After you have identified your risks, the next step is to prioritize them. We do that by assigning a probability rating and an impact rating, then combining the two to determine your exposure (i.e. priority).

The Risk Probability is a measure of the likelihood of the risk occurring. In most cases it is difficult to assign an exact probability. It usually will be sufficient to define probabilities as “High”, “Medium”, and “Low” and define these probabilities as ranges. Here is an example of the ranges I typically use:

• High = 70% or greater probability
• Medium = between 40 – 69 % probability
• Low = less than 40% probability

You can use whatever definition you choose as long as all of the parties helping you assign probability are aware of the defined ranges.

The Risk Impact is a measure of the effect of the Risk occurrence on the schedule, scope, budget and quality of the project. Again, since in most cases this may be difficult to quantify, using ranges represented by “High”, “Medium” and “Low” will suffice. Here is an example of range definitions for Risk Impact:

• High = greater than 10% impact on one or more of schedule, scope, budget and quality
• Medium = 5-10% impact on one or more of schedule, scope, budget and quality
• Low = less than 5% impact on one or more of schedule, scope, budget and quality

The Risk Exposure is a product of both the Risk Probability and the Risk Impact. It is also measured as “High”, “Medium” and “Low” if that is the way you defined the probability and impact. Here is how the Risk Exposure can be determined:

•  Probability (High) + Impact (High) = Exposure (High)
•  Probability (High) + Impact (Medium) = Exposure (High)
•  Probability (High) + Impact (Low) = Exposure (Low)
•  Probability (Medium) + Impact (High) = Exposure (High)
•  Probability (Medium) + Impact (Medium) = Exposure (Medium)
•  Probability (Medium) + Impact (Low) = Exposure (Low)
•  Probability (Low) + Impact (High) = Exposure (Medium – but watch closely due to impact)
•  Probability (Low) + Impact (Medium) = Exposure (Medium)
•  Probability (Low) + Impact (Low) = Exposure (Low)

Now that you have your Risk Exposure determined you should monitor and act on them in order of exposure, with the ones rated “High” given the most attention. This will help you allocate your risk management resources appropriately.

Note: Much more detail on Risk Management can be found in my book “Project Management For The Real World”, available in paperback and Kindle formats at

http://www.amazon.com/dp/b089krddvn

#projectmanagement