Integrating probabilistic programming in enterprise risk management

Businesses face a multitude of risks on a daily basis, from financial and operational to technical, reputational, and strategic. Risk management allows organizations to identify, assess, and mitigate these threats, giving teams the ability to minimize the likelihood they will occur. It also enables them to plan how they will handle them if they arise.

Enterprises typically follow deterministic modeling practices in risk management, which correlate to fixed inputs, single-point estimates, and predefined scenarios. Deterministic risk modelling uses input features to predict a single definite outcome; for example, estimating revenue based on a fixed growth rate or planning a project timeline based on previous projects.

The problem with a deterministic risk model is it ignores changing conditions. Put simply, they’re imperfect. “All models are wrong”, said English statistician George E P Box when sharing model limitations in 1976. Any failure in risk management may lead to unexpected losses, downtime, or even corporate failure.

The real world is fluctuating and dynamic: risks are interdependent, nonlinear, and evolve continuously, where output no longer depends on input values. Enterprises are considering iterative models to handle risks and in model planning, and tend to ignore probability distribution. That’s where probabilistic models come into play.

What is probabilistic programming?

The main function of probabilistic programming languages (PPLs) is to enable statistical modeling.

Most probabilistic programming languages are extensions of general-purpose programming languages with the rand () function and all the necessary tools to perform specialized statistical modeling. Sometimes, probabilistic programming languages can be standalone, for example:

• PRISM extended from B-Prolog
• Hakaru extended from Haskell
• bayesloop extended from Python
• ProBT extended from C++ and Python
• Standalone Church developed at MIT

Probabilistic programming languages are predicated on Bayes' theorem, an iterative process that updates or changes with respect to incoming evidence. The arrival of data at every step pushes the posterior update. This may seem dense, but probabilistic programming will become even more relevant in the coming years, to bridge the gap between outputs from quantum computers and traditional compute architectures.

Use cases in enterprise risk modeling

Based on a deterministic risk management model, enterprises weigh every object or event equally on similar checklists.

Supply chain risk modelling

According to an insight by Gartner, IT decision-makers must incorporate probabilistic approaches to adapt and recover during supply chain disruptions.

Supplier data metrics, such as performance, price justification, and ROI, update the model continuously to predict risks. Some suppliers might be more exposed to geopolitical factors that could disrupt their operations. Other suppliers might continue to operate, although their rate of output could be affected. As a result, enterprise resource planners can assess vendor relationships throughout the year.

Workplace health risk modelling

In factories and chemical industries, where on-site safety is crucial, probabilistic programming can be used for workplace health risk modelling. Enterprises define deterministic threshold levels as part of general analysis but each human is unique and will respond differently. This represents a gap in the data. Probabilistic health and safety management suggests risk concentration and forward-looking liability estimates.

Clinical trial risk modeling: Clinical trials are completed in three phases that cost billions of dollars. Based on historical data, cardiovascular drugs pass around at 12%, while Alzheimer’s drugs incur a high failure rate of 99%. Pharmaceutical companies running probabilistic models can save money by dropping trials when posterior efficacy gets too low.

Financial risk management: Probabilistic credit assessment deduces a credit score as a function of probabilities over a predefined range rather than a single deterministic number. JP Morgan is already using Bayesian inference for robust earnings estimates in financial risk management. Catastrophe and actuarial modeling in insurance markets focuses on updating posterior tables to formulate rates.

Cybersecurity risk modeling: Factor analysis of information risk (FAIR) is a framework that measures security and operational risks as quantitative, enabling enterprises to measure risks in financial terms (numbers). Probabilistic programming can share loss linked to an enterprise asset or process in dollars, rather than a qualitative result for best or worst-case scenarios.

When will probabilistic programming be mainstream?

Probabilistic programming significantly reduces the amount of training data, model development time, computation costs, and power budgets required to produce rich results. Nevertheless, deterministic models are still the most widespread when it comes to risk modelling and planning. Probabilistic programming is starting to make its way into enterprises, as seen by JP Morgan using Bayesian inference in its financial risk models – but the process is slow.

Probabilistic programming is used in research or complex fields due to its computational intensity, slow inference speed, and complex structure. It’s also very difficult to validate and debug such models. This means that, while they may be more dynamic and responsive to real world issues, they could ultimately be more effort to maintain.