Risk threshold differ from risk appetite. The former is more quantitative than qualitative.
How is this threshold objectively determined?
And what is the use of this threshold? Does it affect rating/ranking of risk as well as risk response?
Of the view that risk identification and risk rating should be independent of thresholds. Saving Changes...
Sort By:
George FreemanThought Leader | Author | Architect| Florida, United States
Richard,
When it comes to risk tolerance, what is stated by an executive/organization and what actually happens in the trenches can be different, even to the extent of being “polar opposites.” It’s almost like the laws of nature will subjectify any characteristic of risk management that one attempts to objectify (slightly exaggerated).
From my experience, mapping the patterns of behavior across projects when identified risks and unknown-unknowns are encountered, is the best way to have some sense of objectivity on the question of tolerances. The tracking should be done by “category of risks,” as each category is an independent statement.
Reviewing “lessons learned” and interviewing PM’s and stakeholder’s on past projects is one approach for coming up to speed on this question. But that is almost always subjective as well, as the interpretation of how risks were managed, morphs with ones interpretation of how successful the project was. Saving Changes...
Risk threshold can still be qualitative (as per PMI's Risk Standard), but it effectively specifies the risk appetite (higher level) as it pertains to a given objective.
An example could be cost-related. Risks which have a potential negative impact of more than $10,000 or 5% of the project budget should be analyzed and tracked in the risk register.
Risk thresholds and the variance from those will also usually correlate with risk rating. The higher the variance, the greater the risk rating.
So definitely I would suggest risk thresholds would influence both risk identification and risk rating.
Supposing I have scope, schedule and cost baselines plus the organisations Risk Assesment Matrix (RAM).
But I don’t know what the risk appetite nor threshold is. Is it still absolutely impossible to identify the risk of the project and rank it?
However, what to do to respond to the identified and analyzed risk I think is what depends in addition on the risk appetite and threshold.
Example what lowest threshold defines what go on watch list, what extreme thresholds are avoid and so on and so forth.
...
1 reply by Kiron Bondale
Jan 21, 2020 8:17 AM
Kiron Bondale
...
Risk appetite and thresholds are not a "must have" to be able to manage risks, but without that information, you risk either doing too much or too little risk management. Remember that risk is "uncertainty that matters" (to quote Dr. Hillson) and part of making it matter is understanding the appetite and threshold of the organization and key stakeholders.
Kiron
Saving Changes...
Sergio Luis ConteHelping to create solutions for everyone| Worldwide based OrganizationsBuenos Aires, Argentina
Threshold is defined taking into account the impact of lost into each organization. For example, in my case, it is the warning we have for all related to cost and schedule in our program/projects. Saving Changes...
Supposing I have scope, schedule and cost baselines plus the organisations Risk Assesment Matrix (RAM).
But I don’t know what the risk appetite nor threshold is. Is it still absolutely impossible to identify the risk of the project and rank it?
However, what to do to respond to the identified and analyzed risk I think is what depends in addition on the risk appetite and threshold.
Example what lowest threshold defines what go on watch list, what extreme thresholds are avoid and so on and so forth.
Risk appetite and thresholds are not a "must have" to be able to manage risks, but without that information, you risk either doing too much or too little risk management. Remember that risk is "uncertainty that matters" (to quote Dr. Hillson) and part of making it matter is understanding the appetite and threshold of the organization and key stakeholders.
Kiron
...
1 reply by Richard Darko
Jan 21, 2020 11:57 AM
Richard Darko
...
Thanks.
I think this says it all “but without that information, you risk either doing too much or too little risk management.”
Risk appetite and thresholds are not a "must have" to be able to manage risks, but without that information, you risk either doing too much or too little risk management. Remember that risk is "uncertainty that matters" (to quote Dr. Hillson) and part of making it matter is understanding the appetite and threshold of the organization and key stakeholders.
Kiron
Thanks.
I think this says it all “but without that information, you risk either doing too much or too little risk management.” Saving Changes...
This is an interesting topic Richard, thanks for bringing this up. Risk is increasingly huge and complex subject, unsure if worth tackling from line of defence framework or business taxonomy and work backwards to answer this type of question as it defers from one organisation to another. Saving Changes...
"A statesman is an easy man, he tells his lies by rote. A journalist invents his lies and rams them down your throat. So stay at home and drink your beer and let the neighbors vote!"
