Every PMO plan includes some form of risk management, and a favorite way to communicate risk to your team, sponsors, and other stakeholders is the (ageless) risk register.
So much has been written about the ubiquitous risk register, it's a wonder there is anything more to be said. But here goes:
In simplest terms, the risk register is a matrix of rows and columns showing the elements of expected value:
- Rows identify the risk impact and give it some weight or value, which can be as simple as high, medium, or low. But if you have information -- or at least an informed guess -- about dollar value, then that's another way to weight the risk impact value.
- Columns identify the probability of the impact actually occurring. Again, with little calibrated information, an informed guess of high, medium, or low will get you started.
- The field of column-row intersections is where the expected value is expressed. If you're just applying labels, then an intersection might be "high-medium" row by column. Statistically you can't calculate anything based on uncalibrated labels, but nonetheless the "low-low" are not usually actively managed, and thus the management workload is lessened.
But, there is more to be said (Big words start here)
Consider having more than one matrix, each matrix aligned with the nature of the risk and the quality of the information.
White noise register: One class of risks are the so-called "white noise" risks which are variously called stochastic or aleatory risks; they have three main characteristics:
- They are utterly random in the moment, but not necessarily uniformly or bell shaped in their distributions.
- They have a deterministic -- that is, not particularly random and not necessarily linear -- long-term trend or value. Regression methods can often times discover a "best fit" trend line.
- Other than observe the randomness to get a feel for the long term trend and to sort the range of the "tails", or less frequently occurring values, there's not much you can do about the random effects of "white noise"
Epistemic risks are those with information dependencies. Epistemic risks could have their own risk register which identifies and characterizes the dependencies:
- Epistemic risks are "reducible" with more information, approaching -- in the limit -- something akin to a stochastic irreducible risk.
- An epistemic risk register would identify the information-acquisition tasks necessary to manage the risks.
Situationally sensitive Idiosyncratic risk register: Idiosyncratic risks are those that are a peculiar and unique subset of a more general class. Idiosyncratic risks are unique to a situation, and might behave differently and be managed differently if the situation changed. And so the risk register would identify the situational dependency so that management actions might shift as the situation shifts.
Hypothesis or experiment driven risks are methodologically unique. When you think about it, a really large proportion of the risks attendant to projects fall into this category.
With these types of risks we get into Bayesian methods of estimating and considering conditional risks where the risk is dependent on conditions and evidence which are updated as new observations and measurements are made.
These risks certainly belong on their own register with action plans in accord with the methodology below. The general methodology goes like this:
- Hypothesize an outcome (risk event) and
- Then make a first estimate of the probability of the hypothesized event, with and without conditions.
- Make observations or measurements to confirm the hypothesis
- If unconfirmed, adjust the estimate of conditions, and repeat until conditions are sufficiently defined to confirm the hypothesis
- If no conditions suffice, then the hypothesis is false. Adjust the hypothesis, and repeat all.
Pseudo-chaotic risks: These are the one-off, or nearly so, very aperiodic upsets or events that are not stochastic in the sense of having a predictable observable distribution and calculable trend. Some are known knowns like unplanned absences of key personnel.
Anti-fragile methods: Designing the project to be anti-fragile is one way to immunize the project from the pseudo-chaotic risks. See my posts on anti-fragile for more.
Bottom line: take advantage of the flexibility of a generic risk register to give yourself more specificity in what you are to manage.
Like this blog? You'll like my books also! Buy them at any online book retailer!
