Residual risk and its cost
I believe we’ve already established that humans are generally not very good at assessing real life risk and probabilities, which leads to some interesting and very readable books on stuff like that, such as psychologist Dan Gilbert's "Stumbling on Happiness". In well-bounded problems like poker we are somewhat better, but, as Mark lays out even in poker there is a huge difference between players.
This fact often leads to people equating a very small risk with no risk at all, especially in newspaper articles or political talks. For example, when a few years ago a NASA satellite was falling to Earth, a major newspaper quoted a scientist as saying there was no risk that a person would be hit by the debris – which is quite obviously wrong. (No link as I don’t want to name names – at least the online edition of the newspaper later corrected that quote to "there is a very small risk".)
In activities involving technology, i.e. practically everything in the modern world, we often hear about residual risk, mostly in the context "nothing can happen, there is just a residual risk". As an insurer, this always irritates me; if the statement were true, insurers would be out of business in many areas.
What is residual risk in this context? Basically, it is that risk which is left despite security measures. It is either intentional (because of the cost of security measures, like the free lunch that costs US$ 70k) or unintentional. N. Taleb talks a lot about the latter in his book "The Black Swan", another interesting read on human handling of probabilities. (Even though he IMO has a somewhat skewed view of insurance ;-)) Just to increase the confusion: in analyzing investments, a different definition of residual risk is used, but we will not go into that one here.
Take the operation of an airplane. This has a residual risk greater than zero. As a passenger (who as a human is bad at assessing risk) I might either choose to ignore it (the "it's just a residual risk" statement) or decide that it is small enough to be acceptable. The airline generally won't choose to ignore it - they will buy insurance. The insurer will require that the airline take all reasonable maintenance and security measures. They will then calculate the intentional residual risk, add a buffer for unintentional error, assess possible damages in an incident, and from that calculate a premium.
The good thing about insuring an activity like operating the plane it that the discussion about residual risk suddenly has a rational basis: a cost. If either the risk or the potential damages go up - assuming we are honest in our calculations - then the cost of flying will rise, giving the potential passenger a handle on the decision. A risk in itself is not interesting, it is the addition of damages and the transformation to a cost that allows a discussion on the acceptability of the risk. Mark has previously already looked at the engineering side, especially the cost of a human life.
In my next post I will be exploring a specific technology for which the residual risk part is really important: nuclear energy. Stay tuned.
Notes:  Which includes costs, etc.