Introduction
There are three questions that the risk management process should attempt to answer for the project manager and his or her team—What are the risks and opportunities for this project? What are the right risks and opportunities to manage? What will we do to proactively manage those risks and opportunities? In order to answer the first two questions, the project team has to do a good job of preparing a list of realistic events, both positive and negative that could affect the project. This effort effectively develops an answer to the first question of what are the risks for the project. This paper focuses on dealing with the issues of managing the right risks for the right reasons. Therefore it focuses on analyzing the risks for possible impacts on the projects and developing a scoring mechanism that allows for the subsequent prioritizing of risks on the project. This paper will not address the issue of developing appropriate risk responses for the prioritized risks.
Creating the Risk List
In an effort to add clarity, simplicity, and usefulness to the risk management process, it is recommended to begin with a structured format that captures the risk list and any other relevant information that can be used throughout the project. As an example of this, Exhibit 1 provides a simple framework for capturing the list of risks and preparing them for the analysis and prioritization effort to follow. The key elements of the risk worksheet are the risk identification number (RIN), the work breakdown structure number (WBS), and the event description.
This risk log should be developed and used during the risk identification stage. This form will help organize the risks into a manageable structure, which will also lend clarity to the analysis and prioritization of the risks events themselves. What's important to remember is that this is just a list, it is not prioritized, it is not phased based, it is not sequenced, it is just the result of brainstorming, nominal group discussions or another method of generating a list of risks. The main purpose is to provide some order that will help with the subsequent steps of risk management.
Building the Integrated Matrix
The next step in the risk process has been broken down into two efforts, analyzing the probability of a particular risk event and the impact of the event on the project. Analyzing probability usually involves using a quantitative assessment resulting in a finite number, a qualitative assessment resulting in an ordinal ranking, or a hybrid of both. Determining impact has usually focused on the big two factors, budget and schedule. All of you experienced project managers know that there are a number of other areas of impact that should be considered in order to get a better picture of a risk event. Additional areas that consider inclusion are quality, customers, resources, related projects, market share, procurement, vendors, and others. The matrix is developed using the RIN and the WBS along with various areas of impact that are considered important to the project. To construct the matrix, it is recommended to use a table format in one of the commonly used word processing packages. Using the table capability allows the team to take advantage of the automated features such as adding risks later in the project, sorting the risks based on scores, integrating the calculation function to automatically determine the score and so on. Exhibit 2 provides and example of a table for an imaginary project.
Exhibit 1. Risk Management Log
Exhibit 2. The Risk Analysis and Prioritization Matrix
Exhibit 3. Integrated Analysis Matrix
Exhibit 4. Determining the Value of Risks
The second component of this matrix is the development of the scoring mechanism. There are two that need to be used to make this tool effective. The first is to determine whether or not the scores for assigning impact will be purely quantitative or qualitative. From experience, it appears easier to use a qualitative approach that allows for team members a range of scores rather than relying on a hard number. There may be impact factors that don't lend themselves to the use of hard numbers. The most commonly used qualitative scoring approaches use either a 3-point or 5-point scale. The choice really comes down to the level of precision the team wants when assigning value to the impact area of the project. There is some danger as well here to introducing some confusion on the meaning of the score. For that reason, it is important to define what the scores mean and how you want them to come out. If you want to sort the risks by the highest scores, then an approach might be the following, 3 means a severe impact, a 2 is a moderate impact, and a 1 is a low impact. Then when analyzing the schedule impact, a team might look at the event and determine that it is a low impact and therefore it receives a score of 1 for that impact area.
The analysis of probability also poses an interesting choice or dilemma for the project team. While there is the opportunity to use hard numbers to quantify probability, few project team members really have the confidence in assigning a single value to the probability of risk. So, to accommodate that, the team can use a qualitative approach that allows the assignment of ranges to a single value. For example, using a simple ordinal ranking system of 1, 2, 3, the team can translate these to Low, Medium, or High probability. The key to making this useful is to identify the range that each category represents. A score of 1, low probability could represent probabilities from 1% to 40%, a score of 2 could represent a range of probabilities from 41% to 70%, and 3, high probability, could represent 71% to 99%. Remember that a probability of zero means it is not an event and a probability of 100% means the event is a fact, not a risk. Once the team makes these decisions, the matrix can be developed and implemented. Exhibit 3 shows an example of a completed matrix, along with the scoring guidelines.
