Guest Column | December 15, 2021

Using System Risk Structures To Evaluate COVID-19 Pandemic Risks

By Mark F. Witcher, Ph.D., biopharma operations subject matter expert

In the first article of this series, the principles and concepts of system risk structures (SRS) were presented.1 The purpose of this article is to use those concepts to structure important COVID-19 pandemic risks. By understanding the pandemic’s risks, important decisions for managing your health and the health of others can be identified.

As a warning and disclaimer, the approaches and all COVID-19 severity and likelihood estimates presented in this article are not intended to be used as medical advice or recommendations. The following discussion is intended to demonstrate how SRS can be used to understand complex risks and how SRS might be applied to understand the very complex risk landscape of the COVID-19 pandemic. As recommended in this article, the advice and guidance of experienced, qualified medical professionals should be used to make any medical decisions.

As with any risk analysis, the value of the review is highly dependent on the quality of the input information. During the COVID-19 pandemic, everyone has been inundated with a great deal of good, bad, and confusing information from all directions. This article cites a few references as examples of publicly available literature from likely credible sources to gain an order of magnitude understanding of the attributes of the risks discussed. As is the case with any risk analysis, the analyst must decide the veracity of the input information to minimize the likelihood of bad information resulting in bad decisions.

Overview Of SRS Principles And Concepts

SRS defines a risk as a causal threat input passing through a system that might control the threat to prevent the risk’s consequence. In the case of COVID-19, the initial threat is a source of SARS-CoV-2 virus that might cause risk consequences such as serious disease in yourself or in others around you. SRS’s first principle establishes a risk’s fundamental definition.

A risk is defined not as a single event, but as a possible threat event that enters a system that might control the threat’s ability to produce an output risk consequence event. All risks must be defined by a cause-and-effect relationship described by the threat event, a connecting system, and the resulting consequence event.

Thus, a risk is defined as a threat event of potential impact severity ST and likelihood of occurrence LT (expressed as a probability) that might enter a system having a likelihood (probability) LP of failing to control the threat, thus producing a risk consequence of impact severity SC and likelihood (probability) of occurrence of LC. As described in the initial article,1 the system’s ability to control the threat can be impacted by secondary threats and factors. Using the mathematics of probabilities, the likelihood that the consequence will occur LC is the mathematical product of LT and LP.

SRS is based on risk events having three attributes – severity of impact, likelihood of occurrence, and observer uncertainty associated with the level of knowledge or ignorance, information or misinformation, and objectivity or biases used to evaluate the risk event’s severity and likelihood as well as the system’s likelihood of propagating the threat. As described in the previous article, the risk’s threat and consequence events are rated using a logarithmic severity ST^ and SC^ scale that ranges from 0, no impact, to 7+, catastrophic.1 The likelihood of occurrence values for LT and LC are the probabilities that range from 1, certain, to 10-7, nearly impossible. The likelihood ratings of the threat LT^ and consequence LC^ event’s occurrence are the respective logarithmic values of LT and LP probabilities that range from 0 – certain – to ≤ -7 – nearly impossible. Subjective rating scales for both severity and likelihood of occurrence are shown in Table 1. Also shown in Table 1 at the far right is a similar rating scale of the system’s likelihood LP^ of failing to control the threat.

Table 1 – Summary of subjective ratings for a risk event’s severity on the left, the event’s likelihood of occurrence rating in the middle, and on the right, the likelihood that the system will fail to control the threat. The rating values shown are the logarithmic values of an objective scale shown in the SRS reference.1

A quick assessment of a risk’s significance can be gained by adding a consequence’s severity rating SC^ and likelihood of occurrence LC^ together to form an adjusted risk likelihood (ARL).2 ARL is balanced around zero, with positive numbers representing significant, usually unacceptable, risks, while a negative number describes risks that might be acceptable.2 When comparing risks, the lower ARL is usually the better of the two risks.

