StudyDaddy Management Project management overview paperConduct research using the CSU Online Library and find at least two articles on prioritizing projects. (ATTACHED A FEW, USE AS NEEDED)Compare and contrast the two art

Project management overview paperConduct research using the CSU Online Library and find at least two articles on prioritizing projects. (ATTACHED A FEW, USE AS NEEDED)Compare and contrast the two art

104 JOURNAL OF MODERN PROJECT MANAGEMENT • MAY/AUGUST • 20182018 • JOURNALMODERNPM.COM 105 RISK MATRIX • ABSTRACT • KEYWORDS Risk Management • Heat Maps • Matrices Heat map risk matrices are widely used to prioritize risks. They are Standard Operating Tools for risk management as prescribed by the Project Manage- ment Institute (PMI), International Council on Systems Engineering (INCOSE), and many other organizations. They are widely used in projects and programs structured for product development, business, construction, R & D, medicine, and politics. However, they suffer from several weaknesses, notably subjectivity, symmetry, category prioritization reversal, and a failure to account for Risk Aversion, which often dominates how individuals and companies feel about risk.

Because of this, they can lead to serious mis-prioritization and mismanagement of risks. We propose an alternative to the standard risk matrix that accounts for these deficiencies and provides a significantly better risk prioritization tool. Two field trials were conducted to demonstrate the benefits of the alternative method for project managers.

JAMIE P. MONAT • Systems Engineering Program • Worcester Polytechnic Institute - Worcester, MA - USA • [email protected] SCOTT DOREMUS • Systems Engineering Program • Worcester Polytechnic Institute - Worcester, MA - USA • [email protected] HEAT MAP RISK MATRICES An Alternative to for Project Risk Prioritization DOI NUMBER: 10.19255/JMPM01611 INTRODUCTION --------------------- Project Risk Management typically involves 5 steps (Wijnia (2012), Systems Engineering Pro- cess Office (2002), Microsoft (2017), Project Management Institute (2008).):

1. Risk Identification 2. Risk Assessment/Analysis 3. Risk Prioritization 4. Risk Response Planning 5. Risk Monitoring Each step is challenging, but all are important in the proper management of project risks. This paper addresses Step 3 (Risk Prioritization) only, assuming that project risks have already been identified and assessed with respect to probability (or likelihood) and impact.

Risk matrices (also known as “probability and impact matrices” or “Risk Heat Maps”) are two-dimensional arrays that typically list risk impact on the abscissa and risk probability on the ordinate (Project Management Institute, 2008; Cox, 2008; INCOSE, 2011; Alleman, 2010).

They are often used to prioritize risks. A typical risk matrix is depicted in Figure 1. 1. They are qualitative and subjective, and definitions of “high”, “medium,” and “low” may mean different things to dif- ferent people.

2. They are typically presented as symmetric about the diago- nal, which is often invalid.

3.

They do not account for risk aversion, which is manifested by almost every entity in making decisions.

4. The breadth of the categories may result in serious prioriti- zation errors.

These flaws have been demonstrated and well-documented. Many researchers (Hubbard, 2009; Ball & Watt, 2013; Cox, 2008; Duijm, 2015; Aven, 2017; Wall, 2011) note the subjectivity associated with assigning both probabilities and impacts. Hubbard (2009) calls the use of risk matrices “borderline or worthless” and Cox (2009) calls it “worse than useless.” Wall says that “their theoretical basis is su- perficial and the validity of the qualitative information they employ is highly suspect.” Duijm agrees with Cox but makes several recom- mendations for Risk Matrix use and design because “attempting to curtail their use will be futile.” Ball and Watt also agree with Cox in that “there simply may be no right way to fill in these matrices” and go on to state that they belie a spurious simplicity. Bahill and Smith (2009) list 9 flaws associated with Risk Matrices. Oboni and Oboni (2013) claim that “[Risk Matrices] can be misleading, and expose organizations to potential litigation,” and also that they “have a number of staggering intrinsic conceptual errors, with potentially dramatic negative consequences on their users.” Pickering and Cow- ley (2010) note that on a plot of Probability vs Impact, iso-risk lines should be hyperbolic and thus the rectangular categorizations of a risk matrix are conceptually wrong, yielding over- and under-prior- itization of risks. They further state that “….there appears to be little scientific analysis of their value in improving risk related outcomes.” Thomas et al. (2014) note that “Risk Matrices produce arbitrary decisions and risk-management actions. These problems cannot be overcome because they are inherent in the structure of the Risk Matrices.” Wijnia (2012) argues that “The problems and criticisms [associated with risk matrices] concentrate on 3 points: (i) the risk matrix does not prioritize distinguishable risks, (ii) the risk matrix prioritizes risks incorrectly, and (iii) the risk matrix results in incor- rect decisions on mitigations.” Despite these known issues, heat-map risk matrices are still widely used and, in fact, are recommended by prestigious organizations such as the Project Management Institute, the International Council on Systems Engineering, and the U. S. Department of Defense, pos- sibly because the flaws are not well-understood or because the al- ternatives are perceived to be too complex. In this paper, we attempt to simplify some of the arcane technical explanations of the weak- nesses and present a simplified, practical, alternative approach to Project Risk Prioritization. FIGURE 01. Typical risk matrix. 2 Impact: Probability Low Medium High Very High Very High High Moderate Low Figure 1: Typical risk matrix. Heat map -ty pe risk matrices are implicitly based on the expected value theory of risk, in which expected loss (EL ) is the product of risk probability and risk impact: EL = P x I where EL = expected loss P = Probability of the risk occurring (between 0 and 1.0) I = Impact of the risk (often expressed in dollars) For example, if an individual believes that there is a 70% chance of losing $100,000, then the expected loss is $70,000 according to Expected Value Theory. Using this principal, t he risks are color-coded, typically using red to indicate risks having high probability and high impact ; orange or yellow to indicate risks with intermediate combinations of impact and probability ; and green to indicate risks having either low impact or low probability or both . Red risks take the highest priority, yellow and orange intermediate, and green the lowest priority. Once risks are prioritized, organizations typically apply most resources and urgency to their highest -priority risks ; lower priority risks are de- emphasized and may be eliminated entirely from further risk management. Improper risk prioritization can waste resources, cause projects to fail, and in extreme cases cost lives . Risk matrices suffer from serious flaws: 1. They are qualitative and subjective, and definit ions of “high”, “medium,” and “low” may mean different things to different people. 2. They are typically presented as symmetric about the diagonal, which is often invalid. 3. They do not account for risk aversion, which is manifested by almost every entity in making decisions. 4. The breadth of the categories may result in serious prioritization errors. Heat map-type risk matrices are implicitly based on the expected value theory of risk, in which expected loss (EL) is the product of risk probability and risk impact:

EL = P x I where EL = expected loss P = Probability of the risk occurring (between 0 and 1.0) I = Impact of the risk (often expressed in dollars) For example, if an individual believes that there is a 70% chance of losing $100,000, then the expected loss is $70,000 according to Expected Value Theory. Using this principal, the risks are color-coded, typically using red to indicate risks having high probability and high impact; or- ange or yellow to indicate risks with intermediate combinations of impact and probability; and green to indicate risks having either low impact or low probability or both. Red risks take the highest priority, yellow and orange intermediate, and green the lowest priority. Once risks are prioritized, organizations typically apply most resources and urgency to their highest-priority risks; lower priority risks are de-emphasized and may be eliminated entirely from further risk management. Improper risk prioritization can waste resources, cause projects to fail, and in extreme cases cost lives.

Risk matrices suffer from serious flaws: 106 JOURNAL OF MODERN PROJECT MANAGEMENT • MAY/AUGUST • 20182018 • JOURNALMODERNPM.COM 107 AN ALTERNATIVE TO HEAT MAP RISK MATRICES FOR PROJECT RISK PRIORITIZATION THE PROBLEMS --------------------- --- A. Subjectivity --- All risk assessment involves some subjectivity in assessing both the probabili- ty and impact of risks, but risk assessment matrices seem to magnify this issue.

Common verbal descriptors for probability include “Very High,” “High,”, “Medi- um,” “Low,” “Almost Certain,” “Highly Likely,” “Possible,” and “Unlikely.” Common descriptors for impact include “Low,” “Medium,” “High,” “Very High,” “Minimal,” “Major,” and Catastrophic;” there are many others. The descriptors are wholly subjective and different people might have very different quantitative figures in mind for a probability that corresponds to “High” or an impact described as “Me- dium”. The imprecision of the verbal descriptors can lead to prioritization errors.

Although subjectivity cannot be eliminated from risk management, the tools that are used should certainly not add to the inherent subjectivity.

--- B. The Error of Symmetry--- Most risk matrices are symmetric or near-symmetric about the diagonal (Univer- sity of Sydney, 2016; Department of Defense, 2006; INCOSE, 2015; Project Man- agement Institute, 2008.) That is, they treat a High Probability-Very High Impact (H-VH) risk with the same priority as a Very High Probability-High Impact (VH-H) risk. This is fundamentally wrong and can lead to huge errors in risk prioritiza- tion. Consider the risk matrix shown above in Figure 1, which is symmetric about the diagonal. A Very-High Probability-High Impact (VH-H) risk is designated red, as is a High Probability-Very High Impact (H-VH) risk; thus they are both treated with the same priority. But let’s assign quantitative values to the axis descriptors: are colored red if the product of Impact and Probability exceeds $500,000; or- ange if the product is between $100,001 and $500,000; yellow if the product is between $10,001 and $100,000; and green if the product is less than $10,000.

These thresholds are arbitrary and may be adjusted by the user; this is easily ac- complished using conditional cell formatting in MSExcel. The distribution of cell colors in Table 3 is very different than that in Figure 1 and therefore the risk pri- oritization is different.

In addition, Table 3 is not symmetric about the diagonal. For example, the Very High Probability-Medium Impact (VH-M) value of $90,000 is less than 20% of the Moderate Probability-Very High Impact (M-VH) value of $500,000; yet the conventional heat map risk matrix would have categorized these two risks with equal priority. The one with the larger dollar impact is much more concerning.

Similarly, the VH-H risk of $270,000 is only 36% of the H-VH risk of $750,000 and requires different prioritization, but the conventional risk matrix of Figure 1 classified them both as red.

Clearly, using undefined subjective verbal descriptors and symmetric tables does not yield good risk prioritization or subsequent decision making.

--- C. Risk Aversion --- Unfortunately, the problem gets worse. Under expected value theory (where EL = P x I) a risk with high P and low I can have the same expected loss as one with low P and high I. For example, if an individual believes that there is a 10% chance of losing $100,000, then the expected loss is $10,000 according to Expected Value Theory. Similarly, a 1% chance of losing $1,000,000 would also have an expected loss of $10,000. Therefore, these two risks would be treated equally and would garner the same prioritization color on a risk matrix. But most people (and com- panies) feel differently about those two risks: they are much more concerned with the second risk than the first because of risk aversion, and would assign the second risk a much higher priority. While probabilities are bounded by 0 and 1.00, potential financial impacts are unbounded: the maximum probability one could see is 1.00 but the maximum dollar impact could be in the millions, billions, or higher. People tend to focus on the potential dollar loss more than on the prob- ability. Risk aversion is exhibited by individuals, organizations, teams, and compa- nies, most of whom are highly risk averse when dealing with large potential dollar losses (Taylor & Weerapana, 2010; Binswanger, 1981).

One may account for risk aversion by inferring a utility function for the deci- sion-maker (Clemen and Reilly, 2014). The utility function quantitatively de- scribes the entity’s risk aversion and may be used to correct the Expected Loss (EL) calculated using expected value theory to a Risk-Adjusted Loss (RAL). The RAL may be calculated in several ways. One of the simplest methods is to use the Mean Variance Utility Function (MVUT) (Pratt, 1964; McNamee & Celona, 1987), which calculates the RAL as:

In equation 1 RT is the Risk Tolerance of the organization or individual for whom the project is being conducted 1 and σ 2 is the variance. The variance σ 2 is an indicator of the uncertainty associated with the risk and may be calculated from the equation 4 Most risk matrices are symmetric or near-symmetric about the diagonal (University of Sydney, 2016 ; Department of Defense, 2006 ; INCOSE, 2015; Project Management Institute, 2008 .) That is, they treat a High Probability -Very High Impact (H-VH) risk with the same priority as a Very High Probability -High Impact (VH -H) risk. This is fundamentally wrong and can lead to huge errors in risk prioritization. Consider the risk matrix shown above in Figure 1, which is symmetric about the diagonal. A Very -High Probability -High Impact (VH -H) risk i s designated red, as is a High Probability -Very High Impact (H -VH) risk; thus they are both treated with the same priority. But let’s assign quantitative values to the axis descriptors: Table 1. Quantified Probability Descriptors Table 2. Quantified I mpact Descriptors Probability Descriptor Probability Very High .9 High .75 Moderate .5 Low .25 [As noted above, the descriptors are subjective and may mean different things to different people; another individual might assign entirely different values to the descriptors in Tables 1 and 2, and this might change the resulting risk prioritization significantly. In addition, each verbal descriptor probab ly relates to a range of values; for simplicity, range mid -point values are used here. ] If one replaces the verbal descriptors in Figure 1 with the quantitative val ues of Tables 1 and 2, one obtains Table 3: Table 3. Quantitative Risk Matrix Impact: Low $10,000 Medium $100,000 High $300,000 Very High $1,000,000 Probability Very High 0.9 $9,000 $90,000 $270,000 $900,000 High 0.75 $7,500 $75,000 $225,000 $750,000 Moderate 0.5 $5,000 $50,000 $150,000 $500,000 Low 0.25 $2,500 $25,000 $75,000 $250,000 In Table 3, the cell values have been calculated by cross multiplying the Impact by the Probability , per Expected Value theory , which states that EL (Expected Loss) = Probability x Impact. The color -coding in Table 3 has been adjusted so that cells are colored red if the product of Impact and Probability exceeds $500,000; orange if the product is between $100,001 and $500,000; yellow if the product is between $10,001 an d $100,000; and green if the product is less than $10,000. Ilo br Ddqbphornp = = Ilo br Low $10,000 Medium $100,000 High $300,000 Very High $1,000,000 4 Most risk matrices are symmetric or near-symmetric about the diagonal (University of Sydney, 2016 ; Department of Defense, 2006 ; INCOSE, 2015; Project Management Institute, 2008 .) That is, they treat a High Probability -Very High Impact (H-VH) risk with the same priority as a Very High Probability -High Impact (VH -H) risk. This is fundamentally wrong and can lead to huge errors in risk prioritization. Consider the risk matrix shown above in Figure 1, which is symmetric about the diagonal. A Very -High Probability -High Impact (VH -H) risk i s designated red, as is a High Probability -Very High Impact (H -VH) risk; thus they are both treated with the same priority. But let’s assign quantitative values to the axis descriptors: Table 1. Quantified Probability Descriptors Table 2. Quantified I mpact Descriptors Ppna ahkhrw Ddqbphornp Ppna ahkhrw Very High .9 High .75 Moderate .5 Low .25 [As noted above, the descriptors are subjective and may mean different things to different people; another individual might assign entirely different values to the descriptors in Tables 1 and 2, and this might change the resulting risk prioritization significantly. In addition, each verbal descriptor probab ly relates to a range of values; for simplicity, range mid -point values are used here. ] If one replaces the verbal descriptors in Figure 1 with the quantitative val ues of Tables 1 and 2, one obtains Table 3: Table 3. Quantitative Risk Matrix Impact: Low $10,000 Medium $100,000 High $300,000 Very High $1,000,000 Probability Very High 0.9 $9,000 $90,000 $270,000 $900,000 High 0.75 $7,500 $75,000 $225,000 $750,000 Moderate 0.5 $5,000 $50,000 $150,000 $500,000 Low 0.25 $2,500 $25,000 $75,000 $250,000 In Table 3, the cell values have been calculated by cross multiplying the Impact by the Probability , per Expected Value theory , which states that EL (Expected Loss) = Probability x Impact. The color -coding in Table 3 has been adjusted so that cells are colored red if the product of Impact and Probability exceeds $500,000; orange if the product is between $100,001 and $500,000; yellow if the product is between $10,001 an d $100,000; and green if the product is less than $10,000. Ilo br Ddqbphornp = = Ilo br Low $10,000 Medium $100,000 High $300,000 Very High $1,000,000 4 Most risk matrices are symmetric or near-symmetric about the diagonal (University of Sydney, 2016 ; Department of Defense, 2006 ; INCOSE, 2015; Project Management Institute, 2008 .) That is, they treat a High Probability -Very High Impact (H-VH) risk with the same priority as a Very High Probability -High Impact (VH -H) risk. This is fundamentally wrong and can lead to huge errors in risk prioritization. Consider the risk matrix shown above in Figure 1, which is symmetric about the diagonal. A Very -High Probability -High Impact (VH -H) risk i s designated red, as is a High Probability -Very High Impact (H -VH) risk; thus they are both treated with the same priority. But let’s assign quantitative values to the axis descriptors: Table 1. Quantified Probability Descriptors Table 2. Quantified I mpact Descriptors Ppna ahkhrw Ddqbphornp Ppna ahkhrw Very High .9 High .75 Moderate .5 Low .25 [As noted above, the descriptors are subjective and may mean different things to different people; another individual might assign entirely different values to the descriptors in Tables 1 and 2, and this might change the resulting risk prioritization significantly. In addition, each verbal descriptor probab ly relates to a range of values; for simplicity, range mid -point values are used here. ] If one replaces the verbal descriptors in Figure 1 with the quantitative val ues of Tables 1 and 2, one obtains Table 3: Table 3. Quantitative Risk Matrix Impact: Low $10,000 Medium $100,000 High $300,000 Very High $1,000,000 Probability Very High 0.9 $9,000 $90,000 $270,000 $900,000 High 0.75 $7,500 $75,000 $225,000 $750,000 Moderate 0.5 $5,000 $50,000 $150,000 $500,000 Low 0.25 $2,500 $25,000 $75,000 $250,000 In Table 3, the cell values have been calculated by cross multiplying the Impact by the Probability , per Expected Value theory , which states that EL (Expected Loss) = Probability x Impact. The color -coding in Table 3 has been adjusted so that cells are colored red if the product of Impact and Probability exceeds $500,000; orange if the product is between $100,001 and $500,000; yellow if the product is between $10,001 an d $100,000; and green if the product is less than $10,000. Impact Descriptor $$ Impact py L P O 7 O O O e # / ' L P O O 7 O O O # !i L R O O 7 O O O t 3 # !i L P 7 O O O 7 O O O TABLE 01. Quantifi ed Probability Descriptors TABLE 02. Quantifi ed Impact Descriptors TABLE 03. Quantitative Risk Matrix 5 These thresholds are arbitrary and may be adjusted by the user; this is easily accomplished using conditional cell formatting in MSExcel. The distribution of cell colors in Table 3 is very differe nt than that in Figure 1 and therefore the risk prioritization is different. In addition, Table 3 is not symmetric about the diagonal . For example, the Very High Probability -Medium Impact (VH-M) v alue of $90,00 0 is less than 20% of the Moderate Probability -Very High Impact (M -VH) value of $500,000; yet the conventional heat map risk matrix would have categorized these two risks with equal priority. The one with the larger dollar impact is much more concerning. Similarly, the VH -H risk of $270,000 is only 36% of the H -VH risk of $750,000 and requires different prioritization, but the conventional risk matrix of Figure 1 classified them both as red. Clearly, using undefined subjective verbal descriptors and symmetric tables does not yield good risk prioritiz ation or subsequent decision making. C. Risk Aversion Unfortunately, the problem gets worse. Under expected value theory (where EL = P x I) a risk with high P and low I can have the same expected loss as one with low P and high I. F or example, if an individual believes that there is a 10% chance of losing $100,000, then the expected loss is $10,000 according to Expected Value Theory. Similarly, a 1% chance of losing $1,000,000 would also have a n expected loss of $ 10,000. Therefore, these two risks would be treated equally and would garner the same prioritization color on a risk matrix. But most people (and companies) feel differently about those two risks: they are much more concerned with the second risk than the f irst because of risk aversion, and would assign the second risk a much higher priority. While probabil ities are bounded by 0 and 1.00, potential financial impacts are unbounded: the maximum probability one could see is 1.00 but the maximum dollar impact co uld be in the millions , billions , or higher. People tend to focus on the potential dollar loss more than on the probability. Risk aversion is exhibited by individuals, organizations, teams, and companies, most of whom are highly risk averse when dealing wi th large potential dollar losses (Taylor & Weerapana , 2010; Binswanger, 1981 ). One may account for risk aversion by inferring a utility function for the decision -maker (Clemen and Reilly, 2014). The utility function quantitatively describes the entity’s risk aversion and may be used to correct the Expected Loss (EL) calculated using expected value theory to a Risk -Adjusted Loss (RAL). The RAL may be calculated in several ways. One of the simples t methods is to use the Mean Variance Utility Function (MVUT) (Pratt, 1964 ; McNamee & Celona, 1987), which calculates the RAL as: RAL = PI + σ 2/[2 (RT)] (1) 6 In equation 1 RT is the Risk Tolerance of the organization or individu al for whom the project is being conducted 1and σ 2 is the variance. The variance σ 2 is an indicator of the uncertainty associated with the risk and may be calculated from the equation σ2 = (PI) 2(1 -P) + (PI- I) 2 x P (2) which simplifies to σ 2 = PI 2(1 -P). (3 ) Substituting this expression into equation 1 yields RAL = PI [1+ (1 -P)I/(2 RT)] (4) Risk Tolerance RT is the capability of an entity to absorb risk. It is a dollar amount, and the larger, the greater the ability to absorb risk. Corporations typically have much greater RTs than individuals. For relatively risk -averse companies, a rule -of thumb is RT= .064 x (annual sales) or 1.24 x (net income) or .157 x (equity) (Howard, 1988). Typically, individuals have RTs in the tens of thousands or hundreds of thousands whereas companies have RTs in the millions, tens of millions, or hundreds of millions. If one applie s equation 4 to the 2 risks described at the beginning of this section using a RT=$500,000 , the Risk -A djusted Loss is $10,9 00 for the first risk (P=.10 and I = $100 ,000) but RAL = $19,900 for the second risk (P=.01 and I = $ 1,000,000), as shown in Table 4 . (Recall that the Expected Loss for both risks was $10,000 and they were assigned equal priority according to expected value theory.) Table 4. Comparison of Expected Losses with Risk -Adjusted Losses Risk Expected Loss Using Expected Value Theory EL=P x I Risk-Adjusted Loss Incorporating Risk -Aversion with RT=$500,000 RAL = PI [1+ (1 -P)I/(2RT)] Risk 1 (P=0.1, I=$100,000) L P O- O O O L P O- X O O Risk 2 (P=0.01, I=$1,000,000) L P O- O O O L P X- X O O U ljoh jovp ddpwov tjul x tujpo gg dvjx &, epwc & u vi 2r dv e &puu pg vi u dpoe tjul- yijdi ju dpoujuv ov yjvi ipy vi joejxjew & dvw & &, g &u [ Ui u dpoe tjul nwuv v l ijhi t rtjptjv,[ o n , opy rr &, sw vjpo S vp vi x &w u jo vi d & &u pg U c & R vp d &dw & v jul 0Aekwuv e Lpuu u- gpt x tjpwu x &w u pg jul Up & t od U[ pt U ] L T O O- O O O vi t uw &vu t e rjdv e jo U c & T ) U c & T[ jul 0Aekwuv e Lpuu u 1 The Mean Variance Utility function is an approximation and is valid only when RT>0.4 x I. Other utility functions (such as exponential and logarithmic) provide more accurate results for all values of RT, but are more complicated to use. U ( + / . # ) ( P # - . " # - % ) & , ( ) . " ) , ! ( # 4 . # ) ( ) , # ( # 0 # / & ) , 1 " ) ' . " * , ) $ . # - # ( ! ) ( / . P ( 5 Q # - . " 0 , # ( : " 0 , # ( 5 Q # - ( # ( # . ) , ) . " / ( , . # ( . 3 - - ) # . 1 # . " . " , # - % ( ' 3 & / & . , ) ' . " + / . # ) ( \ 5 Q ] D E Q D P @ E \ D @ E Q 2 \ D Q E 1 " # " - # ' * & # # - . ) \ \ \ \ \ \ 5 Q ] Q D P @ E : D R E / - . # . / . # ( ! . " # - 2 * , - - # ) ( # ( . ) + / . # ) ( P 3 # & - ] F P \ D P @ E ? D Q E G D S E # - % ) & , ( # - . " * # & # . 3 ) ( ( . # . 3 . ) - ) , , # - % : . # - ) & & , ' ) / ( . 7 ( . " & , ! , 7 . " ! , . , . " # & # . 3 . ) - ) , , # - % : ) , * ) , . # ) ( - . 3 * # & & 3 " 0 ' / " ! , . , - . " ( # ( # 0 # / & - : ) , , & . # 0 & 3 , # - % @ 0 , - ) ' * ( # - 7 , / & @ ) . " / ' # - ] : O U S 2 D ( ( / & - & - E ) , P : Q S 2 D ( . # ( ) ' E ) , : P T V 2 D + / # . 3 E D ) 1 , 7 P X W W E : 3 * # & & 3 7 # ( # 0 # / & - " 0 - # ( . " . ( - ) . " ) / - ( - ) , " / ( , - ) . " ) / - ( - 1 " , - ) ' * ( # - " 0 - # ( . " ' # & & # ) ( - 7 . ( - ) ' # & & # ) ( - 7 ) , " / ( , - ) ' # & & # ) ( - : ) ( * * & # - + / . # ) ( S . ) . " Q , # - % - - , # . . " ! # ( ( # ( ! ) . " # - - . # ) ( / - # ( ! ] L T O O 7 O O O 7 . " # - % @ $ / - . ) - - # - L P O 7 X O O ) , . " # , - . , # - % D ] : P O ( ] L P O O 7 O O O E / . ] L P X 7 X O O ) , . " - ) ( , # - % D ] : O P ( ] L P 7 O O O 7 O O O E 7 - - " ) 1 ( # ( & S : D & & . " . . " 2 * . ) - - ) , ) . " , # - % - 1 - L P O 7 O O O ( . " 3 1 , - - # ! ( + / & * , # ) , # . 3 ) , # ( ! . ) 2 * . 0 & / . " ) , 3 : E & S : ) ' * , # - ) ( ) 2 * . ) - - - 1 # . " # - % @ $ / - . ) - - - Risk Expected Loss Using Expected Value Theory EL=P x I Risk-Adjusted Loss Incorporating Risk -Aversion with RT=$500,000 RAL = PI [1+ (1 -P)I/(2RT)] Risk 1 (P=0.1, I=$100,000) L P O- O O O L P O- X O O Risk 2 (P=0.01, I=$1,000,000) L P O- O O O L P X- X O O U ljoh jovp ddpwov tjul x tujpo gg dvjx &, epwc & u vi 2r dv e &puu pg vi u dpoe tjul- yijdi ju dpoujuv ov yjvi ipy vi joejxjew & dvw & &, g &u [ Ui u dpoe tjul nwuv v l ijhi t rtjptjv,[ o n , opy rr &, sw vjpo S vp vi x &w u jo vi d & &u pg U c & R vp d &dw & v jul 0Aekwuv e Lpuu u- gpt x tjpwu x &w u pg jul Up & t od U[ pt U ] L T O O- O O O vi t uw &vu t e rjdv e jo U c & T ) U c & T[ jul 0Aekwuv e Lpuu u 1 The Mean Variance Utility function is an approximation and is valid only when RT>0.4 x I. Other utility functions (such as exponential and logarithmic) provide more accurate results for all values of RT, but are more complicated to use. [As noted above, the descriptors are subjective and may mean different things to different people; another individual might assign entirely different values to the descriptors in Tables 1 and 2, and this might change the resulting risk prioritiza- tion significantly. In addition, each verbal descriptor probably relates to a range of values; for simplicity, range mid-point values are used here.] If one replaces the verbal descriptors in Figure 1 with the quantitative values of Tables 1 and 2, one obtains Table 3:

In Table 3, the cell values have been calculated by cross multiplying the Impact by the Probability, per Expected Value theory, which states that EL (Expected Loss) = Probability x Impact. The color-coding in Table 3 has been adjusted so that cells which simplifies to Substituting this expression into equation 1 yields Risk Tolerance RT is the capability of an entity to absorb risk. It is a dollar amount, and the larger, the greater the ability to absorb risk. Corporations typically have much greater RTs than individuals. For relatively risk-averse companies, a rule- of thumb is RT= .064 x (annual sales) or 1.24 x (net income) or .157 x (equity) (Howard, 1988). Typically, individuals have RTs in the tens of thousands or hun- dreds of thousands whereas companies have RTs in the millions, tens of millions, or hundreds of millions.

