“If I perform risk management for a project, we might be more successful, but I’m not sure what risk really is.”
The original meaning of risk is associated with gambling- to risk is to gamble. When we take risks, there is a chance of gaining and perhaps an equal chance of losing. Project risk has evolved to mean more.
Uncertainty in business ventures has come to be known as risk. Every business venture is basically risky. In new business ventures, project initiatives, and new product development, there are unknown factors and their impacts on the venture are equally unknown. The unknown factors could be favorable or unfavorable. There is a probability that one may either gain or lose business value. However, a loss may hurt the venture. Most business ventures like to assess the probability of loss and compare it with the probability of gain. The decision to go ahead depends on whether the odds are favorable or unfavorable. Risk is the probability of suffering loss. Using this approach, the PMO or Project Steering Committee will not pursue a venture that has a risk probability greater than 49 percent. The odds must be in favor of winning the gamble, even though the tilt is marginal.
Definition 1.1: Risk is the probability of suffering loss.
A refinement of this definition is to include goals, gains, or opportunities in the statement. Perhaps it is implied and obvious that risks relate to gains. Nevertheless, if risks are divorced from the associated goals, then one sees just a set of problems. A risk list should not be reduced to a problem list. Risks have a much broader role to play. We should always include the expected and potential gains that a project offers in the risk assessment.
Definition 1.2: Risk is the probability of suffering loss while pursuing goals
Then there is the consideration of the magnitude of harm from the risk. What will its impact be? The consequence of the risk is evaluated. If the harm is tolerable but the gains are attractive, new decision rules can emerge. One may even take a risk where the occurrence probability is greater than 50 percent. The threshold is not 49 percent. Risk is seen as a weighed parameter and can fluctuate. The weight is based on the magnitude of loss due to risk, if the risk ever occurs.
Risk magnitude is measured using many different estimation methods. When the estimations form a range; such as a minimum of 12 and a maximum of 20, for a measure you want to maximize. You would compute half the distance between the max and min which is 4. Your estimate magnitude is 16 (the mean of the two numbers) with a risk of 4. 4 is 25% of 16, so you might report a risk magnitude of 25%. My point here is magnitude is dealt with in multiple ways.
Risk is defined as the combination of probability of occurrence and the magnitude of loss it causes. This combination is also known as risk exposure. The new definition below takes this into consideration.
Definition 1.3: Risk is the combination of probability and magnitude of loss.
Typically, project risk is defined and measured using Definition 1.3. Measure-ment of risk is often a subjective process. Both the probability and loss are measured using linguistic measures such as "high," "medium," and "low" which are nominal metrics. What matters is not just the risk, but its intensity, measured as risk exposure. Will the risk occur? What will the harm be? These are more significant questions than, "What is the risk?"
A clarification is due at this juncture. If loss occurs because of factors within our control, it is not considered as a risk. Only factors beyond our control give rise to risk. This is the general perception that makes risk management simple. Internal factors are within our control. Hence, only external factors that contribute to loss, which are not under the project manager’s direct control, qualify as risk factors. When this notion prevailed, people believed that they had not caused the risks.
Sometimes, processes are not in control and results are not predictable or what were intended. Such losses become risks. In this case, the origin is not the criterion - predictability and control are important factors. Hence, a complete risk definition would be:
Definition 1.4: Risk is the probability of suffering loss while pursuing goals due to factors that are unpredictable or beyond the PM’s control.