When significant frequency data is available, the quantitative information should be used to estimate the likelihood ratings. COVID-19 risks provide an excellent example of the third attribute – observer uncertainty – greatly impacting the risk analysis by significantly influencing how many people view both severity and likelihood. Thus, the subjective scales shown in Table 1 will be used in this article along with highly subjective information obtained from widely available media sources. The challenge of any risk analysis approach is to present the first two attributes – severity and likelihood – such that the negative impact of observer uncertainty can be identified and minimized.

Structuring COVID-19 Risks

The COVID-19 pandemic has many risks. The SRS in Figure 1 shows three different systems connected by intermediate risk events that might result in three significant risk consequences. The purpose of the SRS is to describe how an initial threat might flow through systems to result in final consequences or outcomes. For the purposes of analyzing risks, a system is defined as anything that takes an input and produces an output. People and their immune systems, hospitals, PPE, etc. are thus considered systems. The SRS shown is only one of many possible ways of structuring and describing COVID-19 risks.

Figure 1 – A three-system SRS risk landscape of a person’s COVID-19 risks. The initial threat shown on the left is the threat of SARS-CoV-2 sources, with two possible risk consequences shown as point A on the far right and point B at the bottom. The SRS also shows a vaccination threat that might produce a vaccine risk consequence reaction (point C).

The threats and consequence events are structured using the following three systems:

  1. Personal Protection (PP) – The systems (PPE, distancing, behavior, etc.) associated with protecting an individual from the threat of direct exposure to the virus.3,4
  2. Individual COVID-19 Control – The systems people use to control the virus threat to prevent disease (immune system and personal health) should they be directly exposed to the virus. Depending on many factors, an individual person’s immune system may or may not control the viral threat to prevent disease and the ability to infect others. These systems might include vaccination or prior COVID-19 disease.
  3. COVID-19 Hospital Treatment – If serious disease occurs, this is the individual’s ability to eventually control serous disease, combined with the supportive care treatment systems (hospitalization, therapies, intensive care, and ventilators, etc.) used to prevent a catastrophic outcome of the disease.

Understanding and evaluating the overall risk of infection threats producing very serious health consequences requires understanding how that threat flows through the systems to an outcome. The likelihood of the final consequence is determined by the combined likelihood of the three systems controlling the primary threat as it flows through the systems.

As will be described, those likelihoods vary widely. If the three systems are robust, then the likelihood of the final consequence is extremely rare, approaching an DLC^ ≤ -7. However, many of the systems are significantly negatively impacted by a variety of factors reducing DLC^ in some cases to likely (DLC^= -1). For people who are concerned about the severity (DSC^ ≥ 5), understanding how the systems work is critical for using them to prevent serious disease or a poor outcome.

Each system will be subjectively evaluated using a separate SRS to understand how they control threats to reduce the likelihood of their respective consequence.

Risk Of Personal Infection

The first system is the personal protection mechanisms used to prevent infection threats from resulting in being infected. The details of these systems have been discussed previously.3,4 The effectiveness of System 1 can range from very robust (LP^ = -6) to providing no control (LP^ = 0), depending on the factors shown in Figure 2. System 1 is by far the least expensive but most effective method of preventing serious consequences. The reasons that people ignore System 1 vary widely, from a reliance on Systems 2 and 3 to just not appreciating the likelihood of the disease’s consequence ELC^ or even DLC^. Their concern is only manifested after they realize the potential significance of the disease DSC^ = ≥ 6 and a more obvious high likelihood of disease (i.e., DLC^ = < -1) producing a highly undesirable DARL (DLC^ + DSC^) of ≥ 5.

Figure 2 – System 1 includes the many small efforts for preventing infection threats from resulting in exposure to the virus. By preventing exposure to the virus, the threat sequence to serious consequences (point A) is significantly controlled.

