Data and Information Risk

What if the data and information used to make important decisions are incomplete, inaccurate, misunderstood or just plain wrong?  Not identifying all relevant data and information attributes could affect not only individuals dealing with personal risk, but also businesses coping with risks to the quality of strategic planning and sustainability.

Risk definition: possibility of loss or injury ⁽¹⁾

Understanding data and information risk is crucial to personal health, safety and security.  It is also critical to boards of directors, business leaders, and enterprise risk managers.  The worst-case scenario is to make a non-recoverable decision that is fatal to an individual or to the viability of a business.

How does one know that the data and information are suspect, that they may not be 100% accurate or reliable, that they change rapidly, or are they just accepted at face value?  As an example, the COVID-19 pandemic in the United States.

Whenever there’s chaos, there’s ambiguity, and where there’s ambiguity, there’s fear. And fear gets manipulated. – Robert Redford ⁽²⁾

Since COVID-19 remains in the forefront of the news, we use it as a means to explore the subtleties of understanding data and information. However, before doing so, a review of issues associated with testing are in order.  We first need to know exactly what we are testing.  Then, we need to be alert to the fact that tests may be inaccurate.

In statistics, the power of a test is that it can accurately detect the presence of a specific effect.  Continuing further, a test may yield a false positive, “you have COVID-19”, but you do not.  Or a false negative, “you do not have COVID-19”, but you really do.

Currently, international travel from the United States to certain foreign countries, requires submission of a negative Reverse Transcription Polymerase Chain Reaction (RT-PCR) test result at the domestic departure airport upon airline check-in. ⁽³⁾ So, what could possibly go wrong?

We can put aside the specter of a false positive for a moment.  Upon check-in, RT-PCR results cannot be older than 72 hours.  Many testing locations, say a medical practice or pharmacy take a sample for the test which is date-time stamped, and will then send the sample overnight to a testing laboratory.

The first risk is if test results will be reported in time to board your flight or not.  This is a function of turnaround time and perhaps luck.

The more important data risk is what is reported about RT-PCR test results, and whether or not the test returns a true result of no infection and not a false positive indicating infection.  As reported, RT-PCR tests amplify a sample sufficiently to detect and classify an antigen. The missing data up to now were the number of amplification cycles used, i.e., the Cycle Threshold or Ct value. ⁽⁴⁾ It seems that with a sufficiently high number of cycles even a dead inactive virus will be detected.  Adding to the current complexity of what this test reports, is that the number of test cycles reported seem inconsistent across the country if reported at all.

The Florida Department of Health has just begun requiring the reporting of Ct values along with test results. ⁽⁵⁾  In summary it seems that if a person is really infected with COVID-19 the virus will be easily detected by the RT-PCR test with a low Ct value.  On the other hand, the use of a high Ct value greater than 30 and perhaps as high as 45, reportedly raises other issues.  For example, unusually high Ct values (>30), may give a false positive triggered by detection of dead viruses.

So, lets circle back to data and information risks.  The RT-PCR test was a convenient, timely, and interesting topic to explore such risks.  The learning is that one needs to understand data and information used to support decisions whether personal or business.  This need extends to the spectrum of data and information of all types and from all sources.

One needs to understand the risks associated with the data.  The sources, the age of the information, how rapidly updated, accuracy, precision and reliability – are all attributes we should consider to answer the question, is it fit for use for our purpose?

We can explore a prospective business decision example.  Let’s say you have been paying close attention to the COVID-19 effects on personal lives and business viability and sustainability.  Being clever, you immediately see a business opportunity – invest in a business venture to provide sanitization and sterilization services using equipment that will kill the COVID-19 virus.  The customer base is estimated to be extensive in a well-defined service area – hotels, schools, hospitals, outpatient clinics, dental offices, and other commercial businesses.  You have $75,000 that you can commit to this venture and can borrow twice that amount.

Here is the dilemma faced – you are not certain how long the COVID-19 pandemic will last and require sanitization and sterilization services.  Also, you are not sure you can charge customers a sufficient amount to make the investment worthwhile.  So, you research what is being reported about COVID-19.  You learn more people are reported as infected, and conclude that this might be a result of more tests being given.  What you cannot discover is how many people in your service area might have been or are now infected but have not been tested.  Most importantly your research discovered that the most widely used test may be yielding a high percentage of false positives.  Doubts begin to arise about accuracy of your prospective business financial assumptions.

Are you taking on more risks than intended, far exceeding your risk appetite?  Accepting data and information at face value may lead to unanticipated outcomes, in the worst case – a fatality, financial ruin or bankruptcy.

It is not just COVID-19 related data, all data and information used to make key decisions pose some element of risk.

Suspect all data and information, not just COVID-19 related, used to make key decisions.  Identify the attributes associated with the data and information, and use what you learn to evaluate source reliability and data and information content.  You own the problem, either adjust your risk appetite upwards by taking on more risk, or downward by taking on less risk. Expect bad outcomes if not done with good due diligence.

References:

• https://www.merriam-webster.com/dictionary/threat
• https://www.quotemaster.org/Ambiguity
• Personal observation in December 2020.
• https://justthenews.com/politics-policy/coronavirus/florida-requiring-labs-report-critical-cycle-threshold-covid-19-tests
• https://justthenews.com/politics-policy/coronavirus/florida-requiring-labs-report-critical-cycle-threshold-covid-19-tests