Risk Measurement
The purpose of Risk Measurements are, for those risks considered sufficiently important, to determine the probability of failure of the possible outcomes and the consequences of failure. Risk metrics can then computed from these factors. The result of this analysis is a collection of elements that are deemed to be at risk.
Risk involves both the probability and consequences of the possible outcomes. Although risk is intuitively familiar to most people, it is a complex and difficult concept to measure. Risk is associated with uncertainty, which is characterised by a distribution of outcomes with various likelihood of occurrence and severity. In its most general form, risk measurement should capture the spectrum of outcomes relative to the desired program technical performance, cost, and schedule requirements. Risk generally needs to be assessed subjectively because adequate statistical data are rarely available.
Risk Analysis
Risk analysis explores the options, opportunities, and alternatives associated with the risk. It addresses the questions of how many legitimate ways the risk could be dealt with and the best way to do so. It examines sensitivity, and risk interrelationships by analysing impacts and sensitivity of related risks and performance variation. It further analyses the impact of potential and accomplished, external and internal changes.
Risk analysis activities that help define the scope and sensitivity of the risk item include finding answers to the following questions:
-
If something changes, will risk change faster, slower, or at the same pace?
-
If a given risk item occurs, what collateral effects happen?
-
How does it affect other risks?
-
How does it affect the overall situation? does the risk require:
-
Development of a watch list (prioritised list of risk items that demand constant attention by management) and a set of metrics to determine if risks are steady, increasing, or decreasing.Development of a feedback system to track metrics and other risk management data.
-
Development of quantified risk assessment.
Quantified risk measurement is a formal quantification of probabilities of occurrence and consequences using a top-down structured process following the work breakdown structure. For each element, risks are assessed through analysis, simulation and test to determine statistical probability and specific conditions caused by the occurrence of the consequence.
Expert Interviews
The interviewing of experts is an important technique for both risk identification and risk measurement. Efficient acquisition of expert judgments is extremely important to the overall accuracy of the risk management effort. The methodology chosen to elicit these judgments must be well documented as the program manager or risk analyst performing the effort is likely to get several divergent opinions from many "experts" and he/she must be able to defend the position taken. The expert interview technique consists of identifying the appropriate experts, questioning them about the risks in their area of expertise, and quantifying these subjective judgments. These methods can be applied to a single expert or groups of experts and are aimed at obtaining information on all facets of risk.
Expert interviews nearly always result in information that can be used in the formulation of a "watchlist". In fact, watchlists frequently evolve from the input of each "expert" functional manager on a program. Another useful output is the formulation of a range of uncertainty or a probability density function (with respect to cost, schedule, or performance) for use in any of several risk analysis tools. Experience and skill are required to encourage the expert to divulge information in the right format. Typical problems encountered include identification of the wrong expert, obtaining poor quality information, unwillingness of the expert to share information, changing opinions and conflicting judgments. When conducted properly, the expert interviews provide very reliable qualitative information. However, the transformation of that qualitative information into quantitative distributions or other measures depends on the skill of the analyst.
Cautions in Risk Assessments
Reliance solely on numerical values from simulations and analysis should be avoided. Do not lose sight of the actual source and consequences of the risks. Testing does not eliminate risk. It only provides data to assess and analyse risk. Most of all, beware of manipulating relative numbers, such as 'risk index" or "risk scales," even when based on expert opinion, as quantified data. They are important pieces of information, but they are largely subjective and relative; they do not necessarily define risk accurately. Numbers such as these should always be the subject of a sensitivity analysis.
|
