Impactlikelihood matrix

Risk: Key people from the legal team will be unavailable during the summer due to their engagement in other projects ... resulting in an inability to make critical purchase decisions. Mitigation: Secure the services of an external legal representative. Obtain PMT authority to use legal team in precedence over other projects during the summer.


Table 5.4 Impact/likelihood scores





None, the risk has been fully mitigated


Activity may be affected, but work can proceed to sign-off


Deliverable may be compromised, but no effect on project completion


Stage may be compromised, but completion is still achievable


Project completion may be compromised


Business or customer may suffer



The risk has passed


Very low likelihood


Low likelihood


Even likelihood


High likelihood


A certainty

The impact list suggests some separation between the values, and the maximum value 11, which is outside the normal scale, suggests an effect on other projects, non-project activity or a client's interests.

Although the likelihood list appears to be no more than a sliding scale, it shows that issues can be identified, qualified and evaluated in the same way as risks. Risks and issues differ only in their likelihood. An issue has happened and scores 10 - a certainty.


Which is the more important, a risk or an issue? To those used to fixing problems, an issue is often more important because it is immediate and must be fixed; whereas those who are risk averse may wish to tackle a potential problem before it occurs. This argument, however, considers only whether it is a potential or actual problem. To properly understand the relative "value" of a risk or issue, it is necessary to assess its impact. When both the likelihood and the impact are considered it is easier to judge whether one specific risk or issue deserves more attention than another.

This is done by multiplying the two numbers to create a risk factor. A risk with a likelihood of 6 and an impact of 7 has a risk factor of 42; whereas an issue with the maximum likelihood of 10 (because it has happened) but an impact of 3 has a risk factor of 30. In this case, it may be more sensible to invest in mitigating the risk even though dealing with the issue seems more immediate.

It is simple to generate a risk factor to establish the relative value of the risk or issue. However, some organisations want to give each risk a financial value. The risk factor is considered in terms of financial exposure, multiplied by the likelihood expressed as a percentage (where 100% makes it an issue). For instance, a supplier who has agreed to a penalty clause may stand to lose $25,000 for late delivery. If the likelihood of this happening is 20%, the financially evaluated risk factor would be $5,000 (20% x $25,000).

Although the risk factor is now expressed in financial terms, it remains a useful way of comparing risks and helps determine whether the cost of mitigating a risk is proportionate. For instance, if it cost the supplier $10,000 to pay extra people to carry out some of the work and finish on time, this might be considered too expensive when compared with the relative $5,000 exposure. However, if the likelihood of a late delivery began to increase, the $10,000 may progressively become the more attractive option.

This approach is useful, but there is a danger that financial quantification will drive project personnel more towards analysis and further away from mitigation. In addition it can be difficult to know when to

Impact/likelihood numeric risk factors














0 0



























stop quantifying the exposure. For example, the supplier at risk from the penalty clause may be exposed to more than the $25,000 charge. The sum could increase substantially through loss of reputation and other customers changing suppliers. The consequence is a risk matrix with no upper limit for financial impact, making it difficult to compare one risk with another, and almost impossible to cap the amount requested for mitigation.

A simple approach is usually the most effective. Not only is the numeric (non-financial) risk factor helpful in evaluating the relative worth of each risk and issue, but it also helps identify who should deal with it (see Figure 5.4).

A factor of 110 shows that an issue (which, by definition, has taken place) is affecting the business or a customer, so it must be referred to the portfolio management team for mitigation. Risks or issues with factors between 57 and 90 should be handled by the project steering group, and those with a factor between 21 and 56 should be dealt with by the project manager. Those scoring 20 or below should be assigned to team leaders.

This approach makes sure the right people hear about risks or issues for which they have authority to mitigate.


Mitigation is the process of making the likelihood or effect of a potential event less severe but, depending on the risk itself, there may be one or more mitigations available.

These are potential options: Share; Endure; Avoid; Lessen.


Risks are often shared. For example, the likelihood and/or effect of a washing machine failing may be sufficiently high to justify taking out a service contract. The risk is shared with the insurance company. Similarly, it is usual to share the risks and rewards of an initiative with a key supplier through penalty and reward clauses in contracts. For example, to mitigate the risk of a project going over budget, a customer might insist on compensation for every day by which the supplier exceeds a target completion date. However, sharing the risk does not always transfer the whole burden to someone else.

The project to redevelop London's Wembley stadium shows how mitigating one risk can sometimes have adverse consequences elsewhere. None of the initial tenders was sufficiently attractive to the Football Association (fa), but then an unsolicited tender proposed a more acceptable fixed-price contract. Knowing that a cost overrun was a major risk, the fa accepted the terms. However, the project ran late. The then chairman of Wembley said: "If we hadn't done that [agree the terms], Wembley would still be a shell and the fa would be bust." In this project a financial risk was shared but the risk of a poor-quality solution or late delivery was not, and it could be argued that it was increased because of the emphasis on a fixed budget.


As an assumption is a guess it is therefore a risk. It should be considered in terms of its likelihood and effect, but it may be decided that the project can live with - that is endure - the risk. For example, it might be assumed that everyone on the project will work an eight-hour day but decided that the project will live with the risk that some people may work fewer hours or be called to work on other projects.


Some risks can be circumvented. For instance, a project may face a risk that proposed changes to a computer system may be delayed because of other technology priorities in the organization. This can be mitigated by using a manual alternative.


It is possible to reduce the effect and/or likelihood of a risk. The specific mitigation may affect either the impact or the likelihood, or both, so it is important to know what the outcome should be. For instance, if the only person able to produce an important report is a novice employee, the likelihood of producing a poor-quality deliverable might be lessened by requiring their manager to set clear expectations at the outset. It might be further lessened by requiring the novice to produce a draft report at the halfway stage so that any quality concerns can be addressed. However, neither mitigation would reduce the effect of a poor report. To do that, the report's audience could be warned before publication to lower their expectations; something might still hit the fan, but not so much of it.

At the very least, the likelihood of a risk should be monitored to determine whether it is moving towards becoming an issue. For example, if there is a risk that time will run out before completion of user acceptance testing, the likelihood can be monitored by tracking the number of outstanding defects being recorded every day. If the number rises, so will the likelihood of the risk becoming an issue. If the number falls, the probability is lessening.

Project Management Made Easy

Project Management Made Easy

What you need to know about… Project Management Made Easy! Project management consists of more than just a large building project and can encompass small projects as well. No matter what the size of your project, you need to have some sort of project management. How you manage your project has everything to do with its outcome.

Get My Free Ebook

Post a comment