Task estimation and probable risks

Question

Let's suppose we are estimating a task (not by the planning poker). We have discovered that there are a few possible problems (risks):

Risk 1 - with the probability p1, ..., risk N - with the probability pN.

Each problem increases the amount of work. But only some of these problems may happen.

There are also some other problems which can arise (additional risks) only if some of the above-mentioned risks happen.

What is the way to calculate an estimate for this kind of task?

Answer 1

I'm a little bit worried about the way you phrased your question. From what I gather, you want some sort of formula or process to account for the risks, then use that formula to get the perfect estimate that will in turn protect you from those risks? Something like this doesn't exist.

There are a few problems with that kind of logic (and with estimating in general):

• an estimation is never a prediction or a certainty. By its definition, an estimation is something uncertain. Your estimate can thus be wrong compared to what something will actually take.
• in general, people suck at estimating. Using a formula or a well defined process for obtaining an estimate gives you a (false) certainty that you covered everything. But maybe you didn't. Deriving an estimate from proven quantitative methods will give you a better degree of confidence in the estimate, of course, and it's the professional thing to do, but confidence does not equal certainty.
• you might not be able to predict all the risks. Maybe you forget something, maybe you miss something else, etc. If you forget some risk and that risk then manifests itself, then whatever estimate you provided initially, taking into account other risks, will be wrong;
• identified risks can or cannot manifest themselves. You don't know which will manifest and which not, so now your estimate turns in multiple estimates for each combination of the risks happening or not happening. Which of the estimates is the correct one? You cannot know.
• even if you identify all risks, you will have to calculate an impact for each. The impact is again an estimation. And you can get that wrong too (as mentioned in the previous points). So your final estimate with all the risk impacts can also be wrong compared to what something will actually take.

I could go on with the examples but there is entire literature on the topic of estimation and risk.

Getting back to the question.

You obviously can't use just your base estimate (with zero risks considered) because something might happen. But you can also not include all the impact all of the risks can add, because some of the risks will probably not happen. So you need some sort of a risk buffer. How long will this buffer be? Between zero (i.e. no risks) and "a lot" (i.e. all the risks), obviously. But how much exactly?

You start by computing a risk exposure for each risk, which is the probability of the risk occurring multiplied by the impact the risk can have (e.g. 10% probability for risk1, with an impact of 7 man days on work if it happens, results in a risk exposure of 0.7 man days for risk1). You do the same for risk2, ..., riskN. All these added together will be your risk buffer.

But if you compute these, you will see that the buffer value will probably be much lower than the highest impact the worst risk can have. And just as well, the value of the buffer can be very large, much larger than the estimate itself. So are you going to chose to add this buffer? Or use a smaller buffer? Or a larger buffer? Basically how much risk you cover yourself from, and how much risk you just accept and move on?

You are now back to square one.

And the problem is that you are trying to get the estimate back as a number. An estimate is never a number. It's a range. You have best case scenario, worst case scenario, and most probable case scenarios. See for example the Three-point estimation technique. And this is where the most important part comes. How you communicate the estimate and how your boss or client deals with it.

An estimate is not something like 6 months, it's something like "With a degree of confidence of 68% we can say it takes 6 months. Why only 68%? Because there is risk1 that adds 3 extra months of work if it occurs, another 2 weeks if risk2 occurs, and so on". In other words "s#it happening is part of life". So more then spending large amounts of time trying to get the best estimates upfront, it's more important to have bosses and clients that understand an estimation is not a certainty or a commitment, that there are risks involved, risk that must be managed by either adding buffers or accepting the risk and moving on, and when something happens, to collaborate and decide on the next best course of action.

Answer 2

Think about your commute from your home to the airport. Assuming that your next drive will be starting at 8:00 am, and that you're commuting by your own car, what is the best case, most likely case, and worst case scenario from a time perspective it will take to get you to the airport in time for your flight. Now think about all of the umpteen risks that you face as you drive, e.g., tire failure, run out of gas, water main break on one of your roads, traffic accident, road construction, on and on. Now assign a probability and impact values to each and then somehow incorporate the expected value (probability x impact) to your initial estimate from the time distribution you established earlier. Then make that drive.

There's a ton of risks that you can include in your calculation for estimating but I am not sure it adds a ton of value to the estimate and then where you'll end up. You not only have epistemic risks (the type of risks you are talking about) but you also have aleatory (random) risks that simply play into it. Trying to find some type of formula that you think will increase the accuracy of your estimate is likely a fool's errand.

If you know your distribution of possible results against a work package, adding (or subtracting) some value in cost or schedule on maybe your top two or three risks in order to add contingency to your planning value is certainly okay and advised. But more than that is likely just consuming your estimating budget with little to no return.

Answer 3

This answer is merely a supplement to the two very good answers extant when I started to write.

First, let me assume that your question is based on the subset of risks that increase work; that you're trying to estimate the additional work/rework that would be the consequence.

Standard answer

I think the "standard" answer is to add management reserve adequate to cover the expected loss; in this case the expected loss would be the amount of rework required for each risk multiplied times the probability of that risk. Management reserve = SUM (P*I) where

• P = the probability that this event will occur (or that the uncertainty will be resolved in such a way to require additional work); this is the probability that a risk (uncertain event that might affect the outcome of your project) will become an issue (something that has happened or will happen that will affect the outcome of your project)
• I = the amount of additional rework

The other two answers express this well; I'm merely including it here so that I can reference the standard model.

note: it is possible, even probable to come to the same analytical outcome using either of the alternatives described below; they are documented only to provide a diversity of analytical approaches

Alternative 1 - from the physical security world

A relatively common alternative (although I rarely see it formally expressed) is to assume that each risk will occur, and estimate the rework that is required, then analyze the total set of rework. I first encountered this in the physical security domain; they don't estimate probabilities, they merely analyze consequences. Enumerate the risks as you have described, and then estimate the work that would be required by each issue (the remediation). Generally you'll find that the remediation activities are not independent. Sets of issues will require the same activity as a rework. When you spot a cluster of rework that recurs, create two alternative project plans. This gives you the opportunity to avoid the risk by pursuing the second project plan that avoids the rework.

Alternative two - from the information security world

The Society for Information Risk Analysis advances the field of study for information risk; they alerted me to research by Tony Cox that Risk matrices may be harmful Note well; summarization is mine. Although I haven't examined it, I'm told that their work overlaps with the analytical approach of actuaries. There are cases where standard practices for estimating Probability and Impact may result in outcomes that do not align with business objectives. I'm not aware of anyone applying this analysis to project management, but I think it is worth examining as an alternative risk management practice. Factor Analysis of Information Risk provides another approach (again, my summary does an injustice to the thoroughness of their approach) - Briefly summarized, FAIR formally expresses the desired outcome, examines the cost and work of the desired outcome if no action is taken, and then looks at alternative scenarios with different mixtures of mitigations applied. I think the essential elements to extract for your question are the emphasis on examining the difference between the planned cost and the cost with rework, and comparing the impact on your scope/schedule/cost/quality that result from pursuing each of the alternative scenarios.