In risk management within projects, probability is used as a way to understand how likely risks are to happen in the future. This is obviously a well-established area.

Presumably there is nothing limiting us from applying the concept of probability to issues [risks that have materialised] that could have happened in the past (where uncertainty exists in whether the issue did or did not occur).

As an related example, I may believe that our organisation has been subject to a cyber attack within the last week. However, we haven't observed this attack happening directly and so we have to build up a picture of whether or not it happened based on information we uncover. It seems appropriate to me that I can take and apply the concept of probability and therefore assess issues in the same way I assess risks.

Does this logic seems permissible? Is this how people think about issues within their risk management?

  • An interesting concept, but I think you have some confused thinking there. All you are actually saying is "can I judge the probability of something happening by examining the evidence?". And obviously the answer is 'Yes'. I think conflating it with Risk Management is a red-herring and serves no purpose, because Risk Management is based on exactly the same principle- one looks at the future and one looks at the past. So ultimately this question is probably off-topic as it is asking for opinions, or is unclear because the answer is so obviously 'yes'.
    – Marv Mills
    Commented Jan 14, 2016 at 13:49
  • I think it is commonly accepted that an issue is a risk where the probability is 100%
    – MCW
    Commented Jan 14, 2016 at 20:05
  • If that is the case Mark, then how would you recommend we show uncertainty in whether an issue really does exist? Is there another parameter to add to the equation? Commented Jan 15, 2016 at 10:21
  • @MarkC.Wallace Philosophically perhaps, but not in practise in my experience. The data and actions around the two entities are quite difference, often with very different audiences I find.
    – Marv Mills
    Commented Jan 15, 2016 at 11:54

2 Answers 2


Probability does not change whether an event is in your awareness or not. For example, approximately 1 in 8 women will develop invasive breast cancer. This translates to over 200,000 new cases each year or almost 4,000 cases a week. This probability is consistent week after week, including this past week, despite the fact I know of no one in my small world impacted with this diagnoses in the past week.

Things in the past are certain. Either something happened or it did not happen. However, if you are studying the past at a macro, population level, then the known probability exists in terms of locating observations of what did happen.


When assigning probabilities to potential risks, you're playing a sophisticated guessing game. Guestimate is the word.

Having data of risks that actually affected previous projects is valuable and should help the guesstimating.

But you cannot say that since it happened in the past, therefore its probability is 100%. Au contraire, sometimes you may be tempted to apply the lightning doesn't strike twice concept, and lower its probability of happening again.

All historical data does is help the guesstimating somewhat, since you still have to guesstimate the other risks and decide how to rate this known-risk against the unknown ones.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.