I've been working the last couple of months on a team creating standardized project management processes, with an external PM consultant. Besides it being fun watching one more stubborn and strong-opinioned co-worker driving the consultant out of his mind, there are some points I also disagree with him. Most of all, his way of using the risk analysis matrix.
For those that never had to deal with that: it's simply a matrix with the probability of a certain risk coming true on one axis, and the cost of it coming true on the other. So one can create clusters of risks that are:
* unlikely and insignificant
* likely and insignificant
* unlikely and significant
* likely and significant
As you certainly see already by gut feeling, risks that qualify as "likely and significant" need to be given a lot of attention, while unlikely and insignificant risks can practically be ignored. The others... well, they need consideration and observation, especially if it costs money to bring up countermeasures. And here's the issue:
This guy has this at first thought great idea of quantifying risks by multiplying the costs of occurance with the probability of occurance. Mathematicians call this the "expectancy". A risk with a higher expectancy is a bigger issue than one with a lower expectancy.
But let's look at some examples:
1) 0.1% chance of occurance, cost: 10,000,000 €. The big desaster, Extremely unlikely. Expectancy: 10,000
2) 50% chance of occurance, cost 20,000 €. Highly likely and still expensive. Expectancy: 10,000
I think it's already plain to see that these risks, despite having the same expectancy, are by common experience not at all equal. Personally, I'd rather bet on a 99.9% chance than on a 50% chance, unless the 0.1% stake is really high and the 50% stake is really low.
But things get even worse with that method: so someone goes and assumes the first risk - it's all guesswork anyway, keep that in mind - to be 0.15%. New expectancy: 15,000! In that case, it would clearly take priority over the second risk with its mere 10,000. Though all that happened was a large growth on an extremely small scale. A growth that's based on nothing but a guess. So what is the exact probability of rain on next week's Tuesday?
This method not only putting values in relation to each other that are actually rather unrelated, it also implies that those values have any actual accuracy.
Next step, he's using the expectancy to see whether a certain monetary effort to advert the risk is worth it. That basically fails with the same issue: is it worth spending 5,000 on a 0.1 chance to lose 10 millions? Is it worth spending 5,000 on a 50% chance to lose 20,000? Well... maybe. However you look at it - you're simply taking a bet, and no numbers will really help you.
This calculation only works if your not doing one project with those risks, but many projects. In that case, you can estimate an
average of 10,000 per project in the long run, and the preventive costs of 11,000 per project not being worthwile. But not for one single project.
I'm a bit afraid that this method gives poeople the wrong ideas...