One widely used method of prioritizing risks is through the
use of risk scoring matrices that quantify the likelihood and
consequence of occurrence. The scoring methodology can
be tailored to fit the needs, complexity, or experience base
of a program/project. The scoring matrix used by the
International Space Station program is shown in Figure 3.
Likelihood is the probability that an identified risk event
will occur. Consequence is an assessment of the worst
credible potential result(s) of a risk. The measurement units
differ depending on the specific risk. For example, the
consequence of a cost risk may correspond to specific dollar
amounts or percentages of the program/project budget or
the consequence of schedule risks may correspond to the
length of time delays in terms of the project’s master
schedule.The likelihood and consequence matrix (including threshold
definitions for each of the likelihood and consequence
scores) are shown in Figure 3:
Timeframe is the time in which action must be taken to
handle the analyzed risk or the time period in which the
program/project will be impacted by it.
The next step of risk management is risk planning, which
begins with assigning responsibility to research the risk in
more detail and then determine the approach to handle the
identified risk. If a decision is made to mitigate the risk, the
subsequent development and implementation of a detailed
action plan will follow.
Risk tracking involves collecting, updating, compiling,
organizing and analyzing risk data and reporting risk trends
to determine whether particular risks are decreasing, staying
the same, or increasing over time. Tracking focuses
primarily on risks identified for mitigation, research, and
monitoring, although all risks, including accepted risks,
should also be tracked to ensure that conditions or
assumptions have not changed to the point that reevaluation
is necessary. For research actions, tracking serves to assure
that the research efforts are progressing satisfactorily and
that the identified timeframe still permits further
investigation and anaylsis. Risk tracking should provide the
insight on which to draw conclusions about the
effectiveness of mitigation actions, or the need to take action on monitored risks that are increasing toward or
beyond a trigger level. "Trigger" levels are the warning or
control limits often used to flag the risk owner that alternate
plans may be required. Trigger levels may be
predetermined for particular risks (if the risks are being
monitored) to signal the need for action. Trigger levels also
identify those effects on the overall program/project, not
only relative to the critical path but also to the resources and
performance results; critical decision-making points;
variations on systems capabilities; and other elements.
Tracking results should be made readily available to the
program/project team members.
Risk control is the feedback process of reevaluating, based
on recent tracking information, what actions to take
concerning a particular risk, and implementing those
decisions. Actions may include changing the current action
plan, closing the risk (accepting the residual risk), invoking
a contingency plan when the original plan is found to be
ineffective or continuing with the original plan and
continuing to track the risk. Each of the risks identified,
analyzed, planned, and tracked should be periodically
reviewed (usually bi-weekly with the ISS program office) to
ensure that decisions made are effective and that associated
actions remain applicable.
Effective risk management requires open, clear, and
ongoing communication within the program/project team.
The risk management documentation process ensures that
risk management policies are established, understood,
implemented, and maintained, and that a formal audit trail is
developed to establish the origin of, and rationale for, all
risk-related decisions. Risk management documentation
must be readily accessible to the entire team; e.g., in an
automated form, and under configuration control.
Consideration should be given to establishing a
program/project risk management repository to provide an
easily accessible way to store program/project risk
information and thereby aid every step of the risk
management process. This would also provide a risk record
archive, making tracking and analyzing risk, past methods,
and results available for all to view, including any lessons
learned.