At a recent Risk Management Workshop, a discussion began on the subjective nature of risk analysis and in particular the ranking of risk. We all know that there are oodles of risk simulation packages that exist and that attempt to minimise the subjectivism of risk ranking, however, they are used in the minority. Qualitative risk analysis evaluates and documents the probability and the impact of potential project risks against a pre-defined scale. The scale can be defined from low to high, from 1 to 5, or from 0% to 100% (or 0 to 1) for probability. Risks can be additionally categorised according to their source or effect, such as regulatory risks or risks leading to delays.
This type of risk analysis is subjective, as it is carried out by individuals participating in a project based on their personal perceptions of the risk likelihood and consequences. The purpose of such analysis is to increase the awareness of the most likely and severe risks, identify weak spots of a project and create risk responses to reduce the effect that these risks will have on a project. So the question from this blog post, is there better brainstorming methods for subjective risk analysis that can bring more discussion and increase the value of the analysis
We believe that the following steps are a good way of brainstorming and evaluating risk in a qualitative format:
- Step 1: Evaluate the impact of each risk: – If the identified risk were to occur, what impact would it ha
ve on the team’s ability to complete the project successfully? Use a scale, for example 1 to 10, to evaluate the impact of each risk. If using this scale, take 1 to 3 to be low impact items, 4 to 7 as medium impact and 8 to 10 as high impact. The impact number can be written on the lower left-hand corner of the post-it note denoting the risk event.
- Step 2: Evaluate the probability of each risk occurring: – For each risk, evaluate the probability that the risk will occur. The 1 to 10 scale can be used or 0 to 1 (standard probability measures). In this case 1 to 3 (0.1 to 0.3) would mean a low probability of occurrence, 4 to 7 (0.4 to 0.7) a medium probability of occurrence and 8 to 10 (0.8 to 1) a high probability of occurrence. In standard probability measures, a probability of 0 indicates no possibility of occurrence and a probability of 1 indicates certainty of occurrence. The probability number can be written on the lower right-hand corner of the post-it note denoting the risk event.
- Step 3: Calculate a risk total for each risk and re-align the post-it notes from highest to lowest risk: – Multiply the impact rating by the probability rating to get a risk total for each risk event. Record the risk rating in the bottom center of the post-it note. Rearrange the post-it notes then so that the highest risk numbers are on the left and the lowest on the right (or the highest on the top and the lowest on the bottom).
- Step 4: Determine a risk level below which risk events may be accepted for now: – Unless, there are a reasonably low number of risk events and it is deemed appropriate to develop risk response plans for each one, a cut-off level should be selected where risk events with a risk rating above this level will have responses developed and risk events below this number will not. The 1 to 100 scale (if risk impact and risk probability were measured from 1 to 10) could be used to determine this level e.g. 40 to 70 denotes medium risk 80 to 100 high risk, or relative measures comparing the risk rating scores within the project could also be used.
It is important to remember that risk assessment is an iterative process and while there may be certain risk events that in this case may not have risk response plans developed for them or indeed may not even be identified as risk events at this stage, circumstances may change later in the project which may mean that the risk rating associated with the risk events increases.
So what do you think? We would be really interested to hear (firstname.lastname@example.org) , if you have any further methods, ways or indeed trick to brainstorm risk analysis.