The Risk Register That Only Goes Up
You facilitate a risk workshop for a $30M hospital fit-out. The register has 140 risks, 96 rated 'high,' and no owners assigned to 60 of them. The project manager says the register is 'comprehensive' and resists pruning because 'we can't delete risks, that's unsafe.' The quantitative analysis uses a simple expected-value sum: probability × impact, added across all risks, producing a contingency of $9.4M - 31% of project cost. The board has capped contingency at $4M. Two risks are correlated: a late equipment delivery and a commissioning delay, both driven by the same sole-source vendor.
1. Diagnose why the $9.4M contingency figure is unreliable.
Read the worked answer
Three separate defects, each of which inflates the number:
- Expected-value summation assumes independence. Adding P×I across risks double-counts correlated exposure. The late equipment delivery and commissioning delay share a sole-source vendor - they are not independent events. If the vendor slips, both fire together. Summing them treats them as if they cannot co-occur, which understates the tail while the additive method overstates the mean. Either way the single number is wrong.
- No owners on 60 risks means no mitigation is actually happening. An unowned risk is a register entry, not a managed risk. The P and I values for those 60 are almost certainly stale and optimistic, because nobody is tracking them.
- 96 'high' ratings out of 140 signals a broken scale. When two-thirds of risks are high, the rating conveys no prioritization. The workshop has produced volume, not analysis.
The $9.4M is a sum of unvalidated inputs. It cannot be defended to a board and should not be presented as a contingency.
2. The PM refuses to remove any risk. How do you get to a defensible contingency within the $4M cap without deleting risk?
Read the worked answer
Reframe: the goal is not fewer risks, it is a prioritized, owned, modeled set. Nothing needs deleting.
- Separate the register from the model. Keep all 140 risks in the register (the PM's concern is legitimate - a risk log is an audit record). Build the quantitative model from the subset that is material and non-trivial. Immaterial risks stay logged and monitored but do not drive contingency.
- Assign owners to all 60 orphans before any number is finalized. Unowned risks cannot be assessed credibly.
- Re-baseline the rating scale so 'high' means something. Use a calibrated probability-impact matrix; most of the 96 will migrate to medium once assessors apply consistent criteria.
- Model the correlated pair jointly, not as two lines. Use a scenario or a correlated Monte Carlo so the vendor risk is counted once, with its combined impact.
- Run a Monte Carlo over the modeled set to produce a distribution, then present the board with a choice: e.g., P50 within cap, P80 above it. The $4M cap becomes a stated confidence level, not an arbitrary cut.
- Show the board the trade-off explicitly - what risk exposure the cap accepts. That is a governance decision for them, made with eyes open, rather than a number quietly trimmed to fit.