The Risks of LSCITS: The Odds Are Stacked against Us

Complex IT Systems are often used in applications which can pose a risk to their owners or to the public. Many of these are subject to extensive risk assessment before they are deployed and operated yet, despite this, undesired events do arise, leading to financial loss or loss of life. This paper investigates the role of existing risk assessment methods and draws the conclusion that they do not effectively predict the causes of actual loss events. The paper then suggests an alternative approach, which has the potential to offer a unified approach to risk assessment across a number of domains, and across different system properties, e.g. safety and financial risk. It concludes with observations on similar methods and research results, especially from accident analysis, and makes suggestions for future research directions.