Quantitative Project Risk Register
A construction project company evaluates the risks of a certain project and decides which mitigating actions shall be accomplished to minimize risks
Financially quantifying project risk instead of plotting colors on a heat map
A risk register is a tool in risk management and project management. It is used to identify potential risks in a project or an organization, sometimes to fulfill regulatory compliance but mostly to stay on top of potential issues that can derail intended outcomes.
In this example, we will argue why a qualitative risk register or heat map that only attempts to “multiply” frequency times severity to obtain a “quantitative” risk register, is a very poor and incomplete representation of project risk and its mitigations strategies.
We start with a list of risks on a project, determining its probability or likelihood of its occurrence rated on an integer scale, and also of its impact (or consequence or severity), if the event actually occurs rated, on an integer scale. This constitutes what has been called a quantitative risk register.
One specific criticism with quantitative risk maps, is that they do not deal adequately with risks that might occur more than once in a project. When we add probability distribution functions to correctly quantify for frequency, we correct this weakness. We also add distribution functions for quantifying for severity or impact of each one of the risks. Adding these two pieces will now allow us to run a Monte Carlo simulation on the risk register and obtain a distribution curve of total project risk. Correlation is added to consider the interconnection of some risk lines to others. We will be then able to analyze integral project risk and correctly rank the relative importance of each individual risk
Then, we insert mitigation strategies for each risk line. Mitigation strategies are intended to reduce the frequency, the impact, or both dimensions of any risk. Mitigation does not come freely. Cost of mitigation is deducted during the simulation. Therefore, we will be able to view quantitative risk before and after mitigation strategies are applied.
However, some mitigation strategies might be more expensive on its application than bearing the risk itself. Optimization techniques will be applied here to evaluate what mitigation strategies minimize the total impact of risk, given the connection or correlation of the risk themselves.
At the end, we compare qualitative heat maps versus quantitatively simulated risk registers.