Risk Management - Standard Process/Definitions: Priority

Acquisition Risk Management Risk Prioritization
The risk rating is based on the probability of impact and the level of impact (manual mapping approach):

	Negligible	Minor	Moderate	Serious	Critical
0 - 10%	LOW	LOW	LOW	MED	MED
11 - 40%	LOW	LOW	MED	MED	HIGH
41 - 60%	LOW	MED	MED	MED	HIGH
61 - 90%	MED	MED	MED	MED	HIGH
91- 100%	MED	HIGH	HIGH	HIGH	HIGH

Reference: Franklin, C. E., Lt. Gen (USAF) Commander ESC, January Memorandum for ESC Program Managers, ESC/CC, Risk Management, Department of the Air Force, Headquarters ESC (AFMC) Hanscom Air Force Base, MA.

Operational Risk Management Risk Prioritization
Risk is the probability and severity of loss from exposure to the hazard. The assessment step is the application of quantitative or qualitative measures to determine the level of risk associated with a specific hazard. This process defines the probability and severity of an undesirable event that could result from the hazard.

Reference: Pocket Guide to Operational Risk Management

Other Priority Definitions
A weighted average model is used to compute an overall score for each identified risk. This score provides a most-to-least critical rank order of the risks. Formally, this scoring model originates from the concept of linear utility.

Definition: The Impact Score of an identified risk is the average of the three equivalent numerical values associated with the risk impact ratings selected for the three impact areas Cost, Schedule, and Technical Performance.

Definition: The Risk Score (equation 1) of an identified risk is the weighted average of the equivalent numerical values associated with the risk's Probability, Impact Score, and Timeframe.

(Equation 1)

In equation 1, U₁ is the risk's Probability with importance weight w₁, U₂ is the Impact Score with importance weight w₂, and U₃ is the equivalent numerical value for the risk's Timeframe with importance weight w₃. Furthermore, the weights sum to unity; that is, w₁ + w_{2 + w₃ = 1.}

Definition: If the impact of a risk to a project on Cost, Schedule, Technical Performance is such that it would cause project termination, then it is rated Severe and the Impact Score defaults to its maximum numerical value of one.

Definition: Risk Score is defined to be equal to one if the Impact Score is equal to one (refer to equation 1).

Definition: The overall Rating for Impact and Risk Priority is defined as follows:

The overall Rating of an identified project risk is rated Severe (in the project's RAW) if the Score for that risk is equal to one.
The overall Rating of an identified project risk is rated High (in the project's RAW) if the Score for that risk is greater than or equal to 0.65 and less than one.
The overall Rating of an identified project risk is rated Moderate (in the project's RAW) if the Score for that risk is greater than or equal to 0.35 and less than 0.65.
The overall Rating of an identified project risk is rated Low (in the project's RAW) if the Score for that risk falls between 0 and 0.35.

The table below summarizes the results of the scoring and risk ranking process described above.

Risk Score is used to rank a risk's priority relative to the other identified risks. The risk with the highest risk score is ranked first in priority, the risk with the next highest risk score is ranked second in priority and so forth. The closer the risk score is to one the higher the priority; the closer a risk score is to zero the lesser the priority.

Reference: Garvey, Paul R., "Implementing a Risk Management Process for a Large Scale Information System Upgrade - A Case Study", INCOSE Insight, May 2001, p.7-8.