Subjectively evaluating the virus exposure consequence prospectively, one might give ESC^ a value of 4 (must reasonably prevent). Depending on the effectiveness of System 1, the likelihood of exposure might vary widely from LC^ of -1 (likely) to -5 (rare), resulting in ARLs between 3 and -1. If ESC^ is disregarded for a higher priority activity resulting in increasing LP (decreasing LP^) by compromising System 1, the DARL for the consequence risks increases significantly to a highly undesirable value.

If a person is exposed to the virus (ELC^ = 0), understanding the following Systems 2 and 3 that describe the likelihood of the disease progressing to more serious consequences becomes important.

Risk Of Disease Progressing Or Spreading

The threat of direct personal exposure has two important possible risk consequences. The first is further progression of the disease requiring additional treatment. The other risk is infecting other people such as friends, family, kids, and associates. The SRS for these risks is shown in Figure 3.

Figure 3 – System 2 SRS describing the flow of the virus exposure threat to the consequences of serious disease (SSC^, SLC^) and infecting other people (OSC^, OLC^).

The severity and likelihood of both consequences depend on a variety of the individual “people systems” that make up System 2. For the sake of the initial discussion, the person will be assumed to be unvaccinated. Some individuals can resist the infection and are highly unlikely (System 2 LP^ between -2 to -6) to progress to serious disease or even show symptoms, while others are highly likely for disease progression.5,6 While the impact of BMI (body mass index or weight), co-morbidities, etc. can be subjectively or statistically evaluated, other secondary factors such as genetic makeup and epigenetic history appear to be largely unknown, making an overall assessment of LP for any specific individual largely a subjective game of chance.5,6

Based on a subjective assessment of the general literature, vaccines are likely to drop System 2’s LP^ by one or more orders of magnitude for most people (e.g., from LP^ of -3 to -5 or -1 to -3).7,8,9 Clearly, some difficult-to-determine fraction of the population must rely heavily on System 1 to prevent serious disease because the effectiveness of Systems 2 and 3 may not significantly decrease the likelihood of serious consequences. The best advice is to seek the guidance of healthcare professionals familiar with your situation to understand and estimate your personal System 2‑LP^ for controlling disease progression. Reliance on sources rich in misinformation or personal perceptions greatly increases the likelihood of overestimating your personal ability (System 2 LP^) of fighting off the disease.

Similarly, the risk of infecting other people can be estimated. The threat likelihood of a person with serious disease as a viral source is near certain (OLT ~ 0). If OST^ is viewed as the viral load for possible infection, then OST^ would be large. Figure 3 shows that those who have disease progression with a high viral load pose a threat to infecting others (possibly ST^ ≥ 5), with the likelihood of infection LT^ depending on the factors in System 1

Evaluating the risk to other people again depends on analyzing System 1. For healthcare workers using sophisticated positive airflow PPE and appropriate gowning, the likelihood of infection using System 1 is very low (LP^ ≤ -7, barrier), although given the very large number of exposures, the net likelihood is probably closer to robust (LP^ = -5 to -6).

Especially for asymptomatic people, there could be a significant difference in perceived severity of infecting others. While the “other person” might be very concerned (OST^ = 4), the infected person may thoughtlessly care little (OST ~ 0) about the severity of infecting others. In some cases, the subjective perception of the severity of infecting others, such as elderly parents, family, kids, and friends may be far more significant than their perceived severity of their own personal outcome.

Risk Of Serious Disease Progression

The treatment SRS of serious COVID-19 disease is described in Figure 4. Since the disease has been diagnosed, the LT^ of the threat is zero (certain) and the high viral load SST^ is high. Successful treatment of the disease is determined by a combination of the same System 2 factors that include the individual’s ability to fight off the virus added to the treatment methods available in the hospital. The heroic efforts of many healthcare workers have significantly increased our experience and knowledge of how to treat COVID-19. That experience and additional treatment methods, antibodies, and antiviral therapies have likely dropped the System 3 LP^ by an order of magnitude, but it remains higher than for many other diseases.

Figure 4 – Patient/treatment SRS for treating serious COVID-19 disease. The likelihood of System 3 successfully treating the disease has increased as the pandemic has progressed, as reflected in lower System 3 LP^s.

