Risk analysis is normally performed by using the method where you start by identifying the risk and afterwards analyze the cause and effect. A structured way of doing this is by use of a RBS.
In literature the RBS is mostly described as an index or a grouping of the risks in a project as in the example below. Just like Work Breakdown Structure (WBS) it is up to you – or your Project Management Office (PMO) to decide the structure of the RBS.I prefer and recommend you to use the breaking down technic in a little different way to give you more insight into the background and the consequence of each risk and see the likely links between many risks in the project.
The RBS is created by analyzing any risk found in the project. You build the hierarchy downwards by trying to identify the causes for the risk you chose to analyze. Which causes are behind this risk? Which conditions could lead to this risk? Asking for causes or conditions will quickly unfold any risk into several paths of causes. You might like to call the identified causes for risks as well or maybe sub-risks.
You build the hierarchy upwards in the same way but now you look for the consequences of the risk you chose to analyze. Again the might be several consequences i.e. several paths but as you move up in the hierarchy you will of course end with the familiar three: delays, cost overruns and quality problems but also environmental and health impacts might be relevant.
Each path in the RBS is now representing a chain of causes or risks. Each risk has at least one underlying cause which can be seen as a risk in itself or sub risk. Each risk has also at least one overlying consequence which can sometimes also be seen as a risk.Having developed a RBS for a certain risk you’ll have a much better understanding of both the causes and the consequences of the risk and thereby a much better background to determine the magnitude of the probability and consequence of this risk.
Furthermore will each small RBS for each of the risks you analyze of cause have several either causes or consequences in common and hereby you can merge all RBS’s to one large RBS for the whole project! Doing this will give you a nice overview which can unveil which risks have the most consequences or which consequences have the most underlying risks. By adding colors to the branches you can highlight these relationships. Merging the small RBS’s is also a very good way to add quality control to your risk management process since any path you cannot connect is either an error or misunderstanding or something that has to be broken down further – and then connected!
After having applied probability and effect to all risks the RBS can finally be used to ‘add’ risk along the paths and hereby answer questions like: “Where do we have the most causes for potential delays (or overruns)?”, “Are the risks more likely to cause delays or cost overruns in this project?” or “Which sub-projects adds mostly to the risk of delays?”
Finn Svenning, March 2016
Thanks to Mogens Mikkelsen and Jens Tastum for reviewing my ideas.