Impact vs. Probability

From apppm
(Difference between revisions)
Jump to: navigation, search
(Blanked the page)
 
Line 1: Line 1:
'''Impact''' and '''probability''' are the two main components of [[Risk analysis]]. Looking at '''Impact versus Probability''' is common in order to categorize and prioritize risks as some risks which may have a severe impact on projects objectives but only happen on rare occasions, while other which have a moderate impact might occur frequently.
 
  
All organizations activities involve risk. Risks are events caused by uncertainties, which can have a positive or negative effect on the activities objectives. As all projects are unique, the associated risk varies between projects. Therefore, [[Risk Management]] is an important part of any organizations as proper management increases the success of a project <ref name=" Winch " />. Risk management involves identifying possible risks, analyzing each risk potential in order to respond to and control the most significant threats and opportunities <ref name="Maylor"/>.
 
The risk analysis is a two-stage assessment process. Initially, qualitative methods are used to examine the identified risk to categorizing and determine the main risk events which are relevant for a quantitative assessment. In risk analysis, risk is traditionally defined as a function of probability and impact <ref name=" Curtis " />. The risk probability is likelihood of an event occurring and the consequences, the extent to which the project is affected by the risk event, are the impacts of risk. By combining the probability and impact, the Level of Risk can be determined. There are various aspects of the project that can be impacted by a risk event <ref name=" Curtis " />. These are aspects such as cost, safety, operational, quality, etc. A commonly used and popular method of risk assessment is preparing descriptive scales to rank risk in terms of probability and impact. These are often referred to as Impact/Probability Matrix or Risk maps and can take both qualitative and quantitative values. This method of risk assessment has its limitations and drawback. However, it is a simple and easy to understand method of prioritizing risks and allocating resources <ref name="MITRE"/> .
 
 
 
= Background =
 
Risk management is a four-stage process, the first being identification of risks, second analysis (assessment), then the risk response and finally the risk monitoring <ref name=" Winch " />. In risk analysis, risk can be defined as a function of impact and probability <ref name=" Curtis " />. During the analysis stage, the risk identified during the [[Risk Identification Process]] can be prioritized from the determined probability and impact of the risk event. Other factors, such as the response time frame and the tolerance should be taken into account when analyzing and categorizing the risks <ref name=" PMI " />.
 
 
 
 
{| class="wikitable" style="float:Right; margin-left: 30px"
 
|+ Table 1: Impact Scale Example <ref name=" PMI " />
 
|-
 
! rowspan = "2" style= "width:60px;" | Objective
 
! colspan ="6" |Relative / Numerical Scale
 
|-
 
!style="height:30px; width:110px; text-align:center; background:#F2F2F2; " | Very Low / 0.05
 
!style="height:30px; width:110px; text-align:center; background:#F2F2F2; " |Low / 0.1
 
!style="height:30px; width:110px; text-align:center; background:#F2F2F2; " |Moderate / 0.2
 
!style="height:30px; width:110px; text-align:center; background:#F2F2F2; " |High / 0.4
 
!style="height:30px; width:110px; text-align:center; background:#F2F2F2; " |Very High /0.8
 
|-
 
!style="text-align:left; background:#F2F2F2; "|Cost
 
|style="height:30px; width:110px; text-align:center; background: white;"|Insignificant change in cost
 
|style="height:30px; width:110px; text-align:center; background: white;"|< 10% increase
 
|style="height:30px; width:110px; text-align:center; background: white;"|10 - 20% increase
 
|style="height:30px; width:110px; text-align:center; background: white;"|20 - 40% increase
 
|style="height:30px; width:110px; text-align:center; background: white;"|> 40% increase
 
|-
 
!style="text-align:left; background:#F2F2F2; "|Time
 
|style="height:30px; width:110px; text-align:center; background: white;"|Insignificant change in schedule
 
|style="height:30px; width:110px; text-align:center; background: white;"|< 5% increase
 
|style="height:30px; width:110px; text-align:center; background: white;"|5 - 10% increase
 
