Dynamic Incentives for Risk Management

Incentives play an important role in assessment and mitigation of operational risks in large-scale organisations with multiple autonomous divisions. This paper presents a game-theoretic approach to optimisation of resources for mitigating security and technology-related risks. In the large-scale organisations considered, the risk manager plays a motivator role and provides assistance or subsidies to divisions, which are modelled as selfish players of a strategic (noncooperative) game. It is assumed that neither the risk manager nor divisions have complete information on the results of their investments, and they learn them `a posteriori´. Dynamic incentive schemes are presented which achieve certain objectives despite this lack of `a priori´ knowledge. The convergence properties of these iterative schemes are analysed. The distributed mechanisms and algorithms developed provide a basis for risk management policies and guidelines.