A couple of days ago a colleague from our Audit Department approached me during a training and asked me a question regarding risk management:
“Is there any weight added to “high”, “medium” or “low” for the “impact” column (or “probability”, for that matter) in the risk log?”
She mentioned that risk was something she was involved in more — in her present occupation, and she wanted to know, if there was anything quantitative below those values. I pointed her to m_o_r for starters — as an example of a more structured approach.
The simple answer to her question, however, was “no.” Without waiting a second thought, I added:
“I wish risk was identified -> estimated -> mitigation planned in the first place. It ends on theory level in many cases, yet any plan & business case without a [regularly reviewed] risk log to support our prognosis is a huge risk itself.”
When discussing the subject of risk, I often mention that our diligence as project managers most probably will depend on what the deliverable is. If this is a high risk project (e.g. an ascent of a high mountain or reaching the depths of the sea in a submarine) we will not treat the subject of risk light-heartedly.
* * *
On a similar note, but not directly related to risk management and risk logs, it really is better to find a way to add more meaning to the standard “low”, “medium” and “high” or “A”, “B” and “C” — either by adding a legend with more tangible information or, say, switching to “must”, “should” or “could” (but perhaps not in the context of risk).
