21.6 Estimating Risk and Contingency Buffers

Intuitively, we all know that high-risk projects should allow larger buffers for risk contingency and low-risk projects can get by with smaller buffers. But how large should you make the buffers?

Risks are typically analyzed according to their severity (or impact) and probability. Table 21-15 shows an example of a table of risks, including the risks' probabilities, severities, and risk exposures.

Table 21-15: Example of a Risk Lists Table for Project Schedule Risks
Risk	Probability	Severity, Schedule	Risk Exposure, Schedule
#1	5%	15 weeks	0.75 weeks
#2	25%	2 weeks	0.5 weeks
#3	25%	8 weeks	2 weeks
#4	50%	2 weeks	1 week
TOTAL RE		-	4.25 weeks

The severity of a risk multiplied by its probability is usually referred to as the Risk Exposure, or RE. Statistically, the RE is the risk's "expected value," or the amount that the project should expect to add to its schedule because of its risks. For the risks listed in Table 21-15, the project should expect to add 4.25 weeks to its base schedule because of project risks. There is a 50% chance the project will add more than that and a 50% chance the project will add less than that.

Total RE makes a good place to begin quantitative buffer planning. If you want more certainty that you will deliver on time, you should plan for a buffer that's larger than the total RE. If you can live with a high risk of overrun, you might plan for a smaller buffer.

RE tells only part of the story. In Table 21-15, if risk #1 or #3 hits, the project will blow past its 4.25 week expected buffer. That isn't very likely, but you should consider the effects that specific risks would have before you settle on a final contingency buffer.

Table 21-15 showed a risk list from the point of view of schedule risks only. Any given risk might also pose a risk to effort, cost, features, quality, or revenue. Table 21-16 shows an example of a risks list table that includes risks to schedule, cost, and revenue.

Table 21-16: Example of a Risk Lists Table for Project Schedule Risks
Risk	Probability	Severity, Schedule (Weeks)	Exposure, Schedule (Weeks)	Severity, Cost	Risk Exposure, Cost	Severity, Revenue	Risk Exposure, Revenue
#1	5%	15	0.75	$150,000	$7,500	$10,000,000	$500,000
#2	25%	2	0.5	$20,000	$5,000	$0	$0
#3	25%	8	2	$80,000	$20,000	$500,000	$125,000
#4	50%	2	1	$20,000	$10,000	$0	$0
TOTAL RE		-	4.25	-	$42,500	-	$625,000

For buffer planning, you'll need separate buffers for schedule, effort, cost, features, and quality. These buffers are only loosely related to each other.

Remember that the severities and probabilities are estimated and that the accuracy of the aggregate RE is only as accurate as the data that went into computing it in the first place.

Tip #102

Use your project's total Risk Exposure (RE) as the starting point for buffer planning. Review the details of your project's specific risks to understand whether you should ultimately plan for a buffer that's larger or smaller than the total RE.

The field of risk management is well advanced, and risk management is an area in which the science of estimation can play a significant role. The "Additional Resources" section that closes this chapter describes where to find more information on risk estimation.