In a recent article, Risk Management and Disaster Recovery in the Age of COVID-19, we discussed how we can gain valuable risk management insights by first looking at the likelihood and impact of a given risk and then drilling down another level and assessing the likelihood and impact of each risk’s specific consequences. In this article, we’re going to explore that concept further by putting these ideas into practice. Using a simple Risk and Consequences Excel spreadsheet (available for download at the end of this article), you will be able to identify and mitigate the hidden consequences that can severely and negatively impact your project.
For this example, let us imagine that we are planning out a product release and we are assessing what risks could impact our delivery date. We identify three high-level risks that could have an adverse impact on our release: pandemic, flood and fire. The table below shows our assessment of the likelihood of each risk, and it also lists out the possible consequences for each risk if they were to eventuate. Each of those consequences assumes its own unique row, which means the Pandemic risk has four associated rows – one for each consequence identified. Next, we look at the likelihood of each consequence occurring and the relative impact of that consequence, all assuming that the associated parent risk occurred. Finally, we calculate the relative severity of the consequence using the following formula:
Relative severity of a risk consequence = (likelihood of the associated risk) * (likelihood of this consequence) * (impact of this consequence)
The higher the severity level of a consequence, the more important it will be to identify mitigating activities to address it.
As the example above shows, water damage to the building has the highest severity because the risk of a flood is high, the likelihood of water damage to the building is high if the flood occurs, and the consequences of water damage to the building are also high. We can conclude that developing a mitigation plan for water damage to the building would be prudent. This is a good start – but there is yet another layer of risk hidden in this data that merits our attention.
Consequence Analysis: Targeting the data across risk categories
Note that in this example all three of our risks include the consequence, “Staff must work from home.” The second tab of the risk mitigation log, Consequence Analysis, is a pivot table that sums up and charts the Severity of Consequence column from the first tab for each of the likely consequences.
Why is this interesting, and why is it important?
On the prior tab, “water damage to building” had the highest severity of consequence score for a specific, individual risk.
However, this tab scores the severity for consequences across all three risk categories. Imagine the aggregate score this way: If a pandemic occurs OR a flood hits OR a fire damages the building, which of my consequences is most likely to occur, and with what severity?
When adding those scores across all risk categories in the other tab, “staff must work from home” (pandemic 28.0 + flood 48.0 + fire 48.0 = 116) is designated the most likely and has the most severe impacts. As such, this is a high priority consequence that merits mitigation. By identifying consequences that are shared across multiple risks, companies can take steps to mitigate those consequences so that when ANY of the associated risks become a reality, they know what steps to take for that consequence. Think about companies that had proactively established mitigation plans in the event their staff needed to work from home due to a flood or a fire (much more likely risks); they looked pretty smart when a once-in-a-century pandemic hit.
This risk mitigation log is offered as a high-level stepping stone to begin the discussions for developing a risk management strategy with your key stakeholders and the executive teams. More sophisticated tools can expand on this data and show the interrelationships between certain risks, consequences and their impact and help you develop appropriate mitigation strategies.
We invite you to download this spreadsheet and start identifying and prioritizing the “big hitter” consequences of specific risks that can have serious, detrimental effects on your organization should you wake up tomorrow face-to-face with another disaster.
CMK SELECT 