Assessing and managing important risks

A common problem in project risk management processes is the need to determine the relative significance of different sources of risk so as to guide subsequent risk management effort and ensure it remains cost effective. A common approach is to rank risks in terms of probability and impact to identify sources of risk which will receive the most attention. This paper examines the shortcomings of this technique in guiding the analysis and management of risks and considers the information needed for a proper assessment of importance. For cost-effective management it is desirable to distinguish not only between the size of impacts and probability of impacts occurring, but also other factors such as the nature of feasible responses, and the time available for responses. The paper offers some practical suggestions for dealing with this problem.