What is Risk

What is Risk

Project Risk Management
Risk is an inherent factor of virtually every human endeavor. Human beings naturally consider risk and reward as part of the decision-making process. The consideration is not always formalized and may occur at a subconscious level.
The Concept of Risk
Risk is all around us; it plays a part in virtually everything that we do. It can be very difficult to predict and assess risky outcomes accurately.
‘Risk’ as a word originates from the French word Risk meaning ‘daring’.
Risk is a measure of the probability and consequence of not achieving a specific project goal. It therefore depends on both the likelihood (probability) of an event occurring and on the consequences (impact) if that event should it occur. Risk is therefore a function of the event, the probability of it occurring and the effect if it occurs. This relationship is sometimes known as the first level equation for risk and can be expressed as
Risk = f(event, uncertainty, consequences)
It is prudent to consider risk in terms of the second level equation for risk:
Risk = f(event, hazard, safeguard)
In this consideration, something – or the lack of something – causes a risky situation. The source of danger is a hazard and the mitigation or defense against the hazard is a safeguard .
Risk acts like a barrier to the development of effective strategy. Risks are evaluated in some way, and if the risk is perceived as being greater than some minimum threshold level, the organization shies away from encountering it; proceeding is too risky. However, effective risk management allows the risk to be controlled to such an extent that there is no longer any need to shy away from it, so that the risky application is able to be pursued ahead of the competition.
The impact of a risk and the probability of it occurring can be considered in terms of the exposure of the organization and the organization’s sensitivity to a particular risk profile. Exposure is a measure of the vulnerability of parts of the organization to risk impacts. Exposure arises when any asset or other source of value for the organization is affected by changes in key underlying variables resulting from the occurrence of a risk event. An organization is exposed to risk when a realized changes in a variable within a given time scale will result in a change in one or more of its key performance indicators. Exposure is therefore a measure of the vulnerability of an organization to stated risks. An organization’s sensitivity to risk is a function of three elements. These are the significance (or severity) of the enterprise’s exposures to the realization of different events (that is, sensitivity to such items as changes in competition, weather conditions, etc), the likelihood of the different events occurring, and the firm’s ability to manage the implications of those different possible events should they occur. Sensitivity is therefore a measure of likelihood and impact, modified to some extent by the ability of the organization to manage these variables.
Risk management is not only about competitor advantage in terms of approaching ventures that contain high risk levels. The organization that is able to develop an effective risk management program, within the limits of its own sensitivity and degree of exposure, is the one that can take good commercial decisions. Having mastered the risks that put the others off, the successful risk management organization is in a much better position to take advantage of risky ventures in the marketplace.
It is possible to say that risk is the distribution of possible outcomes in a firm’s performance over a given time horizon that are due to changes in key underlying variables.
The use of risks to create value is changing. The profile of risk management and the risks defined by organizations in decision making are also changing. As more risks come within the decision-making boundaries of an organization, the risk management system becomes more sophisticated and refined.
So risk is inevitable and can be good. There is therefore a need for some effective way of managing this risk to make sure that is effectively addressed and used. It is always unclear what will happen in the future; and opportunities and threats can be forecast with different degrees of accuracy. However, in general terms, the decision maker acting under conditions of risk would be most concerned with the following questions:
• What can go wrong with the project?
• What possible outcomes do we face as a result of these risks?
• Where do these risks and consequent outcomes originate?
• Do we have any control over these risks and if so are we using it?
• Are the risks and consequent outcomes related to any extent?
• What is the degree of exposure of the organization to these risks?
• How sensitive is the organization to each degree of exposure?
• Do these risks affect the achievement of the overall strategic objectives of the organization?
• What response options do we have?
• What contingencies or emergency responses are in place?
• Can we match the worst case scenario?
• If not which scenario reaches the limit of our response abilities?
• What is the potential reward associated with each risk?
• Are we prepared to accept a risk and corresponding outcome that is beyond our limits to absorb?
The Human Cognitive Process - Pattern Recognition and Attention
Decision making and risk are elements of the human cognitive process. People make decisions in relation to perceived rewards and risk. The decision-making process is largely dependent upon perceived rewards and risks. Perception of risk varies from person to person and in relation to the potential effects of the risk event. Most aspects of the human cognitive process make a subjective evaluation of risk.
Bounded Rationality
The approach to information processing is known as bounded rationality . It is based on the philosophy that a being will generally opt for rational behavior within constraints. Most cognitive processes will be based on reasoning, and therefore logical and rational outcomes, based on pattern recognition and learning will be naturally preferred to illogical and irrational ones.