If one applies equation 4 to the 2 risks described at the beginning of this sec- tion using a RT=$500,000, the Risk-Adjusted Loss is $10,900 for the first risk (P=.10 and I = $100,000) but RAL = $19,900 for the second risk (P=.01 and I = $1,000,000), as shown in Table 4. (Recall that the Expected Loss for both risks was $10,000 and they were assigned equal priority according to expect- ed value theory.) ity) in Table 5 due to Risk Aversion, which increased its calculated value from $500,000 to $750,000. The risk-adjusted values are almost always greater than non risk-adjusted values due to risk aversion; they provide a much better indica- tion of how people and companies feel about risk.

--- D. Category Prioritization Reversal --- Unfortunately, the situation gets even worse. Consider 2 risks as shown in Table 6: 6 In equation 1 RT is the Risk Tolerance of the organization or individu al for whom the project is being conducted 1and σ 2 is the variance. The variance σ 2 is an indicator of the uncertainty associated with the risk and may be calculated from the equation σ 2 = (PI) 2(1 -P) + (PI- I) 2 x P (2) which simplifies to σ 2 = PI 2(1 -P). (3 ) Substituting this expression into equation 1 yields RAL = PI [1+ (1 -P)I/(2 RT)] (4) Risk Tolerance RT is the capability of an entity to absorb risk. It is a dollar amount, and the larger, the greater the ability to absorb risk. Corporations typically have much greater RTs than individuals. For relatively risk -averse companies, a rule -of thumb is RT= .064 x (annual sales) or 1.24 x (net income) or .157 x (equity) (Howard, 1988). Typically, individuals have RTs in the tens of thousands or hundreds of thousands whereas companies have RTs in the millions, tens of millions, or hundreds of millions. If one applie s equation 4 to the 2 risks described at the beginning of this section using a RT=$500,000 , the Risk -A djusted Loss is $10,9 00 for the first risk (P=.10 and I = $100 ,000) but RAL = $19,900 for the second risk (P=.01 and I = $ 1,000,000), as shown in Table 4 . (Recall that the Expected Loss for both risks was $10,000 and they were assigned equal priority according to expected value theory.) Table 4. Comparison of Expected Losses with Risk -Adjusted Losses Risk Expected Loss Using Expected Value Theory EL=P x I Risk-Adjusted Loss Incorporating Risk -Aversion with RT=$500,000 RAL = PI [1+ (1 -P)I/(2RT)] Risk 1 (P=0.1, I=$100,000) $10,000 $10,900 hqj B 8P K-σ- Ay I K = Ay---y---: $10,000 $19,900 Taking into account risk aversion effectively doubles the expected loss of the second risk, which is consistent with how the individual actually feels . The second risk must take a higher priority. One may now apply equation 4 to the values in the cells of Table 3 to calculate Risk -Adjusted Losses, for various values of Risk Tolerance RT. For a RT=$5 00,000 the results are depicted in Table 5 : Table 5. Risk -Adjusted Losses 1 The Mean Variance Utility function is an approximation and is valid only when RT>0.4 x I. Other utility functions (such as exponential and logarithmic) provide more accurate results for all values of RT, but are more complicated to use. TABLE 04. Comparison of Expected Losses with Risk-Adjusted Losses 1. The Mean Variance Utility function is an approximation and is valid only when RT>0.4 x I. Other utility functions (such as exponential and logarithmic) provide more accurate results for all values of RT, but are more complicated to use. 6 In equation 1 RT is the Risk Tolerance of the organization or individu al for whom the project is being conducted 1and σ 2 is the variance. The variance σ 2 is an indicator of the uncertainty associated with the risk and may be calculated from the equation σ 2 = (PI) 2(1 -P) + (PI- I) 2 x P (2) which simplifies to σ2 = PI 2(1 -P). (3 ) Substituting this expression into equation 1 yields RAL = PI [1+ (1 -P)I/(2 RT)] (4) Risk Tolerance RT is the capability of an entity to absorb risk. It is a dollar amount, and the larger, the greater the ability to absorb risk. Corporations typically have much greater RTs than individuals. For relatively risk -averse companies, a rule -of thumb is RT= .064 x (annual sales) or 1.24 x (net income) or .157 x (equity) (Howard, 1988). Typically, individuals have RTs in the tens of thousands or hundreds of thousands whereas companies have RTs in the millions, tens of millions, or hundreds of millions. If one applie s equation 4 to the 2 risks described at the beginning of this section using a RT=$500,000 , the Risk -A djusted Loss is $10,9 00 for the first risk (P=.10 and I = $100 ,000) but RAL = $19,900 for the second risk (P=.01 and I = $ 1,000,000), as shown in Table 4 . (Recall that the Expected Loss for both risks was $10,000 and they were assigned equal priority according to expected value theory.) Table 4. Comparison of Expected Losses with Risk -Adjusted Losses Risk Expected Loss Using Expected Value Theory EL=P x I Risk-Adjusted Loss Incorporating Risk -Aversion with RT=$500,000 RAL = PI [1+ (1 -P)I/(2RT)] Risk 1 (P=0.1, I=$100,000) L P O- O O O L P O- X O O Risk 2 (P=0.01, I=$1,000,000) L P O- O O O L P X- X O O U ljoh jovp ddpwov tjul x tujpo gg dvjx &, epwc & u vi 2r dv e &puu pg vi u dpoe tjul- yijdi ju dpoujuv ov yjvi ipy vi joejxjew & dvw & &, g &u [ Ui u dpoe tjul nwuv v l ijhi t rtjptjv,[ o n , opy rr &, sw vjpo S vp vi x &w u jo vi d & &u pg U c & R vp d &dw & v jul 0Aekwuv e Lpuu u- gpt x tjpwu x &w u pg jul Up & t od U[ pt U ] L T O O- O O O vi t uw &vu t e rjdv e jo U c & T ) U c & T[ jul 0Aekwuv e Lpuu u 1 The Mean Variance Utility function is an approximation and is valid only when RT>0.4 x I. Other utility functions (such as exponential and logarithmic) provide more accurate results for all values of RT, but are more complicated to use. U ( + / . # ) ( P # - . " # - % ) & , ( ) . " ) , ! ( # 4 . # ) ( ) , # ( # 0 # / & ) , 1 " ) ' . " * , ) $ . # - # ( ! ) ( / . P ( 5 Q # - . " 0 , # ( : " 0 , # ( 5 Q # - ( # ( # . ) , ) . " / ( , . # ( . 3 - - ) # . 1 # . " . " , # - % ( ' 3 & / & . , ) ' . " + / . # ) ( \ 5 Q ] D E Q D P @ E \ D @ E Q 2 \ D Q E 1 " # " - # ' * & # # - . ) \ \ \ \ \ \ 5 Q ] Q D P @ E : D R E / - . # . / . # ( ! . " # - 2 * , - - # ) ( # ( . ) + / . # ) ( P 3 # & - ] F P \ D P @ E ? D Q E G D S E # - % ) & , ( # - . " * # & # . 3 ) ( ( . # . 3 . ) - ) , , # - % : . # - ) & & , ' ) / ( . 7 ( . " & , ! , 7 . " ! , . , . " # & # . 3 . ) - ) , , # - % : ) , * ) , . # ) ( - . 3 * # & & 3 " 0 ' / " ! , . , - . " ( # ( # 0 # / & - : ) , , & . # 0 & 3 , # - % @ 0 , - ) ' * ( # - 7 , / & @ ) . " / ' # - ] : O U S 2 D ( ( / & - & - E ) , P : Q S 2 D ( . # ( ) ' E ) , : P T V 2 D + / # . 3 E D ) 1 , 7 P X W W E : 3 * # & & 3 7 # ( # 0 # / & - " 0 - # ( . " . ( - ) . " ) / - ( - ) , " / ( , - ) . " ) / - ( - 1 " , - ) ' * ( # - " 0 - # ( . " ' # & & # ) ( - 7 . ( - ) ' # & & # ) ( - 7 ) , " / ( , - ) ' # & & # ) ( - : ) ( * * & # - + / . # ) ( S . ) . " Q , # - % - - , # . . " ! # ( ( # ( ! ) . " # - - . # ) ( / - # ( ! ] L T O O 7 O O O 7 . " # - % @ $ / - . ) - - # - L P O 7 X O O ) , . " # , - . , # - % D ] : P O ( ] L P O O 7 O O O E / . ] L P X 7 X O O ) , . " - ) ( , # - % D ] : O P ( ] L P 7 O O O 7 O O O E 7 - - " ) 1 ( # ( & S : D & & . " . . " 2 * . ) - - ) , ) . " , # - % - 1 - L P O 7 O O O ( . " 3 1 , - - # ! ( + / & * , # ) , # . 3 ) , # ( ! . ) 2 * . 0 & / . " ) , 3 : E & S : ) ' * , # - ) ( ) 2 * . ) - - - 1 # . " # - % @ $ / - . ) - - - Risk Expected Loss Using Expected Value Theory EL=P x I Risk-Adjusted Loss Incorporating Risk -Aversion with RT=$500,000 RAL = PI [1+ (1 -P)I/(2RT)] Risk 1 (P=0.1, I=$100,000) L P O- O O O L P O- X O O Risk 2 (P=0.01, I=$1,000,000) L P O- O O O L P X- X O O U ljoh jovp ddpwov tjul x tujpo gg dvjx &, epwc & u vi 2r dv e &puu pg vi u dpoe tjul- yijdi ju dpoujuv ov yjvi ipy vi joejxjew & dvw & &, g &u [ Ui u dpoe tjul nwuv v l ijhi t rtjptjv,[ o n , opy rr &, sw vjpo S vp vi x &w u jo vi d & &u pg U c & R vp d &dw & v jul 0Aekwuv e Lpuu u- gpt x tjpwu x &w u pg jul Up & t od U[ pt U ] L T O O- O O O vi t uw &vu t e rjdv e jo U c & T ) U c & T[ jul 0Aekwuv e Lpuu u 1 The Mean Variance Utility function is an approximation and is valid only when RT>0.4 x I. Other utility functions (such as exponential and logarithmic) provide more accurate results for all values of RT, but are more complicated to use. U ( + / . # ) ( P # - . " # - % ) & , ( ) . " ) , ! ( # 4 . # ) ( ) , # ( # 0 # / & ) , 1 " ) ' . " * , ) $ . # - # ( ! ) ( / . P ( 5 Q # - . " 0 , # ( : " 0 , # ( 5 Q # - ( # ( # . ) , ) . " / ( , . # ( . 3 - - ) # . 1 # . " . " , # - % ( ' 3 & / & . , ) ' . " + / . # ) ( \ 5 Q ] D E Q D P @ E \ D @ E Q 2 \ D Q E 1 " # " - # ' * & # # - . ) \ \ \ \ \ \ 5 Q ] Q D P @ E : D R E / - . # . / . # ( ! . " # - 2 * , - - # ) ( # ( . ) + / . # ) ( P 3 # & - ] F P \ D P @ E ? D Q E G D S E # - % ) & , ( # - . " * # & # . 3 ) ( ( . # . 3 . ) - ) , , # - % : . # - ) & & , ' ) / ( . 7 ( . " & , ! , 7 . " ! , . , . " # & # . 3 . ) - ) , , # - % : ) , * ) , . # ) ( - . 3 * # & & 3 " 0 ' / " ! , . , - . " ( # ( # 0 # / & - : ) , , & . # 0 & 3 , # - % @ 0 , - ) ' * ( # - 7 , / & @ ) . " / ' # - ] : O U S 2 D ( ( / & - & - E ) , P : Q S 2 D ( . # ( ) ' E ) , : P T V 2 D + / # . 3 E D ) 1 , 7 P X W W E : 3 * # & & 3 7 # ( # 0 # / & - " 0 - # ( . " . ( - ) . " ) / - ( - ) , " / ( , - ) . " ) / - ( - 1 " , - ) ' * ( # - " 0 - # ( . " ' # & & # ) ( - 7 . ( - ) ' # & & # ) ( - 7 ) , " / ( , - ) ' # & & # ) ( - : ) ( * * & # - + / . # ) ( S . ) . " Q , # - % - - , # . . " ! # ( ( # ( ! ) . " # - - . # ) ( / - # ( ! ] L T O O 7 O O O 7 . " # - % @ $ / - . ) - - # - L P O 7 X O O ) , . " # , - . , # - % D ] : P O ( ] L P O O 7 O O O E / . ] L P X 7 X O O ) , . " - ) ( , # - % D ] : O P ( ] L P 7 O O O 7 O O O E 7 - - " ) 1 ( # ( & S : D & & . " . . " 2 * . ) - - ) , ) . " , # - % - 1 - L P O 7 O O O ( . " 3 1 , - - # ! ( + / & * , # ) , # . 3 ) , # ( ! . ) 2 * . 0 & / . " ) , 3 : E & S : ) ' * , # - ) ( ) 2 * . ) - - - 1 # . " # - % @ $ / - . ) - - - Risk Expected Loss Using Expected Value Theory EL=P x I Risk-Adjusted Loss Incorporating Risk -Aversion with RT=$500,000 RAL = PI [1+ (1 -P)I/(2RT)] Risk 1 (P=0.1, I=$100,000) L P O- O O O L P O- X O O Risk 2 (P=0.01, I=$1,000,000) L P O- O O O L P X- X O O U ljoh jovp ddpwov tjul x tujpo gg dvjx &, epwc & u vi 2r dv e &puu pg vi u dpoe tjul- yijdi ju dpoujuv ov yjvi ipy vi joejxjew & dvw & &, g &u [ Ui u dpoe tjul nwuv v l ijhi t rtjptjv,[ o n , opy rr &, sw vjpo S vp vi x &w u jo vi d & &u pg U c & R vp d &dw & v jul 0Aekwuv e Lpuu u- gpt x tjpwu x &w u pg jul Up & t od U[ pt U ] L T O O- O O O vi t uw &vu t e rjdv e jo U c & T ) U c & T[ jul 0Aekwuv e Lpuu u 1 The Mean Variance Utility function is an approximation and is valid only when RT>0.4 x I. Other utility functions (such as exponential and logarithmic) provide more accurate results for all values of RT, but are more complicated to use. U ( + / . # ) ( P # - . " # - % ) & , ( ) . " ) , ! ( # 4 . # ) ( ) , # ( # 0 # / & ) , 1 " ) ' . " * , ) $ . # - # ( ! ) ( / . P ( 5 Q # - . " 0 , # ( : " 0 , # ( 5 Q # - ( # ( # . ) , ) . " / ( , . # ( . 3 - - ) # . 1 # . " . " , # - % ( ' 3 & / & . , ) ' . " + / . # ) ( \ 5 Q ] D E Q D P @ E \ D @ E Q 2 \ D Q E 1 " # " - # ' * & # # - . ) \ \ \ \ \ \ 5 Q ] Q D P @ E : D R E / - . # . / . # ( ! . " # - 2 * , - - # ) ( # ( . ) + / . # ) ( P 3 # & - ] F P \ D P @ E ? D Q E G D S E # - % ) & , ( # - . " * # & # . 3 ) ( ( . # . 3 . ) - ) , , # - % : . # - ) & & , ' ) / ( . 7 ( . " & , ! , 7 . " ! , . , . " # & # . 3 . ) - ) , , # - % : ) , * ) , . # ) ( - . 3 * # & & 3 " 0 ' / " ! , . , - . " ( # ( # 0 # / & - : ) , , & . # 0 & 3 , # - % @ 0 , - ) ' * ( # - 7 , / & @ ) . " / ' # - ] : O U S 2 D ( ( / & - & - E ) , P : Q S 2 D ( . # ( ) ' E ) , : P T V 2 D + / # . 3 E D ) 1 , 7 P X W W E : 3 * # & & 3 7 # ( # 0 # / & - " 0 - # ( . " . ( - ) . " ) / - ( - ) , " / ( , - ) . " ) / - ( - 1 " , - ) ' * ( # - " 0 - # ( . " ' # & & # ) ( - 7 . ( - ) ' # & & # ) ( - 7 ) , " / ( , - ) ' # & & # ) ( - : ) ( * * & # - + / . # ) ( S . ) . " Q , # - % - - , # . . " ! # ( ( # ( ! ) . " # - - . # ) ( / - # ( ! ] L T O O 7 O O O 7 . " # - % @ $ / - . ) - - # - L P O 7 X O O ) , . " # , - . , # - % D ] : P O ( ] L P O O 7 O O O E / . ] L P X 7 X O O ) , . " - ) ( , # - % D ] : O P ( ] L P 7 O O O 7 O O O E 7 - - " ) 1 ( # ( & S : D & & . " . . " 2 * . ) - - ) , ) . " , # - % - 1 - L P O 7 O O O ( . " 3 1 , - - # ! ( + / & * , # ) , # . 3 ) , # ( ! . ) 2 * . 0 & / . " ) , 3 : E & S : ) ' * , # - ) ( ) 2 * . ) - - - 1 # . " # - % @ $ / - . ) - - - Risk Expected Loss Using Expected Value Theory EL=P x I Risk-Adjusted Loss Incorporating Risk -Aversion with RT=$500,000 RAL = PI [1+ (1 -P)I/(2RT)] Risk 1 (P=0.1, I=$100,000) L P O- O O O L P O- X O O Risk 2 (P=0.01, I=$1,000,000) L P O- O O O L P X- X O O U ljoh jovp ddpwov tjul x tujpo gg dvjx &, epwc & u vi 2r dv e &puu pg vi u dpoe tjul- yijdi ju dpoujuv ov yjvi ipy vi joejxjew & dvw & &, g &u [ Ui u dpoe tjul nwuv v l ijhi t rtjptjv,[ o n , opy rr &, sw vjpo S vp vi x &w u jo vi d & &u pg U c & R vp d &dw & v jul 0Aekwuv e Lpuu u- gpt x tjpwu x &w u pg jul Up & t od U[ pt U ] L T O O- O O O vi t uw &vu t e rjdv e jo U c & T ) U c & T[ jul 0Aekwuv e Lpuu u 1 The Mean Variance Utility function is an approximation and is valid only when RT>0.4 x I. Other utility functions (such as exponential and logarithmic) provide more accurate results for all values of RT, but are more complicated to use. 7 Impact: $10,000 $100,000 $300,000 $1,000,000 Probability Low Medium High Very High 0.9 Very High $9,009 $90,900 $278,100 $990,000 0.75 High $7,519 $76,875 $241,875 $937,500 0.5 Moderate $5,025 $52,500 $172,500 $750,000 0.25 Low $2,519 $26,875 $91,875 $437,500 The thresholds for the various colors in Table 5 are identical to those used in Table 3. Note that the distribution of cell colors in Table 5 is different than that in Table 3 and much different than that in Figure 1. In some cases, Risk-Adjusted values are nearly double what they were without risk aversion. For example the Low Probability- Very High Impact risk was color-coded yellow in Figure 1 (indicating low -moderate priority) while in Table 3 it was calculated to be $250,000 (orange or high pri ority ) but in Table 5, which is corrected for risk aversion, this risk has a risk -adjusted value of $437,500. Similarly, the M oderate Probability -Very High Impact risk was coded as orange in Figure 1 and Table 3 but red (highest priority) in Table 5 due to Risk Aversion, which increased its calculated value from $500,000 to $750,000. The risk -adjusted values are almost always greater than non risk -adjusted values due to risk aversion; they provide a much better indication of how people and companies feel ab out risk. D. Category Prioritization Reversal Unfortunately, the situation gets even worse. Consider 2 risks as shown in Table 6: Table 6. Comparison of Two Risks Risk Expected Loss Using Expected Value Theory EL=P x I Risk-Adjusted Loss Incorporating Risk -Aversion with RT=$768,000 RAL = PI [1+ (1 -P)I/(2RT)] Risk 1 (P=0. 29, I=$499,000) $144,710 $178,088 Risk 2 (P=0.005, I=$ 501,000) $2,505 $3,318 Using either Expected Value Theory or risk -adjusted losses, Risk 1 has ~2 order s of magnitude greater expected loss than Risk 2 and should take a higher priority. But imagine a matrix categorization scheme in which probabilities between 0 and 0.30 are categorized as “Low”; impacts between $100,000 and $500,000 are categorized as “high ”; and impacts greater than $5 00,000 are categorized as “very high” (see Figure 2). In such a scheme Risk 1 would be Low Probability -High Impact while Risk 2 would be Low Probability -Very High Impact and Risk 2 would take a higher priority than Risk 1, which is clearly dramatically wrong. The error occurs be cause a probability of .005 is lumped into the same category as a probability of 0. 29 and because impacts of $499,000 and $501,000 (which differ by less than half a TABLE 05. Risk-Adjusted Losses Taking into account risk aversion effectively doubles the expected loss of the sec- ond risk, which is consistent with how the individual actually feels. The second risk must take a higher priority.