Of note is the consequence sequence of intensive care, ventilator, and death has increasing levels of severity (e.g., possibly SC^ of 5, 6, 7 respectively), but those are accompanied by decreasing likelihoods depending on the patient’s secondary factors (e.g., LC^ of possibly -1 to -3), resulting a stable ARL around 4 for evaluating the final risk consequences. Although medical treatment saves many people, a risk with an ARL near 4 is a very poor risk.

In evaluating the effectiveness of Systems 2 and 3, one factor that reduces the likelihood of failing to fight off the virus, thus reducing both Systems 2 and 3’s LP^s, is getting vaccinated.7,8,9 However, getting vaccinated is a risk that can also be analyzed using SRS.

Risk Of Vaccination

Like any input to a system, vaccination is a threat that has a possible risk consequence. The SRS for a vaccination is shown in Figure 5.

Figure 5 – The vaccination risk is shown as an injection event of severity IST (impact of an injection) passing through a people system to produce a reaction of severity VSC^ with a likelihood of VLC^. The VARL for the vaccine is equal to the sum of VSC^ and VLC^.

Of course, the great unknown is System 2’s amplification factor of VST to VSC, which can only be estimated for a well-defined population from clinical data. Any medical treatment that impacts a person’s immune system should be treated as a significant possible threat. Regulatory agencies take vaccines extremely seriously (VST^ = ≥ 6) and rely on gathering as much clinical trial information as possible to assess the risks (VSC^ and VLC^) before approving vaccines. As described below, the regulatory agencies also consider the risk of vaccination VARL against the risk of the disease without vaccination DARL in making approval decisions.

If the widely available information from all sources that can be traced to at least some levels of medical expertise are reviewed, the severity of the vaccine effects observed VSC^ have been relatively minor compared to the severity of the disease DSC^. At the same time, the likelihood of vaccine reactions VLC^ has been very low while the likelihood of COVID-19 DLC^ in the population has been significant. The general conclusion can be reached from an overall survey of the literature7,8,9, etc. that the vaccine’s VARL is many of orders of magnitude less than the DARL (unvaccinated) of serious disease.

Managing COVID-19 Risks

The pandemic has created a situation where there is no escape from taking one risk or another. Doing nothing does not avoid taking risks. Everyone must decide between the risks identified by the SRS in Figure 1. To manage COVID-19 risks, everyone must look at the available information, determine its veracity, and make their own decisions. Using SRS, the available information can be structured using the three systems shown in Figures 1 through 5 to compare the following relative risk relationships:

  • Practice personal protection?    DARL (with PP) vs. DARL (without PP)
  • Get vaccinated?                           DARL (with vaccine) vs. DARL (without vaccine)
  • Risk of vaccination?                    VARL (of vaccination) vs. DARL (without vaccine)
  • Risk to others?                             OARL (with vaccine & PP) vs. OARL (without vaccine or PP)

While ARLs can be calculated for large well-defined populations based on statistical data, individual ARLs vary a great deal. For an individual making decisions, only the relative ARLs matter. In comparing the above four relative risks, the preponderance of the good information sources suggests that the ARL of the first risk is usually significantly lower than the ARL for the second risk, indicating that the first risk may be the better risk to take.

However, everyone must come to their own conclusion, leading this discussion to cover the last and perhaps the most important risk – that of using bad information to make bad decisions. Or, putting it in more positive terms, choosing the opportunity to use good information to make the best decisions.

The Risk Of Making Bad COVID-19 Decisions

While little can be done to assist people who do not care about their personal safety or the safety of others, managing COVID-19 risks by making good decisions comes from understanding how the threat of bad information can be controlled using an SRS analysis to reduce the likelihood of bad information resulting in bad medical decisions. The SRS for understanding the risk is shown in Figure 6. The threat of bad information is determined by the systems that produce the information. All information systems likely distribute some bad information, but some information delivery systems are much more likely to produce bad information than others.

