁷² ⁷³ This is because the risk hasn’t gone away once the issue has been resolved, it has simply been revealed: that is, now people know, and Iran knows, and people know that Iran knows, that they can do this any time they wish to. Iran has even begun charging transit tolls to ships seeking passage, a development that, if it stands, converts a one-time crisis into a permanent feature of the global shipping cost structure.⁷⁴

Secondly, shipowners who rerouted through the Cape of Good Hope have restructured their logistics, signed new contracts, and reoriented supply chains that won’t simply snap back the moment a ceasefire holds.⁷⁵ ⁷⁶ The IFO Institute forecasts that Germany, which is used as a proxy for industrial Europe, will still see the drag from the war on its GDP growth through 2027, even in the de-escalation scenario.⁷⁷ The inflation spike from Q2-Q3 2026 has already been priced in by Allianz, and that won’t change just because the Strait opens.⁷⁸

There is also the question of what the world does with the lesson. Every oil shock in history has accelerated investment in energy alternatives.⁷⁹ ⁸⁰ The 1973 embargo triggered the first serious wave of Western investment in nuclear power and efficiency standards.⁸¹ The 2026 shock has already prompted urgent conversations about alternative pipelines, renewable acceleration, and LNG infrastructure diversification.⁸² ⁸³ These structural responses will, eventually, reduce the world’s dependence on this chokepoint: but they operate on decade-long timescales, not quarterly ones.⁸⁴

In the shorter term, the most honest answer is: nobody knows⁶⁴, and we’re all paying the cost of not knowing.⁸⁵ The financial markets’ best guess, reflected in options pricing and analyst forecasts, is that there is a meaningful probability of both a relatively contained outcome and a prolonged, recessionary one.⁸⁶⁸⁷The uncertainty itself has a cost, as we’ve now established. And that uncertainty will remain priced into everything. This is the architecture of systemic risk. It doesn’t ask for your involvement. It doesn’t need you to have invested in oil futures or to have taken a position on Iranian politics. It just needs the world to be as interconnected as it is.

Sources

Why ESG Risk is Business Risk

In 2020, Rio Tinto legally blew up 46,000‑year‑old Aboriginal rock shelters at Juukan Gorge in Western Australia to expand an iron‑ore mine.¹ The caves contained evidence of continuous human occupation over tens of thousands of years and were sacred to the Puutu Kunti Kurrama and Pinikura (PKKP) people.²

The blasting was technically lawful under existing approvals,³ but it triggered widespread outrage, a parliamentary inquiry,⁴ and the resignation of the CEO and two senior executives.⁵ Investors and ESG analysts had already flagged Rio Tinto as weak on community relations and governance factors capturing “risk of operational disruption due to community opposition”.⁶

It seems obvious that blasting someone’s spiritual sites to pieces would be considered harmful, so why wasn’t Rio able to see this before they did it?

The short answer is: their risk system did not treat those caves as a business risk. They thought it would be enough to simply get governmental approval rather than understanding the historical and cultural value of the caves. The environmental and social damage did not register as a real problem until after it detonated into a governance crisis.

Traditional finance textbooks worry about market and credit risk, the volatility of asset prices, and company‑specific risk that diversified investors can wash away. ESG risk simply asks a different set of questions about the same business:

How fragile is your position if one whistle‑blower email exposes years of “creative” emissions accounting?
What happens when your coal plant becomes uninsurable or unprofitable long before the end of its physical life?
What is your downside if a supplier’s factory fire kills workers and your brand name is on the label?

Those are not “extra” concerns. They are channels through which financial, legal, operational and reputational damage hits a company.

So,

E: “Climate change” becomes a three‑day flood that shuts your main warehouse, a mandatory carbon price that doubles operating costs, or the loss of export markets because you fail EU value‑chain rules.
S: “Labour conditions” becomes a factory fire, a strike during peak season, or a viral video of an abusive supervisor.
G: “Governance” becomes fraud in a subsidiary, a bribery case under anti‑corruption law, or your board signing off on misleading ESG claims and facing regulators later.

Case 1: Ali Enterprises
In 2012, a fire at the Ali Enterprises garment factory in Karachi killed more than 250 workers and injured many more, making it one of the deadliest factory fires in modern garment production and Pakistan’s worst industrial accident.⁷ The blaze reportedly followed an explosion, but what turned it into a mass‑casualty event were basic safety failures: locked exits, barred windows, no functioning fire alarm, inadequate equipment, and workers with no emergency training.⁷

Weeks before the fire, Italian auditor RINA had certified the factory as compliant with the SA8000 social responsibility standard, on behalf of German discount retailer KiK.⁸ The audit put a stamp of “safe” on what campaigners later called a death trap.

In ESG terms:

Social: labour rights and health and safety were not marginal; they determined whether hundreds of workers lived or died.
Governance: both the factory’s internal controls and the external certification regime failed. Social audits functioned more as reputational shields for brands than as real safety controls.

For brands sourcing from similar factories, the risk event is not “labour standards in xyz country”; it is “mass‑casualty factory disaster linked to our supply chain”, with consequences including legal claims, disrupted production, and global coverage featuring your logo.

Case 2: Rana Plaza
Months later, the Rana Plaza building collapse in Bangladesh killed more than 1,100 garment workers and injured thousands.⁹ Like Ali Enterprises, it exposed structural failings: illegal construction, ignored warning cracks, and workers pushed back into the building under threat of lost wages.⁹ ¹⁰

Together, Ali Enterprises and Rana Plaza turned factory safety from a “CSR” talking point into a core ESG risk for global fashion brands. They were now forced to answer the question: what is the probability and impact of catastrophic supplier accidents affecting our brand value?¹¹

In response:

More than 200 brands signed the legally binding Bangladesh Accord, committing to fund and enforce independent safety inspections and improvements in supplier factories.¹²
The Accord’s inspections and remediation programmes significantly reduced safety risks in covered factories, although broader labour standards and the situation in other countries still lagged.¹³

Again, this is ESG as business risk:

Social: worker safety and freedom to refuse unsafe work.
Governance: the difference between voluntary codes of conduct and binding, enforceable agreements with unions and NGOs.

Case 3: Prologis¹⁴
Prologis, a global logistics real estate company, analysed energy consumption across its portfolio, identified inefficiencies, invested in energy‑efficient technologies and renewables, and built this into its tenant proposition. The results included:

Lower energy costs across the portfolio.
A reduced carbon footprint.
Stronger positioning with ESG‑conscious tenants looking for efficient, low‑carbon facilities.

Here:

Environmental risk is transition risk: rising carbon prices, stricter building codes, and tenant demand for green buildings that could otherwise turn older assets into stranded ones.
Social shows up in tenant relationships and expectations.

Prologis treated these as business hazards, not future CSR talking points. It used ESG data to find where margins would quietly erode over time and acted early.

And what about Rio Tinto and the sacred caves? Through an ESG lens:

Environmental: irreversible destruction of a unique cultural and natural heritage site.
Social: Indigenous rights and loss of trust with local communities.
Governance: failure of board and management to treat community opposition and cultural heritage as material risks, not tick‑box compliance.

The risk event here is not “cultural heritage”. It is “destruction of a sacred site leading to loss of social licence, political and investor backlash, and leadership crisis”. The fact that approvals were in place did not prevent reputational loss or the internal disruption of a forced leadership change.

Once you see these stories together, the claim “ESG risk is business risk” stops being a slogan:

Ali Enterprises and Rana Plaza show social and governance failures turning into catastrophic operational, legal, and reputational losses.
Prologis shows environmental and social foresight translating into lower costs and stronger market position.
Juukan Gorge shows an environmental and social misjudgement leading to a governance crisis and loss of social licence.

That is why ESG‑related risks should sit inside the same enterprise risk management framework as credit, operational, and market risks, not in a separate CSR annex. Assess climate, environmental, social, and governance risks on the same likelihood and impact scales you use elsewhere, so boards can compare them directly and prioritise consistently.

Proactive ESG risk management then looks like any good risk practice:

Watching for weak signals and early warning indicators (accidents in similar factories, community complaints, climate policy shifts).
Stress‑testing strategies against multiple futures, including more aggressive climate policy or stricter human‑rights regulation.
Updating assumptions as technology, regulation, and stakeholder expectations move.

ESG does not create new categories of risk. It forces companies to confront risks they were already running but not properly measuring. Ultimately, value is shaped as much by social licence, institutional trust and regulatory trajectory as by commodity prices or quarterly earnings, and companies that treat ESG signals as peripheral optics problems discover too late that they were early warnings of business loss. Those that integrate them into core decision-making, capital allocation and board oversight are not being “ethical” in a narrow sense; they are protecting asset value, preserving optionality, and reducing the probability of reputational damage.

Sources

Risk – IV: When Climate Risk Becomes Competitive Risk

In 2013, while conducting research for my Master’s thesis, I met corporate leaders who did not understand why climate change was something businesses were being held responsible for. They were often quite resentful, and yet, nearly all of their organisations had suffered from the Mumbai floods that happened that year- for one of them, a logistics company, the losses were so heavy they planned to shift their warehouses out of the city.

Climate change was viewed as a political issue, even as it was already disrupting operations. However, climate risk is no longer about ethics or disclosure; it is about competitive survival.