Risk Forecasting and Analysis

Risk Forecasting and Prediction Momentum
Bounded rationality therefore uses knowledge of past events to assess a current risk in making a decision. This assumes that acceptable outcomes from the past will continue to be acceptable outcomes during the current evaluation process.
This is the concept of risk forecasting . In relation to risk forecasting, we can generally say that it is:
• based on experience. Experience gained in the past is used to analyze and forecast what might happen in the future.
• As much subjective as objective based.
• Possible to subject it to complex modeling as in chaos theory, although it is not restricted to complex mathematical modeling.
• An area that is perhaps best evaluated using a combination of modeling and subjective approaches.
• based on using data from past experience in order to allow extrapolation as a basis for predicting future trends.
In other words, what happened in the past and is happening in the present will continue in the future unless something happens to change it – known as prediction momentum.
In developing a forecast, a decision maker uses a two stage process. The decision maker infers what the future is like before the proposed action, and also infers what the future will be like after the proposed action. This is of course not an exact science. The future is uncertain, and the decision maker may make wrong assumptions and inferences. In addition, even in the most careful predictions, some unexpected mutation may affect the predictions.
Various forecasting techniques can be used and each has strengths and weaknesses.
Some important considerations are given below in relation to forecasting.

• Accurate data.
Any forecasting technique is only as accurate as the data used in developing and operating it. Most organizations store formal records and most individuals retain relatively accurate records and memories of their own experiences. If the more accurate the data is, the more accurate the prediction.

• Time limits.
Generally, the accuracy of any prediction model is a function of the time scale that is required. The longer the time scale, the more difficult it is to make accurate predictions. More and more variables and mutations come in to the equation as time continues.

• Cost.
Detailed and complex forecasting is a labor-intensive Endeavour. It can be very expensive to provide all the resources that are required. If fewer resources are provided, the overall accuracy of the prediction could be reduced.

• Vision.
Intuition and bias are powerful influences on any forecasting application.
It can be very difficult to erase them from the equation completely. Vision is an important attribute.

Intuition and Bias
Intuition and bias are major determinants in how successful forecasting models are in both application and outcome. In most real applications, the decision maker looks at a prediction model and then makes a decision based on his or her intuitive reasoning.
Intuition is a combination of experience and extrapolations forward. It is an example of pooled interdependency within the cognitive process. By using experience, the decision maker can look at all the data and information that have been stored in his or her long-term memory, and also at the pattern recognition information that is arriving in relation to the current situation. He or she can then combine the two and project the situation forward to decide on the best course of action. The extrapolation from known to unknown often includes large areas where definite information is lacking. Intuition can be both individual and organizational. Companies store and use collective experience in much the same way as individuals.
Bias is the tendency for a person or group to misinterpret data or observations because of their own perceptions or outcome preferences. A marketing team may truly believe that their company’s product is better than it actually is because they have been committed to selling it for a long period of time.

Risk Handling
So risk is all around us and it is essential for the propagation of enterprise and innovation. There will always be an element of risk in any enterprise, and this characteristic is not going to go away. The key factor is to manage risk.
This is done by deciding what level of risk is acceptable and what level is not acceptable. Risk that is not acceptable is transferred or reduced in some way.
Once the residual risk is at an acceptable level, it is managed so as to ensure that it does not affect the performance of the project and/or of the organization as a whole.