|style="height:30px; width:110px; text-align:center; background: white;"|10 - 20% increase
 
|style="height:30px; width:110px; text-align:center; background: white;"|> 20% increase
 
|-
 
!style="text-align:left; background:#F2F2F2; "|Scope
 
|style="height:30px; width:110px; text-align:center; background: white;"|Barely noticeable scope decrease
 
|style="height:30px; width:110px; text-align:center; background: white;"|Minor areas affected
 
|style="height:30px; width:110px; text-align:center; background: white;"|Major areas affected
 
|style="height:30px; width:110px; text-align:center; background: white;"|Unacceptable reduction
 
|style="height:30px; width:110px; text-align:center; background: white;"|Project end item effectively useless
 
|-
 
!style="text-align:left; background:#F2F2F2; "|Quality
 
|style="height:30px; width:110px; text-align:center; background: white;"|Barely noticeable quality degradation
 
|style="height:30px; width:110px; text-align:center; background: white;"|Only demanding applications effected
 
|style="height:30px; width:110px; text-align:center; background: white;"|Quality reduction requires sponsor approval
 
|style="height:30px; width:110px; text-align:center; background: white;"|Unacceptable quality reduction
 
|style="height:30px; width:110px; text-align:center; background: white;"|Project end item effectively useless
 
|}
 
 
= Impact =
 
Impacts are often defined as the consequences, or effect, of a risk event on a project objectives. These impacts can be both beneficial or harmful to an enterprises activity <ref name=" Curtis " />. The impact of risk events on different project objectives can be defined in both a qualitative and quantitative manner. These project objectives are cost, schedule, quality, scope, health, safety, etc. The Impact scale can vary, but the most common scale is the five-point scale. Typically, the impacts are described relative as very low, low, moderate, high and very high but often also with defined numerical scales. Dependent on the objective, the scales are given a description of what the impact entails <ref name=" PMI " />. One risk event can affect more than one objective, so the impact of all the possible objective effected must be considered <ref name=" Curtis " />. Table 1 shows how impact can be defined for various objectives. The possible impacts on each objective is described and given a ranking. The ranking in table 1 is both relative, from very low to very high, and numerical, given some numerical values based on the specific project.             
 
 
 
 
{| class="wikitable" style="float:Right; margin-left: 30px"
 
|+Table 2: Probability Scale Example
 
|-
 
! colspan ="2"|Likelihood
 
! colspan ="1" rowspan = "2" |Description
 
|-
 
!style="height:20px; width:100px; text-align:center;" | Relative
 
!style="height:20px; width:100px; text-align:center;" | Numerical
 
|-
 
|style="height:20px; width:100px; text-align:center;background: white;" | Very Low 
 
|style="height:20px; width:100px; text-align:center;background: white;" | 0.1
 
|style="height:20px; width:170px; text-align:center;background: white;" | Highly unlikely to occur.
 
|-
 
|style="height:20px; width:100px; text-align:center;background: white;" | Low
 
|style="height:20px; width:100px; text-align:center;background: white;" | 0.3
 
|style="height:20px; width:170px; text-align:center;background: white;" | Will most likely not occur
 
|-
 
|style="height:20px; width:100px; text-align:center;background: white;" | Moderate
 
|style="height:20px; width:100px; text-align:center;background: white;" | 0.5
 
|style="height:20px; width:170px; text-align:center;background: white;" | Possible to occur
 
|-
 
|style="height:20px; width:100px; text-align:center;background: white;" | High
 
|style="height:20px; width:100px; text-align:center;background: white;" | 0.7
 
|style="height:20px; width:170px; text-align:center;background: white;" | Likely to occur
 
|-
 
|style="height:20px; width:100px; text-align:center;background: white;" | Very High
 
|style="height:20px; width:100px; text-align:center;background: white;" | 0.9
 
|style="height:20px; width:170px; text-align:center;background: white;" | Highly likely to occur
 
|}
 
 
= Probability =
 
Risk probability, or likelihood, is the possibility of a risk event occurring. The likelihood can be expressed in both a qualitative and quantitative manner. When discussing probability in a qualitative manner, terms such as frequent, possible, rare etc. It is also possible to describe the probability in a numerical manner. These can be scores, percentages and frequencies defined by the organizations dependent on the relative description <ref name=" Curtis " />. Table 2 show an example on how an organization can define the ranking for likelihood for a project. The ranking is both a relative and numerical manner and a description of the ranking is given.
 