A viral picture of the Goldman Sachs building that remained powered and largely unscathed despite being in a mandatory evacuation zone during Hurricane Sandy in 2012.¹

The point is not abstract. During Hurricane Sandy in 2012, a widely shared image showed the Goldman Sachs building in lower Manhattan lit and operational while much of the surrounding area was dark. The firm had invested heavily in resilience infrastructure. Business continuity became a competitive advantage.

In a 2015 speech,² Mark Carney, then Governor of the Bank of England, argued that climate change is a “tragedy of the horizon” because its worst effects will be felt beyond the traditional horizons of business planning, political cycles, monetary policy, and financial regulation. Current decision‑makers therefore have weak incentives to act even though future generations will bear the costs, creating a structural mismatch between where the risks sit and where the power to respond lies.

He highlighted three channels through which climate change threatens financial stability:²

Physical risks: losses from more frequent and severe floods, storms, heatwaves, and other weather‑related disasters.
Liability risks: lawsuits and compensation claims against firms and directors for contributing to or failing to manage climate harms.
Transition risks: repricing of assets as policy, technology, and consumer preferences shift toward a low‑carbon economy, creating “stranded assets,” especially in fossil fuels.

Because standard risk models and planning cycles rarely look out beyond a decade, they miss non‑linear climate shocks and underestimate the scale of structural change required, especially under scenarios that keep warming well below 2°C.³ ⁴

Climate change is no longer a CSR issue; it is a core strategic, financial, and operational risk⁵ ⁶ affecting supply chains, asset location decisions, insurance costs, regulatory exposure, consumer demand, and access to capital.

Breaking the tragedy of the horizon requires extending risk management beyond conventional timeframes and embedding climate risk into today’s decision systems. We are already experiencing climate risk, and there is no way to fully insulate every asset from its effects.

For financial institutions, climate risk shows up as credit risk (borrowers’ ability to repay), market risk (asset price changes), operational risk (disruptions to operations), and reputational risk (backlash over financing high‑emitting activities). Empirical work on banks shows that exposures to transition risk are currently modest in portfolio terms but concentrated in specific sectors, and that banks signing net‑zero alliances have begun to reduce lending to the riskiest industries.⁷ ⁸

For corporations, the following may help:

Risk identification: Map climate hazards and drivers (heat, floods, drought, storms, sea‑level rise; carbon prices; regulations; technology shifts) to specific assets, operations, and supply chains.
Assessment and quantification: Use tools ranging from high‑level heatmaps to asset‑level hazard models and financial impact assessments (e.g., revenue at risk, cost of goods sold, capex needs).
Integration into Enterprise Risk Management (ERM): Incorporate climate risks into risk registers, materiality assessments, internal controls, and capital budgeting, with clear thresholds for escalation.

For financial institutions, more technical steps include:

Exposure mapping: Quantify portfolio exposure to vulnerable sectors and geographies as a share of lending and investment books.
Climate-adjusted credit analysis: Incorporate emissions intensity, transition plans, and physical risk exposure into underwriting and pricing.
Scenario stress testing: Use Network for Greening the Financial System (NGFS) or equivalent scenarios to assess losses under combinations of policy tightening and physical shocks.

Regulators increasingly expect banks and insurers to demonstrate that climate risks are integrated into their internal capital adequacy assessments, risk appetite statements, and supervisory dialogues.⁹

For banks and investors, an important nuance is that reducing portfolio emissions too mechanically by divesting from high‑emitting sectors can undermine real‑economy transition, because those same sectors (power, steel, transport) require capital to decarbonise. Leading practice therefore shifts from simple “brown exclusion” to engagement, conditional finance, and transition‑linked instruments.¹⁰ ¹¹

All of this reframes climate change from a distant macro-risk into an immediate business continuity problem. The question is no longer whether climate risk matters, but how organisations operationalise it within decisions made today. Businesses and financial institutions must change how they allocate capital and design products. Climate‑aligned finance involves both reducing exposure to misaligned activities and growing exposure to solutions.¹²

For non‑financial corporates:

Shift capex toward energy efficiency, low‑carbon technologies, and resilience measures (e.g., relocating assets, flood‑proofing, cooling infrastructure), guided by scenario‑tested business cases.
Integrate internal carbon pricing into investment decisions and product design to reflect transition risk and incentivise low‑carbon choices.
Explore innovative risk‑sharing instruments, such as parametric insurance for climate‑related losses or resilience bonds linked to infrastructure upgrades.

For financial institutions:

Develop green and sustainability‑linked products (green bonds, sustainability‑linked loans, transition bonds) with clear use‑of‑proceeds criteria and performance‑based pricing.
Use portfolio alignment tools (e.g., implied temperature rise metrics, sectoral pathways) to steer lending and investment toward net‑zero‑compatible activities, while monitoring credit risk.
Avoid “paper decarbonisation” that simply sells high‑emitting assets to less regulated owners; instead, engage with clients to finance credible transition plans and set conditions for continued support.

Research shows that, so far, banks’ transitions have been gradual and often focus more on emissions metrics than on real‑economy outcomes, underscoring the need to link commitments to enforceable policies and incentives.

To translate this into an actionable agenda, organisations can focus on a staged approach:

Diagnose and govern: Brief boards on climate risk exposure. Assign clear oversight at board and executive levels.
Measure and disclose: Strengthen scenario analysis, emissions tracking, and exposure metrics. Build data systems aligned with emerging standards.
Integrate into risk and strategy: Embed climate considerations into ERM, capital budgeting, procurement, and sector strategies.
Align capital and incentives: Set science-based targets with interim milestones. Adjust lending and investment policies to phase out clearly misaligned activities while scaling transition and resilience finance.
Engage and collaborate: Work with regulators, alliances, clients, and suppliers to raise standards and avoid a race to the bottom.

Traditional business continuity frameworks assume that shocks are temporary, insurable, and geographically contained. Climate risk increasingly violates all three assumptions. The tragedy of the horizon is therefore not just about time, but about governance. Climate risks accumulate slowly, crystallise suddenly, and cascade across balance sheets, supply chains, and communities. By the time they appear in backward-looking metrics, strategic options have already narrowed.

For corporations and financial institutions alike, the challenge is no longer one of awareness or disclosure. It is whether decision-making systems — capital allocation, product design, credit assessment, and continuity planning — can be rewired to operate under conditions of deep uncertainty and irreversible change. Those that succeed will not eliminate climate risk (that’s impossible). They will internalise it early, adapt faster, and preserve optionality as the transition unfolds. Those that do not may find themselves where many firms were in the early 2010s—surprised by risks that were already visible, and outperformed by competitors who prepared earlier.

Sources

Risk – III: Pricing Risk

A 40-year-old non-smoker in Delhi faces a measurable probability of dying in the next year. If the 40 year old is a woman, she will have a slightly better chance at life than a male counterpart. If she lives in a wealthy area, her chances are once again better than another woman living in a less privileged location.¹ ² ³

How do we know this? We know this because actuaries work with mortality and health data from millions of people, and build tables that segment risk by age, gender, smoking status, income, and even geography, to price policies accurately.⁴

Types of risk
Over time, experts have classified risk into different types. Here’s a table about the different types of risk:

