Calculating Risk Scores

Risk Scores

Risk score is a calculated number (score) that reflects the severity of a risk due to some factors. Typically, project risk scores are calculated by multiplying probability and impact though other factors, such as weighting may be also be part of calculation. For qualitative risk assessment, risk scores are normally calculated using factors based on ranges  in probability and impact. In quantitative risk assessments, risk probability and impact inputs can be discrete values or statistical distributions.

Risk Probability Ranges

Risk probability characterizes the chance that a certain event may occur during the course of a project. For example probability could be categorized into 5 levels: Very Low, Low, Medium, High, or Very High. The problem with these categories is that they can be very ambiguous and have different meanings depending upon who you asks. Some methods attempt to improve this by using categories such as  Rare, Unlikely, Possible, Probable and Certain; however, this still leaves us with the question of defining what these terms actually mean.

To clarify this we can add additional detail to each probability category so that there is a common understanding i.e. What does Rare or Very Low Probability mean? Therefore, it is recommended that each category has a probability definition. An example could be as shown below:

In this way, when assessing probability, all team members have a common understanding of the meaning of each category

Risk Impact Ranges

Like probability matrixes, assessing impacts can be just as problematic, if there is not a common definition of what each impact level means. In addition, risk impacts can affect more than one project objective such as cost, schedule, safety, quality or others. These are referred to as risk categories and can be assessed independently.

For each risk category, we want to provide a common definition to aid in the assessment

Calculating Risk Scores

In order to calculate risk score, we need assign a value to each of the  probability and impact levels (e.g. 1, 2, 3, 4, 5). Our matrix now includes these values for each label

If we had  risk that was assessed to have a high probability and medium impact it would land on the matrix as shown below.

The risk score = High (4) x Medium (3)= 12

Risk scores can then be further defined into categories such as Catastrophic, Serious, Moderate, and Low based on the calculated score

• Catastrophic: ≥ 15
• Serious: ≥ 10
• Medium: ≥ 5
• Low: ≤ 4

Risk Scores with Multiple Impacts

As mentioned previous risks can have multiple impacts called risk categories. How do can calculate risk scores if there are multiple categories? Two common methods are:

Probability * highest impact

Probability x highest impact: this is a very common qualitative risk scoring calculation in which the highest impact score for all of the impact is used to calculate the risk score. For example, if you had a risk that had been assessed:

1. Probability: Very High (5)
2. Schedule: High (4)
3. Cost: Medium (3)
4. Safety: Low (2)

Risk score = Probability (5) x Highest Impact (4) = 20

Probability * Average Impact

This takes the probability and multiples it by the average score of all risk impacts. Using the example above, the risk score would be calculated:

Risk Score = Probability (5) x 4+3+2/= 5 x 3 = 15

So we can see that the risk scoring calculation can have a fairly substantial impact on how the risk is assessed.

Calculation Risk Scores Based on Results of Quantitative Analysis

Calculating risk scores from quantitative risk analysis, such as schedule risk analysis, integrated cost and schedule risk analysis and others is both more complex and without any standard process. The reason for the complexity is that the inputs for the  analysis are not ranges or labels of ranges, but  can be expressed in numerous ways:

• discrete percentages (e.g. 25% probability that a risk will occur)
• relative values: a 25% delay in a task
• fixed values: a 15 day acceleration of a task
• statistical distributions: cost impacts with a Beta statistical distribution with Low $25,000, Most Likely $35,000, and High of $50,000.
• Impacts could be actions that restart, end, or cancel activities.

In addition, risk scores have to account for the schedule precedent network, task cruciality, and critical path.  An example would be where you  r a risk with a high probability and impact that is assigned to a task that is not critical or near critical path. Though the risk may have a large impact on the  specific task(s) and push it successors, it may have little or no effect on the overall project finish time. If we looked at a sensitivity analysis we would see that it has a very low correlation coefficient between the duration of the activity with the large risk and the project finish time. Because of this, we recommend that risk scores use Spearman Rank Correlation as part of the risk score calculation.

The process for calculating the quantitative risk score:

1. During simulation record the impact of risk on project parameters during each iteration. An example, Risk A occurs and causes 3 day delay and $20,000 cost increase.
2. Calculate the Spearman Rank Order coefficient between schedule and cost impacts for each risk and Project Cost, Finish Time, Duration etc.
3. Normalize the correlation coefficient.
4. Calculate probability based on the number of times the risk occurred during the simulation. This can be complicated as it is possible for risks to have multiple probabilities per assignment as well as different probabilities for different activities.
5. Risk score for each risk category can now be calculated: calculated probability multiplied on normalized correlation coefficient.
6. For risks that impact multiple categories, risk score for each category multiplied by a weight that represents the relative importance of the category.  For example, if you had cost and schedule categories and schedule is 2x as important as cost, you would get an importance coefficients of .667 for schedule and .333 for Cost.

Depending upon how you are analyzing your projects, the process you use can have a large impact on how your risks are assessed. Make sure you are aware of how the risks will be assessed and that you have common guidelines that explain how project probability and impact are assessed and the methodology used to calculate the risk scores.