Calculating Risk, Part 3

This is the third in a series of articles on calculating and then preparing to deal with project risks:

0. Name and Description (discussed 20 February)
1. Probability (21 February)
2. Cost
3. Exposure
4. Mitigation Plan
5. Contingency Plan
6. Trigger

Look at our sample risk worksheet so far:

NameDescriptionProb.CostExp.MitigationContingencyTrigger
Jo unavailableJo Smith, who has essential knowledge, become unavailable 30%
Expanded discoveryEstimates are based on sample documents from client and troll plaintiff, but it’s possible the samples are wrong or the judge allows additional discovery requests 60%

Which is the bigger risk?

We can’t answer that yet. All we know is the risk more likely to occur. Until we understand the cost of each risk, we’re only guessing at where to direct our focus.

2. Cost

So here are some parameters from our hypothetical matter:

  • Jo Smith costs the firm $400/hour (not her billing rate, but her cost to us, the firm). Her replacement will cost the same, but it will take him ten hours to come up to speed on the project, plus three hours of additional time from the project manager ($300/hour cost) overseeing his training and work. In addition, it will take him five hours more than Jo to finish the work.
  • Additional discovery will cost us $2000.1

Let’s work with these simplified numbers because they’re, well, simple (see below).

Thus the cost of the first issue is $400 x 10 (coming up to speed) plus $300 x 3 (project manager oversight) plus, say, $400 x 3 (because we’re going to write off three of those five extra hours). The total cost is $6100.

So if you go by probability, the second issue is the higher risk. But by cost, it’s the first issue. How do we reconcile this question?

Brief Digression on “Simple” Numbers

A more realistic version of the Jo Smith issue would include the fact that her replacement works only 90% as efficiently, bills $50/hour less, will cause $2000 of disruption to the project he’s currently on, will increase his utility to the project during training so that it’s not ten no-value hours but a curve starting at zero value and edging up toward 90%, and a host of other factors.

If I were actually managing this project, which numbers would I use? Probably something in between. I might rate his ten-hour ramp-up at, say, 50% value and note that we would bill for perhaps three or four of them. But I wouldn’t spend more than about 30 seconds calculating all of this.

Why?

Two reasons. First, we’re dealing with broad approximations. How much is “about a mile” and 14.27 feet? It’s still “about a mile.”2 Second, I’m only looking for “orders of magnitude,” or guidelines, for the same reason I use “T-shirt sizing” in probabilities. Which brings us to the next factor in our list.

3. Exposure

For each risk, the next step is to calculate the exposure, which is simply probability x cost.

Here’s why I recommend using Excel to track risk. You don’t have to do the math. Excel does it for you. You don’t have to approach risk mathematically, but a bit of simple math makes it easier to figure out where to focus your risk-management efforts.

Let’s plug the new numbers into our worksheet.

NameDescriptionProb.CostExp.MitigationContingencyTrigger
Jo unavailableJo Smith, who has essential knowledge, become unavailable 30%$6100$1830
Expanded discoveryEstimates are based on sample documents from client and troll plaintiff, but it’s possible the samples are wrong or the judge allows additional discovery requests 60%$2000$1200

Now I can see that the first risk is a greater threat than the second.

In evaluating which risks to focus on, look for biggest impact, as represented by exposure.

These numbers are relatively close, so I might not spend that much more time working the Jo Smith issue than I would trying to forestall or get on top of expanded discovery. I’ll discuss this issue further in the next section, on mitigation.

Still, it’s worth noting that the lower-probability risk is the larger problem. Spotting these types of issues, especially when you’ve identified 10 or 20 project risks, points up the value of a risk worksheet, whether you track it formally in Excel or informally in OneNote or Word or on a white board with a Do Not Erase sign.3

Exposure isn’t absolute. A risk will either happen or it won’t (again, in simple terms). The first issue will cost us either $6100 or $0, not $1830. Still, over time and over multiple risk items, these average out. You can’t be everywhere and do everything, nor would the client be happy to pay for such. Thus you should look for those areas where you’ll probably make the biggest difference.

Next up: mitigation (a project manager’s term, not quite the same as the legal meaning).

2 comments to Calculating Risk, Part 3

  1. Of course that’s low. It’s a simplified hypothetical!

  2. I’ve written previously on the difference between precision and accuracy. Accuracy is usually more valuable.

  3. Use your phone camera to capture the state of the white board, since Do Not Erase notes aren’t always honored. That said, I recall one large project 20 years ago where we kept the project plan on a white board for seven or eight months. We did buy a project camera for safety, though.