A risk event can be described as the probability p of that event occurring and the distribution of the impact conditional on the risk event occurring. Graphically, one can illustrate the size of the impact as follows:
The horizontal axis represents the magnitude of the impact if the event occurs, which is zero with probability (1-p) and either a distribution containing probability p, or perhaps a fixed value.
Risk registers are a common way of collating the identified risks into one document. For large projects, there will often be hundreds of identified risks. It is important to be able to assess the accumulated potential impact of these risks. One can model each risk separately using formulae such as Binomial(p,1)*PERT(a,b,c), but where there are hundreds of risks this can be quite laborious. A quick solution is to calculate the approximate total risk distribution using Central Limit Theorem. This theorem says that if one is adding a large enough number of random variables (the risk impacts) together, the result will look approximately Normally distributed. Moreover, the Normal distribution will have a mean and variance equal to the sum of the means and variances of each of the variables being added respectively. There are two important caveats to the theorem: each risk must be independent; and no one or two risks can provide the dominant contribution to the variance. Neither may be true, in which case other modeling methods (modeling a risk event, Conditional logic) are more appropriate than the one we discuss here.
We need to be able to determine the mean and variance of a risk impact like the illustration above in order to be able to add a large set of risk impacts together using Central Limit Theorem. Let us suppose that a risk event has a probability p of occurring, and if the risk event occurs it will have an impact that can be described by a conditional distribution with mean mI and variance VI . Then it turns out that for any conditional impact distribution, the mean mR and variance VR of the risk impact as a whole (i.e. including the possibility of being zero with probability (1-p)) is given by (Proof):
| (1) | \mu_R = p\mu_I \\ V_R = pV_I+{\mu_I}^2 p (1-p) |
If the impact of the risk event is just a number I, rather than a distribution, the formulae simplify to: |
It is now a simple matter to get an approximate estimate of the impact of the whole list of risks. Conditional risk impacts are usually modeled with a relatively small set of distribution types: Triangular, PERT and perhaps a Normal or Lognormal. For each distribution type there are formulae that calculate the mean and variance from the distributions' parameters. For example:
Distribution type | Mean m | Variance V |
Triang(a,b,c) | \frac{a+b+c}{3} | \frac{a^2+b^2+c^2-ab-ac-bc}{18} |
PERT(a,b,c) | \frac {a+4b+c}{6} | \frac{\big(\mu-a\big) \big(c-\mu\big)}{7} |
Normal (m,s) | m | s 2 |
Lognorm(m,s) | m | s 2 |
So these formulae can be used together with Central Limit Theorem to estimate approximate ranges of the total risk impact, as shown in CLT Risk Portfolio Approximation
The links to the CLT Risk Portfolio Approximation software specific models are provided here:
