Three types of risk: choose the right response
Some risk questions call for reliable data. Others require people to adapt as competitors, suppliers or hostile actors change their behaviour. A method that works well in one setting may answer the wrong question in another.
Julian Talbot’s 3A model offers three useful prompts: actuarial, active and adversarial risk. These are not exhaustive or mutually exclusive categories. Their purpose is to help you choose and combine methods.
Actuarial: what can relevant observations tell us?
Actuarial questions concern situations where data and justified assumptions support statistical analysis. For example, component service records may help estimate failures across a fleet of similar equipment operating under comparable conditions.
The qualifications matter. A large dataset does not establish that equipment is comparable, observations are independent or future conditions will resemble the past. A new operating environment can weaken an estimate built from otherwise accurate records.
Ask what the model assumes, which observations support it, and what changes would make the estimate less useful. Quantitative analysis can inform a decision while leaving substantial uncertainty.
Active: who will adapt to what we do?
Active risks involve changing behaviour and interaction. In a fictional distribution business, offering a faster service may attract more orders. Competitors may respond with lower prices, suppliers may change their terms, and customers may revise their expectations.
Past demand still matters, but a forecast that assumes nobody responds to the offer is incomplete. Explore plausible responses, monitor what actually happens and retain the ability to adjust.
The model’s association with rule-governed competition is a prompt to consider contracts, social expectations and enforcement. It is not an assumption that every participant will comply or that all competitive outcomes are zero-sum.
Adversarial: who may seek to exploit the arrangement?
Adversarial risk involves actors seeking to harm, defeat, exploit or coerce another party. A fraudulent order is different from a random processing error, even if both initially appear as an unusual transaction.
An adversary may study controls and change tactics in response. Assessment therefore needs attention to intent, capability, access and adaptation, with uncertainty about the actor kept visible. Historical frequencies alone may provide a weak basis for anticipating a new approach.
Adversarial does not automatically mean illegal, and the model does not remove anyone’s legal or ethical obligations. The relevant distinction is the interaction and intent being examined.
Apply all three prompts to one decision
Suppose the distribution business is considering its faster service:
Actuarial: what do comparable delivery records suggest about routine delays and equipment failures?
Active: how might customers, competitors and suppliers change their behaviour?
Adversarial: could someone deliberately exploit new ordering or delivery arrangements?
Each answer suggests different evidence and responses. Reliable service data, an adaptable operating plan and controls against deliberate exploitation can all be necessary in the same business.
For your next assessment, write one question under each heading. If a category appears irrelevant, explain why. Then check whether your chosen methods address the behaviour present, rather than treating every uncertainty as a stable pattern waiting for a larger spreadsheet.
Based on section 1.3.1 of Risk Management Body of Knowledge, by Julian Talbot, Jason Brown and Miles Jakeman, AM. The 3A model is Julian Talbot’s practical classification aid; the distribution example is fictional.
Put the body of knowledge to work
Explore the Risk Management Body of Knowledge for the connected principles, frameworks and methods behind this article.
Considering a shared reference for your team? Enquire about organisational use and tell us how you would use RMBOK.