One may now apply equation 4 to the values in the cells of Table 3 to calculate Risk-Adjusted Losses, for various values of Risk Tolerance RT. For a RT=$500,000 the results are depicted in Table 5:

The thresholds for the various colors in Table 5 are identical to those used in Table 3. Note that the distribution of cell colors in Table 5 is different than that in Table 3 and much different than that in Figure 1. In some cases, Risk-Adjusted values are nearly double what they were without risk aversion. For example the Low Probability-Very High Impact risk was color-coded yellow in Figure 1 (indicating low-moderate priority) while in Table 3 it was calculated to be $250,000 (orange or high priority) but in Table 5, which is corrected for risk aversion, this risk has a risk-adjusted value of $437,500. Similarly, the Moderate Probability-Very High Impact risk was coded as orange in Figure 1 and Table 3 but red (highest prior- 7 Impact: $10,000 $100,000 $300,000 $1,000,000 Probability Low Medium High Very High 0.9 Very High $9,009 $90,900 $278,100 $990,000 0.75 High $7,519 $76,875 $241,875 $937,500 0.5 Moderate $5,025 $52,500 $172,500 $750,000 0.25 Low $2,519 $26,875 $91,875 $437,500 The thresholds for the various colors in Table 5 are identical to those used in Table 3. Note that the distribution of cell colors in Table 5 is different than that in Table 3 and much different than that in Figure 1. In some cases, Risk-Adjusted values are nearly double what they were without risk aversion. For example the Low Probability- Very High Impact risk was color-coded yellow in Figure 1 (indicating low -moderate priority) while in Table 3 it was calculated to be $250,000 (orange or high pri ority ) but in Table 5, which is corrected for risk aversion, this risk has a risk -adjusted value of $437,500. Similarly, the M oderate Probability -Very High Impact risk was coded as orange in Figure 1 and Table 3 but red (highest priority) in Table 5 due to Risk Aversion, which increased its calculated value from $500,000 to $750,000. The risk -adjusted values are almost always greater than non risk -adjusted values due to risk aversion; they provide a much better indication of how people and companies feel ab out risk. D. Category Prioritization Reversal Unfortunately, the situation gets even worse. Consider 2 risks as shown in Table 6: Table 6. Comparison of Two Risks Risk Expected Loss Using Expected Value Theory EL=P x I Risk-Adjusted Loss Incorporating Risk -Aversion with RT=$768,000 RAL = PI [1+ (1 -P)I/(2RT)] Risk 1 (P=0. 29, I=$499,000) $144,710 $178,088 Risk 2 (P=0.005, I=$ 501,000) L Q- T O T L R- R P W Vujoh jvi t Ezr dv e &w Ui pt, pt tjul 0 ekwuv e &puu u- jul P i u ~2 order s of magnitude greater expected loss than Risk 2 and should take a higher priority. But imagine a matrix categorization scheme in which probabilities between 0 and 0.30 are categorized as “Low”; impacts between $100,000 and $500,000 are categorized as “high ”; and impacts greater than $5 00,000 are categorized as “very high” (see Figure 2). In such a scheme Risk 1 would be Low Probability -High Impact while Risk 2 would be Low Probability -Very High Impact and Risk 2 would take a higher priority than Risk 1, which is clearly dramatically wrong. The error occurs be cause a probability of .005 is lumped into the same category as a probability of 0. 29 and because impacts of $499,000 and $501,000 (which differ by less than half a TABLE 06. Comparison of Two Risks Using either Expected Value Theory or risk-adjusted losses, Risk 1 has ~2 orders of magnitude greater expected loss than Risk 2 and should take a higher priori- ty. But imagine a matrix categorization scheme in which probabilities between 0 and 0.30 are categorized as “Low”; impacts between $100,000 and $500,000 are categorized as “high”; and impacts greater than $500,000 are categorized as “very high” (see Figure 2). In such a scheme Risk 1 would be Low Probabili- ty-High Impact while Risk 2 would be Low Probability-Very High Impact and Risk 2 would take a higher priority than Risk 1, which is clearly dramatically wrong.

The error occurs because a probability of .005 is lumped into the same category as a probability of 0.29 and because impacts of $499,000 and $501,000 (which differ by less than half a percent) are placed in different impact categories. The ar- bitrariness of category breadth definition has led to a serious prioritization error. 8 percent) are placed in different impact cate gories. The arbitrariness of category breadth definition has led to a serious prioritization error. P I Figure 2. Category Prioritization reversal Thus, significant prioritization errors accrue when quantitative valu es for probability and impact are not used, when risk aversion is not accounted for , and due to the arbitrary nature of defining category breadths . T he conventional heat map risk matrix mis- prioritizes risks, sometimes very significantly. Proposed Alternative Although it is not possible to eliminate all subjectivity from risk prioritization, we can at least avoid errors introduced by the risk management tools themselves. A good solution to the category prioritization reversal, symmetry, and lack of accounting for risk aversion i n risk matrices is the Enhanced Risk Assessment Matrix (Monat, 201 3). A simplified version of this is easy to apply and pr ovides accurate risk prioritization : 1. Identify the risks.