 
 
= Impact vs. Probability =
 
Risk analysis is a two-stage process. Qualitative risk assessment is the first stage in the risk analysis. By using qualitative methods for risk assessment, the risk can be prioritized for further quantitative assessment or even risk response planning. Quantitative risk assessment is the next stage in risk analysis. The process is involves analyzing the effects of risks on the overall project objectives. They primarily focus on the risks which have been prioritized in the qualitative risk assessment. To ensure the quality and credibility of the risk analysis, general definitions of impact and probability levels must be fitted to individual project context <ref name=" PMI " />.
 
 
 
== Qualitative Analysis==
 
Qualitative methods for risk assessment are relatively rapid in practice, cost effective and easily understood <ref name=" Curtis " />. The result form qualitative assessments are not an accurate estimate of risk. However, they provide a rather a descriptive result and often with sufficient information for planning responses. The results from qualitative risk assessment also lay the foundation for more detailed quantitative risk analysis, if possible and warranted. It is performed regularly throughout a projects life cycle as new risk may emerge at later stages as well as response to a risk may result in other risk events <ref name=" PMI " />. Classifying the risks enables organizations to reduce uncertainty levels and focus primarily on the high-risk events.  There are two qualitative methods of assessing risk events in terms of impact and probability, both involving rating the impact and probability. These are Risk Probability and Impact Assessment and Probability and Impact matrix <ref name=" PMI " />. t.
 
 
=== Risk Probability and Impact Assessment ===
 
The probability assessment involves estimates the likelihood that the risk will occur. The risk impact assessment estimates the effect of a risk event on a project objective. These impacts can be both positive and negative, that is opportunities and threats. The project objectives are numerous, the schedule, cost, quality and scope to name a few. For each identified risk, the impact and probability are assessed. Interviews and meeting with experienced project participants, stakeholders, and experts in the subject are the basis for the risk impact and probability assessment. These impacts and probabilities are rated and the level of impact and probability is assessed. The risk which receive high ratings are investigated further or an appropriate response is planned. The low rated risks do not require an emaciated action but should be included in the [[Risk register]] or monitoring <ref name=" PMI " />.
 
 
=== Probability and Impact Matrix ===
 
The Probability and Impact Matrix is one the most commonly used qualitative risk assessment method. It is based on the two components of risk, probability of occurrence and the impact on objective/objectives if it occurs. The matrix is a two-dimensional grid that maps the likelihood of the risk occurrence and its effects on the project objectives <ref name=" PMI " />. The risk score, often referred to as risk level or the decree of risk, is calculated by multiplying the two axes of the matrix.
 
 
<div class="center" style="width: auto; margin-left: auto; margin-right: auto;">Risk = Impact x Probability </div>
 
 
As the impact and probability can be described in both a relative and numerical manner so can the risk score. The higher the combined ratings are, the higher the score and thus risk level. These ratings are generally defined from low to high or very low to very high <ref name=" Curtis " />. The ratings for likelihood and impact are made using gathered opinions from interviews <ref name="Maylor"/>. These ratings of must be classified by each organization, specific for each activity, as they must define what would result in high, moderate or low risk for their activity. Creating these definitions of impact and probability levels can hlp reducing the influence of bias <ref name=" PMI " />. The result from these risk matrices are used to prioritize the risks, plan the risk response, identify risk which need to be examined further, possibly by quantitative methods and guide resource allocations <ref name="Cox" />. However, the objective which is effected by the risk must also be considered. For example, a risk events which has high safety or health risk would be prioritized over a risk event which would have very high financial risk <ref name=" Curtis " />.
 
