5.1.4 The Benefits of Integrated, Quantitative Risk Management

There is no question that risk management (RM) has a value much greater than its financial cost for implementation. Hall 1 reports return on investments (ROIs) on the order of 20–1. While our experience supports this finding, we believe that the return would be much higher given comprehensive metrics. To date, we have been unable to compile metrics as Hall has done because of the collateral effects that occur in application. Thus, we cannot calculate the true cost avoidance based solely on the application of risk management. This occurs because our approach is intense, focused on quantitative analysis, and designed to produce risk‐based decision support information for decision‐makers. We have dubbed the process risk‐based decision support, (RBDS). A particular characteristic of RBDS is the requirement that an ‘integrated’ result be presented to the decision‐maker. That is, the decision‐maker must have a result that integrates the various risk factors (i.e., cost, schedule, technical, mission, etc.) into a single, consistent, parameter for decision‐making – usually cost. The execution of such a risk management process means stringent demands for quality information are levied on projects. In fact, the coincidental discovery of deficient information during the process has yielded the greatest benefit to programs we have supported with RBDS. Qualitative techniques typically result in subjective risk estimates of likelihood and consequence such as high, medium, and low. Our intent is not to be critical of qualititative techniques; as a matter of fact, we use them. Furthermore, we find great value in qualitative processes, as they yield quick and efficient communication of risk issues across the program/project. However, we always go one step further. We implement a triage procedure to discriminate the ‘high’ risks that require further analysis using quantitative techniques. These quantitative techniques demand quality information from within the program. Typically, examples of deficient information discovered in our application of RBDS include low‐quality program plans, poor cost estimation, missing project elements, inconsistent integrated master plans and integrated master schedules, poor system‐level requirements, and unstable requirements. Each of these deficiencies themselves constitutes a risk to the program. In the following pages, we present a discussion of these management risks and how their identification has contributed to the success of numerous programs and projects. For some of our cases, we will provide semi‐quantitative judgments about the ROIs for RM.