Risk Events vs. Uncertainties in Project Risk Analysis

As part of the risk management plan, you usually identify risks events affecting duration, cost and other parameters, include them to the risk register, assign them to task and resources and perform Monte Carlo simulation of project schedules. To the casual observer, it seems quite straight forward that if you  have a well-defined risk plan and do a high quality risk analysis you have managed all of your risk. But the problem with this process is that it only includes risk events and these only represent a slice of project risk often called “epistemic”. Epistemic risk is characterized by probability and impact and further is manageable, that is, the impact of these risks on your project can be reduced or eliminated through good management. In general epistemic risks are related to our knowledge: we may not know what will happen during a course of project and therefore assign certain probability to some potential events.

However, there is another source of uncertainties that cannot be managed or reduced referred to as “aleatory”. This is important because this missing piece can represent a significant portion of your total project risk. Aleatory uncertainties refer to the inherent variance that occurs in all processes. This variance can be caused by a multitude of factors, but unlike discrete risks they have 100% probability of occurring and cannot be managed to the same extent as epistemic risks. In other words aleatory uncertainties usually are not attributed to certain individual factors. But, how to model them? This type of risk is often referred to as uncertainties and are described by low (optimistic), most likely, and High (pessimistic) estimates that are assigned statistical distributions such as triangular or normal which describe their probability density function.

As with qualitative analysis on risk events, Monte Carlo simulations are used to analyze the impact of these uncertainties and the same visualizations and reports are used. The difference is that there is no risk prioritization and subsequent risk response or mitigation plans. The only way to “manage” these uncertainties is to add risk adjusted schedule margin and cost contingency, which provide reasonable protection to key project objectives to ensure that it is delivered on time and budget.

So what we now see is projects can be impacted by both manageable and unmanageable risks. Yet, often Risk Management Plans include risk analysis processes that are focused on assessing and prioritizing risks, while completely ignoring another major source of uncertainties in their projects. So, even if you have an extremely well defined risk management plan, if it does not include how to incorporate aleatory uncertainties into both your risk analysis and management, you may find that your projects are still not meeting your key objectives.