At Your Own Risk
Can all risk be quantified?
David Frick, PhD, PMP: The short answer?
Based on my own experiences—though not the official position of my organization—in the absence of historical, empirical data, any assessment of probability is most likely a guess. You may suspect that a severe weather event will delay your project for three days and know a 30 percent chance of severe weather exists. But until it happens, you can't be certain of the exact length of the delay. I am not suggesting we avoid attempting to evaluate risk. Rather, I encourage project managers to avoid pronouncing that risk assessments are anything other than educated guesses.
Homam Al khateeb, PMI-RMP, PMP: Not all risks can be quantified, but all risks can be analyzed.
Companies worldwide increasingly require detailed analysis and numbers as the basis for decision-making, so we can't simply ignore the risk if we can't generate a numerical analysis. Anything considered a risk should go through the risk-analysis process. This helps generate an under-standing of the event and its triggers, and may enhance the business decision-making process.
How do you handle risks that can't be easily quantified?
Dr. Frick: There exist only two choices for handling any risk: The first is accepting the risk. Everything else you do is some form of mitigation.
If project success is contingent upon a technology breakthrough—the probability of which cannot be precisely determined—success means big rewards and failure means all investments are lost. You can take an educated guess of the probability of success, and either mitigate (e.g., cancel the project, buy insurance) or do nothing and take a gamble that the breakthrough will occur (accept the risk).
We can occasionally make assessments within a rough order of magnitude, or range of error, based on education and experience. Any assessment is better than no assessment, but the challenge is to ensure all project champions have the same understanding of “rough order of magnitude.”
Mr. Al khateeb: Take intangible reputational risks, for example. They are hard to quantify for two reasons.
First, many organizations believe reputational risks are the consequences of internal process failures and do not allocate costs to handle them as separate risks. Second, there is a lack of standards to handle reputational risks.
Handling these risks starts with understanding the value of reputation to the organization, as not all organizations share the same value definition. The organization should then determine scenarios that may impact reputation, develop a general understanding of those scenarios, increase its risk culture and prepare a crisis plan to handle the impact.
What steps are organizations taking to enhance their risk-management approaches in uncertain times?
Source: Risk in Review 2012, PwC. Results based on a survey of more than 1,000 risk professionals worldwide conducted in November 2011.
Without any historical data, how can you quantify risk on a project?
Mr. Al khateeb: Look to others' experiences.
The best method is to turn to subject matter experts, other companies' experience, industrial standards and risk-management standards that provide a framework for managing risks. Organizations also may select to partner with another organization or consultant with past experience.
Dr. Frick: Use analogy, but keep in mind you are creating some degree of inexactness in your assessment.
As a hypothetical example, say the legislatures of Maryland and Virginia in the United States propose to build a tunnel underneath Chesapeake Bay. A project of this type and magnitude has never been accomplished before; the closest recent analogy might be the Central Artery/Tunnel Project (Big Dig) in Boston, Massachusetts, USA. The experiences of the Big Dig might give some insight on scheduling overruns, leaks, design flaws, consequences of poor execution and the use of substandard materials. But you must challenge comparisons when the two projects have multiple dissimilarities.
Can project managers place too much emphasis on quantifying risk?
Mr. Al khateeb: Focusing too much on hard quantification of risk without proper justification wastes money, resources and opportunities.
The project team must determine the risks that require more detailed analysis and numerical results for their impact on project objectives.
Dr. Frick: Project managers should take a step back and have the courage to admit you don't know what you don't know.
We seldom know the exact probability or consequences of events, yet we claim two-decimal-place accuracy based on some esoteric, multi-tier risk register. These pronouncements are a disservice to the project champion. PM