3 Factors in Risk Management: Probability, Impact, and Velocity

Risk Score

Qualitative and Quantitative Analyses in Project Risk Management both take into account Probability (P) and Impact (I). A Risk Score is the product of the two.
Qualitative Analyses use subjective estimates of probability and impact as a screening process that categorizes risks for management, monitoring, or ignoring. Risks placed in the management category go on to Quantitative Analysis and Risk Response Planning.

What about Urgency?

A third value should be considered: Velocity (V), which is the inverse of the time-to-impact.
Seldom can we deal with all risks at once. The value of considering Velocity lies in prioritizing further effort so you have enough time to respond to urgent risks. We would not consider Velocity when assigning risks to the three categories because we want to deal with the important things, not the urgent things. (Consider Pareto's 80/20 rule.)
If Probability times Impact describes an area, then to be consistent, we would add Velocity as a third dimension. That is,
Priority Score = Priority x Impact x Velocity

Another View of the Priority Score

Priority times Impact has another label, which is Expected Monetary Value (EMV). EMV is often used by itself for guiding decisions. If we express the Priority Score as
Priority Score = EMV x Velocity
then we give EMV a weight equal to the weight of Velocity.
The reason we would not consider the Velocity by itself goes back to the principle about the cost of rework. The later you deal with a problem, the more it costs because you have to repeat and fix work that came before. The previous effort becomes wasted, costs rise, schedule lags, and you have to use extra resources to get back on schedule.
Similarly, the longer you wait to deal with a risk, the more rework you have to do. Therefore, we need to factor both Velocity and EMV into prioritizing work: Velocity to deal with urgent risks, and EMV to control costs.

A New Step: Priority Analysis (when needed)

I recommend inserting a new step into Risk Management when there are risks with high velocity and you have to prioritize which risks to deal with first:

1. Qualitative Analysis with Risk Score = estimated Priority x estimated Impact
2. Priority Analysis with Priority Score = EMV x Velocity = Priority x Impact x Velocity
3. Quantitative Analysis with Risk Score plus other factors such as Velocity and Cost Effectiveness

I bring up Cost Effectiveness because you want to ensure that you don't spend $150 to prevent a risk whose EMV is only $100.

Reference

Hall, Harry, PMP, PMI-RMP. 30 Quick Risk Evaluation Tips. PM South. http://www.pmsouth.com/2015/07/18/30-tips/. Accessed 21 July 2015.

What to Call Risk and Opportunity Management

Many writings lump risk management and opportunity management together under the label, Risk Management.  Risks and opportunities are left-pointing and right-pointing rays on the same line.

Many equate risk with probability, so they drop opportunity from the label. They think of risk as an abbreviation for risk and opportunity. Others worry, then, that opportunity will be forgotten -- as it usually is!

When one speaks of risk [and opportunity], one speaks of the probability that something will happen. That is,

Risk = Probability x Impact, where Impact is a loss

and

Opportunity = Probability x Impact, where Impact is a gain

If risks and opportunities are rays pointing left and right, then opportunities are negative risks. If you deal with them in the same matrix, pay extra attention to your negative signs.

Risk and opportunity management can result in influencing the probability, influencing the impact, or other strategies such as accepting a potential loss or waiting to deal with situations when and if they become an issues.

(Remember that a situation is a risk if the probability lies between zero and one.  A situation is an issue if the probability is one.)

Uncertainty Management

Could we simply call it Uncertainty Management?  Uncertainty would only deal with influencing the probability that something will occur. The face-value of the term fails to imply the other strategies for dealing with risks or opportunities. The name of this knowledge area should reflect the highest-level concepts, not a component concept.

Opportunities and Threats

Another pairing of terms comes from SWOT analysis - Strengths, Weaknesses, Opportunities, and Threats. SWOT analysis is one technique for identifying risks and opportunities.

Opportunities and threats, as a pair, emphasizes the influences or situations that affect or can be affected by a person or project. (In fact, threat implies that the risk event comes from outside, whereas risks can be either internal or external.)  SWOT analysis emphasizes identification of risks. It makes up only a fraction of the whole set of risk and opportunity management processes.

A Common Risk:  Failing to Deal with Opportunities

Many people forget to manage opportunities with the same vigor that they apply to managing risks.  Exploiting opportunities can mitigate the potential impact of risks. The reasoning goes, Risk A may set us back a week, but Opportunity B may save us a week.

PMs have other reasons to exploit opportunities.   Exploited opportunities cut costs, relieve schedule pressure, and improve quality. In short, they maximize profit.

Failure to exploit opportunities wastes resources, causes product lines to stagnate, erodes market share, and results in lost jobs (perhaps your job!) when the company withers.

The failure to exploit opportunities is itself a fundamental risk.

Therefore, referring to the practice as Risk and Opportunity Management calls attention to the oft-forgotten second half of the discipline. 

Remember that semantics is about communicating, not about winning arguments.  If somebody refers to risk management, you know what they mean.  Adjust.

Copyright 2011, 2013, Richard Wheeler -- Permission granted for non-profit or personal use with a link to this post.

IT Metrics and Productivity Institute (ITMPI) Premium membership gives members free access to 400 PDU-accredited webinar recordings and waives the PDU processing fees. The library is growing at about 100 webinars per year. Check it out: http://mbsy.co/dPHm?s=e