Earlier we discussed the difference between risks and issues. In this post we’re going to talk about four aspects of risk you want to make sure and consider when dealing with risks. We find these often missed in discussions about risk. All of these help you determine the materiality of the risk and will help you prioritize the effort you put into responding to and managing the risk (more about managing risks in a later post). The aspects to think about and capture are:
- Impact: How big is the potential impact on the project? We’ve seen this measured in a vague terms as “High, Medium, or Low” or as precise as a dollar amount or specific time the project will be delayed. In our minds the more precise the estimate the better. This is not necessarily because the more precise measure is more accurate but because the thought process required to come up with a precise estimate will help better define the risk.
- Likelihood: What chance is there that this risk will turn into an issue for the project? Are the “odds” high? As with Impact, the more precise measurement the better, to a degree. While high, medium, or low may be a bit light, 27.56% is an estimate that gives an illusion of precision. Likelihood is predicting the future and false precision will give the impression you have a better handle on risk than you ever could. In general we find risk expressed as a fraction with 4 or 5 in the denominator to be sufficient. So for example theres a 1 in 4 (1/4) chance this risk will occur or a 4 in 5 chance. This also provides sufficient detail should you choose to build a mathematical model for risk prioritization (more on mathematical models of risk in another post).
- Immediacy: How soon will the risk occur? Projects are often about prioritizing what’s important today. Having a handle on when you think a risk will occur will help you prioritize when to start worrying about them. This is the most difficult of the aspects to estimate and is the least precise. Generally we think in terms of immediate (defined as within the next 3 months), mid-term (defined as between 3 and 6 months), and long term (greater than 6 months).
- Triggering/Preceding Events: What visible events will precede the risk becoming an issue or indicate the risk is becoming an issue? Be concrete, for example, if we see Milestone X is missed or have an indication it will slip it will indicate that the risk of late product delivery has turned into an issue. Often risks will have several triggering or preceding events. The biggest issue our clients sometimes have here is being too vague about defining the events.
There are, of course, other aspects of risk you want to capture when performing risk analysis and management on a project (for example: risk management strategy and tactics). We’ll be more specific in a later post, but the aspects above are the most often missed on projects and some of the most beneficial in dealing with risks. Remember overall it’s less the list of risks you come up with in the end but the process of periodically identifying and analyzing risks that is of most value to the project.