 
{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
 
|+ Table 3: Impact vs Probability Matrix <ref name=" PMI " />
 
|-
 
!colspan = "1" style="height:20px; text-align:left; background: #F2F2F2; " | Probability
 
!colspan = "5" style="height:20px; background: white; border color: white" | Threats
 
|-
 
!style="height:20px; width:110px; text-align:center; background:#F2F2F2; " |Very High / 0.9
 
|style="height:20px; width:50px; text-align:center; background: green; " |0.05
 
|style="height:20px; width:50px; text-align:center; background: yellow; " |0.09
 
|style="height:20px; width:50px; text-align:center; background: red; " |0.18
 
|style="height:20px; width:50px; text-align:center; background: red; " |0.36
 
|style="height:20px; width:50px; text-align:center; background: red; " |0.72
 
|-
 
!style="height:20px; width:110px; text-align:center; background:#F2F2F2; " |High      / 0.7
 
|style="height:20px; width:50px; text-align:center; background: green; " |0.04
 
|style="height:20px; width:50px; text-align:center; background: yellow; " |0.07
 
|style="height:20px; width:50px; text-align:center; background: yellow; " |0.14
 
|style="height:20px; width:50px; text-align:center; background: red; " |0.28
 
|style="height:20px; width:50px; text-align:center; background: red; " |0.56
 
|-
 
!style="height:20px; width:110px; text-align:center; background:#F2F2F2; " |Moderate  / 0.5
 
|style="height:20px; width:50px; text-align:center; background: green; " |0.03
 
|style="height:20px; width:50px; text-align:center; background: green; " |0.05
 
|style="height:20px; width:50px; text-align:center; background: yellow; " |0.10
 
|style="height:20px; width:50px; text-align:center; background: red; " |0.20
 
|style="height:20px; width:50px; text-align:center; background: red; " |0.40
 
|-
 
!style="height:20px; width:110px; text-align:center; background:#F2F2F2; " |Low      / 0.3
 
|style="height:20px; width:50px; text-align:center; background: green; " |0.02
 
|style="height:20px; width:50px; text-align:center; background: green; " |0.03
 
|style="height:20px; width:50px; text-align:center; background: yellow; " |0.06
 
|style="height:20px; width:50px; text-align:center; background: yellow; " |0.12
 
|style="height:20px; width:50px; text-align:center; background: red; " |0.24
 
|-
 
!style="height:20px; width:110px; text-align:center; background:#F2F2F2; " |Very Low  / 0.1
 
|style="height:20px; width:50px; text-align:center; background: green; " |0.01
 
|style="height:20px; width:50px; text-align:center; background: green; " |0.01
 
|style="height:20px; width:50px; text-align:center; background: green; " |0.02
 
|style="height:20px; width:50px; text-align:center; background: green; " |0.04
 
|style="height:20px; width:50px; text-align:center; background: yellow; " |0.08
 
|-
 
!style="height:20px; width:110px; text-align:center; background:#F2F2F2; " |Impact
 
!style="height:20px; width:60px; text-align:center; background:#F2F2F2; " |Very Low / 0.05
 
!style="height:20px; width:50px; text-align:center; background:#F2F2F2; " |Low / 0.1
 
!style="height:20px; width:50px; text-align:center; background:#F2F2F2; " |Moderate / 0.2
 
!style="height:20px; width:50px; text-align:center; background:#F2F2F2; " |High / 0.4
 
!style="height:20px; width:60px; text-align:center; background:#F2F2F2; " |Very High / 0.8
 
|-
 
|colspan= "6" style="height:10px; background: white; border color: white" | 
 
|-
 
|colspan = "1" style="height:15px; text-align:center; background: red; "    | High risk |
 
|colspan = "2" style="height:15px; text-align:center; " | Score > 0.9
 
|rowspan = "3" colspan = "3" ; text-align:left | A organization defines its risk thresholds, low, moderate and high. These thresholds are differ between projects. 
 
