Every risk event has both probability and impact. In most organiza-
tions, those values are established qualitatively rather than quanti-
tatively. at creates problems because perceptions frequently dier
as to what constitutes a “high” probability or a “moderate” impact.
Driving those dierences in perception is, in part, the lack of organi-
zational standards or schemes to determine those values.
Rating schemes are standardized and are applied on either a proj-
ect-wide or (ideally) an organization-wide basis to clarify the relative
magnitude in terms of impact and probability for a given risk. ey
dene terms like “high,” “medium,” and “low” for those risk consid-
erations. Clear denitions and the means to test individual risks for
their compliance with those denitions support the terms.
Rating schemes are applicable any time a qualitative analysis will be
conducted. Because qualitative analysis prompts a review of the prob-
ability and impact of risk, schemes should be applied any time the
risks are undergoing qualitative review. e schemes are applicable
only after they have been developed and after there is general concur-
rence among team members or the project organization that they are
truly applicable in the environment in question.
Inputs and Outputs
Inputs to develop rating schemes will be evaluations from the organi-
zation’s most veteran project managers on the relative values for both
probability and impact. However, inputs to apply rating schemes will
be the actual schemes themselves, along with support and evaluation
of the team members’ project risks in question.
Outputs from developing rating schemes will be clear denitions of
terms and values for high, medium, low, and extreme probabilities,
as well as unambiguous denitions of impact values for such issues
as cost, schedule, performance, and other areas of importance within
the organization. Outputs from applying rating schemes will be prob-
ability and impact assignments for each project risk.
Major Steps in Applying the Technique
Unlike other risk management techniques, there are actually two
major areas of focus here. e rst is in developing the schemes; the
second is in applying them.
Identify basic probability values. Using a numeric scale and/or value
statements, a core group of project oce, senior management,
or project team members should establish the basic probabil-
ity values to be applied across the project (or ideally, across all
projects). ese values should be designed to minimize confu-
sion or misinterpretation of probability assignments, which risk
impact often inappropriately sways. e values should be set to
reect the organization’s tolerance for frequency of risk occur-
rence. us, organizations with a high tolerance for risk in gen-
eral (such as research and development operations) may classify
the low value using phrases like “won’t normally happen,” or they
may set it numerically at 30 to 40 percent. On the contrary, orga-
nizations with a low tolerance for risk (such as medical product
developers) may categorize their high value using phrases like
“could reasonably happen,” or they may set it numerically at 15 to
20 percent. Dierence in organizational concerns will inuence
what constitutes a low, a medium, or a high probability.
Publish probability values. Probability values should be docu-
mented and distributed to all team members so that they are
aware of perceptions on the potential frequency of occurrence