The discussion of risk management has many facets. Sometimes these are discussed in a context and domain. Sometimes they are simply "made up" and discussed in the absence of any applicability to real problems.
Here's a starting point I received many years ago. John's site seems to have disappeared, so I apologize up front for the reuse of his great diagram in his absence.
Let's first start with the differences between risk and uncertainty. These get confused many times.
- Uncertainty stems from unknown probability distributions.
- The impact of requirements changes
- Perturbations to committed budgets
- Rework and retesting cost and schedule impacts
- Contractural arrangement
- The potential for disaster - labor troubles, the Shuttle blowing up, "fall overs," war, hurricanes.
- Probability that if a discrete event occurs it will impact the project in an unfavorable way
- Risk stems from known probability distributions
- Cost estimating methodology risk resulting from improper models of cost
- Cost factors such as inflation, labor rates, labor rate burdens, etc
- Configuration risk (variation in the technical inputs
- Schedule and technical risk coupling
- Correlation between risk distributions
There are two types of Uncertainty
- Static uncertainty is natural variation and foreseen risks
- Uncertainty about the value of a parameter
- Dynamic uncertainty is unforeseen uncertainty and “chaos”
- Stochastic changes in the underlying environment
- System time delays, interactions between the network elements, positive and negative feedback loops
- Internal dependencies
There are Multiple Sources of Schedule Uncertainty
- Unknown interactions drive uncertainty
- Dynamic uncertainty can be addressed by flexibility in the schedule
- On ramps
- Off ramps
- Alternative paths
- Schedule “crashing” opportunities
- Modeling of this dynamic uncertainty requires simulation rather than static PERT based path assessment
- Changes in critical path are dependent on time and state of the network
- The result is a stochastic network
Here is a Systems Dynamics view of risk impacts on Schedule from Tyson Bronwing's work in Design Structure Matrix (DSM).
So when we talk about risk in cost and scheduling, this is not about static equations, multiplications of integers in a matrix, or over generalizations about the risk process. To be useful any discussion of risk has to address the specific actionable information needed by the Program Manager to make better decisions.