Using the Integrated Matrix
Once the elements of the analysis matrix are identified and placed in the matrix, the next step is to fill it in with the relevant risks for your project. The team will be considering every risk identified at this point so the list may be long. The matrix offers a more complete analysis of risks by allowing the inclusion of multiple factors that could alter the overall value of a risk event. The project team uses the matrix to place a value for each factor and a value of the probability for each risk. To support the analysis of each risk, it is important to have the WBS, the budget, the schedule, and the resource assignments available for reference during the discussions.
Exhibit 5. Completed Risk Analysis Matrix
The first step in the analysis is to ensure that there is an understanding of the scoring process and the meaning of the two scoring scales. The project manager should take the lead in facilitating the discussion and clarification of these scales to make sure that everyone has the same understanding of the scoring system. As part of the scoring process, the range of possible scores needs to be identified as preliminary step to determining the severity of the risk event. Using the example in Exhibit 3, there are five factors identified. The highest possible score for each of the five factors receiving a value of 3 (severe impact) is 15. The highest score for probability is 3. Therefore the highest score for a single risk would be 45 (15 X 3). Conversely the lowest score possible is 5. Each factor is rated a 1 and the probability is a 1. As a result, the range of scores will be from 5 the lowest, to 45 the highest. I want to point out that several risks may score 45 and that's okay. Your project will have multiple risks that are at the top of the risk list. Finally, the project team needs to determine what score constitutes a high risk, and what score constitutes a low risk. Those in between will be the moderate risks.
The second step is to take each risk independently and begin evaluating each identified factor for a score. Ideally, the group should reach a consensus on the score. Consensus here means that the group can live with the score and no one has a violent disagreement with the rating. It is during this discussion that the project manager needs to use their facilitation skills the most and to ensure that each person is comfortable with the resulting score. This discussion continues until each of the identified risks has been scored. During this analysis, the team should be referring to the project documents such as the WBS, schedule, and the budget. The WBS number will help the team identify which area of the project that risk is located. The schedule, along with the WBS number, will identify where in the timeline of the project that risk event occurs. The budget will help the team identify the potential cost of mitigating a risk.
Once the matrix is completely scored, the team can then sort the risks by the scoring column. Exhibit 5 shows a completed matrix along with the scores for the risk events.
This will result in the highest values being listed first and lowest values listed last. The immediate benefit of this is that the risks that need the attention of the team are at the top of this list. There are a couple of fine points that need to be highlighted here. First, the scores should be viewed in terms of the ranges identified. Using our previous example, any risk with a score of 30 or more would be considered a high risk. Any risk that is less than 15 is a low risk. If your highest risk has a score of 27, then accordingly, it is not considered a high risk. It is still the first risk on your list and deserves attention as such. Additionally, because the risks are listed by score, the team can quickly see which moderate risks have the potential to become high risks should any of the values in the impact areas be increased. These are the risks that should be monitored during the project to quickly recognize when it changes its value to the project.
During the execution of the project, the risk matrix serves two purposes. The first is to monitor those risks that are highest on the list. The second is to serve as an existing scale against which new risks can quickly be assessed and prioritized. This will speed up the process of managing the right risks throughout the life of the project. The risk matrix can also be included as part of the communication plan so that all of the stakeholders will have the same view of the risks on the project.
Summary
Risks are an everyday reality on all projects. The real challenge is not to become overwhelmed by the number of risks or their magnitude. Effective risk management plans identify the risks for the projects, focus on the most important risks, and develop mitigation plans within the context of the project constraints. The integrated impact analysis matrix allows the team to include a more complete analysis of project risks while at the same time, quickly identifying which risks demand the attention of the project team. As a result, the team can ultimately invest their finite resources in managing the right risks throughout the life of the project.
