Risk is the
consequence of things happening that negatively impact the performance of an
organization’s planned activities. Risks arise from events that occur inside
and outside an organization. The consequence of the event can impact the
quality, cost or schedule of an activity, or some combination of these effects.
There is risk in any activity but there are usually more risks associated with
activities that are new to the organization. New activities include the
introduction of new products or services or changes to the processes, people,
materials or machines used to produce existing products or services. Risks to
stable products and services arise from unplanned changes to the internal
environment or changes in the external environment, such as the economy, costs
of materials, labor market, customer preferences or actions by a competitor, a
regulating body or a government agency. An effective manager faces up to risks
and manages risks so that the negative impacts are minimized.
Definition of Risk
There is an operational
definition of risk that aids in managing risk. This definition is:
Risk R is The Probability p of an
Undesirable Event Occurring; Multiplied by The Consequence of the Event
Occurrence measured in $, or R=p x $.
This definition
allows risks to be quantified and ranked in relative importance so that the
manager knows which risks to address first and to evaluate how much investment
is reasonable to eliminate or reduce the consequence of the risk. The
definition measures risk in dollars. Thus impacts to the quality of a product
or service or to the schedule of delivering the product or service are
converted to costs. Impacts to quality are converted to dollar costs via
estimated warranty costs, cost of the anticipated loss of customers or loss of
revenue due to anticipated levels of discounting prices. Schedule delays are
converted to dollar costs by estimating the extra costs of labor during the
delays and/or the loss of revenue due to lost sales caused by the schedule
delays.
The key to good
risk management is to address the highest risk first. There are three reasons
to address the highest risk first. First is that mitigating a high risk can
result in changes to plans, designs, approaches or other major elements in an
activity. The earlier these changes are implemented the lower the cost of the
overall activity because money and people resources are not wasted on work that
has to be redone later. The second reason is that some activities may fail due
to the impossibility of mitigating an inherent risk. The earlier this is
determined the fewer resources are spent on the failed activity thus preserving
resource for other activities. The third reason is that any activity is
continually competing for resources with other activities. An activity that has
mitigated its biggest risks has a better chance of competing for continued
resource allocation than an activity that has gone on for some time and still
has high risks.
Managing Risk
Managing risk is accomplished by
taking actions before risks occur rather than reacting to occurrences of
undesirable events. The steps in effective risk management are:
1. Listing
the most important requirements that the activity must meet to satisfy its
customer(s). These are called Cardinal Requirements
2. Identifying
every risk to an activity that might occur that would have significant consequence
to meeting each of the Cardinal Requirements
3. Estimating
the probability of occurrence of each risk and its consequences in terms of
dollars
4. Ranking
the risks by the magnitude of the product of the probability and dollar
consequence (i.e. by the definition of risk given above)
5. Identifying
proactive actions that can lower the probability of occurrence and/or the cost
of occurrence of the top five or ten risks
6. Selecting
among the identified actions for those that are cost effective
7. Assigning
resources (funds and people) to the selected actions
8. Managing
the selected action until its associated risk is mitigated
9. Identifying
any new risks resulting from mitigation activities
10. Replace
mitigated risks with lower ranking or new risks as each is mitigated
11. Conduct
regular (weekly or biweekly) risk management reviews to:
·
Status risk mitigation actions
·
Brainstorm for new risks
·
Review that mitigated risks stay mitigated
In identifying
risks it is important to involve as many people that are related to the
activity as possible. This means people from senior management, your
organization, other participating organizations and supporting organizations.
Senior managers see risks that workers do not and workers see risks that
managers don’t recognize. It is helpful to use a list of potential sources of
risk in order to guide people’s thinking to be comprehensive. Your list might
look like that shown in figure 7.
Figure 7 An
example template for helping identify possible sources of risk to the
customer’s cardinal requirements.
It also helps
ensure completeness of understanding risks if each risk is classified as a
technical, cost or schedule risk or a combination of these categories.
Risk Summary Grid and Risk Register
Two useful
templates used in risk management are the risk summary grid and the risk
register. The risk summary grid is a listing of the top ranked risks on a grid
of probability vs. impact. The risk summary gird is excellent for showing all
top risks on a single graphic and grouping the risks as low, medium or high.
Typical grids are 3 x 3 or 5 x 5. An example 5 x 5 template is shown in figure
8.
Figure 8 An example of a 5 x 5
risk summary grid
The 5 x 5 risk
summary grid enables risks to be classified as low, medium or high; typically
color coded green, yellow and red respectively, and ranked in order of
importance. Note that the definitions for low and medium are not standard. The
definition used in figure 8 is conservative in limiting low risk to the six
squares in the lower left of the grid. Others, e.g. the Risk Management Guide for DOD Acquisition (An excellent tutorial on
risk management that is available as a free download at
http://www.dau.mil/pubs/gdbks/risk_management.asp) define the entire first
column plus six other lower left squares as low risk.
Relative
importance is the product of probability and impact. Identified risks are
assigned to a square according to the estimates of their probability of
occurrence and impact to the overall activity. In figure 8 there is one medium
risk, shown by the x in the square with a probability 0.3, impact 7 and
therefore having a relative importance of 2.1. The numbers shown for impact are
arbitrary and must be defined appropriate to the activity for which risk is
being managed.
A typical
approach is to construct a four column by six row table with Impact being the
heading of the first column and the numbers 1,3,5,7,9 (or whatever five numbers
or letters you choose) in each succeeding row of the first column. The
remaining three columns are labeled Technical, Schedule and Cost. Each box in
the rows under the Technical, Schedule and Cost headings is defined
appropriately for the activity at risk. For example, costs could be defined as
either percentage of budget or in actual monetary units. Similarly schedule can
be defined as percent slip or actual time slip.
The process
using a 3 x 3 risk summary grid typically assigns risks as 0.1, 0.3 or 0.9 and
impacts as 1, 3 or 9. There are three squares for each of the low, medium and
high risk classifications with relative importance values ranging from 0.1 to
8.1 according to the products of probability and impact. Specific processes or
numerical values are not important. What is important is having a process that
allows workers and managers to assess and rank risks and to communicate these
risks to each other, and in some cases to customers. The simple risk summary
grids are useful tools for accomplishing these objectives and are most useful
in the early stages of the life cycle of an activity and for communicating an
overall picture of risks. The risk summary grid can be used as a tool in risk
management meetings but a better tool is the risk register discussed in the
next lecture.
If you find that the pace of blog posts
isn’t compatible with the pace you would
like to maintain in studying this material you can buy the book “The Manager’s Guide for Effective
Leadership” in hard copy or for
Kindle at:
or hard copy or for nook at:
or hard copy or E-book at:
