In the information economy, it’s important to cross-train on select skills from other fields: there’s Operations Management for MBAs, Finance for Senior Managers, and perhaps the most important of all,

Bracketology for Information Security Risk Managers.

**Managing bracket risk**

In the NCAA tournament, on average, the higher seed wins about 70% of the time. Most bracket pools score the results of each round the same, with 32 possible points for picking all of the winners in that round. There are six rounds, so the maximum possible score is 192. If you follow a high-seed strategy (i.e. pick the higher-ranked team) you’ll likely wind up with a score that's better than average.

Of course, if you pick straight seeds, you can expect the following:

* You’ll do well in tournament years that feature exceptionally strong top teams.

* You’ll be ridiculed by your friends for having no imagination and playing it safe.

* In a bracket pool of any size, you’re odds of winning are very, very low.

Everyone else picks upsets. Most people get most of them wrong, but a few get lucky, and the lucky ones come out on top. To have a shot at winning against your friends,

prognosticators, or the masses on

Pickmanager, you have to go with some underdogs. Each year there are usually a bunch of upsets, and the more you pick, the higher your potential score will be--at least in theory.

(As an aside, this perspective sheds a little light on how the current Wall Street mess started, and why it was so hard to stop: to attract investors, you have to produce top returns. And you’re not going to get top returns by always playing conservative.)

**Start with history**Obviously, seeds are a

strong indicator of performance, so it doesn’t make sense to just pick upsets at random. It’s good to

look at the historical performance of each seed as a starting point. There are some upsets that happen every year, and the conventional wisdom is that they are “safe” to pick. For example, let’s look at 5 v. 12 first round matchup. Historically the 5 seed wins 67% of these games; an average of 1 to 2 upsets per year.

If you pick all 5 seeds, you’ll usually get 3 out of 4 possible points in the first round from those matchups. Sometimes they’ll all win and you’ll get 4 points; other times there will be two upsets and you’ll only get 2.

So putting your risk management hat on, which is that the best approach? Without any additional information, what strategy will give you the highest payoff? Consider the 2008 tournament 5 v 12 pairings:

(5) Notre Dame v (12) George Mason

(5) Clemson v. (12) Villanova

(5) Michigan State v. (12) Temple

(5) Drake v. (12) Western Kentucky

The left column on the chart below shows the 16 possible outcomes, with the historical probability of each. To see which one has the highest payoff, compare the columns to the right for each strategy: no upsets, 1 upset, or 2 upsets. (In the table, 2008 team names are listed instead of scenarios for clarity.)

| | | | | **Pick Strategy** | |

| | | **All high seeds win** | **Notre Dame upset** | **MSU and Drake upset** |

| **Outcome** | **Hist. Prob.** | **Max Points** | **Exp. Value** | **Max Points** | **Exp. Value** | **Max Points** | **Exp. Value** |

| **All high seeds win** | **20.2%** | **4** | **0.81** | 3 | 0.60 | 2 | 0.40 |

| **Notre Dame upset** | **9.9%** | 3 | 0.30 | **4** | **0.40** | 1 | 0.10 |

| Clemson upset | 9.9% | 3 | 0.30 | 2 | 0.20 | 1 | 0.10 |

| Michigan State upset | 9.9% | 3 | 0.30 | 2 | 0.20 | 3 | 0.30 |

| Drake upset | 9.9% | 3 | 0.30 | 2 | 0.20 | 3 | 0.30 |

| **MSU and Drake upset** | **4.9%** | 2 | 0.10 | 1 | 0.05 | **4** | **0.20** |

| Clemson and Drake upset | 4.9% | 2 | 0.10 | 1 | 0.05 | 3 | 0.15 |

| Clemson and MSU upset | 4.9% | 2 | 0.10 | 1 | 0.05 | 2 | 0.10 |

| Notre Dame and Drake upset | 4.9% | 2 | 0.10 | 3 | 0.15 | 2 | 0.10 |

| Notre Dame and MSU upset | 4.9% | 2 | 0.10 | 3 | 0.15 | 2 | 0.10 |

| Notre Dame and Clemson upset | 4.9% | 2 | 0.10 | 3 | 0.15 | 2 | 0.10 |

| Clemson, MSU and Drake upset | 2.4% | 1 | 0.02 | 0 | 0.00 | 3 | 0.07 |

| Notre Dame, MSU and Drake upset | 2.4% | 1 | 0.02 | 1 | 0.02 | 3 | 0.07 |

| Notre Dame, Clemson and Drake upset | 2.4% | 1 | 0.02 | 1 | 0.02 | 1 | 0.02 |

| Notre Dame, Clemson and MSU upset | 2.4% | 1 | 0.02 | 1 | 0.02 | 1 | 0.02 |

| All low seeds win | 1.2% | 0 | 0.00 | 1 | 0.01 | 2 | 0.02 |

| Expected Value (number of wins) | 100.0% | | **2.68** | | **2.27** | | **2.15** |

**Focus on specific outcomes, not typical results**It seems that if you know that one high seed is going to lose, you should pick at least one upset --and yet picking only the high seeds has the highest expected payoff (2.68). So what’s going on here?

Across the 16 possible outcomes of the four 5 v 12 games, a “no upset” strategy for this particular matchup ensures that the most likely scenario gives you the highest possible payoff, and the least likely scenario is the one that would leave you with the lowest possible payoff. (It does

**not** hold true in the 8 v 9 case.) Knowing that 33% of the number 12 seeds are going to come out on top doesn’t help you pick the right ones. (Clemson and Drake were knocked out in the first round last year.)

The moral of the story: historical averages are important, but there’s a world of difference between knowing what

*typically* happens and predicting what will

*specifically* happen. You need a much higher level of confidence about specific outcomes (i.e. risks) in order to be more effective than just playing the odds.

How much more confident? Working backwards, if you adjust the probability of the scenario you think is most likely (e.g. MSU and Notre Dame as the only 5 seed winners) you can see what level of confidence you need in your prediction to justify making that choice.

Getting to that level of confidence requires

research; knowing that you’ve reached it takes

practice ...