Welcome back to our talks on project management and this particular series on risk management. The previous two articles on risk discussed the function of risk management and identification of potential risk events. These articles also talked about risk as being an effort to identify uncertain events or conditions that, if they occur, may have a positive or negative effect on project objectives. This next section will cover risk probabilities and the use of risk matrix's.

RAP1Credit: Cory Stophlet, 2014

In an earlier article we covered Work Package Authorization (WPA). I mentioned best case, worst case, and most probable in estimates of cost and schedule planning; those estimates are also risk probability data in planning for risk response. There are other ways to quantify risk; however, I find this method as being the easiest to apply, manage, and use for project performance reporting purposes.

Measuring Impact and Probabilities

Risk analysis impact assessments start by recording each potential risk item and what deliverable(s) and Work Packages (WPs) affected; usually a reference to the Work Breakdown Structure (WBS), Project Breakdown Structure (PBS) and the WP account number is also appropriate. Next, designating whether it is a threat/adverse event or an event with a potential positive outcome; an "N" for negative and a "P" for positive outcome can be used for this purpose. For every risk item on your list ask and record the answers to these questions: What is the best case scenario if this event happens? What is the worst case scenario if this event happens? If this event comes to fruition, what will the effect(s) be on the associated deliverable(s), WP, or task?

Most probable estimates are the base-line. They represent the projected and "planned" values used to determine the work packages and tasks time/duration, cost/budget, and resourcing. But we all know - things don't always go as planned; this is why awareness of the best and worst case scenarios is important. A PM must have the ability to forecast the potential future of the project as relative to the risk events.

RAP2Credit: Cory Stophlet, 2014

What Are the Chances of Rain

Determining a probability value can be as messy as predicting the weather. The weather says that in three days we predict a high of 76 degrees, partly cloudy with a 50% chance of rain, winds from the NE at 10-15 mph. The PM says that the WP scheduled for that same day has a 10% chance of a positive risk event and a 30% chance of an adverse risk event. These are subjective, yet educated guesses based on past behaviors, environmental considerations, potential obstacles s are usually a matter of subjective efforts to quantify the likelihood of a risk events occurrence. This doesn't mean that it's all guesswork; however, it does begin with an "educated guess," and, that along with projected effects in terms of impact on time/duration, cost, resources and scope/quality, we can quantify the possible effects of any realized risk occurrence.

Where Do the Probability Percentages Come From

The "Most Probable" percentage will always be a value between 50% and 100%. This must be the case since the most probable estimate represents the estimates provided by the people that are responsible for getting that work accomplished/spending funds/requiring resources.

The "Optimistic Probability" or best case for a positive outcome should be somewhere between 0% and 25%. A best case/optimistic probability of 0% represents a condition whereby there is no foreseeable situation that would present an opportunity to benefit the project or product; while a rating of up to 25% signifies a reasonable chance to improve the project in some way, whether it is a reduction in the time/duration, costs, expended resources or even enhancement the quality of the product.

The "Worst Case Probability" should have a value between 10% and 50%. There is no such thing as a 0% chance of something going wrong; at least not in project management. There will always be a slight chance of a hiccup in the scheduling or availability of resources. People do get sick, get re-assigned, or quit their jobs. Sometimes, in long projects or when items are purchased only when needed, equipment, materials, pieces and parts can cost more than the original project planned estimates. If the business, organization, or even within the project team, multiple projects are being run using the same human resources or equipment, multiple projects can find themselves competing for the same resources. Remember the weather report: even environmental factors can create a risk potential that must be accommodated.

These are subjective values used to quantify impact of an events occurrence, particularly in regards to time/duration and cost. For example: If a risk event has been assigned a positive probability impact of 10% on the project's time/duration and a 15% impact on cost, a PM can use these numbers in calculating the potential value benefit of the event; such as, the planned task duration was 10 days; however the realized risk event allowed resources to be added to the task resulting in a 9 day actual completion, with a planned cost of $1,200 and an actual cost expended of $1,020. For a worst case realized event of 10% duration and 50% cost, the risk event's realized impact values become 10 planned days can become 10.1 days in duration and the planned cost of $1,200 becomes an actual cost of $1,800. Any time you use a most probable case value of less than 100%, you are indicating that the planned duration and cost is not a sure thing, they are not absolute and there is a recognized potential for a risk event that may go good or bad (optimistic/worst case or pessimistic if you prefer).

Yes it's true that this is based initially on guesstimates - it is also true that this simple and reliable method is effective in accomplishing the primary function of risk management: identifying the potential impact of the realization of any risk event and quantifying that risk in a reasonable and quick manner.

Hopefully you can see how quantifying risk probabilities in this manner allows you (PM) to better estimate or guesstimate what the future may bring. It further permits you to determine where you will spend the greatest effort towards controlling the potential for adverse effects to the project. This is where risk symptoms and triggers are important: they will be touched on again later in an example of Risk Documenting.

As I mention earlier, there are other techniques for assigning probability values. The Project Management Institute's (PMI), Project Management Body of Knowledge (PMBOK) presents a few other methods that may be useful to a PM. You can find PMI's Risk Breakdown Structure, Impact Scale, Probability and Impact Matrix in chapter 11 of the PMBOK, 5th Edition, 2013. Also, another source is the U.S. Department of Defense Extension to: A Guide to the Project Management Body of Knowledge, First Edition, and version 1.0, June 2003, Chapter 11 on Risk Management.

