Risk Management: From Identification to Risk-Adjusted Reserves
Risk Management: From Identification to Risk-Adjusted Reserves
Risk management treats uncertainty as a source of both threat and opportunity. Candidates must distinguish a risk (uncertain future event) from an issue (a realized problem), and must know risk appetite, tolerance, and thresholds. Key tools include the risk breakdown structure (RBS), cause-event-effect statements, probability-impact matrices, risk urgency assessment, EMV, decision trees, Monte Carlo simulation, sensitivity analysis, and correlation modeling. Responses for threats are avoid, mitigate, transfer, accept, and escalate; for opportunities they are exploit, enhance, share, accept, and escalate. Contingency reserve covers identified risks; management reserve covers unknown unknowns.
Traps: qualitative scores are ordinal, not dollars; do not add P80 values across work packages; correlation raises portfolio risk; transferring a risk does not eliminate it; and a response must be cost-effective and assigned an owner. Avoid double-counting the same risk in several categories. Risk registers are living documents, not one-time lists.
Worked example: Three independent risks have EMVs of 0.20 × $100k = $20k, 0.10 × $300k = $30k, and 0.05 × $1M = $50k. The EMV-based contingency is $100k. That is an expected value, not an 80% confidence level; because the loss distribution is skewed, the P80 contingency from a Monte Carlo run is typically higher, and it rises further if the risks are positively correlated. Rule of thumb: use EMV for expected contingency and P80 for budget confidence.