The Risk of Risk Exposure

There are various attributes of a risk such as the cost impact, schedule impact, probability, proximity, exposure and so on. The risk exposure, also known as value at risk, is often taken as being a representative quantification of a risk. It is calculated as the product of the probability or likelihood of a risk occurring and the cost impact if it does happen. There are obvious advantages of this: it is a logical way of prioritising a range of risks for management actions, and it is a good way of summarising a range of risks given that some will occur, and some others will not. It is also very helpful in determining how much money to budget in your risk reserve. 

There are however a few inherent problems and risks with a sole use of the risk exposure in the long term. The first is the tendency to forget that risk exposure is derived from a probability which is a gut feeling or blatantly put, a guess work. It obviously follows that it says nothing of what the impact of the risk will be if it happens. Risk exposure is better
viewed as the average impact of a particular risk if the event contributing to the risk is repeated in the same environment for many many times. So let's say that a risk would have a financial impact of £1,000 and you estimate that it has a 30% likelihood of happening giving a risk exposure of £300. What this means is that if this project is conducted say 100 times, on 30 occasions the risk will occur with a full impact of £1,000 but on 70 occasion, it will not occur and so have a zero impact. This implies that irrespective of how accurate the probability of a risk is, the risk exposure of one particular risk considered in isolation is not very useful. 

If however you are looking at a project risk register with say 50 different risks, the total risk exposure which is the sum of the individual risk exposures become a very good indication of how much will be spent on risks. It is however very important to prioritise these different risks based on their exposure as well their impact. This is because a high impact risk can easily eat up the whole risk budget. Let's look at the example below.

Probability	Cost Impact	Risk Exposure
20%	£1,000	£200
40%	£400	£160
70%	£100	£70
	Total	£430

From the above we see the project has a total risk exposure of £430. If the first risk happens, the risk exposure budget is gone. The risk exposure can only cover the impact of the second or third risk, and hardly enough if both happened. It is therefore very important to keep an eye on top risks with high cost impact and ensure there are mitigation measures in place if possible.

Proximity is another very important attribute of a risk. It gives an indication of when the risk might happen. It is very good for monitoring risks and may be useful for implementing risk mitigation measures. However, the idea of linking risk exposures to proximity is a dangerous one. This is often refereed to as risk exposure profiling and very impressive graphs can be used to illustrate it as below. The danger is that once again the exposure significantly summarises only a few risks and may not add any value. It is exactly the same problem with looking at individual risk exposures. Looking at an individual or even multiple exposure periods as in below can be misleading.

Risk Exposure	Start	Finnish
£200	02/01/2014	03/03/2014
£160	25/04/2014	12/06/2014
£70	20/09/2014	16/11/2014
£430	Total

Risk Exposure Profiling

Another important area to watch out for when looking at risk exposures is when the value changes with time. So let's say we were only looking at the value of the exposure in the above example which is £430, and after a while the value changes to £230. It might as well be that the first risk has occurred and has increased the project cost and therefore no longer treated as a risk. From this we infer that a falling exposure is not always a good thing. 

So in conclusion, while the risk exposure is a very important attribute of a risk, it is important to remember how it is derived and what it means. It is also vital to keep an eye on the other attribute. If this is not done, the risk exposure becomes a risk of its own, and most likely the highest impact risk in a project.