Remember Indiana Jones movie? What is more important for Indiana Jones, spend an extra couple of minute to fight a dangerous villain or have a non-injury accident? In other words, what category is more important: Duration or Safety? This is a more difficult question. What if Indiana Jones has several risks, as shown on in the table below.
Two risks have different impacts in different categories.
Let us assume that probability of both risks is the same. If we only compare risks within a specific category, it would be very easy to prioritize them. For the safety category, the most important risk would be “Encounter with the snake” (as you probably remember Indiana Jones has a phobia of snakes). For the duration category, the most important risk would be “Encounter with the villain”. It will just take longer to defeat the villain than avoid the snake. The issue is what is the most important risk if we take all risk category impacts into consideration? Here is how we can solve this problem.
Each category has a priority. These priorities are used to adjust risk scores. Let assume that we have 5 categories. Theoretically we can just assign priority values to each category:
- Duration and Scope – 20%
- Safety – 40%
- Cost – 20%
- Legal – 10%
- Quality – 10%
It could be quite accurate if we have just two or three categories, but if we have more categories, we can do a more precise calculation. We can ask people, how much more critical to your project or organization is Safety compared to Duration. We might say Safety is 3 times more important. We would then enter this number into the cell of Table associated with Duration and Scope and Safety categories. The corresponding cell associated with both categories will equal 1/3. We can repeat this process of all pairs of categories. In case of 5 categories, it will result in 10 pairs of values. These numbers will be used to calculate priority for each category. This process is called pair-wise comparison. Why is it better than just entering priority as a single value? The reason is it is much easier to elicit relative importance of one category compared to another one. In other words, people will provide much more accurate values if they are asked to compare one category vs another rather than if they are asked just to provide a priority for each category. A similar process was proposed by Thomas L. Saaty in the 1970s for decision making. It is called analytic hierarchy process (AHP) .
Calculation or priorities for risk categories using pair wise comparison
Here is how actual priorities are calculated:
- Calculate the sum of all values for each column. For example, for first column it will be 4.33.
- Normalize the values in each column. For example, the first value in column “Duration and Scope” will be 1 / 4.33 = 0.23
- Calculate the sum of normalized values for each row. Now that we have priorities, we can use it to calculate impacts for both risks in Table 3.3. Impacts of each risk for each category will be multiplied on the priority of this category. For example, we have impact, in our Indiana Jones example we have risk “Encounter with the scary guy”. This risk has two impacts:
– Impact on duration = 10%
– Impact on safety = 1.5%
Now we can multiply these numbers on the of the prioritization weights for each category (16.4% and 25.2% consequently). The results will be:
– Impact on duration = 10% * 0.164 = 1.64%
– Impact on safety = 1.5% * 0.252 = 0.378%
Then we can repeat these calculations for the second risk “Encounter with the snake”. - Sum up the results as shown in in the following table.
- Normalize the results if we want to reset them to a 0 to 100% scale. This step is optional and not required if we just need to rank the risks.
Based on our analysis, the most important risk for Indiana Jones would be “Encounter with the snake”.
In this we discussed the importance of prioritizing risks when you are faced with multiple objectives to ensure that we are focusing on those risks that can have the most impact on our projects. To prioritize risks we can need to assess probabilities and impact types (risk categories) and impacts. Impacts can differ depending upon the risk categories. We can use risk registers or risk matrixes to show the results of the risk assessment and automatically rank risks.
