In most of all readings that I do, risk is calculated multiplying probability x impact. But how can we determine a number to probability and impact without using simple imagination ("i guess is 5!")?
Any experience on how to handle this in practice? Saving Changes...
Sort By:
Kevin GebertDirector of Marketing| IBMS GlobalCo, United States
In my experience the risk manager (or PM) will hold a risk management meeting on a regular basis with the technical leads (subsystem engineers, system engineers, mission assurance manager, etc). In this meeting the probability and impact of new risks can be discussed and usually a consensus can be reached. As the risk manager I would not attempt to do this in a vacuum without the input of the subject matter experts. Saving Changes...
Jack BlackChief Project Officer| PMConnectionJackson, Oh, United States
I’d agree with Kevin. The probability associated to any risk is indeed just an estimate, a guess. However, the more experience is involved in initial estimating, the lesser the error will be. That is why involvement of the project team is so important. Additionally, as probability is assigned to almost all risks (within the risk register) by the same group of people (the team), it can be assumed that mistakes in estimating would be systematic and therefore not limited to just one risk, but quite probably reflected across the register. Finally, the probability itself is not that much relevant. It is the multiplication of probability and impact that allows us to rank the risks and identify more important ones. Last but not least, the team should regularly review the risk management plan and reassess any risk (including its probability) whenever necessary or appropriate.
The same applies to estimating impact, of course.
Saving Changes...
Elizabeth HarrinDirector| RebelsGuideToPM.comLondon, England, United Kingdom
We have tolerances/definitions like:
Unlikely to occur in next 6 months
Like to occur in next 6 months
Highly likely to occur in next 6 months
or
Impact of less than 5 days/£10k
Impact of between 6 and 15 days/£11k to 30k
Impact of over 16 days/£31k
etc. Saving Changes...
Michael AdamsSolutions Architect| LANLLos Alamos, Nm, United States
I also like what Kevin says. It is vital to include and take a lead from your project team on this. Don't forget that risk analysis should revisited frequently as the project proceeds. Something that seemed like a remote risk last month, might be a high risk this month. Also as the project proceeds, the impact of various risks could change.
I recently participated in an advanced risk analysis training, and the other bit of advice I could give you is to name your risks specifically, don't go for generic risks, but nail down specific risks, and don't be afraid to drill down and explore iterations of what may seem like the same risk.
Example: I started a yard care business, and I plan to hire High School Students to do the work.
Risks: (typical):
unreliable employees
lack of interest among potential employees
Risks: (revisited with detail):
*employees can't get to work (unreliable employees)
-lack of car
-no money for bus
-bus doesn't operate on Saturday or Sunday
*employees don't do good work (unreliable employees)
-worried about homework
-upset about lack of time to spend with friends
-don't know how to do thorough yard work
Be sure to examine your risks in detail, it will give you an idea of which ones are more or less likely, and how to mitigate them. Saving Changes...