RISK TYPE	DEFINITION	CHARACTERISTICS	EXAMPLES
HAZARD RISK (Pure Risk)⁵ ⁶	The possibility of loss from natural events or accidents. The oldest, most intuitive kind of risk.	• Unintended—nobody wants them • Objective frequency data—insurers have centuries of records • Insurable—probability and consequence can be estimated from historical data • Cannot create profit—only causes loss	• Fire and property damage • Windstorms and hail • Theft and burglary • Flooding • Liability from personal injury
OPERATIONAL RISK⁷ ⁸ ⁹ ¹⁰	The risk that your business’s internal machinery breaks down. Unlike hazard risk, it’s inherent to doing business—you can’t eliminate it, only manage it. Also cannot be diversified away. Defined by Basel II as: “Risk of loss from inadequate or failed internal processes, people and systems, or external events.”	• Inherent to operations—impossible to eliminate • Non-diversifiable—all firms in an industry face similar operational risks • Hard to quantify—driven by control quality and governance, which are difficult to measure • Multiple sources—spans people, processes, systems, and external events	Process Failures: Accountant enters data incorrectly, leading to wrong financial statements; Wrong calculation of tax liabilities Human Error: Surgeon operates on wrong patient; Employee sends confidential email to wrong recipient; Trader executes wrong order System Failures: Bank’s payment system crashes; Company’s website goes down during peak shopping season; Database corruption losing customer data Fraud: Employee embezzles funds; Vendor submits fake invoices; Internal collusion to bypass controls External Events: Natural disaster destroys office; Key supplier suddenly defaults; Cyberattack from external actor
FINANCIAL RISK¹¹ ¹² ¹³	Risk from changes in financial variables: credit defaults, price movements, or inability to access funds. Encompasses three subcategories.	• Market-driven—determined by supply and demand in public markets • Observable prices—interest rates, bond spreads, stock prices are public • High correlation—multiple financial risks often move together during crises	Credit Risk: Borrower fails to repay loan; Bank faces default Market Risk (Interest Rate, Equity, Currency, Commodity): Interest rates rise, bond portfolio value falls; Stock prices decline; Rupee weakens against dollar; Oil prices spike increasing business costs Liquidity Risk (Asset & Funding): Cannot sell asset when needed (asset liquidity); Cannot raise cash when obligations due (funding liquidity)
STRATEGIC RISK¹⁴	Risk that your business strategy is wrong. Risk from strategic decisions and competitive threats that can derail long-term objectives. Highest impact, but low frequency.	• High impact, low frequency—rare but potentially catastrophic • Long-term consequences—effects persist for years • Cross-functional impact—affects entire organization • Forward-looking—requires anticipating future changes • Not quantifiable—each situation is somewhat unique	Poor Strategy Decisions: Entering unviable new markets; Expanding too quickly into new industries; Pricing strategy that’s unprofitable Competitive Threats: New disruptive competitor; Competitor’s aggressive pricing; Merger of competitors Technological Disruption: Emerging technology makes business model obsolete (e.g., ride-sharing disrupting taxis); Failed innovation or delayed product launches Resource Misalignment: Allocating resources to declining products instead of growth opportunities Market/Industry Changes: Shift in customer needs and expectations; Regulatory changes forcing business model changes
COMPLIANCE & REGULATORY RISK¹⁵	The risk that you violate laws, regulations, or internal policies, resulting in fines, legal action, or reputational damage. The regulatory environment is constantly changing.	• Pervasive—affects all areas of organization • Constantly evolving—new regulations, changing requirements • Penalties escalating—fines and enforcement becoming more severe • Jurisdiction-dependent—different rules in different countries • Partly controllable—you can strengthen controls, but regulatory changes are external	Financial Crimes: Money laundering violations; Bribery and corruption; Sanctions violations Data & Privacy: GDPR violations (Europe); CCPA violations (California); HIPAA violations (healthcare); Customer data breaches Contract & Market Conduct: False advertising; Market manipulation; Insider trading; Misleading disclosures Employment & Safety: Labor law violations; Health and safety violations; Harassment and discrimination Industry-Specific: Healthcare regulations (HIPAA); Financial regulations (Banking Acts); Environmental regulations
REPUTATIONAL RISK¹⁶ ¹⁷	The risk that negative publicity damages your brand, eroding customer trust, investor confidence, investor perception, or ability to attract talent. One of the hardest risks to quantify.	• Hidden until it happens—not visible in normal operations • Disproportionate impact—market values reputation more than the direct financial loss • Self-inflicted worse than external—fraud damages reputation 2x more than accidents • Long recovery time—trust takes years to rebuild • Interconnected—affects customer base, employees, investors, partners simultaneously	Product/Service Failures: Volkswagen emissions scandal (2015): $30B+ in losses, brand destroyed, took years to recover; Boeing 737 MAX crashes: customer confidence shattered; Product recalls damaging trust Ethical/Fraud Issues: Wells Fargo account scandal: reputation destroyed despite being largest bank; Facebook/Meta privacy scandals: customer trust eroded Workplace Issues: Harassment scandals; Discrimination claims; Executive misconduct Environmental/Social: Oil spills; Labor exploitation; Pollution incidents
CYBER & TECHNOLOGY RISK¹⁸ ¹⁹	The risk of losses from disruption or failure of IT systems, data breaches, ransomware attacks, or technology obsolescence. Increasingly distinct from general operational risk.	• Rapidly evolving threat landscape—new attack vectors constantly emerge • Control-dependent—pricing based on current security posture, not history • Insurance available—unlike most strategic risks, cyber can be insured • Industry-dependent—high-risk sectors (finance, healthcare) pay more • Improving controls reduce premiums—strong incentive alignment	Data Breaches: Hackers steal customer information; Personal data of millions exposed; Regulatory fines and lawsuits follow Ransomware Attacks: Criminals lock you out of systems; Demand payment to restore access; Business operations halt System Failures: Software bugs or aging infrastructure cause crashes; Website goes down; Payment systems fail DDoS Attacks: Website flooded with traffic, becomes inaccessible; Business loses revenue during attack Insider Threats: Disgruntled employee steals data; System administrator sabotages operations; Contractor misuses access

Different types of risks

Each of these types of risks attracts different prices. Here’s another table:

RISK TYPE	DEFINITION	PRICING CHALLENGE	KEY INSIGHT
HAZARD RISK (Pure Risk)⁵ ⁶	The possibility of loss from natural events or accidents. The oldest, most intuitive kind of risk.	Relatively straightforward to price because: Historical data is abundant and reliable Frequency and severity are stable over time	Easiest to price. Insurers have vast datasets spanning centuries showing how often fires, floods, and accidents occur. This precision makes hazard risk the most competitively priced and cheapest form of risk insurance.
OPERATIONAL RISK⁷ ⁸ ⁹ ¹⁰	The risk that your business’s internal machinery breaks down. Unlike hazard risk, it’s inherent to doing business—you can’t eliminate it, only manage it. Also cannot be diversified away. Defined by Basel II as: “Risk of loss from inadequate or failed internal processes, people and systems, or external events.”	• Real drivers (control quality, governance, employee skill) are hard to measure • Cannot use simple historical formulas • Basel II uses crude proxy: operational risk capital = percentage of gross income • Limited historical data compared to hazard risk • Outcomes are correlated across firms during crises	Cannot diversify away. When 100 banks all face the same operational risk (say, a payment system cyberattack), they all suffer simultaneously. This systemic nature makes operational risk expensive to accept and pricing it requires judgment, not just formulas.
FINANCIAL RISK¹¹ ¹² ¹³	Risk from changes in financial variables: credit defaults, price movements, or inability to access funds. Encompasses three subcategories.	• Models based on historical data miss tail risk (rare catastrophic events) • Correlation assumptions break during crises (2008 showed this) • Pricing assumes future resembles past • Volatile and difficult to predict	Impossible to price accurately at extremes. Financial risk is driven by market sentiment, which can shift suddenly. Models work 99% of the time but fail catastrophically in the 1% (like 2008), when many risks materialize simultaneously.
STRATEGIC RISK¹⁴	Risk that your business strategy is wrong. Risk from strategic decisions and competitive threats that can derail long-term objectives. Highest impact, but low frequency.	• No historical data for “probability that our strategy fails” • Each strategic decision is somewhat unique • Cannot use formulas or actuarial tables • Outcomes depend on management judgment and execution • Extremely difficult to quantify in advance	Cannot be insured. Strategic risk is almost entirely uninsurable because each company’s strategy is unique. CEOs and boards must accept this risk as part of doing business. Pricing relies on scenario analysis and management judgment, not hard data.
COMPLIANCE & REGULATORY RISK¹⁵	The risk that you violate laws, regulations, or internal policies, resulting in fines, legal action, or reputational damage. The regulatory environment is constantly changing.	• Probability of enforcement depends on regulator priorities (which change) • Penalties are often discretionary and unpredictable • New regulations create retroactive compliance challenges • Conflicting guidance from different regulators • Costs increase with regulatory tightening	Costs are rising fast. Regulators are increasingly aggressive, penalties are larger, and reputational consequences are severe. Organizations must continuously invest in compliance infrastructure (legal teams, compliance officers, audits) as a cost of doing business.
REPUTATIONAL RISK¹⁶ ¹⁷	The risk that negative publicity damages your brand, eroding customer trust, investor confidence, investor perception, or ability to attract talent. One of the hardest risks to quantify.	• Stock price falls MORE than announced loss (2x for fraud, 1x for accidents) • 26% of company value is directly attributable to reputation (one study) • No standard pricing model • Very difficult to quantify until it happens • Historical data limited	Stock market values reputation more than we can measure. When a company announces a $1B fraud loss, stock price might fall 5% ($5B loss in value). The extra $4B is “reputational loss”—the market’s judgment that the company is now riskier. Yet most companies can’t quantify or insure this risk.
CYBER & TECHNOLOGY RISK¹⁸ ¹⁹	The risk of losses from disruption or failure of IT systems, data breaches, ransomware attacks, or technology obsolescence. Increasingly distinct from general operational risk.	• Unlike hazard risk (stable data over decades), cyber threats evolve rapidly • Historical data is unreliable—new attack types didn’t exist 5 years ago • Pricing focuses on current security posture not past incidents • Rapidly changing insurance market (premiums spiked 80% in 2021-2022) • Standardization emerging (ISO 27001, NIST)	Pricing is behavior-based. Unlike traditional insurance (fixed premium regardless of actions), cyber insurance prices based on your current controls. Companies with firewalls, multi-factor authentication, and ISO 27001 certification pay ₹80,000/year. Those with weak security might pay ₹3,00,000 or be denied coverage. This creates powerful incentives to improve security.

Pricing different types of risks

General principles of pricing risk
People react in different ways to risk. Some of us prefer the straight and narrow and others don’t think much of doing things that would be considered too risky by others- think of how some don’t mind skydiving, whereas others prefer their feet firmly on the ground. There are risks associated with both skydiving, and staying on the Earth, but different people like different things.

Therefore, risk can technically be transferred from one person to another. And this can be offered as a business service, for a price.

Now, before we go into this further, please understand that some risks can never be transferred- just that the effect of their impact can be mitigated. People will die, that is life. But by buying term insurance, we can ensure our families don’t suffer financial loss as well as the loss of our love and support. Similarly, living beings get sick- by purchasing health insurance we can just make sure we don’t face financial difficulties if we ourselves get sick in a way that costs a lot of money to fix. We are not transferring the death and decay, we are transferring the financial cost of these events.

