Risk, Uncertainty, and Decision Analysis
Risk process and vocabulary
Risk management runs from planning through identification, qualitative and quantitative analysis, response planning, and monitoring. Distinguish a risk (uncertain event that, if it occurs, affects objectives) from an issue (a realized risk). Threats and opportunities are both risks; responses include avoid, transfer, mitigate, accept for threats and exploit, share, enhance, accept for opportunities. Know the difference between contingency reserves (for known-unknowns, within the cost baseline) and management reserves (for unknown-unknowns, above the baseline, requiring sponsor approval).
Analysis tools
Qualitative analysis uses probability and impact to prioritize, often with a probability-impact matrix. Quantitative analysis uses expected monetary value (EMV = probability × impact), decision trees, Monte Carlo simulation, and sensitivity (tornado) analysis. Understand that EMV of a risk is signed: a threat has negative EMV, an opportunity positive.
Traps
- Confusing contingency (known-unknown) with management reserve (unknown-unknown).
- Treating risk identification as a one-time event - it is iterative.
- Choosing a response without checking it against the risk owner's authority or the project constraints.
Rule of thumb
Decision tree example: Option A costs 100 and has a 30% chance of a 200 penalty. EMV of penalty = 0.30 × 200 = 60, so total expected cost = 160. Option B costs 140 with no penalty. Choose B (140 < 160). Always add the base cost before comparing.