The Geometry of Risk

On the last stop of a recent trip, I checked into the Bethesda Marriott. It was late afternoon, and as I entered my room, I flicked on the TV set and switched to the cable news. "Five Shootings, Five Dead, in 17 Hours," read the streamer, while the large screen showed a map of the area west of DC.

The next morning, Washington Editor Jill Wechsler picked me up for our appointment at FDA in Rockville, at the western end of the shooter's cruel circle. (See "Special Report-FDA in Motion," page 38.) Cranes and construction sites surrounded us as we approached the faded grey monolith of FDA headquarters. Change outside symbolized even greater change inside the building-a reconstruction largely for the sake of fighting terror that could attack by food, water, air, or simply from the shadows of the unknown.

As if to emphasize the last point, the Rockville area was just entering the prolonged terror of the snipers' killing spree. On my flight home that evening, the parallel irony of our discussions at FDA-which plumbed the agency's new "risk-based regulation" philosophy-began to sink in. It makes perfect sense, as the deputy commissioner argued, to focus FDA resources on regulating processes and products that present the greatest risk. If only it were that simple to put into practice.

Risk measurement, not risk management, is the problem. Quantifying risk involves measuring an event in three dimensions: the likelihood of its occurrence; the severity of its consequences; and the predictability of its outcome according to the first two parameters. (No, likelihood and predictability are not the same; the first applies to the event; the second, to the reliability of the prediction.) That geometry makes it possible to quantify the risk of past events recurring. But the same construction also makes risk measurement nearly futile for future events with no precedence. That is why terrorism, by definition, comes as a surprise.

Even when you know the rough odds that an event will happen-say, one in 50 million potential targets-it may help little in allocating resources. Likelihood, consequences, and predictability remain uncertain, so the dragnet must stay proportionally wide.

FDA may encounter a similar problem in applying its risk-based approach. The relative risks of table salt and cyanide appear obvious, but other compounds carry more concealed dangers, which only a large patient population may express. It is difficult to imagine how the agency or industry companies will predict the likelihood or consequences of adverse events. Most probably, they will have to identify broad categories of products and processes for risk-modeling. Not that big a change from the past.

Yet, the risk-based philosophy, together with IT advances and agency budget crunches, will likely have one predictable result: a greater burden on regulated companies to produce and share risk-assessment information. Companies may also experience some regulatory loosening in other areas-a nod to the deregulation movement now firmly in power. But they might also wonder at times whether the replacement of old burdens with new ones is worth the trade.