Risk Assessment and Control
There are different types of risk. Risks also have different characteristics. People often assess these characteristics as part of the risk analysis process. While this assessment is often subjective, it can involve highly complex objective analysis. Total elimination of risk is rarely achieved and is often impossible. Therefore, the assessment process acts as a means of evaluating the risk that remains so that some kind of monitoring and control system can be set up. This concept forms the basic elements of a risk management system.
Risk management is a strategic approach. Risk assessment and control have to form a part of a long-term operational process. Risks have to be calculated and analyzed in advance and then monitored against performance to identify where risks are changing and how effectively they are being managed. There is a tactical element involved as well, since responses may depend on the specific nature of the occurrence. However, it is important to realize that a risk management strategy should be developed in detail for a project before the project actually starts, the strategy being implemented as early as possible in the life cycle of the project.
Risk assessment is part of the collective risk analysis process. Risk analysis involves the determination of the probability of individual risky events occurring, and also of establishing some measure of the potential consequences of each event occurring, together with some kind of monitoring and control system to assist with the management process. Risk handling is the process of dealing with risks. It is not sufficient to identify and analyze the risks; the risks have to be handled in some way in order to reduce the likelihood of individual events occurring. Risk feedback is an essential section in the process. Feedback is the process where the results of occurred risks are analyzed and any results and items for use in future strategies are fed back into the system. Risk analysis, handling and feedback are often referred to collectively as risk control.

Elements of Risk Assessment
Risk assessment is about identifying and assessing all potential risk areas within the project. It is probably the most difficult phase of the project risk management process. Risk has been defined previously as a combination of uncertainty and constraint. Constraints are generally difficult to remove, but it is important that they are recognized and understood.
The essence of project management is planning, forecasting, budgeting and estimating, which implies that very little in the project is certain. Thus, determining the uncertainty in a particular project could just about include every aspect of that project. This is highly impractical because the cost and time required to carry out such an assessment would be prohibitive; common sense must therefore be applied to ensure that the process of risk assessment is restricted to attempting to select only those areas of the project with the most severe constraints and the greatest uncertainty.
It is nevertheless important to remember that the process is in fact an iterative one and that risk assessment is only complete when the assessors and project manager are satisfied that all undetected risks are insignificant.
The assessment process allows the risk taker to develop a risk typology. This can be based on probability and impact or on safeguard and hazard. The impact is the severity of the effect on either the budget, the schedule to project completion, the quality of the work, or the safety of the project. Whether the severity of impact of the risk or the probability of the risk occurring at all is high or low is a matter for the judgment of the risk assessor and the project manager.

Elements of Risk Control
Risk control involves the thorough investigation of the entire project and will include reviewing the project’s plans, documents and contract to identify all possible areas where there may be uncertainty or ambiguity about what is proposed or the method through which objectives are to be achieved. The constraints inherent in the project must underpin all these investigations and should be considered. The performance of individual sections or activities where risks have been identified is then monitored to ensure that risk is being minimized and to gauge the magnitude of any changes in the risk status of the activity.
Risk control is particularly important in monitoring the evolution of risks.
Because risks change over time in terms of probability and impact, it is imperative that any such evolutions are monitored and controlled. In modern business, rabbits can grow into sharks if you don’t watch them carefully!
Risk Identification
Risk identification requires different approaches and considerations by different people within the project. Any person’s perception of risk depends on numerous factors, including:
• where the individual is in the organization;
• the power level of the individual;
• the immediate area of authority of the individual;
• the responsibilities of the individual.

The risk itself, as an occurrence or event, will have a source and an effect.
For any given event, there could be numerous potential sources and numerous different effects. Control requirements will vary depending on the critical of the risk element and on the relative power and importance of the activity as part of the greater whole.
Some risks are more controllable than others, in that people can make varying efforts to try to avert them. Some events can be prevented to some extent, such as avoiding car crashes by regularly maintaining a vehicle. Others, such as accidents caused by other drivers, are very difficult for an individual to prevent.