1. The Formula²⁰ ²¹
With that out of the way, when someone asks you to bear their risk, you charge them a price. That price is made up of several components:

Price of Risk = Expected Loss + Administrative Costs + Risk Loading + Profit Margin

Where:

Expected Loss is simply: Probability × Consequence. If there’s a 2% chance of a ₹100,000 loss, the expected loss is ₹2,000.
Administrative Costs are the cost of doing business. For an insurer, this includes underwriting (reviewing your application), policy servicing (managing your account), claims processing, and marketing. For a bank, it includes loan documentation, monitoring your creditworthiness, and collecting payments if you default.
Risk Loading is the “insurance premium on the insurance premium.” It’s an extra charge you demand to accept the fact that reality might differ from your expectations. This is where variance becomes critical.²²
Profit Margin is what you keep as profit.

2. Variance

Variance is uncertainty about whether actual outcomes will match expected outcomes. As risk increases, variance often increases faster. Why? This happens because most people will fall closer to the middle of the normal distribution (discussed in the post linked at the beginning of the paragraph), but as risk increases, the number of people who are either that risky or are willing to take that risk are fewer and fewer (few will skydive, more will bungee jump, most will fly commercial). The fewer the number of people to whom a risk applies, greater the chances of variance (because the insurer has fewer people over whom to spread the risk). In other words, the law of large numbers works less effectively with small groups. With 1 million people, outcomes average out predictably, so let’s say you get the same or very similar number of claims every year. With 50 people, you might get zero claims one year and three claims the next—massive volatility.

I just want to be sure this is clear, so here is another example. Suppose two people pool their money every month, and decide that if one of them gets sick, the sick person can to use a certain percentage of the total money pooled (collected) by both of them to pay for the treatment. It is possible that for many years no one gets sick, but it is also possible that one (50%) of the total contributors or both (100% of the total contributors) get sick one day. On the other hand, in a pooled health insurance which has many contributors, say 1 million contributors, if 1 person gets sick, they are 1/1,000,000 of the total number of contributors (or 0.0001% of the pool- much, much less than 50%, right?).

Secondly, higher-risk individuals have more uncertain outcomes—meaning it’s harder to predict exactly what will happen. A skydiver faces multiple possible outcomes with varying probabilities: they could live unharmed, break bones, die from equipment failure, die from a heart attack mid-jump, or face other unpredictable complications. Each outcome has a different probability, making the overall risk calculation more complex. In contrast, a person simply walking on the ground faces far fewer potential causes of serious injury or death, so the range of possible outcomes (variance) is much narrower. Another way of looking at this is that a 30 year old healthy non smoker likely has fewer known causes of death historically than a 70 year old smoker.

This is why insurance premiums for risky people increase disproportionately:

The insurer must hold more capital to protect against bad luck.
A 30-year-old non-smoker with a 0.05% probability of death in a year might have a premium of ₹3,000.
A 60-year-old smoker with a 1% probability of death (20x higher) doesn’t pay 20x the premium (₹60,000). They pay 50x+ the premium (₹1,50,000 or more) because:
- The absolute expected loss is 20x higher.
- The variance around that expected loss is also much higher (more uncertainty about outcomes).

Insurers also worry about correlation—the risk that many claims happen simultaneously. A life insurer pricing individual deaths assumes they’re independent. But if a pandemic strikes, many policyholders might die at once. This correlation risk requires extra capital, adding to the risk loading.²³ ²⁴

Uncertainty
When an insurer lacks information about a particular risk, they will charge more for it, because they do not know how potent the risk is, or how frequently it occurs.²⁵ ²⁶

Suppose a bank is deciding whether to lend to two borrowers, both with self-reported income of ₹10 lakhs per year.

Borrower A: A salaried employee with 10 years of bank statements, tax returns, and employer verification. The bank has rich information about their actual, consistent income.
Borrower B: A self-employed consultant with only 2 years of tax returns. Income has varied between ₹5 lakhs and ₹15 lakhs per year. The bank’s uncertainty about their true ability to repay is high.

Both might have estimated default probabilities of, say, 2% based on available data. But the bank will charge Borrower B a higher interest rate, not because their actual default probability is higher, but because the bank’s uncertainty about that probability is higher.

This principle explains all of the following:

Businesses in developed countries with strong financial reporting get cheaper capital than those in developing countries with weak disclosure.²⁷ ²⁸
Companies listed on stock exchanges get better rates than private companies (more transparency).²⁹
Established firms in regulated industries get better rates than startups in emerging sectors.³⁰

Therefore, the more standardised and measurable a risk, the cheaper it is to price and the lower the price demanded. Insurance for hazard risk (with centuries of actuarial data) is cheaper relative to coverage than climate insurance (with only decades of data).³¹ VaR models for market risk are widely accepted because market prices are observable. But there’s no standard model for reputational risk, so it’s not widely insured.³²

This creates a system where:

Predictable, measurable, insurable risks get priced accurately and competitively.
Unpredictable, hard-to-measure risks are either:
- Not insured at all (like most strategic risk).
- Priced with huge margins because of the uncertainty (like reputational risk).

This is a profound source of inefficiency in capital allocation. Risks that are easiest to measure and quantify get the cheapest pricing and most capital. Risks that are hardest to measure—sometimes the ones that matter most—get starved of capital or don’t get priced at all.

A problem that has emerged from this is that historical models can simply not price tail risks (risks at the corners of normal distributions). An area this affects is climate risk, and its pricing.³³ ³⁴ A different example many of us lived through was the 2008-09 subprime financial crisis. In 2008, banks had calculated that simultaneous mortgage defaults across their portfolio should happen once every few thousand years. Yet it happened in 2007-2008. Why?³⁵

The models went with historical data and assumed:

Housing prices wouldn’t decline nationwide (they always went up historically).³⁶
Unemployment wouldn’t spike across industries simultaneously.³⁷
Banks wouldn’t stop lending to each other.³⁷

But all three happened together, creating a “perfect storm” that the models had assigned nearly zero probability. The tail risk was real; the pricing was wrong. Financial institutions now conduct stress testing—asking, “What if housing prices fell 30%? What if unemployment doubled? What if credit markets froze?“—precisely because historical models miss these scenarios.

Thus, if a financial advisor saying “stocks haven’t crashed in 50 years, so the probability is very low” is engaging in tail risk underpricing, and yet, we do still use the method to price some kinds of risk. The next section talks about this and other methods of risk pricing.

Pricing different risks

Methodology 1: The Actuarial Approach (Hazard Risk)⁴
Insurance companies maintain vast databases of historical claims. For life insurance, they track millions of deaths by age, gender, health status, and lifestyle. For home insurance, they track fire and weather damage claims by location and property type. For auto insurance, they track accidents by driver age, vehicle type, and location. From this data, actuaries calculate frequency (how often does the event occur?) and severity (how much damage when it does?). The math relies on:

Having huge sample sizes (law of large numbers).
Accurate historical data (actuarial tables updated constantly).
Stable risk—the probability of death doesn’t change dramatically over time.

Why this works: Hazard risk has all these properties. Insurers have massive datasets, deaths are well-documented, and the probability of death doesn’t swing wildly year to year.
Why it fails: When underlying assumptions break, actuarial models fail. During COVID-19, mortality rates spiked unexpectedly, and life insurers faced massive losses. The historical tables became temporarily unreliable.

Methodology 2: The Credit Approach (Financial Risk)³⁸ ³⁹ ⁴⁰
Banks estimate the Probability of Default (PD) of a borrower. This comes from:

Credit ratings (developed from historical default rates of companies with similar characteristics).
Credit scores (statistical models predicting default probability).
Loan characteristics (collateral, loan-to-value ratio, term length).

They also estimate Loss Given Default (LGD)—how much money the bank recovers if the borrower defaults. If a borrower defaults on a ₹100 lakh loan backed by ₹60 lakhs of collateral, the LGD is 40%.

The interest rate spread (the premium above the risk-free rate) is then set approximately as:

Interest Rate = Risk-Free Rate + (PD × LGD + Risk Loading) + Liquidity Premium + Other Premiums⁴¹

Other premiums:

Risk Premium	Explanation
Credit Risk Premium⁴²	Compensation for the probability that the borrower defaults and the amount the lender loses if they do (PD × LGD)
Liquidity Premium⁴³	Compensation for holding an asset that is difficult to sell quickly (e.g., corporate loans are less liquid than government bonds)
Inflation Risk Premium⁴⁴	Compensation for uncertainty about future inflation; if inflation is higher than expected, the real value of repayments falls
Term Premium⁴⁴	Compensation for lending money for longer periods; longer loans have more uncertainty about interest rates and borrower circumstances
Currency Risk Premium⁴⁵	Compensation for the risk that exchange rates move unfavorably; relevant when borrowing in a foreign currency
Sovereign Risk Premium⁴⁶	Compensation for political and economic instability in the borrower’s country; reflects country-level risk beyond individual borrower risk
Regulatory Risk Premium⁴⁷	Compensation for the risk that changes in laws or regulations will harm the lender’s position
Prepayment Risk Premium⁴⁸	Compensation for the risk that the borrower repays early (often when interest rates fall), causing the lender to reinvest at lower rates
Concentration Risk Premium⁴⁹	Compensation for lending a large amount to a single borrower or sector, which increases the lender’s exposure
Call Risk Premium⁵⁰	Compensation for the risk that the bond issuer redeems the bond early, leaving investors with reinvestment risk
Event Risk Premium⁵¹	Compensation for the risk of specific one-off events (mergers, leveraged buyouts, natural disasters) that suddenly change creditworthiness
Convertibility Risk Premium ⁴⁸	Compensation for the risk that capital controls or currency restrictions prevent conversion to foreign currency
Transfer Risk Premium⁵²	Compensation for the risk that a government blocks or restricts cross-border payments, even if the borrower wants to pay

Different types of risk premiums that may be charged by banks on loans

Why this works: Credit markets are large and competitive. Banks have decades of default data. Collateral can be valued. PD and LGD can be estimated with reasonable accuracy.
Why it fails: When credit conditions change suddenly (as in 2008), the relationship between PD and actual defaults breaks. A borrower who seemed safe (PD 1%) might suddenly have a 20% probability of default if the economy collapses. This is called “correlation risk”—risks that seemed independent are actually correlated, and they all materialize simultaneously.