2. Assign quantitative values for probability and dollar impact to each (subjective) .

3. Estimate the organization’s or individual’s Risk Tolerance RT using a rule -of -thumb.

4. Apply Equation 4 to calculate Risk -Adjusted Losses (RALs).

5. Prioritize the risks from highest RAL to lowest.

This approach requires few machination s and calc ulations, and is very straightforward. For graphic appeal, c olor-coding can be added if desired. Practical Example $0 $50,000 $100,000 $500,000 0.60 0 0.30 0.80 1.00 >$1,000,000 M H M L H VH VH L Risk 1 Risk 2 FIGURE 02. Category Prioritization reversal Thus, significant prioritization errors accrue when quantitative values for prob- ability and impact are not used, when risk aversion is not accounted for, and due to the arbitrary nature of defining category breadths. The conventional heat map risk matrix mis-prioritizes risks, sometimes very significantly.

PROPOSED ALTERNATIVE --------------------- Although it is not possible to eliminate all subjectivity from risk prioritization, we can at least avoid errors introduced by the risk management tools them- selves. A good solution to the category prioritization reversal, symmetry, and lack of accounting for risk aversion in risk matrices is the Enhanced Risk As- sessment Matrix (Monat, 2013). A simplified version of this is easy to apply and 108 JOURNAL OF MODERN PROJECT MANAGEMENT • MAY/AUGUST • 2018 2018 • JOURNALMODERNPM.COM 109 AN ALTERNATIVE TO HEAT MAP RISK MATRICES FOR PROJECT RISK PRIORITIZATION provides accurate risk prioritization: 1. Identify the risks.

2. Assign quantitative values for probability and dollar im - pact to each (subjective).

3. Estimate the organization’s or individual’s Risk Toler - ance RT using a rule-of-thumb.

4. Apply Equation 4 to calculate Risk-Adjusted Losses (RALs).

5. Prioritize the risks from highest RAL to lowest. This approach requires few machinations and calculations, and is very straightforward. For graphic appeal, color-coding can be added if desired.

PRACTICAL EXAMPLE --------------------- The SideLobe Company ($12M annual sales) designs and de - velops surface and air search radars for various industrial sectors including commercial, state, and federal organizations.

SideLobe has decided to embark on a risky air search radar project for the Navy. The radar is risky because it takes advan - tage of newly developed software algorithms that automatically detect, track, identify, engage, and destroy air targets. Typical radars of this type normally require human intervention to assess threats and engage them with the appropriate weapon system.

The SideLobe Robotic Acquisition System (RAS) automates this entire process without human intervention.

At the outset of the project SideLobe consulted various references (including the Project Management Body of Knowledge (PMBOK)), and established the probability and impact verbal descriptors shown in Table 7 for use in the risk assessment.

SideLobe then developed a list of project risks, of which the 5 most significant are shown in Table 8.

Using the typical Heat Map Risk Matrix as prescribed by the PMI and INCOSE, SideLobe then depicted the risks as shown in Table 9 in which the numbers in the 5 cells corre - spond to the 5 risks: 9 The SideLobe Company ( $12M annual sales) designs and develops surface and air search radars for various industrial sectors including commerci al, state, and federal organizations. SideLobe has decided to embark on a risky air search radar project for the Navy. The radar is risky because it takes advantage of newly developed software algorithms that automatically detect, track, identify, engage , and destroy air t argets . Typical radars of this type normally require human intervention to assess threats and engage them with the appropriate weapon system . The SideLobe Robotic Acquisition System (RAS) automates this entire process without human intervention. At the outset of the project SideLobe consulted various references (including the Project Management Body of Knowledge (PMBOK) ), and established the probability and impact verbal descriptors shown in Table 7 for use in the risk assessment. Table 7. SideLobe’s Verbal Descriptors SideLobe then developed a list of project risks, of which the 5 most significant are shown in Table 8. Probability Descriptor Impact Descriptor Very High (VH) Very High (VH) High (H) High (H) Moderate (M) Medium (M) Low (L) Low (L) 10 Table 8. Most Significant Project Risks. ID Risk Probability Impact 1 Desired technology and functionality is not achievable. M VH 2 L band radar subcontractor cannot deliver required functionality on time. M H 3 Required staffing levels cannot be met. H H 4 Design maturity cannot meet radar stability requirements. L M 5 Targets are misidentified and subsequently engaged. L VH Using the typical Heat Map Risk Matrix as prescribed by the PMI and INCOSE , SideLobe then depicted the risks as shown in Table 9 in which the numbers in the 5 cells correspond to the 5 risks : Table 9. SideLobe’s Heat -Map Risk Matrix Impact: Probability Low Medium High Very High Very High High 3 Moderate 2 1 Low 4 5 10 Table 8. Most Significant Project Risks. ID Risk Probability Impact 1 Desired technology and functionality is not achievable. M VH 2 L band radar subcontractor cannot deliver required functionality on time. M H 3 Required staffing levels cannot be met. H H 4 Design maturity cannot meet radar stability requirements. L M 5 Targets are misidentified and subsequently engaged. L VH Using the typical Heat Map Risk Matrix as prescribed by the PMI and INCOSE , SideLobe then depicted the risks as shown in Table 9 in which the numbers in the 5 cells correspond to the 5 risks : Table 9. SideLobe’s Heat -Map Risk Matrix Impact: Probability Low Medium High Very High Very High High 3 Moderate 2 1 Low 4 5 11 At this point, SideLobe feels they have done their job regarding risk management and , based upon this rudimentary assessment, are now going to focus on risk 3 as the highest priority, followed by risks 1 and 2 as the next highest . Yet, for some reason the senior managers at SideLobe are not comfortable with this crude analysis and (fortunately) don’t feel that these r isks are actionable without more information. SideLo be decides that they must quantify the probabilities and impacts of the 5 risks identified in Table 8 . Although they find it difficult to ascribe numerical values to their subjective feelings, they persevere using a team -oriented brainstorming session and develop Table 10, in which they articulate exactly what they mean by “high, ” “medium,” “low,” etc. Table 10. Risk s with Quantitative Probabilities and Impacts ID Risk Probability Impact 1 Desired technology and functionality is not achievable.

M (0.5) VH ($2,000,000) 2 X band radar subcontractor cannot deliver required functionality on time. M (0.6) H ($800,000) 3 Required staffing levels cannot be met. H (0.90) H ($600,000) 4 Design maturity cannot meet radar stability requirements. L (0.30) M ($400,000) 5 Targets are misidentified and subsequently engaged. L (0.005) VH ($2,000,000) At this point SideLobe feels much more comfortable with how they are handling their risks because they can prioritize the risks based upon the ir quantified probabilities and impacts. However, in a side discussion with a business partner, they learn about risk aversion and how it often dominates how companies feel about risk s. Thus , SideLobe rework s their assessment to include risk aversion using the Risk Tolerance rule- of-thumb for mod erately risk averse firms. Using a corporate heuristic for Risk Tolerance of 0.064 x annual sales, SideLobe’s Risk Toleran ce RT would be 0.064 x $12,000,000 = $ 768,000. Using the Mean Variance Utility Function they calculate the Risk Adjusted Loss for each risk of Table 10 using equation 4: RAL = PI[1+(1 -P)I/2(RT)] , and re- tabulate the risks in order from highest RAL to lowest, obtaining Table 11. TABLE 08. Most Significant Project Risks TABLE 07. SideLobe’s Verbal Descriptors TABLE 09. SideLobe’s Heat-Map Risk Matrix TABLE 10. Risks with Quantitative Probabilities and Impacts At this point, SideLobe feels they have done their job regarding risk management and, based upon this rudimentary assessment, are now going to focus on risk 3 as the highest priority, followed by risks 1 and 2 as the next highest. Yet, for some reason the senior managers at SideLobe are not comfortable with this crude analysis and (fortunately) don’t feel that these risks are actionable without more information.

SideLobe decides that they must quantify the probabilities and impacts of the 5 risks iden - tified in Table 8. Although they find it difficult to ascribe numerical values to their sub - jective feelings, they persevere using a team-oriented brainstorming session and develop Table 10, in which they articulate exactly what they mean by “high,” “medium,” “low,” etc. upon to provide consistent results, even when used by highly intelligent people who are familiar with its application; while the RAL method provides much better prioritization consistency. These results also suggest that the heat map introduces subjectivity while the RAL method does not.

In the 2nd field study, 25 past or current project managers (who also happened to be graduate students in 2 WPI Operations Risk Management courses) were provided 5 theoretical project risks along with their probabilities and potential impacts. The pro - ject managers were asked to prioritize the risks using a) a heat-map risk matrix and b) Risk-Adjusted Loss. Specific instructions that were given are provided in Appendix I.

The results are interesting and somewhat surprising (data are summarized in Appen - dix II.) Sixty % of the individuals felt that the RAL method was easier to use than the heat-map method. Typical comments for those who preferred the RAL method included, “I believe the RAL method is much easier to read and interpret because it quantifies 12 Table 11. Risk -Adjusted Losses for Each Risk ID Risk Probability P Impact I Expected Loss (P x I) Risk -Adjusted Loss (per eq uation 4) 1 Desired technology and functionality is not achievable. M (0.5) VH ($2,000,000) $1,000,000 $1,651,042 2 X band radar subcontractor cannot deliver required functionality on time. M (0.6) H ($800,000) $480,000 $580,000 3 Required staffing levels cannot be met. H (0.90) H ($600,000) $540,000 $561,094 4 Design maturity cannot meet radar stability requirements. L (0.30) M ($400,000) $120,000 $141,875 5 Targets are misidentified and subsequently engaged. L (0.005) VH ($2,000,000) $10,000 $22,956 Table 11 shows the risks prioritized by Risk -Adjusted Loss (RAL) . In table 11 the cells are colored red if the Risk -Adjusted Loss exceeds $1,000,000; orange if the RAL is between $500,001 and $1,000,000; yellow if the RAL is between $100,001 and $500,000; and green if the RAL is less than $100,000. Note that the priorities depicted in Table 11 are different from those depicted in Table 9: Risk 1 is now the highest priority, followed (in order) by risks 2, 3, 4, and 5 (the previous prioritization was Risk 3, 1, 2, 5, 4) . Inasmuch as Risk 3 has only 1/3 the RAL of Risk 1, classifying Risk 3 as the highest priority could yield a substantial waste of resources. Benefits for the Project Manager ---Field Validation Determining a project risk’s probability and potential impact are steps 1 and 2 of the Project Risk Management approach described in the Introduction. This study, however, assumes that the impact and TABLE 11. Risk-Adjusted Losses for Each Risk 13 probability have been determined for each project risk, and focuses on the correct prioritization of the risks once they have been characterized. To demonstrate the value to the project manager of the Risk - Adjusted Loss method of project risk prioritization, 2 field studies were conducted. In the first, 5 WPI Systems Enginee ring professors (all of whom were familiar with heat -map type risk matrices for risk prioritization) were ask ed to prioritize 5 given risks whose probabilities and $ impact s were provided (see Table 12 ) using a heat -map risk matrix. Table 12. The 5 Risks Presented for Prioritization The 5 professors (identified as A, B, C, D, and E) came up with 4 different prioritizations, as shown in Table 13 . Table 13. Professor Risk Prioritizations Using Risk Matrix Professor A Professor B Professor C Professor D Professor E Highest Priority Lowest Priority Risks 2 and 3 Risks 2 and 3 Risk 3 Risk 5 Risk 3 Risks 1 and 5 Risks 1 and 4 Risks 1 and 2 Risks 1, 2, 3, and 4 Risks 1 and 2 Risk 4 Risk 5 Risk 5 Risk 5 Risk 4 Risk 4 The prioritizations are significantly different for 4 of the 5 professors. The same 5 professors were then asked to prioritize the same 5 risks using the Risk Adjusted Loss method. This time, 4 of the 5 professors developed identical prioritizations: Risk 3 followed (in order) by risks 2, 1, 5, and 4; the 5 th professor obtained a prioritization of Risk 3 followed by risks 2, 4, 1, and 5. This shows that the heat -map style risk matrix cannot be relied upon to provide consistent results, even when used by hig hly intelligent people who are familiar with its application; while the RAL method provides much better prioritization consistency . These results also suggest that the heat map introduces subjectivity while the RAL method does not. In the 2 nd field study, 25 past or current project managers (who also happened to be graduate students in 2 WPI Operations Risk Management course s) were provided 5 theoretical project risks along with their probabilities and potential impacts. The project managers were asked to prioritize the risks using a) a heat -map risk matrix and b) Risk -Adjusted Loss. Specific instructio ns that were given are provided in Appendix I . Risk P(%) I($) 1 110,000,000 2 55,000,000 3 501,000,000 4 75 50,000 5 90 80,000 13 probability have been determined for each project risk, and focuses on the correct prioritization of the risks once they have been characterized. To demonstrate the value to the project manager of the Risk - Adjusted Loss method of project risk prioritization, 2 field studies were conducted. In the first, 5 WPI Systems Enginee ring professors (all of whom were familiar with heat -map type risk matrices for risk prioritization) were ask ed to prioritize 5 given risks whose probabilities and $ impact s were provided (see Table 12 ) using a heat -map risk matrix. Table 12. The 5 Risks Presented for Prioritization The 5 professors (identified as A, B, C, D, and E) came up with 4 different prioritizations, as shown in Table 13 . Table 13. Professor Risk Prioritizations Using Risk Matrix Ppned + +np A Ppned + +np B Ppned + +np C Ppned + +np D Ppned + +np E hfgd +r Pphnphrw Lnud +r Pphnphrw Risks 2 and 3 Risks 2 and 3 Risk 3 Risk 5 Risk 3 Risks 1 and 5 Risks 1 and 4 Risks 1 and 2 Risks 1, 2, 3, and 4 Risks 1 and 2 Risk 4 Risk 5 Risk 5 Risk 5 Risk 4 Risk 4 The prioritizations are significantly different for 4 of the 5 professors. The same 5 professors were then asked to prioritize the same 5 risks using the Risk Adjusted Loss method. This time, 4 of the 5 professors developed identical prioritizations: Risk 3 followed (in order) by risks 2, 1, 5, and 4; the 5 th professor obtained a prioritization of Risk 3 followed by risks 2, 4, 1, and 5. This shows that the heat -map style risk matrix cannot be relied upon to provide consistent results, even when used by hig hly intelligent people who are familiar with its application; while the RAL method provides much better prioritization consistency . These results also suggest that the heat map introduces subjectivity while the RAL method does not. In the 2 nd field study, 25 past or current project managers (who also happened to be graduate students in 2 WPI Operations Risk Management course s) were provided 5 theoretical project risks along with their probabilities and potential impacts. The project managers were asked to prioritize the risks using a) a heat -map risk matrix and b) Risk -Adjusted Loss. Specific instructio ns that were given are provided in Appendix I . Risk P(%) I($) 1 110,000,000 2 55,000,000 3 501,000,000 4 75 50,000 5 90 80,000 TABLE 13. Professor Risk Prioritizations Using Risk Matrix TABLE 12. The 5 Risks Presented for Prioritization At this point SideLobe feels much more comfortable with how they are handling their risks because they can prioritize the risks based upon their quantified probabilities and impacts. However, in a side discussion with a business partner, they learn about risk aversion and how it often dominates how companies feel about risks. Thus, SideLobe reworks their as - sessment to include risk aversion using the Risk Tolerance rule- of-thumb for moderately risk averse firms. Using a corporate heuristic for Risk Tolerance of 0.064 x annual sales, SideLobe’s Risk Tolerance RT would be 0.064 x $12,000,000 = $768,000.