RAP3Credit: Cory Stophlet, 2014

Tracking/Planning Response Tools

Matrix, Spreadsheet, Worksheet or Risk Form: How you record and manage it is your choice; however, let me offer my experience in this matter. A simple way to record and track potential risk events is by using a matrix or spreadsheet. Another way is to use a risk worksheet for each event with the inclusive contingency responses or plans. They can also be combined, using the spreadsheet to provide a general identification and overview easily communicated and posted in the project office or war-room; while, the annex or form is can be used to detail each risk case. Either way, the minimal information a PM needs to include is listed below.

In a matrix or spreadsheet format the top row will have headings for the columns as: (1) WP/Risk Event ID, (2) Schedule Impact, (3) Cost Impact, (4) Resource Impact - although you may want to break resources down further into personnel, materials, contracts, outsourcing, etc., - and finally, (5) Scope/Quality Impact. In the first column in the rows below the column heading WP/Event ID, you will list these items shown below.

 Row 1 - Deliverable/WP at Risk:

 Row 2 - Potential Risk Event(s):

 Row 3 - Most Probable/Planned Value:

 Row 4 - Project Schedule Control/Decision Points:

 Row 5 - Best Case Event/Probability:

 Row 6 - Worst Case Event/Probability:

 Row 7 - Symptoms and Triggers:

 Row 8 - Risk Contingency(s):

 Row 9 - Change Control Integration:

In this way you can record in the appropriate box along the rows the relevant information as it effects or has the potential to affect the project and product performance issues.

RAP4Credit: Cory Stophlet, 2014

In worksheet format, the same information as used in the matrix/spreadsheet is applied; however, is a slightly different way as shown below.

1. Deliverable/WP at Risk (with WBS/PBS/WPA ID Account Number):

2. Potential Risk Event(s):

3. Most Probable/Planned Value: This is your original planning information; the baseline data.

3.a. Schedule/Duration

3.b. Cost

3.c. Resources Planned:

3.c.1. Human Resources/Personnel/Workers

3.c.2. Equipment, Materials, Supplies

3.c.3. Contracted Work/Outsourced

3.d. Scope/Quality

4. Project Schedule Control/Decision Points: Identify the nearest checkpoint or decision point prior to the affected WP or task that will allow you (the PM) to assess the project's health and whether or not the symptoms are present to indicate the potential of a risk to the schedule/duration, costs associated to the work or product, availability of required resources (human resources/personnel/workers, equipment, materials, supplies, contracted and outsourced work), as well as threats and opportunities to the project and product scope or quality.

5. Best Case Event/Probability: If the event for this worksheet occurs or symptoms present themselves an improvement on the project performance, list these as they relate to their function.

5.a. Schedule/Duration

5.b. Cost

5.c. Resources:

5.c.1. Human Resources/Personnel/Workers

5.c.2. Equipment, Materials, Supplies

5.c.3. Contracted Work/Outsourced

5.d. Scope/Quality

6. Worst Case Event/Probability: If the event for this worksheet occurs or symptoms present themselves an adverse result on the project/product performance, list these as they relate to their function.

6.a. Schedule/Duration

6.b. Cost

6.c. Resources:

6.c.1. Human Resources/Personnel/Workers

6.c.2. Equipment, Materials, Supplies

6.c.3. Contracted Work/Outsourced

6.d. Scope/Quality

7. Symptoms and Triggers: Identify those things you think may be considered symptoms or triggers. An example of a symptom of risk to a work package might be: Contracted bids not submitted on time; contracted bids not sufficient to meet the project needs; contracting office is short staffed; a worker quits or is fired; unavailable planned equipment or materials; excessive rework; shortages of materials supplies, etc.; these are just a few potential items. Break them down, if possible, into the respective categories:

7.a. Schedule/Duration

7.b. Cost

7.c. Resources:

7.c.1. Human Resources/Personnel/Workers

7.c.2. Equipment, Materials, Supplies

7.c.3. Contracted Work/Outsourced

7.d. Scope/Quality

8. Risk Contingency(s): I'll discuss this area in the next article on Risk Response and Contingency Planning.

8.a. Schedule/Duration

8.b. Cost

8.c. Resources:

8.c.1. Human Resources/Personnel/Workers

8.c.2. Equipment, Materials, Supplies

8.c.3. Contracted Work/Outsourced

8.d. Scope/Quality

9. Change Control Integration: See the articles on Risk Response and Contingency Planning and Change Control Management.

RAP5Credit: Cory Stophlet, 2014

Prioritize risk effort based on the tasks that fall on the critical path or that are the greatest threat to the projects overall schedule duration and project costs. Look at all the risk items: For each, ask yourself, which of these has the greatest potential to throw the project performance over budget and over schedule or push the project/product out-of-scope? Those risk items are the highest priority events and require the greatest effort in controlling. That being said, if you are familiar with the concept of the project's critical path (CP), as events occur and alter the schedule, costs, scope, etc., the CP may change and a new set of priorities established to account for the effects of realized risk occurrences.

Final Word

The higher the percentage number (10%, 20%, 30% etc.) you, the PM, assigns to a risk item, the more effort and detail must be put into the risk mitigation, response and contingency planning (more on this in the next risk management article). Identifying, analyzing and assessing the impact of potential risks is a continual chore that must be included in every project status update, performance meeting, and coordination meeting. Things will go wrong, but how you deal with it will make all the difference to yourself, the team, and the outcome of the project. When an opportunity exists to improve on the cost and schedule performance, look for a way to take advantage of it as long as it is not detrimental to the product scope. The outcome of the project is not just measured in dollars and time; it is also measured in customer satisfaction with the product and service.