Steve Kay, a Program Manager interviewed in the Closing Credit article of the August 2012 issue of PM Network made an interesting change on his mega-project – he altered the typical 5×5 risk matrix (e.g. very high – very low) to a 4×4 one to remove the “sitting on the fence” option for those participating in the qualitative risk analysis process.
This prompted me to check the risk registers for a few of the historical projects I’d been involved with and I noticed that when there is a three or five rating scale for probability and impact, the medium selection is picked much more often than one of the other choices. This should not be a surprise since we can draw a reasonable conclusion that probability and impact values follow a normal distribution for projects with an average level of risk.
My concern is that the frequent selection of this rating relates more to indecisiveness or lethargy than to statistics.
The former cause might be tied to the common behavior in some organizations of people being unwilling to take a stand. With a three point rating scale, providing a low severity for a risk which you had previously identified might incur the wrath of those minimalists who want the focus purely to be on critical threats or opportunities. Doing the same for someone else’s risk event might put you at loggerheads with them as they might perceive a very different severity for their risk. On the other end of the scale, assessing a risk event as high might brand you as a “Chicken Little”.
Such behavior might occur if risk analysis participants are lacking knowledge on what the different ratings imply and how to score risks, but more likely it is caused by participants that are uninterested in the process. I believe that most staff are so focused on their day-to-day operational and project work and the “real” issues that plague them that they wish to minimize their effort spent on risk management which they perceive as being at best, an academic practice.
The recommendation in the PM Network article is a simple way to address the inappropriate use of medium ratings as it forces participants to pick ratings that will be either above or below the point of indecision. This method could be enhanced by one or more of the following practices:
- Take the time before qualitative risk analysis begins to clearly explain risk rating scales and illustrate their usage with examples.
- Make sure that you effectively communicate the linkage between risk scoring and the responses that would be based on the scores as well as the implications of scores on risk reporting.
- As of a follow up to the analysis session and only if you have sufficient risks to support this, you may wish to construct a graph of the distribution of impacts and probabilities to see if the overall shape of the curve “fits” the team’s perception of the overall project’s risk profile. If it doesn’t, this could point to inconsistent scoring.
Yoda said “Do or do not, there is no try” – medium might just be the “try” of risk management!