Figure 5-12 depicts the process used to prioritize the risks present in a
program. The inputs of this process are risks that have been identified. The
evaluation team, through consensus or as directed by the Risk Management Plan,
selects the prioritization criteria. PF and CF should
always be part of the criteria, along with any other appropriate factors.
Urgency, an indication of the time available before the procedures for
handling the specific risk must be initiated, is often considered in the
evaluation. The PM may also choose to rank-order the prioritization criteria,
e.g., consequence/impact is more important than probability.
A multi-voting method is useful to prioritize risks (see
References-Scholtes, 1988; Linstone, 1975). The Delphi method is a simple and
effective method of arriving at a consensus among a group of experts. The
procedure is for team members to vote on the priority of each risk and tally
the results, which are fed back to the team. Team members vote again and the
process is repeated until no changes occur in the results. It is normal to
reach the final outcome within a few voting sessions. If there are a large
number of risks, they may be broken into smaller groups for ranking. As a
general rule, no more than 10 items should be prioritized per vote. The
results of the series of votes are documented in the prioritized list of
PM guidance, which operates as a technique control function, can be used,
for example, to specify prioritization criteria and prescribe the format of
the prioritized list of risks.