Engine 19.0.0rc597 · Reader 9.0.0rc656 · Development snapshot
Relative risk compares the proportion of hits in one group with the proportion in another. Ghost Observatory calls this ratio lift when comparing a rule’s attribute segment with all the other checked objects for that rule.
A lift of 2 means the segment’s deviation share is twice the rest’s; 0.5 means half as large. Use the ratio to locate concentrations worth examining, then inspect the counts and confidence interval. A concentration associated with a customer, team or person does not establish its cause.
The relative-risk formula
Arrange the checked objects in a two-by-two table. Let a be segment hits among n1 segment objects, and c be hits among the n2 objects in the rest.
| Population | Deviates | Does not deviate | Checked |
|---|---|---|---|
| Selected segment | a | n1 − a | n1 |
| Rest of the rule’s population | c | n2 − c | n2 |
Lift = RR = (a / n1) / (c / n2)
This is a ratio of probabilities, rather than an odds ratio. Comparing a group with the whole rule’s share would also give a different result, because that whole includes the selected group.
The Katz log confidence interval
The Engine calculates a two-sided 95% interval on the natural-log scale, then exponentiates its limits. Let z be the standard-normal 97.5th percentile, approximately 1.959964.
s = √(1/a − 1/n1 + 1/c − 1/n2)
Lower bound = exp[ln(RR) − z s]
Upper bound = exp[ln(RR) + z s]
An interval containing 1 includes equal deviation probabilities as a possibility under the model. The interval is an approximation based on the counts and independent-unit assumptions. Many groups and rules are compared, and the product does not apply a multiple-comparison adjustment to these intervals.
A worked example: 20 of 50 versus 10 of 50
The segment’s share is 40%; the rest’s is 20%. Dividing gives a lift of 2.000. The formula gives a 95% Katz interval of 1.044 to 3.831. Under the documented publication rules, lift_status is estimate.
The calculation uses 100 checked objects with 30 hits overall. At the whole rule’s 30% share, the segment would have 50 × 0.3 = 15 expected hits. That also passes the product’s minimum-count checks.
What happens when a cell is zero?
If any of the four cells is zero, the Engine adds 0.5 to all four cells before calculating the ratio and its interval. Each row total therefore increases by 1. This Haldane–Anscombe correction is recorded as lift_status='corrected'; the published observed counts remain unchanged.
For 10 hits among 50 segment objects and no hits among 50 other objects, the corrected shares are 10.5/51 and 0.5/51. The resulting lift is 21.000, with a wide interval of 1.264 to 348.934. The correction makes the calculation finite. Sparse observations can still produce a wide interval.
Both examples meet the publication conditions described below.
Minimum counts and withheld comparisons
A published lift requires at least 3 observed segment hits and at least 5 expected segment hits at the whole rule’s observed share. The expected count is n1 × total hits / total checked objects. The Engine applies these publication thresholds before correction.
For example, 3 hits among 10 segment objects and 27 among 90 others have equal observed shares. The segment’s expected count is only 3, so its lift is withheld with too_few. If every checked object belongs to the segment, there is no comparator and the status is no_rest.
Attribute segments cover customer, last actor’s team, object type and the person at the first process step. The first-person value requires a known order for the object’s whole process history. A group with an unknown attribute is omitted when it contains fewer than five checked objects, but those objects remain in the rest population for other comparisons.
Each row uses one object-level rule and analysis scope. Attribute groups overlap across dimensions, so their counts and ratios should not be added together. The event-level minimum-step-time rule has no attribute lift rows.
Relative risk, absolute difference and odds ratio
In the example above, 40% versus 20% gives a relative risk of 2. The absolute difference is 20 percentage points; the relative increase is 100%. These are three descriptions of the same counts, not interchangeable numbers.
The odds ratio uses hits divided by non-hits. Here it is (20/30) / (10/40) = 8/3, approximately 2.667, rather than 2. Report the measure by name and retain the original counts so a reader can reconstruct the comparison. The published lift field on this page is the relative-risk calculation.
Engine results and Reader presentation
rule_breakdown stores lift, lift_low, lift_high and lift_status, alongside the observed hit_count and checked_count. Join rule_id to rules for the rule definition and scope.
Processes → Deviation segments draws those stored ratios and intervals on a logarithmic ratio axis. It identifies corrected results, explains withheld comparisons and indicates intervals crossing 1. The Reader divides stored hits by checked counts for the displayed share; it does not fit a new relative-risk estimate.
Related measures and sources
For uncertainty around a single rule’s deviation share, see the Wilson confidence interval. For a distribution of event counts across people, see the Theil index. Both use different denominators from a segment-versus-rest comparison.
Method reference: the official statsmodels risk-ratio interval documentation. The correction and minimum-count policy described here describe the stated Observatory snapshot.