Methodology 3: Value at Risk (Market Risk)⁵³ ⁵⁴
When investment banks, traders, and portfolio managers hold stocks, bonds, or other financial assets, they face a fundamental question: “How much could we lose on a bad day?” Value at Risk (VaR) answers this question: “What’s the maximum loss I might suffer with 95% confidence over a given time period (usually one day)?”

Suppose you hold a portfolio of Indian stocks worth ₹1 crore. You want to know your VaR at 95% confidence for one day.

Here’s how you calculate it:

Gather historical data: Look at how much your portfolio’s value changed each day over the past 5 years (roughly 1,250 trading days).
Calculate daily returns: On some days, your portfolio gained 2%. On others, it lost 3%. Most days, changes were small (±0.5%).
Rank all the losses: Sort all the daily changes from worst to best.
- Worst day: -10% (₹10 lakh loss)
- 95% of days: losses were less than -7%
- Typical days: ±1%
Identify the 95th percentile: Find the loss that was exceeded on only 5% of days (the worst 5% of outcomes). Let’s say this was -7%.

Your VaR is ₹7 lakhs.

What this means in plain English:
“Based on historical patterns, we are 95% confident that on any given day, we won’t lose more than ₹7 lakhs. But on 1 out of every 20 days (5% of the time), we might lose more than this—possibly much more.”

How Banks Use VaR:

Banks use VaR for three main purposes:

Setting risk limits: “No trader can hold a position with VaR greater than ₹50 lakhs.”
Allocating capital: “This trading desk’s portfolio has VaR of ₹2 crore, so we must set aside ₹2 crore in capital to cover potential losses.”
Pricing risk: “We need to earn at least 10% return on our ₹2 crore capital (₹20 lakhs per year), so the portfolio must generate returns higher than the risk-free rate by at least this amount.”

Why this works: Market prices are observable and historical data is abundant. VaR is simple to calculate and widely understood.
Why it fails spectacularly: VaR assumes the future resembles the past. When it doesn’t—when a “tail risk” event occurs that’s much worse than historical data suggested—VaR provides false confidence. Black swan events—outliers far beyond historical norms—happen more often in real markets than VaR predicts. This is why sophisticated risk managers now conduct stress tests: “What if housing fell 30%? What if correlation across assets went to 1.0 (everything moves together)?” These scenarios often have probabilities that can’t be estimated from historical data.

Methodology 4: Reputational Risk Quantification¹⁶ ¹⁷ ⁵⁵ ⁵⁶
Reputational risk is one of the hardest to price because reputation damage is:

Invisible until it happens
Subjective (how much is brand trust worth?)
Interconnected (affects customers, employees, investors, suppliers simultaneously)

Yet we know reputation has enormous value because research shows that roughly 26% of a company’s market value is directly attributable to its reputation.⁵⁷ So how do we price something intangible?

The Stock Price Method: When a company announces a major negative event (fraud, scandal, product failure), the stock price falls. But often, the stock price falls more than the announced financial loss. The difference is the market’s estimate of reputational damage.

Reputation Risk Quantification Models that try to systematically price reputation risk:

Identify reputation threats: Product recalls, scandals, poor earnings, social media backlash
Estimate frequency: How often does each type of event happen in this industry?
Model financial impact: Customer loss, revenue decline, employee turnover costs
Quantify total effect: Project impact on profits over 3-5 years

However, unlike life insurance (centuries of death data) or credit risk (decades of default data), reputation damage is:

Context-dependent: The same scandal might destroy one company but barely hurt another
Hard to predict: Social media can amplify or diminish reputational harm unpredictably
Self-reinforcing: Initial reputation damage can trigger customer flight, making things worse

This is why most companies don’t buy reputation risk insurance:

Insurers can’t agree on how to price it
Coverage is extremely expensive when available
Policies have many exclusions

So reputation risk remains largely self-insured—companies must manage it through strong governance, ethical culture, and crisis response planning, but they can’t transfer it to an insurer the way they can with fire risk or credit risk.

Methodology 5: The Security Audit Approach (Cyber Risk)⁵⁸ ⁵⁹ ⁶⁰
Historically treated as operational risk, cyber risk is now often priced separately. Unlike traditional hazard risk (based on decades of historical data), cyber insurance prices risk based on current security posture. Insurers conduct security audits assessing:

Business context: Industry (finance = higher risk), revenue size, number of employees, data sensitivity.
Technical controls: Firewalls, intrusion detection, endpoint protection, multi-factor authentication.
Process maturity: Patch management, vulnerability assessment, incident response plans.
Compliance: Certifications like ISO 27001 or NIST Cybersecurity Framework.
Training: Employee security awareness, phishing simulations.

Unlike traditional insurance (where you pay a fixed premium regardless of your actions), cyber insurance creates incentive alignment. Companies are rewarded for improving security. This is why cyber premiums vary so widely—from ₹80,000 to ₹3,00,000 for similar coverage, depending on security posture, so if the insured company becomes better prepared, its insurance premium can go down. The industry is evolving rapidly. As cyber threats evolve, pricing models are updated. Premiums spiked 80% in 2021-2022 (due to ransomware explosion) but have stabilized as companies improved controls and insurers refined models.

Methodology 6: Scenario Analysis (Strategic Risk)⁶¹ ⁶²
Strategic risk is fundamentally different because:

Can’t be insured—no insurer will cover “your strategy might be wrong”
No historical data exists for “probability our specific strategy fails”
Each decision is unique—your market entry isn’t comparable to another company’s
Outcomes depend on management judgment, execution capability, and competitor actions

Instead of formulas, companies use scenario analysis—imagining multiple possible futures and testing strategy robustness across them.

The Process:

Step 1: Define the Current Strategy: Example: An e-commerce company currently selling books and electronics is considering expanding into furniture delivery.

Step 2: Imagine Alternative Futures (Scenarios): Scenario planning typically develops 3-5 scenarios representing different ways the future might unfold. Assign probabilities to different scenarios and how much loss your company would bear, for example, a company may have a scenario that

Step 3: Calculate Expected Value (With Huge Caveats).

Example:

Scenario A: “Competitive Onslaught”

3 major competitors enter within 18 months
Price war erupts, margins drop 20%
Company loses ₹50 crore over 3 years
Probability: 60%

Scenario B: “Logistics Nightmare”

Delivery complexity exceeds expectations
High return rates (15%)
Company loses ₹30 crore
Probability: 40%

Scenario C: “Weak Demand”

Market adoption slower than projected
Company loses ₹80 crore
Probability: 30%

Scenario D: “Success”

Market responds positively
Company gains ₹150 crore
Probability: 20%

Note: Probabilities don’t need to sum to 100% because scenarios aren’t mutually exclusive—multiple scenarios could occur simultaneously (e.g., you could face both competitive pressure AND logistics challenges).

Expected Outcome = (Probability of Scenario × Impact)

= (0.6 × -₹50cr) + (0.4 × -₹30cr) + (0.3 × -₹80cr) + (0.2 × +₹150cr)
= -₹30cr – ₹12cr – ₹24cr + ₹30cr
= -₹36 crore expected loss

Why this works: Strategic risk isn’t insurable. There’s no historical data on “furniture market entry outcomes” for this specific company. Each strategic decision is somewhat unique. Organizations can’t buy insurance for strategic risk; they must manage it through planning, contingency analysis, and management judgment.
Why it fails: Scenarios often miss the most important surprises. In 2020, COVID-19 wasn’t in most companies’ scenarios. When reality diverges from scenarios, organizations must adapt on the fly. This is why CEOs, not risk managers, bear ultimate responsibility for strategic risk.

Sources

Risk – II: ISO 31000:2018 as applied to Indian cricket

TL;DR, because this is not a post for cricket casuals:

Fog in North India in December, heat waves in April, election clashes, and security disruptions are predictable risks, not bad luck.
Indian cricket continues to treat these as isolated incidents rather than as interconnected system-level risks that cascade across scheduling, logistics, player welfare, and revenue.
The BCCI now runs a ₹20,000-crore ecosystem, yet lacks a transparent, enterprise-wide risk management framework appropriate to that scale.
Global sports bodies manage similar uncertainties using formal risk frameworks (e.g., ISO 31000) to decide what risks to avoid, mitigate, insure, or accept.
Applying ISO 31000 to Indian cricket shows that systematic risk management would cost far less than repeated disruptions, cancellations, and credibility damage.
At this scale, ad-hoc risk management is not neutral—it is value-destructive.

