The Risk Owner and the Risk Manager will rank and prioritize each identified risk and opportunity by occurrence probability and impact severity, according to the projects criticality scales.
Evaluating occurrence probability (P):
This is determined preferably based on experience, the progress of the project, or else by speaking to a risk expert, and is on a scale of 1 to 99%.
For example, suppose the risk that: the inability of supplier X to conduct studies on a modification Y by the end of 2025 is 50% probable. This could be determined from feedback and analysis of the suppliers workload.
Evaluating impacts severity (I):
To assess the overall impact, it is necessary to estimate the severity of each of the impacts defined at the project level. A scale is used to classify the different impacts and their severities. This ensures that the assessment of the risk and opportunity is standardized and reliable.
The criticality level of a risk or opportunity is obtained by the equation: Criticality = P x I
The purpose of the qualitative assessment is to ensure that the risk management team prioritizes the response on critical items first.