Risks (negative and Opportunities as positive) are occurrences of an event that would modify the project’s outcome.
Only when the hypothetical course has been set, it is reasonable to evaluate the possible events that will have an impact on the output.
Which are the risks’ sources?
Each “Option” has different risks. Deeper the digging into the details, more accurate will be the output. At a Business Case level, everything can only be evaluated at a high level. This requires that attention shall be paid to the possible effects generated by applying the chosen “Option”.
All risks are calculated with the following formula:
Risk = importance x likelihood.
- The importance’s value is supplied by business vision and confirmed by cost/benefit’s analysis. It is expressed in money (costs and windfalls).
- The correct amount should be worked out using the method chosen for the “Investment Appraisal” (following section) Capital budgeting.
- The likelihood is expressed in percentage (100 represents certainty). The input will be supplied by analyses of similar situations. Working in a familiar environment, where the events had formed a history is a huge bonus for the reliability of the “Risk Analysis” (to be considered as a branch of the “Risk Management”).
Finding the correct values
The quality of every analysis depends upon three factors:
- The reliability of the used formula(s) for retrieving and confirming the incoming data– its acceptance in academia and/or industry.
- The number (quantity) of data and the correctness of their sources.
- The intelligibility (and subsequent acceptance) of each risk’s label.
For the Business Case, these three rules can be easily respected.
- In the logic of using “fractals” for producing the logic that sustains all projects’ documentations, these formulas will be used throughout the whole project. Those features that were considered “important” will receive more attention (i.e. resources). The figures forming the vectors (e.g. significance, costs, stakeholders’ quantity and importance) will be used as input for the formula for building the “Impact Matrix”.
- The data to be used are coming straightforward from the document itself. This operational condition offers the opportunity of maintaining sound connections between the data used for taking decisions and the criteria adopted for applying them. Giving certainties creates a solid ground for mutual respect and comprehension.
- The list of projects’ risks offers a broad view of the potential sources. However, managing a diagram composed of five categories for a total of forty-five items it is not an easy task. Furthermore, some categories are fitted for Sponsor (Snr Managers); others are prone to be considered as blames, more than just hypothesis. This does not reduce the importance of each item; the remark is focused on considerate way to propose the risks’ label.
How to present the risks’ impacts
The ubiquitous matrix (where impacts meet likelihood on a Cartesian Plan) offers a good entry point (good site)
However, the power of this tool is a bit overstated. The essential questions about Risk Management are to be focused on resources (people’s commitment and money available)
- Who will be responsible for what
- Starting from the categorization of the risks, it is obvious that some elements shall be addressed by Senior Manager(s) in conjunction with stakeholders.
- How much can be spent
- Other as much as important the allocation of budget for a global (administrative) support of the Project Manager, otherwise the outsourcing to external professionals.
- Setting the reserves
- The money to be put aside, are destined to finance all operations that would be activated if the event occurrence has overcome the threshold value.
- Cultivating controls
- The system relies on the ability of each person responsible for spotting the increase of danger and understand (at managerial level) the importance and reliability of this signal. People remain the powerhouse of the project.
- Fixing the ceiling
- Quite often the amount resulting from the matrix (the financial reserves) is astonishing high. It looks like the project is too riskier. The amount to be left as project’s reserve will work as cursor. Only the work-package(s) on production shall be covered . It would be better to close the project, saving what has been done to start with another “Option”, than do not start at all.
Conclusion
The Business Case is produced within a small circle of people: Senior Management, major stakeholders, architect/SME and the PM in charge. Everyone is called to take decisions that will form the guidelines. In situation like these, the quest for accuracy could hamper the process. Otherwise, documenting each proposal offers a solid ground for building the framework.
More readings
http://www.projectsatwork.com/article.cfm?ID=250401
Image courtesy of: http://ahmandishere.blogspot.com/2006/12/squirrel-intentionality.html




Eugenio,
The formula Risk = Importance x Liklihood is not mathematically valid
The likelihood is a probabilistic value with a mean, mode, median and a probability distribution function (Triangle is a popular risk assessment one).
The Importance is a Cardinal Value with an uncalibrated value. In the absence of the financial, operational, or other “impact” assessment.
These two variables can not have the multiplication operator between them. This is a popular error found in almost every risk management book except those used by defense, NASA, Nuclear Power and insurance industries. By this I mean the software development industry is the only one using this incorect formula, including PMI.
One good starting point is http://www.sei.cmu.edu/risk/dod-risk.pdf. Here a 5×5 matrix is developed where the definitions of the various riks probabilities and impacts are built for each class of risk.