Beyond probability-impact matrices in project risk management: A quantitative methodology for risk prioritisation

Project management involves inherent complexities and risks that can significantly impact project success. The European Commission (2023) defines a project as a temporary endeavor with specific constraints. Achieving project objectives is challenging due to unexpected events disrupting plans and budgets, often leading to cost overruns. The Standish Group (2022) emphasizes the importance of managing project uncertainty, making risk management indispensable. Risk management's primary goal is to identify, assess, and communicate project risks, facilitating informed decision-making to mitigate their impact on budget and schedule. Various methodologies and standards integrate a project risk management process, encompassing risk identification, assessment, response planning, implementation, and monitoring. A critical challenge is prioritizing risks to direct management efforts efficiently, especially given the limited resources. Risk matrices are widely used tools for risk assessment and ranking, considering likelihood and impact. However, these matrices face significant limitations including the inability to capture complex interrelationships between risks and the reliance on imprecise qualitative estimations. The study addresses the limitations of probability-impact matrices by proposing a quantitative methodology for project risk prioritization that overcomes these drawbacks.

The paper begins by reviewing existing risk management methodologies and standards from various sources, including ISO 31000, PMBOK, PRINCE2, APMG, and ICB 4.0, highlighting commonalities and differences in their risk management processes. It then delves into the widespread use of probability-impact matrices across diverse sectors, acknowledging their simplicity and ease of use. However, the review emphasizes the limitations and criticisms of these matrices, citing inaccuracies in comparing risks, subjective interpretations, and the inability to account for complex interrelations. The literature review discusses various proposed solutions, such as using fuzzy sets, independent score measures, logarithmic scales, and continuous probability consequence diagrams to improve risk matrix accuracy. The authors highlight the lack of quantitative methods integrating qualitative risk analysis data into project simulation models, emphasizing the novelty of their proposed approach.

The proposed methodology uses a quantitative approach based on Monte Carlo Simulation (MCS) to prioritize project risks. The process begins with risk identification, followed by qualitative analysis to estimate the probability (P) and impact (I) of each identified risk. Unlike traditional risk matrices, this method incorporates these estimations into a project model for MCS using the MCSimulRisk software. Three types of uncertainty are considered: aleatoric (modeled using probability distribution functions), stochastic (modeled using Bernoulli distribution functions), and epistemic (modeled using uniform distribution functions). The choice of distribution function and parameters depends on the available project knowledge and risk assessment team's experience. The MCS simulates the project model with and without each individual risk. By comparing the results, the impact of each risk on project duration (Imp_Dri) and cost (Imp_Cri) is quantified. A confidence percentile (e.g., P95 or P80) is selected to determine the risk appetite, representing the level of risk the project is willing to assume. This percentile is used to calculate the Value at Risk (VaR), and the impacts of each risk on the project duration and cost objectives are determined by subtracting the original project's expected duration and cost from the values obtained after including the risk. Finally, risks are prioritized according to their absolute impact on cost and duration objectives, separately creating two lists ranked by magnitude.

The methodology is demonstrated through a case study of a real-life engineering, procurement, and construction (EPC) project. The project's activities are defined by their duration, cost (fixed and variable), and precedence relationships. Eleven risks are identified, with some impacting both duration and cost. Qualitative analysis assigns probability and impact levels to each risk, generating a probability-impact matrix for comparison purposes. MCSimulRisk performs 20,000 iterations for each simulation, incorporating triangular distribution functions for activity durations and uniform distribution functions for risks. A P95 percentile is chosen as the risk measure to quantify risk impact. The results show significant differences in risk prioritization when comparing the probability-impact matrix with the proposed MCS-based method. The quantitative method provides absolute values for each risk's impact on both duration and cost. Risks affecting only cost have no impact on duration, while risks impacting duration also affect cost. The order of importance of risks varies depending on whether the duration or cost objective is prioritized. The study demonstrates how the quantitative approach provides a more precise and nuanced understanding of risk impact than traditional qualitative methods.

The findings highlight the limitations of probability-impact matrices in accurately prioritizing risks. The proposed MCS-based methodology offers several advantages: it provides quantitative results, considers the absolute impact of each risk rather than relative rankings, and distinguishes between impacts on duration and cost objectives. This allows for more informed decision-making regarding resource allocation for risk management. The case study demonstrates that risks initially identified as having only a cost impact can significantly impact the project’s overall cost. Also, risks affecting duration have a more substantial impact on cost than those affecting only cost. The study's results emphasize the importance of using a quantitative method to understand the impact of risks and allocate resources effectively. The independent prioritisation allows for flexibility based on the project's primary objective (schedule or cost).

The paper presents a novel quantitative method for project risk prioritization using Monte Carlo Simulation, offering a significant improvement over traditional probability-impact matrices. The methodology provides a more accurate and nuanced assessment of risk impact on both duration and cost objectives. Future research could explore the sensitivity of the results to different parameter estimations and extend the model to incorporate interdependencies between risks in complex projects. Real-world application of the methodology across various sectors is also a key area for future work.

The accuracy of the proposed methodology relies heavily on the quality of the initial risk identification, probability, and impact estimations. While the study acknowledges the importance of expert judgment, subjective biases in these estimations can affect the simulation results. The model assumes that risks are independent, which might not always be the case in highly complex projects with interconnected risks. The influence of risk interdependencies on the prioritization results should be investigated in future research.