The evaluation team, through consensus or as directed by
the Risk Management Plan, selects the prioritization criteria. PF
and CF should always be part of the criteria, along with any other appropriate factors. Urgency, an indication of the time available before the procedures for handling the specific risk must be initiated, is often considered in the evaluation. The PM may also choose to rank-order the prioritization criteria, e.g., consequence/impact is more important than probability.
A multi-voting method is useful to prioritize risks (see References-Scholtes, 1988; Linstone, 1975). The Delphi method is a simple and effective method of arriving at a consensus among a group of experts. The procedure is for team members to vote on the priority of each risk and tally the results, which are fed back to the team. Team members vote again and the process is repeated until no changes occur in the results. It is normal to reach the final outcome within a few voting sessions. If there are a large number of risks, they may be broken into smaller groups for ranking. As a general rule, no more than 10 items should be prioritized per vote. The results of the series of votes are documented in the risk prioritization list.
PM guidance, which operates as a technique control
function, can be used, for example, to specify prioritization criteria and
prescribe the format of the risk prioritization list.