Risk registers prioritize risks by likelihood of occurring and severity of impact if it does occur. In an ideal world, an operations project manager has access to a numerical probability of a risk occurring and the expected value (mean) of its impact in terms of cost or timing.
Usually, however, this information is not available, so you want to qualitatively rank the likelihood of experiencing the risk from 1 to 5, with 1 representing a “very low” probability to 5 representing a “very high” probability.
The expected impact of the risk is also ranked from 1 (“very low”) to 5 (“very high”). The two numbers are multiplied to create an unmitigated risk score ranging from 1 to 25. You can then use the risk scores to prioritize the risks.
To see this tool in practice, consider an example of the Melville Island tar sands project. When oil prices were approximately $125 per barrel, there was some thought given to processing tar sands on Melville Island in Canada for oil. The logistical hurdles would have been immense. The distance to the nearest port, Churchill in Manitoba, Canada, on Hudson Bay, is 1,200 miles.
Melville Island and Hudson Bay are both icebound six months of the year. Finally, there is no permanent human habitation on Melville Island. Any settlement or port would have to be built from scratch with materials sent from Churchill. There is no vegetation except for lichens, moss, and some woody vines that grow along the ground. However, there are a lot of polar bears!
At the top of the chart is an organizational risk, which is the risk that not enough skilled labor is willing to relocate to Melville Island. (We can’t imagine why. Think of the polar bears romping in your backyard.)
The expert group decides that the unmitigated likelihood of this being a problem is medium, so they give it an unmitigated likelihood score of 3. However, if it does happen: no workers, no project. So they give the risk an unmitigated impact score of 5 (very high). This gives you an unmitigated risk score of 3 5 = 15.
Let’s consider another risk, not enough icebreakers available for rent. The risk is that you could lose 6 months of port usability per year. This might very well double the time to complete the project. While the experts think the likelihood score is a 2 (low), the potential impact is a 5 (very high). This creates a risk score for the icebreakers of 2 5 = 10.
You then continue brainstorming risks and assigning them risk scores. This continues until you can’t think of any more risks. However, the identification process does not end with the planning phase. It continues throughout the life cycle of the project until its completion. The risk register is a living document. Likelihood and impact scores change as a project progresses, and new potential risks emerge. All must be continuously tracked.