|-
 
|colspan = "1" style="height:15px; text-align:center; background: yellow; " | Moderate risk
 
|colspan = "2" style="height:20px; text-align:center; " | 0.05 < Score < 0.9
 
|-
 
|colspan = "1" style="height:15px; text-align:center; background: green; " | Low risk
 
|colspan = "2" style="height:20px; text-align:center; " | Score < 0.05
 
|}
 
 
 
'''Low impact – Low probability:''' The risks that are characterized as low, or very low, risks have both a low impact and likelihood of occurrence. For negative risks, threats, the response required is not necessarily as proactive management action. However, they should be included within the risk register for future monitoring. Positive risks, opportunities, within the low-risk category should be monitored or just simply accepted. Opportunity acceptance means taking advantage of the opportunity if it arises, but not actively pursuing it <ref name=" PMI " />.
 
 
'''High impact – Low probability:''' Risks with high impact but low likelihood of occurrence can be characterized from low to high risks but most often within the moderate category. The characterization is dependent on the organizations defined threshold. These events rarely occur, defined as rare catastrophes. It is difficult to determine the probability based on historical records due to lack of data. Therefore, the probabilities must be estimated subjectively. The most commonly responses are to insure or mitigate the problem <ref name="NRC" />. 
 
 
'''Low impact – High probability:''' Risks with low impact but high likelihood of occurrence can be characterized from low to high risks but most often within the moderate category. The characterization is dependent on the organizations defined threshold. These risks are mostly due to uncertainties of numerous elements that individually, are minor risks but combined, could amount to higher risks. These are such uncertainties as actual cost and duration of different aspects of a project, changes to activates or other similar uncertainties, that alone, have little impact <ref name="NRC" />.
 
 
'''High impact – High probability:''' The risks that are characterized as high risks have both a high impact and likelihood of occurrence. A risk which has a negative impact, is a threat to the objective, may need priority actions and aggressive responses. These aggressive responses could be mitigation of the risk or even terminating the project if the risk is to great. A risk that has a positive impact, is an opportunity, is most likely obtained easily, with the greatest benefits and should thus be targeted first <ref name=" PMI " />.
 
 
== Quantitative Analysis ==
 
Quantitative risk assessment methods provide a more accurate analysis results than the qualitative risk assessment. However, they are costlier and often time consuming, so only the risk prioritized by the qualitative risk assessment are analyzed.  These methods are mostly used to analyze the combined effect of all affecting risks. The most important benefit is that the information produced support decision making and reduce project uncertainty. In some cases, quantitative methods are not applicable due to lack of sufficient data but that must be evaluated by the project manager. The analysis should be repeated as a part of risk control to determine whether the overall risks are reaching a desirable state <ref name=" PMI " />.
 
 
=== Sensitivity analysis ===
 
Sensitivity analysis is a quantitative technique useful to determine the variables which have the greatest effect on the risk <ref name="NRC" />. They help estimating risks with the most potential impact and how variations in the objectives and different uncertainties are correlated, the effect of each element on the objectives <ref name=" PMI " />. They also help assess probability of the project decisions being affected by the concrescences and risk actions which result in the desired outcome can be identified. Generally, it is only the highest risk scenarios which are considered in the sensitivity analysis. These analyses can be time consuming and costly, this is often why qualitative analysis such as Probability and Impact Matrix is used to identify the highest concerning risks <ref name="SA" />.
 
 
 
= Limitations =
 
Qualitative methods are imprecise. They are just estimates and it can happen that unlikely risk do happen and likely things sometimes never come to pass. The quality of the information available influences the quality of the results so the information must be evaluated to help determining the risks importance but it can also <ref name=" Curtis " />. When using the Probability and Impact Matrix, risk that are quantitative different can get the same rating and often the risks are overestimated. The results from the Probability and Impact Matrix are subjective and are thus open to more than one interpretation <ref name="Cox" />. The matrix doesn’t provide the possibility of assessing the overall project risks nor address risk interactions and correlations. Not all concepts of risk of risk can be mapped to a Probability and Impact Matrix, as the tool is designed around an event oriented risk concept. The practice often is impractical until a certain maturity level where some of the best opportunities for risk management may have passed <ref name="PIM" />.
 
