Making risk assessments more comparable and repeatable

Many of the objections to implementing Risk Management and acting upon risk results hinge on the subjectivity of the risk assessment system. This subjectivity makes it difficult to make risk assessments justifiable, repeatable, and comparable over an entire project, program, or organization. One cannot easily justify assigning a 30% likelihood to a risk occurring when others with more, the same, or less experience are ascribing a 60% likelihood of occurrence to a similar risk. How to get all (or most) risk assessments, regardless of type (software, hardware, integration, programmatic, external, etc.), justifiable, repeatable, and comparable has been one of the holy grails of Risk Management for years. The methodology outlined in this paper meets at least some of this requirement. The methodology requires incorporating the Likelihood of Occurrence into a set of specifically defined sublevels under each risk category rather than using it as a separate multiplication factor. Basically, the assumption behind this methodology is that the more mature the process, the more experience available, the more detailed the design, etc., the lower the likelihood of occurrence of a specific risk becomes. Making this assumption, incorporating the likelihood into each specific sublevel and requiring justification for each choice then allows the establishment of more representative scores for project risks and allows risk information to be presented in a justifiable, repeatable, and comparable fashion. © 2010 Wiley Periodicals, Inc. Syst Eng 14: 173–179, 2011