How to do risk profiling?

Question

I've recently started working on a data center migration project for a large financial services client.

One of the tasks I'm accountable is risk profiling the migration based on the as-is and to-be solution planning - inputs will be things like planned migration approach, Business & IT Service architecture and other domain specific information.

Can anyone describe any risk profiling techniques and the logic behind them?

Answer 1

TL;DR

Risk assessment is a broad topic that can (and has) filled many books. There is no simple answer to your question. However, there are certainly starting points.

Borrow from Security/Audit

The security and audit fields have some well-defined threat (risk) assessment models. For example, OWASP details the Microsoft Threat Modeling Process. While this model is really focused more in information security than project risk in general, it's still a sound approach to examining risk.

Commercial Risk Assessment Standards

There are also a number of commercially-available risk assessment frameworks and standards. These include:

• AS/NZS ISO 31000:2009 Risk Management – Principles and guidelines
• NIST 800-30 Guide for Conducting Risk Assessments
• Carnegie Mellon's OCTAVE framework

ISO 31000 would appear to be the most domain-agnostic, and says it "can be used by any organization regardless of its size, activity or sector." Your mileage may vary in this regard.

You should be able to find other frameworks dedicated to non-IT projects, but you'll have to use some domain-specific knowledge to research the issues if you want anything more than a generic approach. On the other hand, if all you want is a generic approach, then any of the risk assessment models should suffice; just tweak them to suit your project's particular business domain.

Answer 2

In addition to @CodeGnome's advice, you may also want to consult the Society of Information Risk Analysts.

riskscience podcast currently discussing concepts of risk tolerance that may be related to "risk profiling". In a recent episode they've discussed a number of risk frameworks beyond those that @CodeGnome cited. They are focused on information risk analysis, not on project risk analysis, but I highly recommend their work, particularly Tony Cox's work on the limitation of PIG (Probability Impact Graphs)

PMI publishes the Practice Standard for Project Risk Management - which is authoritative but expensive.

@CodeGnome mentions the NIST 800-30 guide about which I am skeptical; it is adequate for starting risk management, but the values tend not to be calibrated and are not useful for making decisions - PMI's standard is better, but I think it still falls short of the real goal. I don't think I would want to base a monte carlo analysis on risk assessments done with either system.

FAIR is an expensive system at the other end of the spectrum; it is quite likely more than you need (more expensive, more thorough, and more complicated). But if you're serious about risk management, I highly recommend learning FAIR. (I can't afford it right now, but I've hung around the edges long enough that I understand the methodology, even if I lack the details.)

Answer 3

Before starting the assessment think about how you will present it

@CodeGnome and @Mark C. Wallace have given you excellent references for risk assessment. However, it is good to think about how you are going to present your findings before jumping into it.

I recommend presenting it in a Probability Impact Grid overlaid with the Risk Appetite of the business:

"Each risk should be rated in terms of its probability of occurrence and impact on the project. These figures should be multiplied together to determine an individual rating for each risk as a percentage. Probability x Impact x 100 = Risk Percentage. In the table above, the cut-off points were <5% (green), >5% to <15% (yellow) or >15% (red)"

For example, if you estimate the probability as very low and the impact as medium, that risk will get mapped to the 2% box.