# Risk Analysis Techniques - Project Management

The potential for serious risk can bring about a couple of reactions—we avoid the risk altogether, we take steps to minimize the risk, or we make plans to deal with the risk event in case it occurs. The potential that a risk will happen during the course of your project depends on the nature of the risk. If your project involves constructing a highway overpass in North Carolina, the probability of an earthquake is very low, so you wouldn't even bother coming up with a plan to deal with this risk event. However, the probability of a hurricane is very high, so you may want to take this into consideration as a project risk.

Risk analysis takes into consideration the probability that the risk will occur and its impact if it does. The end result of this process is a prioritized list of risks that you can use to determine which risks need response plans.

One of the easiest ways to rank the risks is using the Nominal Group technique that we talked about in the last section. After identifying the risks, ask the group to rank them in their order of importance. This technique will work for very small projects, but I recommend going a step further for all other projects and examining probability and impact.

Risk Probability and Impact

Probability can be assigned using a simple high-medium-low scale that ranks the probability for each risk. For instance, our fictitious annual employee meeting project is scheduled to occur in November. There's a high probability of snow in November, which could prevent employees from getting to the event or getting there on time. So, you would assign this risk event a high probability.

probability

The likelihood that an event will occur.

Examine the remaining risks on the risk list and assign a probability for each. Below Table shows an example of a risk probability chart. The risk number is used to track the risk throughout the project and to tie it to a response plan a little later in this process.

Table Risk probability chart

Risk number has a high probability rank, which means that this risk should have a risk response plan developed to avoid the risk or reduce its impact if it occurs. Risks number 2 and number 4 probably need risk response plans as well.You may want to combine the probability score with an impact score to help you further determine the need for risk response plans for these two. We'll cover impact scores shortly. Risk number 3 doesn't need any further attention, but it should remain on the risk list.

Probability can also be expressed as a value. The classic example is the coin flip. There is a 50 percent probability that you'll get heads and a 50 percent probability that you'll get tails on the flip. The probability that the event will occur plus the probability that the event will not occur always equals 100 percent, or 1.0.

For example, if there is a 60 percent probability of snow on the evening of the event, there is a 40 percent chance it will not snow, and the total of both probabilities equals 1.0. The closer the probability of the event occurring is to 1.0, the higher the risk.

Assigning Risk Impacts

Impact values can be assigned to risk in the same way that the probability scores are assigned. You can use a high-medium-low value to indicate the impact the risk event has on the project if it should occur. For example, the snow risk event has a high probability of occurring, and the impact is also high should this event occur. Any risk event with a combination of high probability and high impact should have a risk response plan developed to deal with the risk should it occur.

You can also develop predefined measurements that will qualify the risk event and tell you what value to place on the impacts of the risk event. For example, you can rate the impact using a high-medium-low scale like the one shown next. Depending on where the risk impact falls on the scale, it's assigned a value from .05 to .80. The ranks and values are as follows:

The snow event is assigned a rank of high, which means the impact's value or weight is .60. You'll want to assign a value to the probability of the risk event and to the impact of the risk event so that an overall risk score can be determined. The overall risk score, which we'll calculate next, will determine what type of risk response should be developed for the risk.

Probability Impact Matrix

Now we'll put this altogether in a probability impact matrix. The idea here is to multiply the probability score by the impact value to come up with an overall risk score. The higher the overall risk score, the higher the risk to the project. Below Table shows an example of a probability impact matrix.

Table Probability impact matrix

The risk management policies your organization has in place (or that you establish) may dictate that all risks with overall risk scores greater than or equal to .30 need risk response plans. This means that both the snow risk event and the banquet hall risk event need risk response plans. The risk response plans are documented in the risk management plan that we'll discuss later in this chapter.

How to Assign the Ratings

Assessing the probability and risk impact and assigning values to each are accomplished using some of the same techniques you used to identify the risks. You can consult subject-matter experts, use interviewing techniques, or use the Delphi or Nominal Group technique to determine probability and impact values. Once you have the values, you can calculate the overall risk score as we did in the previous section. The risk score then tells you what you should do about the risk.

Your organization may have policies already established regarding how to rank risks and what actions need to be taken to plan for the risk events depending on their scores. Some organizations have specialized teams who are devoted to risk analysis and risk management. But if your organization does not have any predetermined policies regarding risk management, you should spend some time developing them yourself by working with a few key team members, subject-matter experts, and stakeholders to determine the criteria for risk responses based on the risk scores.

Risk Tolerance

Risk tolerance is the comfort level you have for particular risk events. For instance, driving to work every morning carries some level of risk. Your car may not function properly, you could have a fender bender at the corner stoplight, or road crews could have set up a detour on your regular route that adds significant drive time to your commute. None of these risks keep you from coming into work, however. The benefits of going to work and generating revenue for the company, gaining satisfaction from a job well done, and earning a pay-check for yourself outweigh the risks of driving to work. That means you're willing to take the risk of driving to work to get the benefits.

risk tolerance

The amount of risk a person or organization is willing to tolerate in exchange for the perceived or actual benefits of partaking in the activity.

Organizations, like individuals, also have risk-tolerance levels. Some are more risk averse (that is, they avoid risk at all costs) than others. Stakeholders also have risk-tolerance levels you should consider when planning for risks. One organization may think nothing of taking on a project that has a high likelihood of failure because of the information they'll gain in the process, while another organization wouldn't even allow the project to make it to the project selection committee's attention.

Be certain you're aware of the risk-tolerance levels of your organization and key stakeholders when you're the one responsible for developing the risk management policies.