And now onto the post.

This post has been inspired by watching the BCCI schedule summer matches in tropical South India, and winter season matches in our smoggy chilled North. Watching Indian cricketers roam about in Lucknow against South Africa while wearing pollution masks while broadcasters told us match was delayed due to low visibility conditions made me wonder what other risks BCCI could just avoid, or at least manage better.

These risks are predictable. ~~Fog~~Smog in North India in December isn’t a surprise. Heat waves in April aren’t black swans. Even geopolitical and security disruptions, while unpredictable, follow recognisable patterns. Yet Indian cricket continues to treat these as isolated “incidents” rather than as interconnected risks that can be anticipated, priced, and managed.

This is not about fog or heat. It’s about running a ₹20,000-crore system without an enterprise risk framework. So I’m doing an ISO 31000 evaluation for the BCCI. FOR FREE. Please someone share this with anyone influential in the BCCI.

Here’s a non-comprehensive list of some risk sources and events that can happen. You can skim through it if you like, I know it’s long, which already tells you lots:

Risk Category	Specific Risk	Example/Evidence	Risk Source	Impact Area
Geopolitical & Security	Cross-border conflict/military escalation	IPL 2025 suspension due to India-Pakistan tensions (May 2025)¹	Political/regulatory external context	Tournament suspension, revenue loss, player safety concerns
Geopolitical & Security	Communal/religious tensions	Mustafizur Rahman threats from Ujjain religious leaders (Dec 2025);²	Social/political external context	Player threats, stadium disruptions, player unavailability
Geopolitical & Security	Terrorism/security incidents	Potential attack on stadium or traveling teams	Security threat external context	Deaths/injuries, event cancellation, insurance claims
Weather & Climate	Dense fog	Lucknow T20I abandoned without a ball (Dec 17, 2025);³	Natural hazard/environmental	Match cancellation, travel disruptions, schedule compression
Weather & Climate	Extreme heat	Player heat exhaustion risks, crowd attendance decline	Environmental/climate change	Player health, match timing changes, spectator safety
Weather & Climate	Flooding/waterlogging	Monsoon season pitch damage, venue inaccessibility	Environmental/climate change	Venue unusability, match postponement, ground preparation delays
Weather & Climate	Drought	Groundwater depletion affecting pitch maintenance	Environmental/climate change	Pitch quality degradation, venue unusability
Weather & Climate	Severe storms/hailstorms	Potential infrastructure damage, match disruption	Environmental natural hazard	Venue damage, match abandonment, spectator safety
Operational & Logistics	Flight/travel cancellations	Flights cancelled across northern India^{(just search it, happens bi-weekly in December)}	Transportation system failure	Team travel delays, venue setup issues, player unavailability
Operational & Logistics	Equipment/supply disruption	Medical supplies, nutrition goods, cricket equipment delays to venues	Supply chain vulnerability	Player preparation delays, competitive disadvantage, safety risks
Operational & Logistics	Transportation of spectators	Mass transit failures, road congestion, parking unavailability	Infrastructure/logistics	Spectator attendance decline, safety concerns, venue capacity underutilization
Operational & Logistics	Accommodation unavailability	Limited hotel capacity during tournament, staff housing issues	Supply/demand mismatch	Team comfort degradation, player fatigue, franchise cost overruns
Venue & Infrastructure	Poor crowd management systems	Chinnaswamy stampede⁴	Operational/design vulnerability	Spectator casualties, reputational damage, regulatory action, venue unusability
Venue & Infrastructure	Structural deterioration	Aging concrete, roof damage, electrical system failures	Asset maintenance gap	Venue closure, safety risk, remediation costs
Venue & Infrastructure	Inadequate emergency response systems	Poor medical facilities, limited ambulance access, untrained staff	System design gap	Casualties during medical emergencies, litigation
Financial	Broadcasting rights disruption	Disney+ Hotstar and Star Sports unable to broadcast during IPL suspension	External event affecting revenue	Revenue loss for franchises/broadcasters (₹crores per day), contractual disputes
Financial	Sponsor withdrawal/advertising rate decline	Potential sponsorship cancellations due to event suspension or negative publicity	Market condition/risk perception	Franchise revenue decline, reduced capital for player wages
Financial	Insurance claims disputes	Ambiguous “war” and “riot” clauses limiting payout eligibility⁵	Contractual/insurance gap	Uncompensated losses during suspension or disruption
Financial	Currency fluctuation	Overseas player contracts, broadcast payment variability	Market/exchange rate risk	Player cost increases, sponsor revenue volatility
Financial	Franchise profitability uncertainty	Rising costs (venue, insurance, player wages) versus volatile revenue (attendance, viewership)	Business model vulnerability	Franchise owner losses, potential team withdrawal
Corruption & Integrity	Match-fixing/spot-fixing	CSK/RR spot-fixing scandal (2013);⁶ ongoing betting corruption concerns	Criminal/gambling-driven activity	Player bans, franchise suspension, sport integrity damage, legal action
Corruption & Integrity	Illegal betting rings	Vast unregulated Indian betting markets with links to match-fixers⁷ ⁸	Criminal enterprise/regulatory gap	Match manipulation, player recruitment to fixing, law enforcement involvement
Corruption & Integrity	Umpire/official bribery	Potential fixing of key decisions affecting match outcomes	Corruption risk	Match integrity compromise, game credibility loss
Personnel	Key player unavailability	International obligations, injuries, visa issues, political reasons (Mustafizur situation)	Competing objectives/external restrictions	Team competitiveness, schedule disruptions, franchise value impact
Personnel	Player health/injury risks	Heat exhaustion, match injuries, stress-related conditions from uncertainty	Physical hazards/psychological stress	Loss of key players, season disruption, franchise financial impact
Personnel	Coach/staff turnover	Mid-season departures, conflicts between franchise and coaching staff	HR/organizational risk	Team continuity loss, player morale impact
Regulatory	Government restrictions/timeline conflicts	Elections scheduling conflicts with IPL dates;⁹ security directives impacting match scheduling	Government policy/external political context	Schedule changes, venue restrictions, resource allocation changes
Regulatory	Visa/immigration restrictions	Player visa delays, border restrictions preventing team travel	Government/immigration policy	Player unavailability, team incomplete status
Regulatory	Tax/regulatory changes	Changing tax levies on sports franchises, regulatory compliance requirements	Government fiscal policy	Franchise cost increases, profitability compression
Demand & Market	Fan disengagement/viewership decline	Cancellations and disruptions reduce fan engagement, ticket sales suffer	Market/behavioral shift	Revenue decline, reduced franchise valuations, reduced sponsorship interest
Demand & Market	Competitive threat from other entertainment	Social media, gaming, OTT platforms diverting cricket viewers	Technology/market disruption	Declining viewership, reduced sponsorship value, lower ticket sales
Demand & Market	Social media backlash/reputational damage	Negative sentiment from cancellations, perceived mismanagement	Communications/perception risk	Brand damage, sponsor pressure, fan retention loss
Health & Safety	Pandemic-related restrictions	COVID-like scenarios requiring lockdowns or capacity restrictions	Health emergency/external event	Match cancellation, venue capacity limits, player quarantine requirements
Health & Safety	Food/water safety incidents	Contaminated food/water affecting teams or spectators	Health/hygiene risk	Illness outbreaks, regulatory action, liability
Health & Safety	Air quality/pollution issues	High pollution affecting visibility, player respiratory health	Environmental hazard	Match visibility issues, player health concerns, match cancellation

Before diving into solutions, let’s define what we’re actually talking about. ISO 31073¹⁰ establishes the vocabulary for various terms used in ISO 31000,¹¹ which is the ISO framework for risk management. According to the frameworks, risk is “the effect of uncertainty on objectives”.
Here,

Objectives are whatever results the organisation wishes to achieve.
Effect means a deviation from the expected, whether the deviation is positive, negative, or both;
Uncertainty occurs from a deficit of information; and

Therefore, risk is a deviation from the aims that an entity is working towards caused due to lack of knowledge about the situations surrounding the objective. The deviation can have a positive or negative outcome, but the deviation means it is still a risk, and leads to risk consequences, or outcomes that affect the objectives.

Uncertainty can never be removed entirely. As we see in the normal distribution, risk events can happen even when we are 99.999% certain of our processes. This is called residual risk, or when a risk event occurs even when controls have been applied against the risk source. An event is the occurrence or change of circumstances (the bridge collapses, prices spike, new regulations take effect that can be the source of a risk. A risk source is an element with potential to give rise to risk (think: aging infrastructure, volatile commodity prices, regulatory change). Understanding residual risk is critical for determining whether further treatment is needed or whether the organisation should accept and monitor what remains. It is important to emphasise here that everyone perceives risk differently (risk perception): engineers might see technical risks as manageable; the public might see the same risks as terrifying. Effective risk communication requires understanding these perceptual differences.

The likelihood of an event, is a broad expression of the chance of something happening, and can be expressed qualitatively or quantitatively, but in the previous posts we have understood what a probability is, as expressed between 0 and 1 (here and here), and frequency, which is when we count the number of the type of events we are quantifying. understanding these basic terms helps us understand how vulnerable we are due to our exposure to a source of risk, as well as how to build resilience. Because we’re discussing a standard, these words have specific definitions:

Vulnerability refers to intrinsic properties creating susceptibility to risk sources.
Exposure measures the extent to which an organization is subject to an event.
Resilience captures adaptive capacity in complex, changing environments, so this isn’t about preventing events, it’s about how to recover from them.