Figure 6 – Medical decision SRS for controlling bad COVID-19 medical decisions. The SRS shows the information systems that might produce bad information threats to an individual’s decision systems (thought processes) for making the decisions that might produce risk consequences of bad medical decisions. The secondary factors for each system are shown.

Since there is nearly an unlimited amount of conflicting and inconsistent information out in the world, the threat of bad information is certain (LT^ = 0).

What is the ARL (LT^ + ST^) of each information source?  What is the rationale for your LT^ and ST^ estimates? If the ST^ for each source is given the same value, then the estimate is reduced to the relative LT^ values.

Since the information is important, its severity is high.  Clearly, some information systems have a wide range of capabilities and agendas, as reflected by their secondary factors. The individual, as the primary controlling system, must evaluate the likelihood of bad information from each source based on the source’s secondary factors. That likelihood range varies many orders of magnitude, from certain to very unlikely. The individual must use their own knowledge as well as the experience, skills, and knowledge of others to assess the input information to make their decisions.


While pandemic risks can be managed, they cannot be eliminated. Risks that have a high degree of uncertainty in a complex landscape must be managed by making order of magnitude estimates of the different risks’ relative severity and likelihood while minimizing the impact of observer uncertainty and misinformation. The pandemic can be viewed as “one of life’s gambling casinos.” Dealing with the casino’s risks requires understanding how to manage risks for placing the smartest bets. As with playing any casino game, you must structure the risks to understand the rules of the game and then use the best available information to place your bets. As shown in this article, understanding the COVID‑19 risk landscape, even just intuitively, can reduce the risk of serious consequences to you and those around you.


  1. Witcher, M., Principles And Concepts Of System Risk Structures For Understanding & Managing Risks, BioProcess Online, December 6, 2021.
  2. Witcher, M., Rating Risk Events: Why We Should Replace The Risk Priority Number (RPN With The Adjusted Risk Likelihood (ARL), BioProcess Online, April 7, 2021 Rating Risk Events Why We Should Replace The Risk Priority Number (RPN) With The Adjusted Risk Likelihood (ARL) (
  3. Witcher, M., What Managing Personal SARS-CoV-2 Risks Can Teach Us About Managing Pharma Risks, BioProcess Online, June 12, 2020.
  4. Witcher, M,. Revising Annex 1: Case Study in Controlling Operating Risks by Understanding Uncertainty, BioProcess Online, November 13, 2020.
  5. Mallapaty, S., “The search for people who never get COVID”, Nature, October 29, 2021.
  6. Callaway, E., “The quest to find genes that drive severe COVID”, Nature, July 8, 2021.
  7. McPhillips, D., New CDC data shows the risk of dying from Covid-19 is 11 times higher for unvaccinated adults than for fully vaccinated adults, CNN health, Oct. 15, 2021.
  8. Garciade Jesus, E., Covid-19 vaccines are doing their job, Science News (kindle edition), Oct. 9, 2021.
  9. Wen, L., “Stop the false narrative about young children and covid. They need vaccines.” Letters to the Editor, Washington Post (kindle version), October 28, 2021. Author’s note: Leana Wen, MD, MSc is a physician and former Baltimore health commissioner.

About The Author

Mark F. Witcher, Ph.D., has over 35 years of experience in biopharmaceuticals. He currently consults with a few select companies. Previously, he worked for several engineering companies on feasibility and conceptual design studies for advanced biopharmaceutical manufacturing facilities. Witcher was an independent consultant in the biopharmaceutical industry for 15 years on operational issues related to: product and process development, strategic business development, clinical and commercial manufacturing, tech transfer, and facility design. He also taught courses on process validation for ISPE. He was previously the SVP of manufacturing operations for Covance Biotechnology Services, where he was responsible for the design, construction, start-up, and operation of their $50-million contract manufacturing facility. Prior to joining Covance, Witcher was VP of manufacturing at Amgen. You can reach him at or on LinkedIn (