When Is A Risk Not A Risk?: The Importance of Risk Descriptions

The importance of risk descriptions
David Hillson
When is a risk not a risk?

Dr David Hillson HonFAPM FIRM FRSA

Director
david@risk-doctor.com
Risk Doctor & Partners

www.risk-doctor.com
2009 David Hillson/Risk Doctor Limited, Slide 1
With acknowledgements to
http://www.apm.org.uk/PrioritisingProjectRisk.asp
Copyright 2009 David Hillson/Risk Doctor Limited
Page 1

David Hillson
Why are risk descriptions important?

A good risk description enables:
Understanding Prioritisation Management
A good risk description must be:

Clear Comprehensible Unambiguous
What is the risk?

Typical examples:
Resources Requirements The economy Competition Overspend/late delivery Safety incident Job (in)security
Are these clear, comprehensible, unambiguous?
Page 2

David Hillson
Key characteristics of risk

Uncertain (ambiguity, variability) Matters (affects objectives) Proto-description: Risk is uncertainty that matters
Risk
Uncertain event or set of circumstances
Effect
Contingent result
What is a risk?
Risk connects uncertainty with objectives
A risk event is an uncertain event or set of circumstances that, should it occur, will have an effect on achievement of one or more of the projects objectives (APM PRAM Guide)
http://www.apm.org.uk/PRAMGuide.asp
Page 3

David Hillson
Two-dimensional risk
Risk has two dimensions : 1. uncertainty 2. effect on objectives
probability impact
Two-dimensional prioritisation
PROBABILITY
VHI HI MED LO VLO VLO LO MED HI VHI
IMPACT
Probability-Impact Matrix
define scales, then rank each risk in both dimensions determine size and relative importance of risks Red = urgent, Yellow = monitor, Green = OK
For both threats & opportunities
Page 4

David Hillson
The mirror double P-I Matrix for both threats & opportunities
VHI
VHI
PROBABILITY
PROBABILITY
HI MED LO VLO VLO LO MED HI VHI VHI HI MED LO VLO
HI MED LO VLO
NEGATIVE IMPACT (Threats)
POSITIVE IMPACT (Opportunities)
Is this enough?
Basic risk description must have two elements:
The uncertainty (event, set of circumstances) Why it matters (effect on objectives)
Any other useful elements to include in risk description to improve understanding?
Page 5

David Hillson
Where does the risk come from?

Cause
Drives probability
Uncertain event or set of set of circumstances circumstances
Certain fact or condition
Risk
Drives impact
Effect
Contingent result
Real examples: cause, risk, effect

The current hardware is not fast enough to support testing. This means that we may be unable to test performance until production hardware is used. A number of usability issues have been identified by the supplier who plans to raise change requests. Extra work may be identified at the detailed design gateway as the full statement of work is not available at project start The team does not have a documented design for the XYZ function. Therefore there is the risk that the architecture may not support the required functionality, resulting in the requirements not being met and/or a higher number of defects. The development team may not perform the tasks in the order laid out in the schedule. This could result in the dates and quality of deliverables being unpredictable. One contractor left in week 36, another joined start week 37. The inevitable disruption is not catered for by contingency. Given the unusually high number of builds to be carried out, test cycles may take longer than planned, which will consume significant additional amounts of time and resource Allocated resource may be reassigned to higher priority projects We are modifying one of our most complicated components. We have very little time for these changes. We rely heavily on ABC being delivered on time
Page 6

David Hillson
Risk description using risk metalanguage

A structured description of a risk which separates cause, risk and effect
As a result of <1. existing condition>, <2. something uncertain> may occur, which would lead to <3. effect on objectives> Key words :
1. is, do, has, has not 2. may, might, possibly 3. would, could [present condition] [uncertain future] [conditional future]
What about variable impact?

Cause
100% Probability Drives probability of occurrence
Certain fact or condition
Risk Risk
Variable impact Drives impact
Uncertain event or set of circumstances
Effect(s) Effect(s) Effect
Contingent result
Page 7

David Hillson
Real examples: cause, risk, effect

Variable exchange rates:
The supplier has provided a fixed price in foreign currency for the delivery of gas turbines. For planning purposes, the project budget has been set at the current exchange rate. However, uncertainty in future exchange rates will drive actual costs that may be either higher or lower than this baseline.
Immature software specification:

The signal processing software specification is immature. It is uncertain as to how well aligned it is to the overall system specification. A detailed review can be expected to produce changes. An increase in software resource requirements can be expected, although these could range from 3 man-months to 5 man-years.
Multiple causes, multiple risks, variable impact

Relevant Facts
Probability drivers
Risk(s)
Impact variability drivers
Effect(s)
Page 8

David Hillson
Real example: cause, risk, effect

Failure to co-locate software team It is planned that the software design team of 40 will be co-located in Reading within 2 months of contract award. This may not be achieved, either because suitable facilities for the team may not be established in time or because key members of the proposed software team may refuse to relocate from their current base in Edinburgh. This would necessitate running the software team with its current geographic split, leading to requirements for additional effort and expenses to support communication, a parallel test environment to be set up and an estimated increase of between 1 and 3 months in the development phase due to inefficient working practices.
Causal map
many(C) : many(R) : many(E)
Cause
Cause Cause Cause Cause Cause
Risk
Risk
Risk
Risk
Effect
Effect
Effect
Effect
Effect(s)
Page 9

David Hillson
Real example: Risk concept map

[Ref. Bartlett 2002]
Banks need to consider staff incentives Euro changeover is a holiday period R1 R15 Retention of required resources may be difficult and costly Planned branch opening times may be impacted Replenishment may be a problem On premise storage R11 Banks could run out of cash in certain areas Robusticity of notes and coins over time has yet to be proven Bank Customer dissatisfaction
R2
Demand will be unusually high
CIT availability
Volume testing cannot fully simulate use over time
Risk of litigation Risk of misdispense if notes not robust
Novelty of the Euro R4 R17 R3 Unprecedented number of simultaneous software instructions to ATMs within 2/3 hour time period on Jan 1 R7
R5 Most of the currency will only be first seen close to E-day
R12 R13 Potential for many forgeries Handlers more prone to making errors R6 Resources need to be committed
Big-bang switchover
Potential for widespread system crashes and ATM downtime
New note blocks need to be "broken" Local variations
First time every ATM will have new cash
Local practice
Has a power down and re-IPL been tested for the whole ATM network? ECB rules R14 Help desk support has to be more localised
Potential for help desk call surge
Support response impacted
Support contract impacted
R16
Different approaches to hardware, software, support, testing, operations and changeover
= cause
R10
= risk = effect
R8
R9
Lack of consistency between banks and between countries makes comparisons difficullt
R17
Best approach?
It depends on:
Level of detail required for risk description Complexity of risk process Types of risk encountered
But also on reason for risk description:

To generate understanding To permit prioritisation To support management
All approaches must produce risk descriptions that are clear, comprehensible & unambiguous
Page 10

David Hillson
More information from David Hillson david@risk-doctor.com www.risk-doctor.com

Page 11

When Is A Risk Not A Risk?: The Importance of Risk Descriptions

Uploaded by

Copyright:

Available Formats

You might also like

When Is A Risk Not A Risk?: The Importance of Risk Descriptions

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

When Is A Risk Not A Risk?: The Importance of Risk Descriptions

Uploaded by

Copyright:

Available Formats

The importance of risk descriptions