Security optimize

See effect of dependent risk by using a decision tree

Certain risks may only appear as a result of actions taken as a result of managing another risk. Project management expert Tom Mochal says that is when you want to use a decision tree.
Editor's note: This article was originally published August 29, 2006.

Most of the risks project managers face are independent of other risks. These types of risks are easier to identify and easier to manage. However, there are times when risks are connected. That is, it's possible that certain risks will only appear as a result of actions taken as a result of managing another risk. That's where the decision tree is used. A decision tree is a technique for determining the overall risk associated with a series of related risks.

For example, let's say your project needs to place a large equipment order. You think there is a 20% risk that your primary hardware supplier may not be able to provide all the equipment you need for a large order in a timely manner. This could be risk A. As a part of the risk response plan, you decide to talk to a second vendor to see if they can help fulfill the equipment order on short notice. The vendor normally has the equipment in stock. However, you also discover that there is a 25% possibility that there may be a disruption in their plant because of a potential strike. This is risk B.

Do you see how the two risks are related? Risk A is the primary project risk. If you can successfully manage risk A, there will be no reason to work with the second vendor and, therefore, risk B will never enter into the project. If risk A comes true, your risk plan will need to deal with a second risk B.

What you really want to know is what the chance is that risk A will come true (i.e., your primary vendor cannot fulfill the entire order) and risk B will also come true (i.e., the backup vendor goes on strike). That would be the worst case scenario for you. The total risk is calculated by multiplying the individual risks. Since there is a 20% chance of risk A, and a 25% chance of risk B, the probability that both risks will occur is 5% (.20 * .25). You can use risk trees to come up with financial implications as well. Let's look at the generic decision tree in Figure A, which is slightly more complex. Figure A

Figure A

This decision tree shows two risks: A and B. Risk A has two outcomes; outcome 1 is 20% likely to occur, and outcome 2 is 80% likely to occur. The monetary value of risk A is $10,000. If outcome 1 occurs, a second risk B is introduced, and there are three likely outcomes, 1.1, 1.2, and 1.3. The monetary value of risk B is $30,000. Using the decision tree, you see that the financial risks of the various outcomes are as follows:

  • Outcome 1.1 has a financial risk of $9,500 ($10,000 * .20) + ($30,000 * .25).
  • Outcome 1.2 has a financial risk of $23,000 ($10,000 * .20) + ($30,000 * .70).
  • Outcome 1.3 has a financial risk of $3,500 ($10,000 * .20) + ($30,000 * .05).
  • Outcome 2 has a financial risk of $8,000 ($10,000 * .80).

So you should try to achieve outcome 1.3 because it has the smallest financial risk impact. If you don't think you can achieve outcome 1.3 (and there is only a 1% chance you can (.20 * .05)), you should try for outcome 2. There is an 80% chance you can hit outcome 2.

As you see, this process can get complicated. Fortunately, most project risks are independent of each other. But when you discover that one risk leads to another dependent risk (and perhaps more dependent risks), a decision tree can help you determine the probability and impact of each risk combination.

-------------------------------------------------------------------------------------------------------------------

Get weekly PM tips in your inbox TechRepublic's IT Project Management newsletter, delivered on Wednesday, offers tips to help keep project managers and their teams on track. Automatically sign up today!
3 comments
grossmalone
grossmalone

timberland boots timberland outlet timberland shoes timberland boots timberland boot sale timberland fashion boots timberland boots kids timberland shoes outlet timberland discount shoes discount timberland boots [b][url=http://www.toptimberlandsales.com/]timberland boots[/url][/b] [b][url=http://www.toptimberlandsales.com/]timberland outlet[/url][/b] [b][url=http://www.toptimberlandsales.com/]timberland shoes[/url][/b] [b][url=http://www.toptimberlandsales.com/]timberland boots[/url][/b] [b][url=http://www.toptimberlandsales.com/]timberland boot sale[/url][/b] [b][url=http://www.toptimberlandsales.com/]timberland boots[/url][/b] [b]timberland outlet[/b] [b][url=http://www.toptimberlandsales.com/]timberland shoes[/url][/b] [b]timberland boots[/b] [b][url=http://www.toptimberlandsales.com/]timberland boot sale[/url][/b] [b][url=http://www.toptimberlandsales.com/]timberland fashion boots[/url][/b] [b]timberland boots kids[/b] [b][url=http://www.toptimberlandsales.com/]timberland shoes outlet[/url][/b] [b][url=http://www.toptimberlandsales.com/]timberland discount shoes[/url][/b] [b][url=http://www.toptimberlandsales.com/]discount timberland boots[/url][/b]

sabbathbloodysabbath
sabbathbloodysabbath

According to me this chart can be used # RISKS LIKELIHOOD IMPACT MANAGEMENT STRATEGY OWNER (Person Responsible) 1 High Database load and crashes Low High The hardware and software database patches need to be tested Database Administrator 2 Employees resistant in adapting new system Medium Low Friendly training sessions Gladstone Developers 3 Security breaches (i) Hacking (ii) Leakage of private information Medium High Proper Application of Security Practices and Distributed storage of data Following strict standardized data handling practices Security Administrator

benoit.moreau
benoit.moreau

Hi, the articles of Tom Mochal are generally quite interesting. In this paper, though, I am filled with perplexity. I cannot understand what the phrase "Outcome 1.1 has a financial risk of $9500" can really mean. I feel that the "value of risk" is used as if the financial outcome was always the same for both event outcomes of each node of the event tree. I feel the the current Wikipedia article is more convincing, although not absolutely clear: http://en.wikipedia.org/wiki/Decision_tree What do you think about it ? Benoit Moreau, Belgium