Understanding risk also helps organisations understand which risks to accept, and which to defend against. New Zealand’s sports sector adopted ISO 31000 in 2016; Australia’s sporting associations follow it; international sporting events apply it to pandemic preparedness. This is called Risk attitude- the organisation’s overall approach towards risk, and their tendency to pursue, avoid, or accept it. Attitudes towards risk always depend upon any entity’s risk appetite (the amount and type of risk they are willing to accept), and their risk tolerance, which looks at specific risks for each objective. An example of risk appetite is the willingness to invest in innovative technology, and that of risk tolerance is the amount of specific risk an organisation may accept for data breaches in particular.

ISO 31000 Framework for Indian Cricket
While it may appear that these are all just the costs of doing business in India, I don’t think this is true. Also, other sports systems facing similar uncertainties—pandemics, extreme weather, terrorism, financial volatility—don’t operate this way. They use formal risk management frameworks to decide what to avoid, what to mitigate, what to insure, and what to accept. ISO 31000 is one such framework, and it’s suited to complex, multi-stakeholder systems like Indian cricket. Here it is applied to Indian cricket:

1. Establish Context (Where Are We Playing?)

External context
- Geopolitics: India–Pakistan tensions, elections, security environment.
- Climate: Fog in North India, heat waves, monsoon, long‑term climate change.
- Market: OTT platforms, competing sports/entertainment, sponsor expectations.
Internal context
- BCCI governance and decision‑making.
- Franchise finances, contracts, insurance.
- Stadium infrastructure, ground staff capacity, logistics capability.
Risk criteria
- What level of disruption is acceptable?
- Which risks are “never acceptable” (deaths, match‑fixing, major stampedes)?
- What is the minimum acceptable probability of completing a season as scheduled?

2. Risk Assessment (What Can Go Wrong, How Bad, How Often?)

Identify risks
- Use the big table: geopolitical, weather, logistics, stadium safety, financial, corruption, personnel, regulatory, demand, health.
- For each, note: risk source → potential event → likely consequences.
Analyze risks
- Estimate likelihood (e.g. “fog in Lucknow in December” = high; “pandemic lockdown every year” = low).
- Estimate consequence (e.g. “stadium stampede” = catastrophic; “one match fogged off” = moderate).
- Factor in vulnerability (old stadiums, fragile logistics) and resilience (backup plans, cash reserves).
Evaluate risks
- Plot likelihood × consequence.
- Decide which risks are:
  - Intolerable (must be treated immediately).
  - Tolerable with treatment (controls and monitoring).
  - Acceptable (monitor only).

3. Risk Treatment (What Do We Do About Each Risk?)

For each major risk, choose a treatment option (or a mix):

Avoid the risk
- Don’t schedule T20Is in dense‑fog cities during December–January.
- Don’t use stadiums that fail minimum structural and crowd‑safety standards.
Mitigate / reduce the risk
- Upgrade stadium exits, crowd‑control systems, and medical response.
- Build travel redundancy: buffer days, alternative flight routes, backup buses/trains.
- Strengthen anti‑corruption: monitoring betting patterns, education, strict sanctions.
- Heat protocols: evening matches, drinks breaks, heat‑stress monitoring.
Share / transfer the risk
- Tournament‑wide insurance for cancellation, terrorism, extreme weather.
- Clear contracts with broadcasters/sponsors about rescheduling and force majeure.
Retain (accept) residual risk
- Accept that a few games may still be lost to weather or logistics despite controls.
- Document what level of residual risk is being accepted, by whom, and with what monitoring.

4. Implementation & Control (Who Owns What, and How Is It Run?)

Governance & roles
- BCCI Risk Committee: owns the overall risk framework and major decisions.
- Franchise risk owners: handle team‑level logistics, personnel, finances.
- Venue operators: own stadium safety, crowd management, emergency response.
Communication & consultation
- Regular briefings with teams, broadcasters, police, local authorities.
- Clear public communication on cancellations, rescheduling, and safety decisions.
Monitoring
- Track near‑misses (e.g. small crushes at gates, close calls with fog or heat).
- Maintain dashboards: incidents per season, delays, injuries, corruption alerts.

5. Review & Continuous Improvement (What Did We Learn This Season?)

After each season / major incident:

Incident reviews
- IPL suspension: What early warning signs did we miss? Could we have acted sooner?
- Chinnaswamy stampede: Which design and process failures led to casualties?
- Lucknow fog‑out: How should scheduling rules change for fog‑prone venues?
- Mustafizur threats: How do we handle politically sensitive players and venues?
Effectiveness checks
- Did our treatments reduce likelihood or consequence as expected?
- Did any controls fail or create new risks (e.g. over‑policing crowds)?
Update the system
- Revise risk criteria, appetite, and tolerances where needed.
- Amend scheduling policies, venue standards, insurance terms, and contracts.
- Feed lessons into next season’s planning: same framework, better parameters.

To-Do List
If Indian cricket embraced systematic risk management, the BCCI would have:

A Risk Management Policy (BCCI document) establishing appetite and tolerance
A Risk Register (updated quarterly) tracking all relevant risk categories with assessed severity and treatment strategies
Incident Response Protocols that trigger automatically (e.g., if weather forecast shows fog, reserve dates activate; if geopolitical tension rises, security protocols engage)
Venue Certification requiring regular safety audits for all stadiums
Insurance covering defined scenarios with unambiguous language
Player Education on corruption risks, mental health impacts of uncertainty, safety protocols
Stakeholder Transparency (fans, sponsors, broadcasters informed about residual risks and mitigation strategies)
Continuous Learning (post-incident reviews feeding into policy updates)

Why bother?
Risks are interconnected: geopolitics affects scheduling, which affects logistics, which affects player welfare, which affects performance, which affects revenue. One shock propagates through the entire system.

But the real argument is how all this affects BCCI’s income: In fiscal year 2024-25, the BCCI earned a total of ₹20,686 crore—double what it was five years earlier. But this income doesn’t flow uniformly. It comes from multiple sources, each vulnerable to different risks:

IPL: ₹5,761 crore (59.1% of FY 2024-25 BCCI revenue)¹²
International cricket (men’s): ₹361 crore (3.7%)¹²
ICC distributions: ₹1,042 crore (10.7%)¹²
WPL (women’s): ₹951 crore broadcast deal over five years = approximately ₹190 crore annually¹³
Interest and other income: ₹1,500+ crore from treasury management ¹² ¹⁴
Sponsorships, licensing, other: ₹400 crore and growing¹⁵

Total bank balance: ₹20,686 crore.¹⁶ At this scale, ad-hoc risk management is not neutral—it is negligent.

The numbers are sourced, but even if the numbers are completely wrong, the logic I’m about to present you with will still hold.

Consider the May 2025 IPL suspension. Its immediate impact was ₹1,600-2,000 crore in tournament revenue loss. But the suspension also:

Forced reschedules of international T20I series planned around IPL slots
Delayed women’s cricket planning (WPL scheduling coordination)
Created cascading effects on domestic Ranji Trophy schedules
Disrupted team preparation windows for the Asia Cup (subsequently postponed)

When the IPL shut down due to the events that followed the Pahalgam terrorism, one risk event rippled across all BCCI’s operations. The ₹3,500-4,000 crore total ecosystem loss wasn’t borne by IPL alone—it distributed across broadcasters, sponsors, franchises, international teams visiting India, and state cricket associations that depend on BCCI’s distributions (approximately ₹100-125 crore in combined sponsorship, broadcast, and match-day revenue for 16 matches ¹⁵ and the broadcaster JioCinema faced losses of ₹1,900-2,000 crore (35% of their ₹5,500 crore seasonal projection)¹⁷ While war is a systemic risk (read more here, scroll down to the risk sections), a stampede at a celebration event is not.

Now let’s do some hypothetical maths. Let’s say of BCCI’s total ₹20,686 crore exposure, 10% is under difficult-to-avoid-risk, and another 20% are things that could go wrong but if everything happened normally (planes flew on time, luggage was not lost, people had common sense, etc.) it would not go wrong. Now assume costs of mitigation to be between 10-20% of the cost of losses. This would be the breakdown of that exposure:

Risk Category	% of Total Exposure	Exposure Amount (₹ Crore)	Annual Loss Probability	Expected Annual Loss (₹ Crore)	Mitigation Cost (10-20% of loss)	Net Benefit if Mitigated
High Risk (Geopolitical, Corruption, Major Infrastructure)	10%	₹2,068.6	20-30%	₹414-620	₹41-124	₹290-579
Medium Risk (Weather, Logistics, Personnel, Sponsorship)	20%	₹4,137.2	30-40%	₹1,241-1,655	₹124-331	₹910-1,531
Low Risk (Normal operations)	70%	₹14,480.2	1-5%	₹145-724	₹15-145	₹130-709
TOTAL	100%	₹20,686	~15-20% aggregate	₹1,800-3,000	₹180-600	₹1,200-2,820

Now let’s do scenario analysis with ILLUSTRATIVE NUMBERS.

