

Like probability matrixes, assessing impacts can be just as problematic, if there is not a common definition of what each impact level means. In this way, when assessing probability, all team members have a common understanding of the meaning of each category Risk Impact Ranges An example could be as shown below: Label What does Rare or Very Low Probability mean? Therefore, it is recommended that each category has a probability definition. To clarify this we can add additional detail to each probability category so that there is a common understanding i.e. Some methods attempt to improve this by using categories such as Rare, Unlikely, Possible, Probable and Certain however, this still leaves us with the question of defining what these terms actually mean. The problem with these categories is that they can be very ambiguous and have different meanings depending upon who you asks. For example probability could be categorized into 5 levels: Very Low, Low, Medium, High, or Very High.

Risk probability characterizes the chance that a certain event may occur during the course of a project. In quantitative risk assessments, risk probability and impact inputs can be discrete values or statistical distributions. For qualitative risk assessment, risk scores are normally calculated using factors based on ranges in probability and impact. Typically, project risk scores are calculated by multiplying probability and impact though other factors, such as weighting may be also be part of calculation. It is important to consider such consequences when setting contingencies since, as would be expected, low probability, high impact risks require greater contingency than likely, low impact risks.Risk score is a calculated number (score) that reflects the severity of a risk due to some factors. Indeed, the effect of low probability, high-impact risks will be quite different from that of high probability, low-impact risks, even though individually the risks can the same product term (impact x probability). The correct treatment of risk requires both the impact and probability dimensions to be considered, and that focusing attention on those risks ranked as ‘riskiest’ by a multiplied figure of these two dimensions is dangerous. Unfortunately much risk analysis involves going through the motions to assign numbers without actually doing much thinking about what lies under the hood. Some advise caution, concluding risk matrices do not necessarily support good (e.g., better-than-random) risk management decisions, while others have described the PIM approach as hiding more than it reveals and that it can be a dangerous waste of time.

While risk matrices are viewed by some as useful for ranking risk in order of significance (the bigger the number, the greater the risk), it can be irrational when applied blindly. A risk rating such ‘15’ will have no absolute meaning, (it would be inappropriate to conclude that such a rating is fifteen times more important than rating of 1). The example shows a risk that has been assessed as ‘medium probability’, ‘medium cost impact’, generating a ‘risk score’ of 15. Probability impact matrix with risk score The most common such measure is to multiply your measure of probability of the risk with your measure of the impact of the risk as shown below: Risk Managers are assumed to be at the leading edge of their profession if they provide quantitative measures of both probability and impact, and combine them to give an overall measure of risk.
