It should not be too hard to answer the question "What is the biggest risk in your project or business?" Most of us know what keeps us awake at night, either worrying about what could go wrong (threats), or getting excited about possible improvements (opportunities). But how do we decide which risk is the "biggest"? Is it just an intuitive feeling, or are there measurable parameters we can use?
It is very common to use just two factors to size risks: probability and impact. These estimate how likely the uncertain risk is to occur, and how significant its effect would be if it actually happened. Probability and impact are related to the size of a risk because they describe two fundamental characteristics of every risk:
- Each risk is uncertain, which means that it may not happen, and "probability" reflects the degree of uncertainty about whether it will happen or not.
- A risk that occurs would affect our ability to achieve one or more objectives, and "impact" describes our prediction of the extent to which objectives would be affected.
There are however several other important characteristics of risks which we might want to use when we answer the question "Which is the biggest risk?" For example:
- Manageability - How easy is it to do something about the risk? We may decide that a medium-probability/medium-impact risk that we can do nothing about is more risky than a high-probability/high-impact risk which is simple to deal with.
- Proximity - If the risk happens, how soon do we expect that to be? A risk that might happen tomorrow should be treated as more important than one which might not occur until next month or next year.
- Propinquity - How important is the risk to me personally, or to my team or our business? We are more sensitive to risks that affect us directly, and view risks to others as less important.
- Urgency - How much time do we have in order to implement an effective response to the risk? If we must act now to address the risk, we should give it higher priority than one where we have longer to respond.
- Relatedness - Is this risk related to other risks? A risk with complex links or dependencies with many other risks should be treated as higher priority than a simple independent risk.
We might wish to consider these and other factors when we try to decide how big a risk is, and what degree of priority we should give it. Simply assessing probability and impact is a limited way to determine risk size. Of course if you use more dimensions to size your risks, it becomes harder to develop suitable ranking algorithms and to present results. For example the traditional Probability-Impact Matrix only deals with those two characteristics, and other tools are required to deal with additional dimensions - for example bubble charts or risk meters.
The question "What is your biggest risk?" seems simple, but we should avoid the trap of giving an answer which is too simplistic.
Source: David Hillson, Risk Doctor Limited
copyright©. ProjectPro®. All rights reserved.
Designed by Equadoor
For technical difficulties e-mail: Webmaster
Home | e-Zine | Editorial | Project Parade | About Us | Training | News Flash | Library | Links | Calendar | Consulting | PM Services | Training Schedules | Training Registration | Subscribers | Recommend Website | Advertise | Contact Us