Rating scheMes
Every risk event has both probability and impact. In most organiza-
tions, those values are established qualitatively rather than quanti-
tatively. at creates problems because perceptions frequently dier
as to what constitutes a “high” probability or a “moderate” impact.
Driving those dierences in perception is, in part, the lack of organi-
zational standards or schemes to determine those values.
Technique Description
Rating schemes are standardized and are applied on either a proj-
ect-wide or (ideally) an organization-wide basis to clarify the relative
magnitude in terms of impact and probability for a given risk. ey
dene terms like “high,” “medium,” and “low” for those risk consid-
erations. Clear denitions and the means to test individual risks for
their compliance with those denitions support the terms.
When Applicable
Rating schemes are applicable any time a qualitative analysis will be
conducted. Because qualitative analysis prompts a review of the prob-
ability and impact of risk, schemes should be applied any time the
risks are undergoing qualitative review. e schemes are applicable
only after they have been developed and after there is general concur-
rence among team members or the project organization that they are
truly applicable in the environment in question.
Inputs and Outputs
Inputs to develop rating schemes will be evaluations from the organi-
zation’s most veteran project managers on the relative values for both
risk ManageMent
probability and impact. However, inputs to apply rating schemes will
be the actual schemes themselves, along with support and evaluation
of the team members’ project risks in question.
Outputs from developing rating schemes will be clear denitions of
terms and values for high, medium, low, and extreme probabilities,
as well as unambiguous denitions of impact values for such issues
as cost, schedule, performance, and other areas of importance within
the organization. Outputs from applying rating schemes will be prob-
ability and impact assignments for each project risk.
Major Steps in Applying the Technique
Unlike other risk management techniques, there are actually two
major areas of focus here. e rst is in developing the schemes; the
second is in applying them.
Scheme Development
Identify basic probability values. Using a numeric scale and/or value
statements, a core group of project oce, senior management,
or project team members should establish the basic probabil-
ity values to be applied across the project (or ideally, across all
projects). ese values should be designed to minimize confu-
sion or misinterpretation of probability assignments, which risk
impact often inappropriately sways. e values should be set to
reect the organizations tolerance for frequency of risk occur-
rence. us, organizations with a high tolerance for risk in gen-
eral (such as research and development operations) may classify
the low value using phrases like “wont normally happen,” or they
may set it numerically at 30 to 40 percent. On the contrary, orga-
nizations with a low tolerance for risk (such as medical product
developers) may categorize their high value using phrases like
could reasonably happen,” or they may set it numerically at 15 to
20 percent. Dierence in organizational concerns will inuence
what constitutes a low, a medium, or a high probability.
Publish probability values. Probability values should be docu-
mented and distributed to all team members so that they are
aware of perceptions on the potential frequency of occurrence

Get Risk Management, 5th Edition now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.