Risk Management: The Probability and Impact Matrix

A risk is an uncertain event that, if it happens, affects your project's goals. Most risks are threats (a storm, a vendor that goes silent), but some are opportunities (a sponsor who wants to pay for more). Risk management means finding them early, ranking them so you focus on the few that matter, and deciding in advance what you'll do. The tool at the center of it is the probability and impact matrix. In this lesson you'll use it on a one-day festival in Austin, where a single afternoon thunderstorm can cost more than the stage.

1. Identify risks
2. Score P×I
3. Calculate EMV
4. Plan responses
5. Monitor the register

Step 1: identify risks and write them clearly

The project: Eastside Eats & Beats, a one-day food and music festival for about 6,000 people in East Austin in May, with a $220,000 budget. The organizers ran a one-hour risk workshop with the team, two vendors and a volunteer who had worked other Austin festivals. Good sources of risks:

• Lessons learned from past similar projects (the best source by far).
• Every assumption in the charter: each one is a risk if it turns out false.
• The critical path and any single points of failure (one supplier, one key person).
• A simple prompt for each WBS branch: "What could go wrong here? What could go better than planned?"

Write each risk in a three-part format so the response is obvious: "Because of [cause], [risk event] may occur, which would lead to [effect]." For example: "Because May is peak storm season in Central Texas, a severe thunderstorm may force us to stop the event, which would lead to refunds and lost vendor fees." Compare that with "weather," which tells nobody what to do.

Step 2: score probability and impact

Agree on the scales before scoring, or every person will use their own. The festival team used these:

Then score each risk and multiply: Score = Probability × Impact. Here is the festival's list of threats:

Step 3: calculate expected monetary value

The P×I score ranks risks. To decide how much money to set aside, you need dollars: expected monetary value (EMV) multiplies the probability as a percentage by the dollar impact.

Not every risk will happen, and EMV doesn't predict which. It says that across all these risks, the festival should expect to absorb about $31,300, which is a sound basis for the contingency reserve you met in the budget lesson. There's also an opportunity: a local brewery might sponsor a beer garden (40% × $12,000 = $4,800 of positive EMV). Wise teams don't subtract it from the contingency until the contract is signed.

Step 4: plan the responses

Every amber and red risk needs a response strategy, an owner and, when possible, a trigger: an early warning sign that tells you the risk is starting to happen.

For opportunities, the mirror strategies are exploit (make sure it happens), enhance (raise its probability or value), share (partner with someone better placed to capture it) and accept.

Is the response worth it?

Compare the cost of the response with the EMV it removes. For R1, a weather cancellation policy costs $3,800 and leaves only a $5,000 deductible if the storm hits:

EMV before:  35% × $40,000 = $14,000
EMV after:   35% × $5,000  = $1,750
Reduction:   $14,000 − $1,750 = $12,250  vs. premium of $3,800 → worth it

R5 is less clear: a backup generator rental costs $1,200, more than R5's $900 EMV. The team rented it anyway, because a power failure at 9 p.m. with 6,000 people on site is also a safety issue, not just a cost. EMV informs the decision; it doesn't replace judgment.

Step 5: keep the risk register alive

The risk register is the table that holds all of this: ID, description, category, owner, P, I, score, EMV, response, trigger, status and last review date. A register written once and filed away is worse than none, because it gives false comfort. Review it on a fixed rhythm:

• Rescored every open risk with what we know today.
• Closed risks that can no longer happen (the permit arrived: close R4).
• Added new risks from the team, vendors and the latest status report.
• Checked every trigger (for R2: fewer than 40% of tickets sold six weeks out).
• Confirmed each red and amber risk has an owner who knows they own it.

Common mistakes

A: 0.40 × $15,000 = $6,000
B: 0.15 × $30,000 = $4,500
C: 0.30 × $10,000 = $3,000
D: 0.20 × $12,500 = $2,500
Total EMV         = $16,000

Summary

• Write risks as cause → event → effect; mine lessons learned and charter assumptions for them.
• Score with agreed 1–5 scales; P×I ranks risks into green (1–4), amber (5–12) and red (15–25).
• EMV = probability × dollar impact; the total for threats is a solid basis for contingency.
• Threat responses: avoid, mitigate, transfer, accept, escalate. Opportunities: exploit, enhance, share, accept.
• Give every serious risk an owner and a trigger, and review the register on a fixed rhythm.

Next lesson: Agile and Scrum: Roles, Events and Artifacts. You'll see how Scrum delivers in short sprints and how to forecast with velocity.