Describing Risk: Accurate Description = Better Management

When it comes to project risk management, it is not only important to understand the definition of risk, but it is equally important to know how best to describe risk. A badly described risk can, at best, result in false assumptions being made about the risk and, at worst, result in the wrong actions being taken to control the risk which turn out to be completely ineffective.

Risk is essentially made up of three components, these being:

• Threats or Opportunities
• Risk Events
• Risk Impacts

In order to put the importance of describing risk accurately into context, I would like to recount a personal event which took place one day, back in 1987, while I was competing in a national hang gliding event.

It was a warm, sunny afternoon in July 1987, with a steady 15 knot north easterly wind blowing. Around forty fellow hang-glider pilots were gathered at the top of One Tree Hill, all having entered the annual spot-landing classic competition that year. As luck would have it, I was currently lying in joint second position. The objective of the competition was to make a controlled landing within a 10-meter diameter target, marked on a field about 1 kilometre away and some 2,000 feet below us. At around 4pm, wind conditions changed and swung from being a steady north easterly to a variable north westerly. Most pilots packed up their gliders and headed back down the hill to go and enjoy a cold drink at the local hotel, but a few of us remained behind, assessing conditions. All I needed was to make a controlled landing in the outer-most circle of the target, and that would be enough to make me the outright winner of the competition. After a brief consultation with my instructor and mentor, I decided to go for it. The launch ramp was in a fixed position, facing north east, and couldn’t be moved, so I needed to adjust my take-off run to compensate for the change in wind direction and strength. I did this by putting most of my weight against the left down-tube and angled my run as much as I could into the wind as I charged down the ramp. By virtue of the fact that I am still here to tell this story today, proves that my strategy worked and, even better, I managed to achieve my goal by making a somewhat tenuous landing within the target ring, which was judged to have been “controlled”, but only just!

After landing, a few pilots who had stayed behind to watch, came up to offer their congratulations. However, I remember one of them saying, “Mike, you took quite a risk taking off in those conditions!” I had to agree that it certainly had been a risky decision, but I was also interested to know what his view of the risk was, so I asked him. His response, which was also something that I could not disagree with at the time, was, “Well, there was a big risk that you could have been killed.”

Now, being only twenty years old at the time, and not all that well versed in the nuances of risk management, this statement made perfect sense to me and I left it at that. Some thirty years later, however, with a few more miles under my belt and now spending most of my days reviewing risks and risk descriptions, I’m a bit more judgemental when I hear statements along the lines of, “There is a risk that someone could get killed”. Primarily because the person who has uttered that statement has not actually described the risk at all. They have only described one of the potential impacts of the risk.

And that, finally, gets us to the importance of describing risk accurately. As long as all three components that make up a risk are captured in the description of your risk then, I would say, you have accurately described the risk. That would be to:

• Describe the threat (or opportunity) which is the source of the risk,
• Describe the event that could result from the identified threat or opportunity,
• Describe the consequences (or impacts) of that event.

But how does accurately describing a risk help you manage it? Let’s go back to my risky hang-gliding experience for a minute and have a look at how that risk may be better described and, hence, how we can manage the risk based on its description.

Firstly, what was the threat? For the purposes of this analysis, we need to temporarily set aside all the other threats associated with hang-gliding in general, and focus only on the immediate threat which increased the “effect of uncertainty on my objective”. And that was a change in weather conditions.

Secondly, what was the event? The event was a possible failure to take off correctly.

Finally, what were the potential consequences? Well, these are numerous and could have ranged from simply not making it to the target landing zone, to damaging the glider, to personal injury or even death. Now, in terms of Threat Risk Management, we generally look at the worst possible outcome so, in this case, we would consider that to be death.

Therefore, an accurate description of the risk I took back in July 1987 could be stated as: “Failure to take-off correctly (EVENT) because of adverse weather conditions (THREAT), resulting in potential death (IMPACT)”.

However, when it comes to controlling risks, specific plans and actions need to be implemented which separately manage the probability of risk occurrence and the subsequent impacts of the risk. It is therefore often more practical to describe the risk in terms of the threat (or opportunity) and event only, and then list out the potential consequences separately. This then enables one to hone in on specific probability response plans and separate impact response plans. So, taking the hang-gliding risk description one step further, we could revise this to say the risk is: “Failure to take-off correctly (EVENT) because of adverse weather conditions (THREAT)” and the potential impacts of this risk are: “A long walk home, property damage, personal injury or death”.

With that revised description, we are now better placed to identify suitable response plans separately for probability and consequence, which may be tabulated as follows:

You will notice that all the probability mitigations taken in this example dealt with mitigating the event only, and not the threat. In most risk situations, we would look to mitigate the threat as well as the event, to reduce the probability of risk occurrence. In this instance, however, I had accepted the threat of adverse weather conditions and was therefore committed to the event, leaving me no option but to mitigate the event only and, of course, the potential impacts!

For more information about our project risk management services and software, or if you just want to express your own views on the subject, please feel free to get in touch via our “Contact Us” page.