0

Forgive me if this doesn't belong here, but I thought this more appropriate for PM than for Programmers or SO.

We use risk assessments where I work as part of the software development life-cycle. A matrix of impact (sometimes referred to as severity) versus likelihood is used to establish absolute risk. One of the levels of impact (or severity) is "None" which I take to mean 'if this happened there would be absolutely no impact'.

Have I missed something? I've asked colleagues but no one seems to be able to come up with a meaningful answer. What is the point of defining a risk which has no impact? Surely that is not a "risk" that is just 'something which can happen' and has no business on a risk assessment.

Improve this question

3 Answers 3

Reset to default
4

In my opinion you're right. If a future event has no influence on project (or, if it has 0 probability of happening), it should not be considered as risk.

Of course, having "None" in your risk log can show exactly this - the item was evaluated, its impact is considered negligible, so you should not care about it any more. It can be beneficial to keep them registered to show that it was already considered - so it will not surface later as a new risk.

Improve this answer
1
  • +1 for your first paragraph. But there is a difference between "negligible" and "none". 'Negligible' means the impact would be small but real whereas 'None' means zero impact. If a risk has been addressed and found to not be a material risk then in my view it must be closed. There is no sense in keeping a non-risk open. It is always possible to reopen a closed risk if information changes and shows it has gone from no impact to some impact.
    – Marv Mills
    Commented Nov 11, 2015 at 13:36
1

If you are using a 5x5 matrix, which is a two dimensional view of risks, then "none" should not be an option. If you are assessing risks this way, then a zero impact is not a threat. It's nothing.

If you are using more quantitative techniques, where you may capture a probabilistic distribution of possible results, a zero impact--or a negligible impact--could be captured. For example, if you are assessing the risk of a schedule variance, you may establish a probabilistic triangular distribution ranging from a favorable variance of, say, three weeks, to an unfavorable variance of 10 weeks. Within this range, no impact, i.e., deliver on time, is a possibility.

Improve this answer
0

One place where a zero impact/probability risk can be useful to document is when you are talking about the impact/probability after you have implemented your risk response plan. At my workplace it is common practice to document impact/probability of risks with and without the response plan.

For example, assume you have a risk of moderate probability but your team finds a clever way to avoid that risk altogether. That reduces probability to zero. But you could still keep that risk on your register in case an issue comes up that prevents you from continuing to avoid that risk.

Improve this answer
1
  • I would disagree with your last line. If you have mitigated the risk, the risk should be closed- it no longer exists. If there is another risk that your mitigation actions might fail then that should be raised as a separate risk as it will have different causes, different mitigation and different outcomes to the original risk. I believe one should always strive to keep the risk log "clean" and only show real current risks. If it is not real or current it has no place on the risk log and only serves to conceal the real risks behind noise and confusion about what is real and current.
    – Marv Mills
    Commented Nov 11, 2015 at 13:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.