Measuring Risk in Dollars and Cents
While taping a PM Podcast interview with Cornelius Fichtner earlier, we brushed against the topic of risk and how to measure it. The subject had also come up a few weeks ago in a different conversation; in both cases, it seemed to stir some interest in how to quantify risk in financial terms.
Monetizing risk is nothing new conceptually, but I want to share some thoughts about it. Now, I know that certain standards talk about the existence of 'positive risk' but I am more inclined to treat such occurrences as rare and pleasant surprises (pessimists might consider positive risk as a product of overly conservative revenue forecasting).
Maybe I am just stubborn, but I find it much more useful to consider risk in strictly negative terms, as a form of cost. This enables risk management to be a function of cost management and it allows you to readily factor it in as part of the overall value equation.
The basic concept can be illustrated using a one dollar lottery ticket for the weekly mega-million drawing. Without the risk factor, the idea of spending a buck to gain a return of millions of dollars looks pretty sweet. But, when you factor in the probability of not winning at 99.9999 percent and impact of the risk as losing your total investment, then the net risk adjusted potential payback of 1 ten thousandth of a cent makes it a much less attractive opportunity. The bottom line is that it's probably not going to clear the steering committee's hurdle rate.
I submit that any risk, potential or actual, represents a cost of some kind. It might be reflected as extending the time to market, reduced potential revenue, the cost of increased resources, more capital, the cost of redesign, or the expense of mitigating actions. The way I figure it, if you can't put a monetized estimate on an identified risk, then you are not through researching yet. If it has no cost, then it isn't a risk; it's just an odd curiosity or mild distraction of some sort.
So, with that in mind, the next question becomes how to fairly value it. For example, let's say you have identified a risk that is estimated to have an impact of $100,000 in rework costs if it occurs. The probability of the risk occurring is anticipated to be 50%. Therefore, the cost of simply accepting that risk is $100,000 x 0.5 or $50,000. Now, what if you knew you could spend $10,000 to reduce the probability of occurrence by half? Now the cost of the risk is valued at ($100,000 x 0.25) + $10,000 in mitigation costs, or $35,000 total.
So, the cost of this particular risk is now defined in monetary terms, and can be treated as you would any other cost when assessing the potential value of an investment.
Things get much more philosophical when you start to consider whether you should further devalue an investment opportunity initially. Should you attempt to account for the potential costs of 'known unknown' risks that will undoubtedly emerge as the initiative progresses? That is a conversation best had after hours, over a tasty beverage.
If you consider taking this approach, don't forget to also adjust how you are doing valuation calculations if you are currently risk adjusting via discounted cash flow. If you risk adjust using a defined cost approach, then don't double-dip by generically risk adjusting again when you set discount rates, etc.
This approach actually makes both risk management and valuation a little simpler. Risk is no longer hidden in DCF calculations, and risk is defined in a way that makes it easier for everyone to comprehend. Finally, because risk is quantified in the same manner as the key parameters it is most likely to be associated with (labor costs, material costs, revenue, etc.), it now becomes a directly comparable and independent measure, rather than some amorphous 'relative risk factor' like 0.65. See section 4 of Taming Change with Portfolio Management for additional thoughts on investment valuation and managing investment risk.



