Thursday, December 17, 2015

Risk management: time matters

Want to manage risks? Super! It's always a good idea.
Everybody starts with the traditional four steps:
  1. Identify the risk
  2. Prioritize among risks
  3. Evaluate probability and impact
  4. Set up a risk response or mitigation
Actually, there are problems with Step 3
  • It's rare, bordering on "never", that you would know "probability". Why?  Because it's unlikely you would have enough historical quantitative and calibrated data to form an estimate. (Actually, to form an estimate of a distribution from which a estimate of probability can be determined) Thus, you're likely guessing
  • Time matters, and time is not actually explicit in Step 3
And, so what to do?
  •  Substitute the concept of "confidence interval" for a specific probability: less than this, greater than that; or contained within a range of this to that.*
  • Explicitly state the time frame during which the confidence interval applies. After all, the example oft cited is a good one: your confidence it will rain today is a good deal different than your confidence it will rain this week, but the impact may be the same if you are doing project work in the weather.
* Ooops, another problem: a confidence interval is obtained by integrating a probability distribution, but we've just said we don't have the data necessary to form a distribution. So, does a lack of data also invalidate a confidence interval?
  • Strictly speaking, if the actual shape of the confidence "curve" within the interval is important, then yes there is an issue
  • But, if we are, as most of us are, approximating the interval with some end points that are "very likely to contain the real outcome" then the shape of the curve is not so important. Thus: press on!

Available now! The second edition .........
Bookmark this on Delicious

Read in the library at Square Peg Consulting about these books I've written
Buy them at any online book retailer!
Read my contribution to the Flashblog