In Part 1 of this Risk Management Series, we had a look at the purpose of Risk Management. I like to think of it as the mixing action that binds all your project ingredients together. Managing risk shouldn’t be a chore, but an essential part of staying on top of your project environment, and it is the best tool you have to bring your projects in on time, on budget and with the quality your client expects.

I now want to look at the first two steps in managing risk, and they both form part of risk analysis. Risk Probability and Risk Impact are together used to classify a risk, and this classification will feed into the treatment options a manager chooses from in deciding how to manage a risk.

Risk Probability
Risk Probability is just a measure of the chance of a risk event actually occurring. Obviously, the higher the chance a risk event will actually occur, the more seriously you are likely to treat it. At least, that’s the idea.

In the context of risk management, I use the following scale to rate my project risks:

This is a scale I find useful for the type of projects I work with; I recommend that you adjust it to suit your own needs. Remember, this is fairly subjective: it’s always wise to research risk probability in previous project data or from experienced heads if you are unsure.

Risk Impact
The second step in classifying a risk is to assign an Impact rating to the risk. Ratings are based on a qualitative judgement of the impact of the risk event, if it occurs, on project schedule, scope and/or budget. I use the following scale, but again, adapt it to fit your own projects and go hunting for the best data you can find on which to base your estimate:

So, in this part, we have seen how to analyse risks in terms of impact and probability. Next time around, we’ll look at risk classification and why all this is important. And yes - do take the time to analyse ALL risks to your project. Don’t leave any excuses for a project to fail.