Using the Mean Variance Utility Function they calculate the Risk Adjusted Loss for each risk of Table 10 using equation 4: RAL = PI[1+(1-P)I/2(RT)] , and re-tabulate the risks in order from highest RAL to lowest, obtaining Table 11.

Table 11 shows the risks prioritized by Risk-Adjusted Loss (RAL). In table 11 the cells are colored red if the Risk-Adjusted Loss exceeds $1,000,000; orange if the RAL is between $500,001 and $1,000,000; yellow if the RAL is between $100,001 and $500,000; and green if the RAL is less than $100,000. Note that the priorities depicted in Table 11 are different from those de - picted in Table 9: Risk 1 is now the highest priority, followed (in order) by risks 2, 3, 4, and 5 (the previous prioritization was Risk 3, 1, 2, 5, 4). Inasmuch as Risk 3 has only 1/3 the RAL of Risk 1, classifying Risk 3 as the highest priority could yield a substantial waste of resources.

BENEFITS FOR THE PROJECT MANAGER - FIELD VALIDATION --------------------- Determining a project risk’s probability and potential impact are steps 1 and 2 of the Project Risk Management approach de - scribed in the Introduction. This study, however, assumes that the impact and probability have been determined for each pro - ject risk, and focuses on the correct prioritization of the risks once they have been characterized. To demonstrate the value to the project manager of the Risk-Adjusted Loss method of pro - ject risk prioritization, 2 field studies were conducted. In the first, 5 WPI Systems Engineering professors (all of whom were familiar with heat-map type risk matrices for risk prioritiza - tion) were asked to prioritize 5 given risks whose probabilities and $ impacts were provided (see Table 12) using a heat-map risk matrix.

The 5 professors (identified as A, B, C, D, and E) came up with 4 different prioritizations, as shown in Table 13.

The prioritizations are significantly different for 4 of the 5 pro - fessors. The same 5 professors were then asked to prioritize the same 5 risks using the Risk Adjusted Loss method. This time, 4 of the 5 professors developed identical prioritizations: Risk 3 followed (in order) by risks 2, 1, 5, and 4; the 5th professor ob - tained a prioritization of Risk 3 followed by risks 2, 4, 1, and 5.

This shows that the heat-map style risk matrix cannot be relied the risk. It's a better visual representation of the data, and it better informs decision mak - ers with clear and concise evidence” and “The RAL method was easier because it didn’t really involve any creativity, critical thinking or brain power. We have the formulas and tables, so lit - erally all I did was plug it all into Excel and let it do the math. The Risk Matrix method involved thinking about the different categories and 110 JOURNAL OF MODERN PROJECT MANAGEMENT • MAY/AUGUST • 20182018 • JOURNALMODERNPM.COM 111 AN ALTERNATIVE TO HEAT MAP RISK MATRICES FOR PROJECT RISK PRIORITIZATION their bands, doing some internal reflection on what I thought they should be grouped as, and looking at the results once I prioritized the risks to make sure they made sense. Neither method was really hard to use, but the Risk Matrix method took longer and was more effort.” Typical comments from those who felt the Heat-Map method was easier included, “I believe the Heat-Map Matrix would be considered easier to use only in that there is no math involved and it might be less intimidating to some people. But that is not to say the RAL isn’t easy, in fact, it’s pretty straight forward and easy enough to use” and “Since I am, as well as many of the Sponsors I encounter each day, very familiar with the Heat Map Risk Matrix, that gives it a leg up on ease. Also, since many of these same Spon- sors are non-technical with even simple equations and numbers hurting their heads, I would say that the Heat Map Risk Matrix method will continue to be easier accepted, as they would “understand” simple probabilities and impacts much easier than Expected Loss, Risk Tolerance, and Risk Adjusted Loss. That said, the use of a Heat Map Risk Matrix always has and always will be more “qualitative” than “quantitative” in both how the probability ranges are determined and defined (why 0%-20%, why not 0% to 10%??), and most certainly how impact ranges are categorized (Minor, Moderate, Major) and assessed. Thus, I would say that the Heat Map Risk Matrix is “easier” to use.” The general consensus seemed to be that for those who are not intimidated by numbers and calculations, the RAL method is easier to develop, but less familiar than the heat map, which is well-known and therefore may be eas- ier to use as a risk communication tool.

A large majority (88%) felt that the RAL method provided a more accurate prioritization. Typical comments from those individuals included, “Hands down the RAL provides a better prioritization. In fact I would go so far to say that the heat map does not really prioritize the risks. If you do not take expected value into account, how can you compare. Specifically if someone is ranking the order I am not really sure by what basis you do this. In prac- tice, the only real use I have seen of the colors was a way to form a basis to ignore an issue that has no practical solution. Every other time the colors just track who is monitoring the steps to fix the risk” and “The heat map limits you to bucketing risks into 3 categories (well one can do more colors) and the bucketing does not do a good job of handling prioritization by com- bining impact and probability. The RAL uses a straightforward calculation to prioritize the risks which includes the effects of risk aversion. Heat map does not cover risk aversion.” Of the few respondents who felt that the Heat- Map approach provided more accurate prioritization, comments included, “A better visual aid in how to explain why a risk is more important to the project than other. It can be used for your own use, it can be easily recog- nized by others without formal training, and can be manipulated as needed to reflect an ever changing risk landscape” and “Heat-map matrices are a very good visual to show the impact of something that could be more than just monetary significance. If a risk has a lower monetary value but longer outage time than another risk, that impact could be included in a heat-map matrix, where that wouldn’t necessarily show up in an RAL.” The clear consensus was that the RAL approach is more quantitative while the heat map is qualitative; that the RAL technique reduces prioritization errors, and that the RAL technique is superior because it allows for risk aversion.

The bottom line in assessing the 2 techniques, however, is the consisten- cy with which different project managers prioritize the given risks. For the heat-map prioritization method, the consistency among managers was very poor. Sixteen different prioritizations were provided by the 25 project man- agers, only one of which (Risks 1, 3, and 5 as top priority and Risk 2 and 4 as lowest priority) was provided by more than 2 individuals. Seventeen individuals rated Risk 1 as the top priority while 5 rated it the lowest. Sev- enteen rated Risk 3 the top priority while 5 rated it the lowest. This great inconsistency demonstrates the weakness of the heat-map approach in pri- oritizing risks. With exactly the same data on risk probability and impact, there is great variation in the resulting priorities deriving from the heat- map approach.

The RAL method yielded substantially better (but not perfect) consistency in risk prioritization. 100% of the respondents listed either Risk 2 or 3 as the highest priority and Risk 4 or 5 as the lowest. Twenty project managers (80%) came up with a prioritization of either Risks 3, 2, 1, 5, and 4 (in order) or Risks 2, 1, 3, 5, 4. Of those 20 project managers, 9 (36%) prioritized the risks (in order) as Risks 3, 2, 1, 5, and 4 while 11 (44%) determined the pri- oritization to be Risk 2 followed by Risks 1, 3, 5, and 4. The reason for this bi- furcation in prioritization is interesting and surprising: those who obtained the “correct” prioritization (the prioritization that accrues when Equation 4 is applied correctly: Risks 2, 1, 3, 5, 4) interpreted Equation 4 as RAL=PI + PI 2(1-P)/[2(RT)]. Those who obtained the “incorrect” prioritization (3, 2, 1, 5, 4) misinterpreted Equation 4 as RAL=PI + (PI) 2(1-P)/[2(RT)] [note the parenthesis around the second PI term.] This surprising error underscores the need to be extremely clear in the expressions used for equations, even when following notation conventions, when administering the RAL tech- nique to prioritize risks.

The 5 project managers who developed neither of the 2 most common pri- oritizations typically made simple calculational or observational errors. For example, two rated Risk 4 as a higher priority than Risk 5 even thought they had calculated a higher RAL for Risk 5. One dropped a zero in the RAL cal- culation and 1 did not use the correct equation, dropping the (1-P) term in Equation 4. These errors underscore the need to check calculations careful- ly (perhaps by another analyst) when using the RAL method.

