Bill Holmes

# Quantitative Risk Assessment – Wait, how much money do you need??

As Maimonides said: “The risk of a wrong decision is preferable to the terror of indecision”.

However, those words are seldom spoken at a Project’s Executive Steering Committee Meeting!

Quantitative Risk Analysis is often implied in project risk discussions, but its use as a primary risk assessment tool is not that common. The reason I say it is implied is because the question: “what’s it going to cost me?” is often discussed without the application of proper tools and techniques. Like Qualitative Risk Analysis, Quantitative Risk Analysis leverages the two components of risk:

• Probability – how likely is the event to occur

• Impact – what will happen if the event occurs

Quantitative Risk Analysis actually assigns a dollar value to a specific risk event. While this allows identified risks to be grouped together logically so that response strategies can be developed, it also provides a tool to absolutely rank the risks based on the estimated cost of the event.

The Project Manager (PM) is not a subject matter expert – they are a process expert. This is why establishing governance over all processes in the Planning Phase is crucial, and the decision to use Quantitative Risk Analysis and the supporting guidance should have been documented at that time. It is also important to remember that for the PM, risk presents as variance from the plan – both positive and negative.

Quantitative Risk Analysis uses Expected Monetary Value (EMV) to determine the dollar impact of a given potential risk event. The formula is very simple: EMV = probability x impact where:

Probability = the likelihood of an event expressed as a percentage

Impact = the monetary cost of an event should it occur

Let’s do an example:

You are planning a vacation with your family, so you have your mechanic make sure everything is operating properly on the family vehicle. They tell you that there is a 40 % chance that your alternator will fail, and if that occurs on the trip you will need to get the car towed and the part installed. They estimate that the total cost of would be $500. Using the language of risk – there is a 40% chance that the risk event “alternator will fail” will occur, and it will cost you $500. The formula for the EMV for this event is: 40% x $500 = $200. So the EMV of this risk event is $200.

Now you may say “but that isn’t the total cost!” There are the additional (and hard to quantify) costs associated with this event. What if you are delayed so long you miss a night at the hotel? What about feeding your family while waiting? And what about the impact on the trip itself?? Quantitative Risk Analysis would require you to assign a dollar value to all those! Unlike Qualitative Analysis which would categorize it as “likely, very bad”, Quantitative Analysis requires much more refinement.

But here is one of the great benefits of Quantitative analysis – the ability to compare choices! So you ask your mechanic how much to replace the alternator – any answer less than or equal to $200 is an automatic “replace it”!

Because EMV is based on actual math (probability and impact) computers really like it. It also allows you to do all sorts of sophisticated modeling based on a series of EMV calculations (Monte Carlo is a well-known simulation tool) to determine the least risky path for the project!

It is also helpful in establishing a contingency reserve amount to account for risk. We will discuss contingency reserve in a later post on risk response strategies.

As a side note, even if you are using Qualitative Risk Analysis, it is sometimes helpful to force the experts to provide a probability estimate. I have found this especially helpful when discussing “low probability, high impact” risks. What does “low” mean?? One in a 100? One in a 1000? One in a 1,000,000? Order of magnitude can be very important!

The major challenge of using this method is the same as Qualitative Risk Analysis. You are relying on Subject Matter Experts to come up with estimates! For this reason, the PM must guide the experts on how to “score” the risks using the previously described Risk Assessment Matrix. While the guidance will be different than what is provided for Qualitative Risk Analysis, the Risk Assessment Matrix is a crucial tool to compensate for the risk/reward bias described in the Utility Theory.

Another challenge is that you are asking the experts for specific numbers! For probability, you are asking them to state a percentage and a specific dollar amount for the EMV calculation to work. Even in the simple example provided above, is it really a 40% chance the alternator will go out? What math is that based on? And how do you capture the “cost” of the family vacation being delayed, potential expenses for food and lodging, ect.?

There is also the psychological impact of someone seeing a calculated number that seems to reflect certainty. Telling the Executive Steering Committee that: “This risk event has an Expected Monetary Value of $377,233” seems so much more refined than saying: “This will probably occur and it will have a significant impact”. The problem is that both are based on estimates – that is to say educated guesses - even if one is also based on real math.

So which is better? Qualitative or Quantitative Risk Analysis?

As with most project related questions, it depends on the project and the organization! The most important thing for the PM to remember is that you must establish the processes in the Planning Phase of the project and hold the experts accountable. The most important thing for executives to remember is that both methods are estimates! And what is an estimate? An educated guess.

Next – Risk Response Strategies