Quantitative methods often provide more accurate results but are costly and time consuming. Using numbers may imply more precision in results. However, the data and techniques used in these methods also need to be considered. If the models used are incorrect or don’t represent reality the result is meaningless. Same with the inputs. If the inputs are wrong the result from the analysis is useless. In risk analysis, this is a problem as assumptions are not always apparent <ref name=" Curtis " />.
 
 
 
= Annotated bibliography =
 
 
'''Winch, G.M. (2010) ''Managing Construction Projects: An Information Processing Approach, Second Edition.'' Oxford: Wiley-Blackwell Publishing.
 
'''
 
The book contains a description of the practice of managing risk and uncertainty in a construction project. It describes briefly the four activities of risk management process. The definitions of risk and uncertainty is described and the importance of risk management supported. Winch describes briefly the purpose of risk analysis and defines Probability and Impact matrix as the most commonly used tool for categorizing risks. The planned responses to risks that have been prioritized and categorized are also described within the same matrix as the probability and impact. 
 
 
'''Curtis, P. & Carey, M. (2012). ''Risk Assessment in Practice.'' Deloitte & Touche LLP.'''
 
Risk Assessment in Practice is a framework developed by five private sector organizations with the goal of thought leadership. It focuses on risk assessment process and criteria, impact and probability and the practice of qualitative and quantitative methods for the assessment, categorization and prioritization of risk. The limitations and advantages of the methods are also discussed. 
 
 
 
 
'''Project Management Institute, Inc. (2013). ''A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Fifth Edition.'' Newtown Square, Pennsylvania :Project Management Institute, Inc.'''
 
 
The Project Management Institute’s “A Guide to the Project Management Body of Knowledge” is a guideline for managing individual projects and defines project management related concepts as well as the life-cycle and processes of projects and project management. It defines nine knowledge areas and risk management is one of them. Risk analysis is one of the steps of risk management. The guidline describes various qualitative and quantitative methods for risk analysis, among them are the Impact and Probability Assessment, Impact and Probability Matrix and Sensitivity Analysis. 
 
 
 
 
= References  =
 
 
<references>
 
<ref name="Winch"> Winch, G.M. (2010) Managing Construction Projects: An Information Processing Approach, Second Edition. Oxford: Wiley-Blackwell Publishing </ref>
 
<ref name="Maylor"> Maylor, H. (2010) Project Management, Fourth Edition. Harlow, England: Pearson Education Limited </ref>
 
<ref name="Curtis"> Curtis, P. & Carey, M. (2012) Risk Assessment in Practice. Deloitte & Touche LLP </ref>
 
<ref name="MITRE"> The MITRE Corporation. (2014) MITRE Systems Engineering Guide. The United States: MITRE Corporate Communications and Public Affairs </ref>
 
<ref name="PMI"> Project Management Institute, Inc. (2013). A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Fifth Edition. Newtown Square, Pennsylvania: Project Management Institute, Inc </ref>
 
<ref name="NRC"> National Research Council. (2005). The Owner’s Role in Project Risk Management. Washington, D.C: The National Academies Press </ref>
 
<ref name="Cox"> Cox, L. (2008). What's Wrong with Risk Matrices? Risk analysis: an official publication of the Society for Risk Analysis. 28(2), 497-512 </ref>
 
<ref name="SA"> Iloiu, M. & Csiminga, D. (2009). Project RISK Evaluation Methods - Sensitivity Analysis. Annals of the University of Petroşani, Economics, 9(2), 33-38 </ref>
 
<ref name="PIM"> Risk Management Capability Ltd. (2005). Probabilit- Impact Matrix (PIM). http://www.rmcapability.com/resources/Capability+Guidance+Sheet+-+Probability-Impact+Matrix.pdf </ref>
 
 
</references>
 
 
</references>
 

Latest revision as of 17:24, 29 September 2017

Personal tools
Namespaces

Variants
Actions
Navigation
Toolbox