Despite the calculational and observational errors and those caused by misinterpretation of Equation 4, the prioritization consistency derived from the RAL method is substantially better than that deriving from the heat-map method. Addressing those errors via checking calculations with a 2nd analyst and clarifying the interpretation of Equation 4 should dra- matically improve the consistency of the RAL method. The better consist- ency afforded by the RAL method indicates that the RAL method is a better tool for risk prioritization than the heat-map and thus provides substan- tial value to project managers. Pretend that you are a risk analyst for a small, moderately risk-averse engineering company that has annual sales of $10 million and $4 million in equity. Your compa- ny is executing an important, big project involving city infrastructure. Your team has identified the following 5 project risks, along with their probabilities (in %) and impacts (in $$): 20 APPENDIX I Instructions for Field Study Pretend that you are a risk analyst for a small, moderately risk -averse engineering company that has annual sales of $10 million and $4 million in equity. Your company is executing an important, big project involving city infrastructure. Your team has identified the following 5 project risks, along with their probabilities (in %) and impacts (in $$): Risk P, Probability (%) I, Impact ($) 1 1 $10,000,000 2 5 $5,000,000 3 50 $1,000,000 4 75 $50,000 5 90 $80,000 We want to prioritize these risks to determine which are most important to address first, which are less important, and which risks may not require any action at all. We’d like to compare 2 different techniques for prioritizing these project risks: 1. The common heat-map type risk matrix 2. Prioritization based on Risk -Adjusted Loss (RAL) A good prioritization method would properly distinguish the most important from the least important risks. To compare these 2 different prioritization approaches, please follow the step- by-step instructions below: Part I. USING A HEAT-MAP STYLE RISK MATRIX TO PRIORITIZE RISKS. 21 STEP 1. Establish and Color-Code the Matrix 1. Will this be a 3 x 3, 4 x 4, 5 x 5, or other matrix? Note that it need not have the same number of rows (for likelihood or probability) as columns (for impact,) so it could be a 4 x 5 matrix, for example. 2. Color in the cells: red for the most significant risks, green for the least significant, and yellow and orange for intermediate risks. (You may use only 2 colors (e.g. red and green), 3 colors (red, yellow, green), 4 colors (red, orange, yellow, green) or any other scheme that you like. STEP 2. Establish Probability Categories and Bounds 1. For the probability (or “likelihood”) you will have as many probability categories as the number of rows you decided upon in Step 1. Now you need to name them e.g. “Low,” “Medium,” “High,” (if you have 3 categories) or “Very Low,” “Low,” “Medium,” “High,” “Very High” (if you have 5 categories). You may use any names you like (e.g. “inconsequential” instead of “very low”). 2. Now you need to establish the bounds for each probability category; that is, you must break the probability scale (0-100%) up quantitatively. You may use any scale you like: linear, logarithmic, some combination, or any other scale. Examples might be: STEP 3. Establish Impact Categories and Bounds 1. For the impact you will also have as many impact categories as the number of columns you decided upon in Step 1. Now you need to name them e.g. “Low,” “Medium,” “High,” (if you have 3 categories) or “Very Low,” “Low,” “Medium,” “High,” “Very High” (if you have 5 categories). You may use any names you like (e.g. “inconsequential” instead of “very low”). 2. Now you need to establish the bounds for each impact category; that is, you must break the impact dollar scale ($0 -$X) up quantitatively. You may use any scale you like: linear, logarithmic, some combination, or any other scale. Examples might be: Pro bability Range (%) Category 0-20% Very Low 21-40% Low 41-60% Medium 61-80% High 81-100% Very High Pro bability Range (%) Category 0-20% Low 21-80% Medium 81-100% High or 22 STEP 4. Categorize each Risk by Probability P and Impact I 1. For each of the 5 risks that you have been given, you must categorize both their probability and impact using the scales that you developed in steps 2 and 3 above. For example, if a given risk (“Risk a”) has a probability of 15% and an impact of $3,000,000, and if your category bounds are as follows: Then you would categorize this risk as “Very Low Probability, High Impact.” Similarly, a risk with a probability of 50% and an impact of $280,000 (“Risk b”) would be categorized as “Medium probability, Low Impact.” Categorize all 5 given risks in this manner. STEP 5. Locate Each Risk on the Matrix: The 2 risks described above (Risk a: Very Low Probability, High Impact; and Risk b: Medium Probability, Low Impact) would be placed as shown below on this particular risk matrix: Clearly, Risk a’s priority is green and Risk b’s is Yellow. Impact Range ($) Catego ry Impact Range ($) Catego ry Impact Range ($)Catego ry $0-100,000 Very Low $0-300,000Very Low $0- 1,000,000Low $100,001-500,000 Low $300,001-600,000Low $1,000,001- 5,000,000Medium $500,001-1,000,000 Medium $600,001-900,000Medium >$5,000,000High $1,000,001- 5,000,000 High $900,001-1,200,000High >$5,000,000 Very High >$1,200,000Very High Pro bability Range (%)Category 0-20% Very Low 21-40% Low 41-60% Medium 61-80% High 81-100% Very High or or 22 STEP 4. Categorize each Risk by Probability P and Impact I 1. For each of the 5 risks that you have been given, you must categorize both their probability and impact using the scales that you developed in steps 2 and 3 above. For example, if a given risk (“Risk a”) has a probability of 15% and an impact of $3,000,000, and if your category bounds are as follows: Then you would categorize this risk as “Very Low Probability, High Impact.” Similarly, a risk with a probability of 50% and an impact of $280,000 (“Risk b”) would be categorized as “Medium probability, Low Impact.” Categorize all 5 given risks in this manner. STEP 5. Locate Each Risk on the Matrix: The 2 risks described above (Risk a: Very Low Probability, High Impact; and Risk b: Medium Probability, Low Impact) would be placed as shown below on this particular risk matrix: Clearly, Risk a’s priority is green and Risk b’s is Yellow. Impact Range ($) Catego ry Impact Range ($) Catego ry Impact Range ($)Catego ry $0-100,000 Very Low $0-300,000Very Low $0- 1,000,000Low $100,001-500,000 Low $300,001-600,000Low $1,000,001- 5,000,000Medium $500,001-1,000,000 Medium $600,001-900,000Medium >$5,000,000High $1,000,001- 5,000,000 High $900,001-1,200,000High >$5,000,000 Very High >$1,200,000Very High Pro bability Range (%)Catego ry 0-20% Very Low 21-40% Low 41-60% Medium 61-80% High 81-100% Very High ) , ) , Q Q rtPm S : L) .14 ) ,8 41 1) 6 o8 - % 3 m , ) ) 8%8 . 3 m ) (0 b ' *) . b P : For each of the 5 risks that you have been given, you must categorize both their probability and impact using the scales that you developed in steps 2 and 3 above. For example, if a given risk (“Risk a”) has a probability of 15% and an impact of $3,000,000, and if your category bounds are as follows: Then you would categorize this risk as “Very Low Probability, High Impact.” Similarly, a risk with a probability of 50% and an impact of $280,000 (“Risk b”) would be categorized as “Medium probability, Low Impact.” Categorize all 5 given risks in this manner. STEP 5. Locate Each Risk on the Matrix: The 2 risks described above (Risk a: Very Low Probability, High Impact; and Risk b: Medium Probability, Low Impact) would be placed as shown below on this particular risk matrix: Clearly, Risk a’s priority is green and Risk b’s is Yellow. Impact Range ($) Catego ry Impact Range ($)Catego ry Impact Range ($) Catego ry $0-100,000Very Low $0-300,000Very Low $0- 1,000,000Low $100,001-500,000 Low $300,001-600,000Low $1,000,001- 5,000,000Medium $500,001-1,000,000 Medium $600,001-900,000Medium >$5,000,000High $1,000,001- 5,000,000 High $900,001-1,200,000High >$5,000,000 Very High >$1,200,000Very High Pro bability Range (%)Category 0-20% Very Low 21-40% Low 41-60% Medium 61-80% High 81-100% Very High ) , ) , 21 STEP 1. Establish and Color-Code the Matrix 1. Will this be a 3 x 3, 4 x 4, 5 x 5, or other matrix? Note that it need not have the same number of rows (for likelihood or probability) as columns (for impact,) so it could be a 4 x 5 matrix, for example. 2. Color in the cells: red for the most significant risks, green for the least significant, and yellow and orange for intermediate risks. (You may use only 2 colors (e.g. red and green), 3 colors (red, yellow, green), 4 colors (red, orange, yellow, green) or any other scheme that you like. STEP 2. Establish Probability Categories and Bounds 1. For the probability (or “likelihood”) you will have as many probability categories as the number of rows you decided upon in Step 1. Now you need to name them e.g. “Low,” “Medium,” “High,” (if you have 3 categories) or “Very Low,” “Low,” “Medium,” “High,” “Very High” (if you have 5 categories). You may use any names you like (e.g. “inconsequential” instead of “very low”). 2. Now you need to establish the bounds for each probability category; that is, you must break the probability scale (0-100%) up quantitatively. You may use any scale you like: linear, logarithmic, some combination, or any other scale. Examples might be: STEP 3. Establish Impact Categories and Bounds 1. For the impact you will also have as many impact categories as the number of columns you decided upon in Step 1. Now you need to name them e.g. “Low,” “Medium,” “High,” (if you have 3 categories) or “Very Low,” “Low,” “Medium,” “High,” “Very High” (if you have 5 categories). You may use any names you like (e.g. “inconsequential” instead of “very low”). 2. Now you need to establish the bounds for each impact category; that is, you must break the impact dollar scale ($0 -$X) up quantitatively. You may use any scale you like: linear, logarithmic, some combination, or any other scale. Examples might be: Pro bability Range (%) Category 0-20% Very Low 21-40% Low 41-60% Medium 61-80% High 81-100% Very High Pro bability Range (%) Category 0-20% Low 21-80% Medium 81-100% High or We want to prioritize these risks to determine which are most important to address first, which are less important, and which risks may not require any action at all. We’d like to compare 2 different techniques for prioritizing these project risks:

1. The common heat-map type risk matrix 2. Prioritization based on Risk-Adjusted Loss (RAL) A good prioritization method would properly dis- tinguish the most important from the least impor- tant risks. To compare these 2 different prioriti- zation approaches, please follow the step-by-step instructions below:

--- Part I. USING A HEAT-MAP STYLE RISK MATRIX TO PRIORITIZE RISKS. --- STEP 01. Establish and Color-Code the Matrix A good prioritization method would properly distinguish the most important from the least important risks. To compare these 2 different prioritization approaches, please follow the step- by-step instructions below: 1. Will this be a 3 x 3, 4 x 4, 5 x 5, or other matrix?

Note that it need not have the same number of rows (for likelihood or probability) as columns (for im- pact,) so it could be a 4 x 5 matrix, for example.

2. Color in the cells: red for the most significant risks, green for the least significant, and yellow and orange for intermediate risks. (You may use only 2 colors (e.g. red and green), 3 colors (red, yellow, green), 4 colors (red, orange, yellow, green) or any other scheme that you like.

STEP 2. Establish Probability Categories and Bounds 1. For the probability (or “likelihood”) you will have as many probability categories as the number of rows you decided upon in Step 1. Now you need to name them e.g. “Low,” “Medium,” “High,” (if you have 3 categories) or “Very Low,” “Low,” “Medium,” “High,” “Very High” (if you have 5 categories). You may use any names you like (e.g. “inconsequential” instead of “very low”).

2. Now you need to establish the bounds for each probability category; that is, you must break the probability scale (0-100%) up quantitatively. You may use any scale you like: linear, logarithmic, some combination, or any other scale. Examples might be: STEP 3. Establish Impact Categories and Bounds 1. For the impact you will also have as many im- pact categories as the number of columns you de- cided upon in Step 1. Now you need to name them e.g. “Low,” “Medium,” “High,” (if you have 3 catego- ries) or “Very Low,” “Low,” “Medium,” “High,” “Very High” (if you have 5 categories). You may use any names you like (e.g. “inconsequential” instead of “very low”).

2. Now you need to establish the bounds for each impact category; that is, you must break the impact dollar scale ($0-$X) up quantitatively. You may use any scale you like: linear, logarithmic, some combi- nation, or any other scale. Examples might be:

STEP 4. Categorize each Risk by Probability P and Impact I 1. For each of the 5 risks that you have been given, you must categorize both their probability and im- pact using the scales that you developed in steps 2 and 3 above. For example, if a given risk (“Risk a”) has a probability of 15% and an impact of $3,000,000, and if your category bounds are as follows: • APPENDIX • CONCLUSION --------------------- Heat map style risk matrices are poor risk prioritization tools. They suffer from subjectivity, lack of consideration of psychological factors important in decision-making, and categorization errors, all of which can yield significant risk mis-prioritization. The result can be wasted resources, failed projects, and in extreme cases loss of life. This paper describes a risk prioritization approach based on Risk-Adjusted Loss that obviates these weaknesses. All of the techniques demonstrated herein are easily implemented in spread- sheet programs such as MS Excel using standard equation operators, utility functions, and conditional formatting. These techniques will yield better risk prioritization and hence fewer wasted resources, more successful pro- ject outcomes, and in extreme cases may even save lives. 112 JOURNAL OF MODERN PROJECT MANAGEMENT • MAY/AUGUST • 20182018 • JOURNALMODERNPM.COM 113 AN ALTERNATIVE TO HEAT MAP RISK MATRICES FOR PROJECT RISK PRIORITIZATION • APPENDIX • Clearly, Risk a’s priority is green and Risk b’s is Yellow.

Place all 5 given risks on your chosen risk matrix in this manner.

STEP 6. Read Off the Matrix Prioritization Red risks are highest priority, orange (if you used orange) next highest, yellow next, and green lowest priority. Note: it is entirely possible that you will have mul- tiple risks at the same priority, and that you may therefore have fewer than 4 different priorities. Please complete the table below listing the priority of each of the 5 given risks.

Priority 1 (Red): _______________________ Priority 2 (Orange—if used): ________________________ Priority 3 (Yellow): ________________________ Priority 4 (Green): ________________________ --- Part II. USING RISK-ADJUSTED LOSS TO PRIORITIZE RISKS --- Now, please repeat the risk prioritization using the Risk-Adjusted Loss method:

STEP 1. Use the table shown here with the given Probabilities P and Impacts I for each risk:

STEP 2. Determine RT, the Risk Tolerance of the entity for whom you are doing 23 Place all 5 given risks on your chosen risk matrix in this manner. STEP 6. Read Off the Matrix Prioritization Red risks are highest priority, orange (if you used orange) next highest, yellow next, and green lowest priority. Note: it is entirely possible that you will have multiple risks at the same priority, and that you may therefore have fewer than 4 different priorities. Please complete the table below listing the priority of each of the 5 given risks. Priority 1 (Red): _______________________ Priority 2 (Orange—if used): ________________________ Priority 3 (Yellow): ________________________ Priority 4 (Green): ________________________ Part II. USING RISK-ADJUSTED LOSS TO PRIORITIZE RISKS. Now, please repeat the risk prioritization using the Risk -Adjusted Loss method: STEP 1. Use the table shown here with the given Probabilities P and Impacts I for each risk: Risk P, Probability (%) I, Impact ($) EL, Expected Loss (P x I) RAL, Risk-Adjusted Loss* Priority 1 1 $10,000,000 2 5 $5,000,000 3 50 $1,000,000 4 75 $50,000 5 90 $80,000 * RAL = [1 + !!! !/!""! (!" ) ]] ] Q :] . , ' # ( ] 7] . " ] # - %] ) & , ( ] ) ] . " ] ( . # . 3] ) ,] 1 " ) '] 3 ) /] , ] ) # ( !] . " ] ( & 3 - # -] D 3 ) / ,] # . # ) ( &] ( ! # ( , # ( !] ) ' * ( 3 @ @ @ , ' ' , 7] . " ] ( ( / &] - & -] ( ] + / # . 3] , ] * , ) 0 # ] # (] . " ] Q ( ] * , ! , * "] ) (] * ! ] P E :] ) /] ' 3] / - ] . " ] ) & & ) 1 # ( !] / & -] ) ] " / ' 9] • RT= .064 x (annual sales) or • 1.24 x (net income) or • .157 x (equity). 24 STEP 3. Calculate EL, the expected Loss, of each risk, using the following equation: EL = PI And fill in the EL values in the table provided in STEP 1 above. STEP 4. Calculate RAL, the Risk -Adjusted Loss, of each risk, using the following equation: RAL = [1 + !!! !/!""! (!" ) ]] ) . ] . " .] . " ] ] - " ) / & ] ] ^] . " ] ] ) ,] "] , # - % :] ] ] T :] # & &] # (] . " ] . & ] * , ) 0 # ] # (] ] P] ) 0 :] ] ] U :] , # ) , # . # 4 ] . " ] , # - % -] , ) '] " # ! " - .] ] . )] & ) 1 - .] ( ] # & &] # (] . " ] ) & & ) 1 # ( !] . & 9 ] ] , # ) , # . 3] P 9]] C C C C C C C C C C C C C C C C C C C C C C C ] , # ) , # . 3] Q 9] C C C C C C C C C C C C C C C C C C C C C C C C ] , # ) , # . 3] R 9] C C C C C C C C C C C C C C C C C C C C C C C C ] , # ) , # . 3] S 9] C C C C C C C C C C C C C C C C C C C C C C C C ] , # ) , # . 3] T 9] C C C C C C C C C C C C C C C C C C C C C C C C ] ] Part III. GENERAL INFORMATION. Name: __________________________________________ Title: ____________________________________________ Have you ever served on a project team?: ________Yes __________No Are you serving on a project team now? ________Yes __________No Have you ever managed a project? ________Yes __________No Are you managing any projects currently? ________Yes __________No Which, of the 2 methods above, do you believe provides a better risk prioritization? ______Heat-Map Risk Matrix _________RAL _____________Neither the analysis (your fictional engineering company---remember, the annual sales and equity are provided in the 2nd paragraph on page 1). You may use the follow- ing Rules of Thumb:

• RT= .064 x (annual sales) or • 1.24 x (net income) or • .157 x (equity).

STEP 3. Calculate EL, the expected Loss, of each risk, using the following equation:

EL = PI And fill in the EL values in the table provided in STEP 1 above.

STEP 4. Calculate RAL, the Risk-Adjusted Loss, of each risk, using the following equation:

Note that the RAL should be > the EL for each risk.

STEP 5. Fill in the table provided in STEP 1 above.

STEP 6. Prioritize the risks from highest RAL to lowest and fi ll in the following table:

Priority 1: _______________________ Priority 2: ________________________ Priority 3: ________________________ Priority 4: ________________________ Priority 5: ________________________ --- Part III. GENERAL INFORMATION --- Name: __________________________________________ Title: ____________________________________________ Have you ever served on a project team?: ________Yes __________No Are you serving on a project team now? ________Yes __________No Have you ever managed a project? ________Yes __________No Are you managing any projects currently? ________Yes __________No Which, of the 2 methods above, do you believe provides a better risk prioritization?

______Heat-Map Risk Matrix _________RAL _____________Neither Why? (Please be specific): _______________________________________________________________ _____________________________________________________________________________________________ _____________________________________________________________________________________________ 22 STEP 4. Categorize each Risk by Probability P and Impact I 1. For each of the 5 risks that you have been given, you must categorize both their probability and impact using the scales that you developed in steps 2 and 3 above. For example, if a given risk (“Risk a”) has a probability of 15% and an impact of $3,000,000, and if your category bounds are as follows: Then you would categorize this risk as “Very Low Probability, High Impact.” Similarly, a risk with a probability of 50% and an impact of $280,000 (“Risk b”) would be categorized as “Medium probability, Low Impact.” Categorize all 5 given risks in this manner. STEP 5. Locate Each Risk on the Matrix: The 2 risks described above (Risk a: Very Low Probability, High Impact; and Risk b: Medium Probability, Low Impact) would be placed as shown below on this particular risk matrix: Clearly, Risk a’s priority is green and Risk b’s is Yellow. Impact Range ($) Catego ry Impact Range ($)Catego ry Impact Range ($)Catego ry $0-100,000 Very Low $0-300,000Very Low $0- 1,000,000Low $100,001-500,000 Low $300,001-600,000Low $1,000,001- 5,000,000Medium $500,001-1,000,000 Medium $600,001-900,000Medium >$5,000,000High $1,000,001- 5,000,000 High $900,001-1,200,000High >$5,000,000 Very High >$1,200,000Very High Pro bability Range (%) Category 0-20%Very Low 21-40% Low 41-60% Medium 61-80% High 81-100% Very High or or 22 STEP 4. Categorize each Risk by Probability P and Impact I 1. For each of the 5 risks that you have been given, you must categorize both their probability and impact using the scales that you developed in steps 2 and 3 above. For example, if a given risk (“Risk a”) has a probability of 15% and an impact of $3,000,000, and if your category bounds are as follows: Then you would categorize this risk as “Very Low Probability, High Impact.” Similarly, a risk with a probability of 50% and an impact of $280,000 (“Risk b”) would be categorized as “Medium probability, Low Impact.” Categorize all 5 given risks in this manner. STEP 5. Locate Each Risk on the Matrix: The 2 risks described above (Risk a: Very Low Probability, High Impact; and Risk b: Medium Probability, Low Impact) would be placed as shown below on this particular risk matrix: Clearly, Risk a’s priority is green and Risk b’s is Yellow. Impact Range ($) Catego ry Impact Range ($)Catego ry Impact Range ($)Catego ry $0-100,000 Very Low $0-300,000Very Low $0- 1,000,000Low $100,001-500,000 Low $300,001-600,000Low $1,000,001- 5,000,000Medium $500,001-1,000,000 Medium $600,001-900,000Medium >$5,000,000High $1,000,001- 5,000,000 High $900,001-1,200,000High >$5,000,000 Very High >$1,200,000Very High Pro bability Range (%)Category 0-20% Very Low 21-40% Low 41-60% Medium 61-80% High 81-100% Very High or or V R w r D t z r r r r T would be categorized as “Medium probability, Low Impact.” Categorize all 5 given risks in this manner.

STEP 5. Locate Each Risk on the Matrix:

The 2 risks described above (Risk a: Very Low Probability, High Impact; and Risk b: Medium Probability, Low Impact) would be placed as shown below on this particular risk matrix: • REFERENCES • Alleman, G. (2010). Herding Cats, Retrieved from http:// herdingcats.typepad.com/my_weblog/2010/07/risk- matrix.html Aven, Terje, “Improving Risk Characterisations in Practical Situations by Highlighting Knowledge Aspects, with Applications to Risk Matrices,” Reliability Engineering and System Safety 167, 2017, 42-48 Bahill, A. Terry, and Smith, Eric D. (2009), “An Industry Standard Risk Analysis Technique,” Engineering Management Journal, 21:4, 16-29 Ball, David J., and J. Watt, “Further Thoughts on the Utility of Risk Matrices,” Risk Analysis 33 (11), 2013, 2068-2078 Binswanger, H. P. (1981). Attitudes Towards Risk:

Theoretical Implications of an Experiment in Rural India.

The Economic Journal, 91(364).

Clemen and Reilly, Making Hard Decisions with DecisionTools®, 3rd Ed., 2014, South-Western Cengage Learning, 640-659 Cox, L. A. Jr. (2008). What’s Wrong with Risk Matrices? Risk Analysis, 28(2), 497.

Cox, L. A. Jr., as quoted in Hubbard, Douglas W., The Failure of Risk Management, 2009, Wiley, Hoboken, NJ, p. 123 Davies, Martin, Making a Risk Matrix Useful, http:// causalcapital.blogspot.com/2015/08/making-risk-matrix- useful.html, 2015 Department of Defense, “Risk Management Guide for DoD Acquisition, Sixth Edition (Version 1.0),” 2006, p. 11 Duijm, Nijs Jan, “Recommendations On the Use and Design of Risk Matrices,” Safety Science, 76, 2015, pp. 21-31 Howard, Ronald A., 1988, “Decision Analysis: Practice and Promise,” Management Science 34 (6), 679 Hubbard, Douglas W., The Failure of Risk Management, 2009, Wiley, Hoboken, NJ, 122-125 INCOSE, Systems Engineering Handbook (2011), INCOSE- TP-2003-002-03.2.2, Wiley I NCOSE, Systems Engineering Handbook (2015), INCOSE- TP-2003-002-04, Wiley, p. 117 McNamee, P., and Celona, J., (1987). Decision Analysis for the Professional with Supertree, Redwood City, CA:

Scientific Press.

Microsoft (2017), “Risk Management Process Overview,” https://technet.microsoft.com/en-us/library/cc535304.aspx Monat, J. P., “Enhanced Risk Assessment Matrix for the Management of Project Risks,” Project Management Institute Virtual Library, http://citeseerx.ist.psu.edu/viewdoc/ download?doi=10.1.1.400.1616&rep=rep1&type=pdf, February 2013 Oboni, Franco, and Oboni, Cesar, (2013), “What You Need to Know About Risk Management Methods,” Riskope International, Vancouver, BC, Canada, www.riskope.com Pickering, Alexander, and Cowley, Stephen P. (2010), “Risk Matrices: Implied Accuracy and False Assumptions,” J.

of Health and Safety Research and Practice, 2 (1), 9-16 Pratt, J.W., (1964). Risk Aversion in the Small and in the Large. Econometrica, 32. 122–136.

Project Management Institute (2008). A Guide to the Project Management Body of Knowledge (PMBOK® guide)—Fourth edition. Newtown Square, PA Systems Engineering Process Of�ice, 212, Space and Naval Warfare Systems Center, “Risk Management Process,” PR- SPP-04 v3.0, 10 June 2002 Taylor, J., & Weerapana, A. (2010). Principles of Macroeconomics: Global Financial Crisis eEdition. (406– 408). Mason, OH: South-Western Cengage Learning.

Thomas, Philip, Bratvold, Reidar, and Bickel, J. Eric (2014), “The Risk of Using Risk Matrices,” SPE Economics and Management 6 (2), 56-66 University of Sydney, WHS Risk Management Steps, http:// sydney.edu.au/whs/activities/prioritise.shtml, 2016 Wall, Kent D., “The Trouble with Risk Matrices,” (2011), Naval Postgraduate School (DRMI) Working Paper Wijnia, Ype (2012), “Asset Risk Management: Issues in the Design and Use of the Risk Matrix,” In: Mathew J., Ma L., Tan A., Weijnen M., Lee J. (Eds.) Engineering Asset Management and Infrastructure Sustainability, Springer, London, 1043-1059 SCOTT DOREMUS is a Senior Lecturer at Worcester Polytech- nic Institute where he teaches Data Analysis and Decision Making, Risk Management, System Optimization, Concepts of System Engineering, Systems Integration and Test, Quality Planning, Design and Control, Work Systems and Facilities Planning and Computer and Network Security. Scott has 37 years of practical experience in the U.S. military, naval combat systems integration, aircraft avionics, medical instruments, networking equipment, consulting, program management, technical leadership and tele- communications. Scott began his lecturing career as an adjunct instructor of sys- tems integration and is now a full time instructor for the Electrical and Computer Engineering, School of Business and Computer Science departments. Scott’s re- search interests lie in decisional analysis, risk, and the integration of human fac- tors in engineering. He holds a Bachelor of Science degree from National Univer- sity San Diego and a Master of Science degree from DePaul University in Chicago.   JAMIE PETER MONAT, PH. D. is a Professor of Practice within the Systems En- gineering Program/ECE Department and the Foisie Business School at Worcester Polytechnic Institute, Worcester, MA, where he teaches (both on- line and face-to-face) and develops courses in Operations Risk Management, Project Management, System Optimization, Business Practices for Engineers, and Systems Thinking. Dr. Monat has both management and teaching expe- rience in the business consulting, medical device, separations, food & bever- age, and environmental industries, having served as President and founder of Business Growth Specialists, Inc., as President of Harvard Clinical Technology, as Sr. Vice-President of Pall Corpora- tion, and in a variety of executive positions for Koch Membrane Systems, Inc. Dr. Monat’s current research interests include applications of systems thinking, business applications of logistic re- gression, emergence and self-organization, project risk management, operations risk analysis, and competency-based education. He has a B.S. in Aerospace and Mechanical Sciences from Princeton, and an M.S. and Ph.D. in Civil Engineering from Stanford. He is a member of INCOSE and the Project Management Institute. • AUTHORS • 25 Why? (Please be specific): ______________________________________________________________________________ ______________________________________________________________________________ ____________________ __________________________________________________________ ______________________________________________________________________________ ______________________________________________________________________________ __________________________________________ ____________________________________ APPENDIX II Summarized Field Study Data Respondent: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 Heat-Map Technique Top Priority 1,2,3,4,5 3 5 3 1,2 3 5 1 1,5 2nd Prio rity 1,3,5 2,5 1 Middle Priority 1,2,5 1,2,3 1,2,3,4 1,3 1 3,5 1,2,3,5 1,2,5 3 1,3 3 1,2,4,5 1,3,5 2,3 1,2,3,4,5 3,5 5 1,3,5 4 1,2,3,5 1,2,3 1,3,5 3,5 4th Priority 4 1,2,5 4 Last Priority 2,4 4 4,5 2,4,5 4 4 4 4 2,4,5 2 3 2,4 4,5 1,2,4 1,2,3,4 2,4 2,3 4 4,5 2,4 1,2,4 RAL Technique Top Priority 3 2 3 2 3 2 2 2 2 3 3 2 2 2 3 3 2 3 3 3 2 3 2 2 2 2nd Prio rity 2 1 2 3 2 1 1 3 1 2 2 1 1 1 2 2 1 2 1 2 1 2 1 1 1 MIddle Priority 1 3 1 1 1 3 3 1 3 1 1 3 3 3 1 1 3 1 2 1 3 1 3 3 3 4th Priority 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 Last Priority 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 APPENDIX II --------------------- Summarized Field Study Data Copyright ofJournal ofModern ProjectManagement isthe property ofEditora Mundoandits content maynotbecopied oremailed tomultiple sitesorposted toalistserv without the copyright holder'sexpresswrittenpermission. However,usersmayprint, download, oremail articles forindividual use.

Have a similar question?

Continue to edit or attach image(s).

  • Fast and convenient

    Fast and convenient

    Simply post your question and get it answered by professional tutor within 30 minutes. It's as simple as that!

  • Any topic, any difficulty

    Any topic, any difficulty

    We've got thousands of tutors in different areas of study who are willing to help you with any kind of academic assignment, be it a math homework or an article.

  • 100% Satisfied Students

    100% Satisfied Students

    Join 3,4 million+ members who are already getting homework help from StudyDaddy!