How do I score Risk in a Risk Log?

More about Risk Scoring

Risk Scoring Matrix: Impact vs Likelihood

• A score of 1 is “Low Risk”.
• A score of 25 is “Extremely High Risk”.

Assigning Likelihood Values

1. Rare: A very unlikely event. It could happen, but probably never will. Below 5%
2. Unlikely: Not expected. Slight possibility. An improbable sequence of events. 5% – 25%
3. Possible: Moderate likelihood. Foreseeable. May have occurred in projects like this before. 25% – 50%
4. Likely: Strong possibility. High likelihood. An easily foreseeable event. 50% – 75%
5. Almost Certain: Almost certain without any intervention. Above 75%.

Assigning Risk Impact Values

1. Insignificant: The project will have to make some minor changes to scope. Resolvable by project team. Can be managed. Acceptible.
2. Minor: Some changes to deliverables.
   Outside of Project Tollerances or Contingency.
   Adjustment to scope with some impact.
3. Moderate: One or more areas likely not to deliver as planned. Descoping required. Significant impact.
4. High: Significant descoping required.
   Major Impact.
5. Extreme: Serious failure of project objectives. Disastrous Impact.

You then multiply your Impact and Likelihood scores together. See the Risk Scoring Matrix below to quickly ascertain the risk level.

Risk Scoring Matrix

Use this scoring to prioritise your risks

This risk scoring is a useful tool to prioritise the effort in your project to mitigate the most important risks first.

Use Risk Mitigation to reduce the risk levels

As you move through your project, and manage your risks with your Risk Log, you will plan mitigation steps for each risk. These mitigation steps may not remove the risk completely, but they should reduce the impact and/or the likelihood of that risk.

Problems with Scoring Risks with a Matrix

There are many ways to allocate weighting to risks, and to group severity, with no right or wrong answer. The allocation of severity groupings helps you give summaries to your colleagues, but the groupings you choose will need to vary depending on the project type, size and environment.

See more here on Wikipedia about the problems with Risk Matrices.

Example Guidance for Project Managers according to Risk Severity

1. Extreme
   Escalate immediately to project authorities.
   Include recommendations.
   Actively control.
2. High
   Manage immediately.
   Inform project authorities.
   Act on mitigation and ensure you have response plans ready.
3. Moderate
   Manage risk and escalate in normal reporting.
   Watch carefully for change in exposure.
4. Low
   Manage risk.