A colourful way to see risk variability

I’ve said before that risk is variable. But traditional project management pretends that “risks” are individual things—what I sometimes call “point risks”. So if you’re working in that environment, here’s a colourful way to highlight the difference.

Here’s a typical risk scoring grid, which I’ve adapted from the website of some auditors… but it really it could come from anywhere. I’ve heightened the drama a bit by adding a new level of danger beyond red, and elevating the score we give to a “catastrophic” event. It doesn’t matter much—it doesn’t make it any less erroneous.

Risk scoring grid

The usual idea is that you “identify” your risks (“like rabbits in a field”) and give each one a score for impact and likelihood. Then you multiply the two scores, and that tells you how worried you should be—and therefore how much effort/cost/time you need to put into dealing with it.

Even in doing just this we’ve already made a ton of errors, but I’m going to ignore those and just focus on the problem of pretending that “risks” are individual things, which might exist at points on a grid.

To eliminate some errors with this grid we have to make some interpretations. One part of this is to have an objective way to interpret each impact level—otherwise we find that one person’s Moderate is another person’s Major. It’s common to use financial cost for this. Another part is to do the same for the levels of likelihood, and an obvious approach is to apply percentage ranges to each of Rare, Unlikely, etc.

For example, for the impacts we might say Catastrophic is £1m and above, Major is £250,000 and up, Moderate is £100,000 and up, Minor is £10,000 and up, and Negligible is anything less that that. And for the likelihood ranges we might say Almost Certain is 80% and up, Likely is 60% and up, Possible is 40% and up, Unlikely is 20% and up, and Rare is anything less.

So, can you think of an example risk? Have you found where it lies in the grid?

In truth, risks are variable and do not lie at a point on a grid. Let’s take an example: Suppose we’re an online retailer and we want to consider the risk of publishing the wrong product price on our website. Among other places this has happened before at Screwfix and it looks like it would have cost them hundreds of thousands of pounds. So we might think we could work out the chance of this happening, the likely financial impact, and find a point for it on the grid after multiplying the two scores.

We might think that, but we’d be wrong. To take the Screwfix example, all the prices on their website became £34.99. We might calculate the probability of that, and we might calculate the resultant loss. But what if we considered all the prices switching to £399.99? Maybe the odds of that happening would be less (because fewer goods are that price, so it’s less likely that number would slip into the system) and the losses might be less, too. At the other extreme, what about all the prices becoming £3.99? Higher likelihood, perhaps, and higher losses, no doubt.

We can see that the risk does not lie at a point; it is not an event described by single impact and likelihood figures. It is variable. In our case we might see that the risk ranges in probability from 0% to perhaps 40%, 50% or 60%. The impact ranges from very little to perhaps over a £1m, depending on the error made. And so the “point risk” is a nonsense. Referring to our colourful grid, the danger lies across a number of grid cells, ranging from Rare to perhaps Likely, and from Negligible to Catastrophic.

Risk scoring

And all this ignores another factor that increases the variability—over what timeframe are we considering? The likelihood of this happening in the next day is quite small; the likelihood of it happening in the next year is much higher; the likelihood of it happening in the next three years is higher still. What is our frame of reference? Another factor that influences the variability here is how many products get the wrong update. In our example all the products get the same update of the wrong price, but what if the error is applied only within specific categories of product? Perhaps you can think of other factors which generate even more variability.

Notice that in this particular grid the Likely column ranges from green to black. If we’re sufficiently imaginative (and let’s say the Likely range is 60% to 79%) we might dream up some area of concern that is 60% likely to cost us £1m in some period, but 79% likely to cost us less than £10,000. That means our risk covers the entire green to black range.

Even without that extreme example, I hope it’s clear that any uncertainty will range in its likelihood and impact—it can’t be pinned down to a single point. And perhaps that can encourage us to look at those uncertainties from a more useful perspective, and treat them in a more rounded, more integrated manner.