Scenario A – No Mitigation (Do Nothing)

Element	Amount (₹ Crore)	Notes
Reserves/ Bank Balance	₹20,686	Baseline
Expected Losses (unmitigated)	₹1,800-3,000	From Table 1
Insurance Recovery (40-50% of losses)	₹720-1,500	Partial coverage; war/corruption not covered
Net Loss After Insurance	₹1,080-2,280	Uninsured exposure
Effective Revenue After Losses	₹18,406-19,606	Revenue minus net loss
Annual Cost to Organization	₹0	No prevention investment
Net Outcome	₹18,406-19,606	Revenue minus losses

Scenario B – Full Mitigation (Invest in Risk Management)

Element	Amount (₹ Crore)	Notes
Reserves/ Bank Balance	₹20,686	Baseline (unchanged)
Mitigation Investment	₹180-600	Cost to prevent/reduce losses
Expected Losses (with mitigation)	₹450-900	Reduced by 60-75% through mitigation
Insurance Recovery (40-50%)	₹180-450	Still applicable, lower losses
Net Loss After Insurance & Mitigation	₹270-450	Dramatically reduced
Effective Revenue After Mitigation & Losses	₹20,236-20,416	Revenue minus mitigation cost and net loss
Annual Cost to Organization	₹180-600	Mitigation investment
Net Outcome	₹20,236-20,416	Much better than Scenario A

None of the above means that BCCI doesn’t do risk mitigation at all. They must do. Matches are insured, security is coordinated with state authorities, schedules are adjusted, and contingency plans exist. But much of this risk management remains reactive, fragmented, and event-specific, rather than systematic.

The scale of Indian cricket has outgrown this approach. What is now a ₹20,000-crore ecosystem operates across volatile geopolitics, increasingly extreme climate conditions, aging infrastructure, fragile logistics, and intense public scrutiny. In such an environment, risk does not arrive as isolated shocks. It propagates. A fog-out affects scheduling, which affects logistics, which affects player welfare, which affects performance, which ultimately affects revenue and credibility. Treating each disruption as an unfortunate exception misses the underlying structure of the problem.

Active risk management does not promise certainty, nor does it eliminate risk. What it offers is clarity: an explicit understanding of working to anticipate risks in our cricket system so that most can simply be prevented, and those that cannot be prevented are mitigated. The IPL did not need to be part of India’s war theatre. After the Pahalgam attacks those matches could have been shifted to lower risk areas, such as away from the border, and we wouldn’t have had Ricky Ponting trying to persuade foreigners to stay back and play.¹⁸

Sources

Risk: an introduction

Risk of an event = Probability of the event happening × the consequensces of the event happening.¹

To understand probability better, please read this and this.

This is the most basic definition of Risk. Risk = Probability, or how likely an event is to occur × Consequence, or impact. Because it is multiplicative, a high-probability event with low consequence (losing a pen) is low risk, and a low-probability event with catastrophic consequence (say, a nuclear exchange) can be high risk. The danger zone is where meaningful probability meets serious consequence.

History
For most of history, people spoke about fate, luck, or divine will, not “risk” in a calculable sense. Hazards (storms, plagues, crop failures) were seen as acts of gods or nature. There was no notion of systematically measuring uncertainty.

In the 17th Century, A French nobleman, Chevalier de Méré, asked Blaise Pascal why some gambling bets worked better than others. Pascal’s correspondence with Pierre de Fermat (1654) is widely seen as the birth of modern probability theory.² ³ They developed early ideas of expected value – essentially, the mathematical ancestor of “probability × impact”.⁴

In the 18th Century, Daniel Bernoulli introduced the idea of utility in 1738:⁵ the insight that losing or gaining the same amount (£100) does not feel equally important to rich and poor people. This work planted the seeds for understanding why humans are risk‑averse and set the stage for later behavioural theories.

As trade, shipping and life insurance developed in the 18th–19th centuries, people started using probability tables to price the risk of death, shipwrecks and fire.⁶ This was the first large‑scale, institutional attempt to put numbers on everyday risks and pool them.⁶ Risk pooling is when lots of people chip in a little money into a shared pot (the “pool”) so that when one person has a big, unexpected cost (like a car accident or sickness), the money from the whole group covers it, making big losses manageable for individuals and premiums more stable for everyone.⁷ After industrialisation, wars and technological disasters, “risk” broadened from individual hazards (a ship sinking) to complex systems (nuclear power, financial markets, supply chains). The language of “risk management” emerged after the Second World War and matured through the later 20th century, culminating in general standards such as ISO 31000.⁸ ⁹

Expected Value⁹ ¹⁰
The mathematical heart of risk is Expected Value (EV). This is simply the average outcome if you repeated an action infinitely.

If a bet offers a 50% chance to win £100 and a 50% chance to lose nothing, the Expected Value is £50 ($0.50 \times 100 + 0.50 \times 0$). Rationally, you should pay anything up to £49.99 to take that bet.

But real life isn’t a casino with infinite replays. Humans often get only one shot. If an individual takes a risk with a positive expected value—like cycling to work to save money and improve health—but gets hit by a bus on day one, the “average” outcome is irrelevant. This is why variance matters as much as the average. A risk might look good on paper (high expected value) but have a “ruin condition” (a consequence you can’t recover from) that makes the math irrelevant.

Normal Distribution
If you measured the height of every single individual on the planet, or even a representative sample of them, the shape of that graph (often called “curve” in academic language) would be similar to this image:

This is the Normal Distribution (or Bell Curve), and it is the most important shape in risk management.¹² It describes how randomness usually behaves. The very top of the hill represents the Mean (the average). This is what you “expect” to happen; in our stadium example, this is the average height (say, 5’9″). The vast majority of people will be average height, so their heights will be recorded as being clustered right around the middle.

If the Mean tells you where the peak is, Variance tells you how wide the hill is. It is a statistical measure showing how spread out a set of data points are from their average.¹³

Low Variance: Imagine a hill that looks like a needle. This means data points are tightly clustered. If you measured the height of 10,000 professional jockeys, the variance would be low—almost everyone is close to the average.¹⁴
High Variance: Imagine a hill that looks like a flattened pancake. This means data is widely spread out. If you measured the height of a random crowd containing jockeys and basketball players, the hill would be very wide.¹⁵

In risk management, mean tells you what usually happens; variance measures unpredictability and the potential for outcomes to be very different from the average, which is the essence of uncertainty.¹⁶ ¹⁷ A high variance means numbers are widely scattered, increasing the chance of both extreme positive and, crucially, extreme negative outcomes (losses).¹⁸ Low variance indicates they are clustered closely around the mean: it quantifies the dispersion or variability within a dataset.¹⁸ In the height data set, while most people would be average height, some people would be very short and others very tall as well. It’s just that the number of people who are not close to the average would fall off the farther away we get from the mean, or the middle of the bell curve.

Standard Deviation¹⁸ ¹⁹

Normal Distribution divided into standard deviations distances from the mean.²⁰

If Variance tells you the hill is “wide,” Standard Deviation (Sigma, or σ) tells you exactly how wide in real units. It is simply the square root of variance.

Think of Standard Deviation as the ruler for the Bell Curve.

1 Standard Deviation: In a normal distribution, about 68% of all outcomes happen within one standard deviation of the mean. If the average height is 5’9″ and the standard deviation is 3 inches, 68% of men are between 5’6″ and 6’0″.
2 Standard Deviations: Go out a bit further, and you capture 95% of all outcomes.
3 Standard Deviations: Go out three steps, and you capture 99.7% of everything.

In risk, when someone talks about a “Six Sigma” event (six standard deviations away from the average), they are talking about something so rare that it should theoretically almost never happen. And yet, in financial markets and complex systems, these “impossible” events happen surprisingly often.

Confidence²¹ ²²
If a bank says, “We are 95% confident we won’t lose more than £1 million tomorrow,” they are essentially saying: “If tomorrow is a normal day (one of the 95%), we are safe. But if tomorrow is one of those rare, 1-in-20 bad days, all bets are off.”

In statistics, confidence is often explained using confidence intervals: at a 95% confidence level, the method used to build the interval would capture the true value about 95 times out of 100 repeated samples. That does not mean the true value has a 95% probability of being inside this specific interval; it means the procedure has 95% long-run reliability. This means, confidence intervals speak about frequency: how often do the unexpected or unwanted events happen. At 95%, they happen on any 5 days out of 100. at 99%, they happen once every 100 days.

For risk management, think of confidence levels as a dial for paranoia:

95% Confidence: You are planning for the normal bad days. You accept that on 1 day out of every 20 (roughly once a month), you will breach your limit.
99% Confidence: You are planning for the severe days. You only accept breaching your limit on 1 day out of 100 (roughly 2–3 times a year).
99.9% Confidence: You are planning for near-disaster. You only accept a breach once every 1,000 days (roughly once every 4 years).

The Micromort
In the 1970s, Stanford professor Ronald Howard needed a way to compare diverse risks like skydiving, smoking, and driving. He invented the Micromort—a unit representing a one-in-a-million chance of death.²³

This equalises different activities. Instead of vague fears (“is it safe to fly?”), we can use units:

1 Micromort is roughly the risk of driving 250 miles (400 km).²⁴
1 Micromort is also the risk of flying 6,000 miles (9,600 km).²⁴
Scuba diving costs about 5 micromorts per dive.²⁵
Skydiving costs about 8–10 micromorts per jump.²⁴
Just being alive (all-cause mortality for a young person) costs roughly 1 micromort per day.²⁶

In conclusion, risk is the price of life.

Sources

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this: