Editor’s note: This article was originally published August 29, 2006.

Most of the risks project managers face are independent of other risks. These types of risks are easier to identify and easier to manage. However, there are times when risks are connected. That is, it’s possible that certain risks will only appear as a result of actions taken as a result of managing another risk. That’s where the decision tree is used. A decision tree is a technique for determining the overall risk associated with a series of related risks.

For example, let’s say your project needs to place a large equipment order. You think there is a 20% risk that your primary hardware supplier may not be able to provide all the equipment you need for a large order in a timely manner. This could be risk A. As a part of the risk response plan, you decide to talk to a second vendor to see if they can help fulfill the equipment order on short notice. The vendor normally has the equipment in stock. However, you also discover that there is a 25% possibility that there may be a disruption in their plant because of a potential strike. This is risk B.

Do you see how the two risks are related? Risk A is the primary project risk. If you can successfully manage risk A, there will be no reason to work with the second vendor and, therefore, risk B will never enter into the project. If risk A comes true, your risk plan will need to deal with a second risk B.

What you really want to know is what the chance is that risk A will come true (i.e., your primary vendor cannot fulfill the entire order) and risk B will also come true (i.e., the backup vendor goes on strike). That would be the worst case scenario for you. The total risk is calculated by multiplying the individual risks. Since there is a 20% chance of risk A, and a 25% chance of risk B, the probability that both risks will occur is 5% (.20 * .25).
You can use risk trees to come up with financial implications as well. Let’s look at the generic decision tree in Figure A, which is slightly more complex.
Figure A

This decision tree shows two risks: A and B. Risk A has two outcomes; outcome 1 is 20% likely to occur, and outcome 2 is 80% likely to occur. The monetary value of risk A is $10,000. If outcome 1 occurs, a second risk B is introduced, and there are three likely outcomes, 1.1, 1.2, and 1.3. The monetary value of risk B is $30,000. Using the decision tree, you see that the financial risks of the various outcomes are as follows:

  • Outcome 1.1 has a financial risk of $9,500 ($10,000 * .20) + ($30,000 * .25).
  • Outcome 1.2 has a financial risk of $23,000 ($10,000 * .20) + ($30,000 * .70).
  • Outcome 1.3 has a financial risk of $3,500 ($10,000 * .20) + ($30,000 * .05).
  • Outcome 2 has a financial risk of $8,000 ($10,000 * .80).

So you should try to achieve outcome 1.3 because it has the smallest financial risk impact. If you don’t think you can achieve outcome 1.3 (and there is only a 1% chance you can (.20 * .05)), you should try for outcome 2. There is an 80% chance you can hit outcome 2.

As you see, this process can get complicated. Fortunately, most project risks are independent of each other. But when you discover that one risk leads to another dependent risk (and perhaps more dependent risks), a decision tree can help you determine the probability and impact of each risk combination.


Get weekly PM tips in your inbox
TechRepublic’s IT Project Management newsletter, delivered on Wednesday, offers tips to help keep project managers and their teams on track. Automatically sign up today!