The goal of risk analysis is to identify critical risks: those risks that have the most potential to positively or negatively impact your project objectives. Identifying critical risks is a process of prioritization and this an output of qualitative or quantitative risk analysis. Risk prioritization facilitates project decisions, particularly with regards to risk mitigation and response planning. There are a number of tools which can help with risk prioritization, particularly the risk register and the risk matrix.
Why We Should Prioritize Risks
Let us assume that this summer you are planning a road trip from Boston to New York that will primarily travel along the I95. The weather forecast is promising, nothing spectacular, but good for travelling. Before embarking on your trip, you perform an-hoc risk assessment. Like a good project manager, you want to minimize the chance of delays and determine what you might require in case of an emergency. Here is an example of risks that you might encounter:
- You run out of gas and your trip could take a lot longer. This is could be especially concerning if you find yourself out of gas while on the I95 as this means that you will have increased probability of other risks occurring as you are stranded precariously on the side of the freeway. Mitigation plan: Start with a full tank of gas and, if you are extremely risk averse, you might choose to carry an extra gas caner or two.
- Your car breaks down. As with the above, this has the potential to seriously impact your schedule (as well as your budget). Mitigation plan: Perform all scheduled maintenance and perhaps ask your mechanic to inspect all major systems. However, even a well maintained vehicle can suffer a breakdown, so you may want to carry a few spare parts. For example, some light bulbs, spark plugs, a crankshaft, and an alternator, just in case.
- You get a flat tire. You already have a spare one, but you could get a second flat. Mitigation plan: Carry a second spare tire.
- In spite of the forecast, the weather is unpredictable and may turn for the worst. Mitigation plan: Pack some extra supplies, candles, warm blankets, rain gear, extra food and other items that will help you survive a couple days in case of a major hurricane and floods. Take a raft and life jacket.
- You could be robbed. Could it happen on your way to New York? Absolutely. Mitigation plan: Wear body armor and carry your stun gun, pepper spray, and horn with you. Just in case things get really ugly, you probably should have your machine gun and enough rounds of ammunition of survive a long siege – think the “Walking Dead”.
- The roads could be blocked. Think of what happened to the King of France, Henry the IV. Well travelling down a road, he found it blocked by several logs. When they stopped, an assassin jumped into the carriage and stabbed the king. Henry IV was not good in risk management, but you are. Mitigation plan: Take a chainsaw and, just in case, your mother-in-law can ride in the back as a body guard.
- You could get a speeding ticket. You could go the speed limit and eliminate the risk altogether, but your plan calls for a speed of 15% over the posted limit. It will get you to New York quicker, but close to a speed that will put you at risk for a ticket. Mitigation plan: You could buy some anti-radar devices, but better yet, you can install stealth technology and your car invisible to police radar.
You might be starting to see a problem here. If you try to avoid and/or mitigate all of the risks you have identified, this will result in two things. Your car will be so laden down with supplies it will be unable to move and the expense of all your mitigation efforts will mean that you won’t have any funds to enjoy the sites if you manage to get to New York. For example, though we haven’t checked, we believe stealth technology would take a considerable chunk out of your budget. The reality is that you must deal with constrained resources (budget, time, etc.) and it would be impossible to completely mitigate all of your risks. The solution is to prioritize your risks to determine which are the most important, so that given your limited resources you can minimize your risks in the most cost effective manner possible. Now, the question is, how do you determine what risks are the most important? This is where the risk register comes in as it is the key to prioritizing your risks.
Risk scores
We discussed risk registers when we talked about risk identification. Now, we can use the risk register as part of the risk analysis, including risk response planning, and risk monitoring and control. To prioritize risks, you need to assign each one a risk score. The risk score is calculated using a risk’s probability and impact.
Risk score = Risk Probability * Risk Impact
If a risk occurs, it will have varying impacts on different project objectives (such as duration, cost, and safety). For example, the risk “run out of gas” may have a significant impact on your trip duration, but very little on cost or safety. Therefore, the risk score should be calculated separately for each objective. If you calculate the all probabilities and impacts of a risk, you can calculate its overall risk score. Table 1 shows an example of the risk register with risk scores calculated based on overall probabilities and impacts. The bar on the right column is an easy way to present risk scores. To make the score easier to understand, you can multiply them by a certain value (e.g. 100). Please note that risks in the risk register are sorted based on risk score. As a result, Table 1 is a tornado diagram for risk scores.
Risk scores relatively simple and yet powerful indicator of the order in which we should prioritize our risk response planning activities. Done properly, it provides a realistic measure of the potential impact and it relative importance as compared to other project risks. There are many cases in projects where a risk’s impact is very significant but the probability of occurring are very small. Psychologically, people overestimate the “score” of risks very high because the impacts arouse emotions like fear and anxiety. The classic situation is the risk of a terrorist attack on an aircraft. Although the impact of the risk can be very significant, the probability is very small. The score of a risk “terrorist attack” is lower than many other risks related to the operation of aircraft, such as mechanical problems or a sleep deprived pilot. As a result, people often support greater expenditure towards the elimination of terrorist attacks as opposed to improving maintenance programs or monitoring sleep diaries of pilots. In our road trip example, though an armed robbery would have a significant impact on our project, the probability of it occurring is extremely low. Therefore, its overall risk score is lower compared to the other risks. If you have to make a choice between bringing extra rain gear or wearing body armor, rain gear should be your priority. In this way we can see how accurate risk scores are the key to prioritizing your risks and making the best use of your limited resources.
