Estimating the cost impact of risks

We all know that managing risk is important.  In fact, Graham Downes recently suggested (in a comment on this blog) that the best way to stop eager young project managers from being “blown up” is  to teach them to better manage risk.

But even when they manage risk actively, I see a lot of teams rating the cost of a risk blowing up on them as “TBA” (ie – to  be advised … ie we don’t know).

Some projects even end with a whole pile of risks listed as high impact with a dollar impact of TBA.

If this is the case, then possibly it is better to not worry about having a column in the risk register to cover dollar impact. Instead, focus on making the impact relevant and real to the team.

I do like to rate the dollar impact of my risks and like other people I often don’t have the time to assess the dollar impact of every risk properly. But I do like to rank my risks by dollar impact to have a look at the scariest ones.

So what I do is allocate a cost to the risk on a scale of really bad to really trivial.  I do this as follows:

• Decide on what would represent a huge cost in the context of the project, one that makes it worth canning the whole project.  I often do this by simply doubling the budget of the project.
• Assign this dollar value as “category A”.  So for example if $10m is a really scary figure for the project, then “A” means “any risk whose impact could have an impact of over $10m”.
• Then assign category B, category C and so on to smaller numbers so that you have a scale with wide ranges for each letter.  It might look like this – A = greater than $10m; B = $2m – $10m; C= $500K – $2m; D=$100k – $500K; E= $20K – $100K; F= $5K – $20K and so on.
• Eventually you will get to amounts that are small enough to agree not to worry about them as risks.

The trick is to have broad ranges so that it is easy to guess where a risk should fit. The mathmatically pure among you may notice that a risk could fall into category A and B if it is exactly $2m. I claim this doesn’t matter and that you should in this case assign it to the higher category.

Adding a scale for risks allows the team to assign a (very) rough dollar value without too much analysis, yet allows you to categorise risks as really scary or not so bad.

This, I think, makes it easier to deal with the bulk of the risks.  Of course you can still assess the dollar impact of certain risks in more detail if appropriate.