# How do you measure risk?

As a related question to: What's the best definition and explanation of project risk?

What is the most useful way of measuring risk? I've been thought it's best to measure it in additional monetary cost to project budget. By writing down all 'risk events' and their related probabilities and incurred costs, we can calculate the 'risk value' of a project at any given moment in time.

This method seems a bit unintuitive to me though (does not really go well with the word 'risk'). I'd like to know what other methods of measuring risks are there.

On my projects all risk boil down to What will it cost if the risk event happens? For that reason, I try to express all risk in terms of cost. Everything ultimately costs money. Time costs money, so schedule slips can be converted into cash equivalents. Once everything is in the same units, you can rank your risk exposure objectively. I like to compare them all in terms of constant expected loss. The expected loss is the total likelihood of the event occurring (Event Probability times Impact Probability) times the total loss. A graph of these values allows you to see that risk 4 and risk 2 in the example have nearly equivalent risk exposure even though risk 4's total loss is \$150,000 and risk 2 has an estimated total loss of \$750,000

• +1 excellent point that even schedule slips cost money. But I prefer to separately manage the schedule vs. cost effects, because schedule slippages can't always be translated into dollar values. Unless your project is the Olympics! Commented May 1, 2011 at 22:39

The only risk I care is "What do I risk if not doing it?"...

It's pretty useful: I work on a lot of risky project, and even if they fails (it's rare), I never lose the whole thing: I just reorient the resources and recycle.

It cause a lack of efficiency day by day, but the risk of "doing" disappears, and I have done in two years most that my three predecessor who prefere only doing choices they can predict the outcome. So it's easy for them to evaluate, and they work very quickly, but they do very few and spend a great deal with evaluating risk and other thing they cannot say without trying out.

I just try, it's less risky ^^

• Hi Qvy, I will like to understand your answer. What I got was that every time you have a risk, you evaluate the cost of not acting on that risk. Is my interpretation correct?
– Geo
Commented Feb 8, 2011 at 3:21
• Yes, excuse me for my bad english ^^ Commented Feb 8, 2011 at 8:44
• +1 Risks can also be good risks. Many managers don't consider the effects of "opportunity risk", which is, as you pointed out, the risk of "Not acting". Thank you for pointing this out. Commented Apr 8, 2011 at 23:39

I love your questions since I struggle through measuring risk all the time.

I try not to use book definitions but I think to help you I will need to. A risk is defined in PMBOK as

uncertain event or condition that, if it occurs, has an effect on at least one project objective

So the way that I am currently measuring my risk is by categorizing them how they primarily impact the project. Either Scope, Cost or Time and then I measure the possible impact of that value. Now in reality, you could easily make a \$\$\$ amount from any of these 3 aspects, so if you want to simplify the equation, you just covert the scope risk into a dollar amount.

Hope this helps.

Geo

Quantitative measure is great, but most project risks can likely be managed very well using a 5x5 ordinal scale for both probability and impact, reserving the more intense and harder-to-do quantitative approach for more higher impact risks or where you might need that degree of precision for decision making against several alternatives.