In this Challenge of the Week (CHOW), we present a not so difficult one for you to crack – the idea being not so much to tease brains but convey a message that may be described as “Bang for the Risk Mitigation buck”!
Here goes:
You are reviewing the top risks in a project to substantially enhance an application in the hospitality domain – to be deployed world-wide in a major hotel chain. About 30% of the project work is envisaged to be at customer locations in the US and about 70% at the development facility in Hyderabad.
“Lack of expertise in the hospitality domain” has been identified among the top risks in the project with a probability of 70% (Likely to occur) and potential impact of 80% (Very High impact on scope, schedule, cost and quality goals).
The Project Manager has come up with the following list of mitigation actions, the resultant reduced risk probability & risk impact and additional cost estimated for each mitigation action:
| Option | New Probability | New impact | Additional cost of mitigation |
| 1. Hire a domain expert offshore | 30% | 40% | $40,000 |
| 2. Adopt incremental delivery (to obtain early feedback & adapt) | 50% | 40% | $20,000 |
| 3. Shift complex functionality work to the onsite team (for closer coordination customer) | 10% | 10% | $85,000 |
The questions are:
a. How would you choose from among the three options above?
b. Does it make sense to choose more than one? All? Any two? Which ones?
Suggested solution:
As we said when we presented the Challenge of the Week back in May ’16, the idea is to come up with a measure for the “Bang for the Risk Mitigation buck”. In other words, for a given risk mitigation option, what are you spending and how much reduction are you likely to achieve in terms of a lower risk score (which is the product of risk probability and risk impact). The measure can be the reduction in risk score for a given mitigation option divided by the associated cost (Cost-Benefit). For ease of calculation, we will ignore the thousands in the cost figures and take just 40, 20 and 85 cost units.
| Option | Risk score before mitigation | Risk score after mitigation | Cost | Cost-Benefit | Order of preference |
| 1. Hire a domain expert offshore | 0.7 x 0.8 = 0.56 | 0.3 x 0.4 = 0.12 | $40,000 | (0.12 – 0.56) / 40 = -0.011 | # 2 choice |
| 2. Adopt incremental delivery (to obtain early feedback & adapt) | 0.7 x 0.8 = 0.56 | 0.5 x 0.4 = 0.2 | $20,000 | (0.2 – 0.56) / 20 = -0.018 | # 1 choice |
| 3. Shift complex functionality work to the onsite team (for closer coordination with customer) | 0.7 x 0.8 = 0.56 | 0.1 x 0.1 = 0.01 | $85,000 | (0.01 – 0.56) / 85 = -0.006 | # 3 choice |
| 4. Option 1 + 2 | 0.7 x 0.8 = 0.56 | 0.15 x 0.16 = 0.024 | $40,000 + $20,000 = $60,000 | (0.024 – 0.56) / 60 = -0.009 | ??? |
As you can see from the table above, if you have to pick the top option in terms of bang for the buck that would be option 2. Hope it is clear
Now next question: should you be adopting more than one option – say 1 and 2 both?
If you did, the new (lower) risk probability would be the combined probabilities of options 1 and 2 (30% and 50%) – 0.3 x 0.5 = 0.15. Let us say risk impact also dramatically reduces (which is debatable!) to 0.4 x 0.4 or 0.16. So, the new risk score for options 1 + 2 is 0.15 x 0.16 = 0.024. The Cost-Benefit is (0.024 – 0.56) / (40 + 20) = -0.536/60 = -0.009. The “bang” for options 1 + 2 seems disappointing, is it not? Not better than individual option 1 and individual option 2. That’s the way the numbers stack up! You can examine other combination options and see how the Cost-Benefit looks compared to pursuing options in isolation. You can then pick the top options depending on cost, stakeholder risk appetite, feasibility of mitigation options and other factors.
In summary, do bear in mind sometimes the numbers tell you things which are counterintuitive. Secondly, despite just the numbers play, good sense and judgement should prevail (after all, where do the numbers come from?!). For example, if you pursued options 1 and 2 together, while risk probability may come down as shown above, does the risk impact really come down by that much? May be not. That is a matter of judgment.