
This is likely defined in terms of scope, cost, quality, etc., whereas impact scales can be numeric, textual, or in ranges based on impact types. While developing impact scales, you have to consider the impact type. You could say risk impact is the consequence or effect of the risk–if and when the risk happens. Risk impact is measured as a deviation from the project’s scope, schedule, cost, and performance baselines or objectives. Sample probability scales with associated textual values are shown in the below table.Īs you can see, the probability of risk occurrence is considered to be “Very High” if there is more than an 80% chance of the risk occurring, whereas probability will be “Very Low” if the risk has a 1% to 10% chance of occurrence.Īnother arm of individual risk is the impact of the risk to the project, program, or portfolio if the risk occurs and is fully realized. The probability scale can be numeric, textual, or a combination of both. The probability of risk occurrence is decided in the risk management planning process, and it’s applicable for both threats (negative risks) and opportunities (positive risks). The estimated probability of an individual risk is tied to a well-defined risk event or condition. You could also say probability is the chance or likelihood of occurrence. Probability of a risk is the evaluated chance that an event will occur given existing conditions. Based on this, we can consider a few foundational concepts next, which will help us to build the risk matrix.

“A risk is an uncertain event or condition that, if it occurs, will have a positive or negative impact on one or more objectives of the project.”Īs you can see, a risk has two key elements: an element of uncertainty or probability, and an element of impact or consequence. As per Project Management Institute (PMI): You can just as easily use MS Word and/or MS Excel to create such reports.īefore we proceed, let’s look at the definition of an individual risk. In many places, I’ll be using the Primavera Risk Analysis tool to create these risk matrix reports. And finally, I’ll share a few advanced concepts such as using other risk assessment parameters or generating a butterfly risk matrix report.
#Risk probability and impact matrix how to#
Next, I’ll inform how to generate pre- and post-mitigated risk matrix reports. In the following article, I’ll first outline the foundational blocks of creating the risk matrix, followed by building a risk matrix scoring scheme (instrumental in plotting the risk matrix). This is widely used by risk management practitioners across projects, programs and portfolios. In this article, we will learn about one particular report, the Risk Matrix Report. Management practitioners call the information reports, which in turn, facilitate effective communication. It has to be communicated in the right way and with a right format. I’m referring to things such as start variance, cost variance, and the number of high priority vs number of low priority risks.Įven so, information on its own is also insufficient. This, in turn, becomes valuable information. The real value comes when you analyze the data and extract intelligence out of it. That said, data on its own doesn’t give you or a stakeholder any real value.

For example, in project management you have data such as planned start, planned cost, planned story points, total number of risks, etc. Working with projects, programs, and portfolios, generates a lot of data.
