Probability and Impact

Jovana Riddle

Salvatore Adamo was the head of Vintel Corp’s Risk Management Department.
His responsibility was to manage risks for many of the company’s products.
However, one particular product had major risk implications and mattered to
Salvatore the most. It was Vintel’s flagship product and had a very important risk
event at stake. The risk at stake had a very low probability of occurring but had a
huge potential impact on the company and its future. This was the first time in the
company’s history that a product with such a low probability risk event could lead
to such enormous potential impact. This case presents how Salvatore adjusted
Vintel’s risk analysis procedure to address this type of risk.

RISK ANALYSIS STEPS

In order to effectively manage risk for Vintel’s product, Salvatore typically followed
the standard procedure. He started off with the identification of all potential risks.
He then identified the probability and impact of each risk, using a 1-to-5–point scale.
For each risk, the risk score was then calculated based on a set formula (Probability
+ 2 ⫻ Impact). He then used a Risk Rating table with predetermined thresholds to
categorize risks into high (red), medium (yellow), and low (green) severity risks.
Typically, the threshold for high risk is 12 and above. Medium risks have a score
ranging from 8 to 11. Risks that score below 7 are considered low risks. Usually high
risks will get more management attention and Vintel will perform further investiga-
tion and come up with appropriate response plans. Medium and low risks will get
less management oversight. The use of this procedure would ensure that risks are
analyzed in a systematic manner based on their probability and impact.

ADJUSTING THE THRESHOLDS

Salvatore knew from past experience that in general a very low probability risk event
does not have as high a potential impact or a severe outcome. In such a typical situation,
using the Risk Rating table in Figure 11.1 should work fine. But for this flagship prod-
uct, a lot of very low probability risks have a very high level of impact, and using his
normal Risk Rating table may not be appropriate. “Am I right?” Salvatore thought.

245
246 CASE STUDIES

Figure 11.1 Example of Rating a Risk Impact on Schedule on a Five-Level

Scale

Scale 1 2 3 4 5
Very Low Low Medium High Very High
Risk Impact on Slight schedule Overall project Overall project Overall project Overall project
Schedule delay delay <5% delay 5–14% delay 15–25% delay > 25%

Probability Risk Score ⫽ P ⫹ 2 ∗ I Key:

NC ⫽ 5 7 9 11 13 15 High Severity
HL ⫽ 4 6 8 10 12 14 Medium Severity
L⫽3 5 7 9 11 13 Low Severity
LL ⫽ 2 4 6 8 10 12
VU ⫽ 1 3 5 7 9 11
VL ⫽ 1 L⫽2 M⫽3 H⫽4 VH ⫽ 5
IMPACT

Probability Key Impact Key

VU ⫽ Very Unlikely
LL ⫽ Low Likelihood
L ⫽ Likely
HL ⫽ Highly Likely
NC ⫽ Near Certain
VL ⫽ Very Low Impact
L ⫽ Low Impact
M ⫽ Medium Impact
H ⫽ High Impact
VH ⫽ Very High Impact

“I think I am,” Salvatore talked to himself. He knew that he had to adjust his
risk thresholds, such that those risks are in the category of high risk. Salvatore
had a flashback to his experience with Ford Australia.
Several years ago when Salvatore visited Ford Australia for technical
exchange, he participated in risk analysis training. One of the risk events they
discussed was the SUV tire explosion. Typically, tire explosion is a very low
probability risk event. But when it happens, it can cause the vehicles to rollover,
which can lead to the severe injury or death of the passengers in the SUV. Besides
the safety of the passengers at stake, tire explosion should impact the sales of the
SUV by as much as $5 billion. This was definitely a high risk.
This flashback assured Salvatore that the risk thresholds needed to be
adjusted. If not for this flagship product, a risk event like “tire explosion” would
always end up being a medium-level risk and would never get as much manage-
ment attention as it should. No management attention means no further analysis
and no support. Then, if the risk happens, he could not imagine how huge the
impact would be. “Probably not $5 billion but it would definitely be ugly and no
more future for me at Vintel,” thought Salvatore.
Discussion items
1. Would adjusting the threshold be the right move for Salvatore? If it is, what
should the new threshold be to account for the very low probability and very
high impact risks?
2. Would adjusting the thresholds be the only solution? What else should Salvatore
introduce to Vintel such that risks get proper management attention?