Tools › Project Management › Risk › Risk Register and Quantitative Risk › Example

Eight-risk register on a $10 M, 24-month baseline: DoD RIO Guide scoring, expected monetary value and the Monte Carlo S-curves

Tool	Risk Register and Quantitative Risk
Source	U.S. Department of Defense (2017). Department of Defense Risk, Issue, and Opportunity Management Guide for Defense Acquisition Programs. Tables 3-1, 3-2 and 3-3, Figures 3-5 and 3-6; NASA Cost Estimating Handbook v4 (2015) Appendix G, Section G.2.3; GAO-20-195G (2020) Chapter 12.
Level	Professional

Problem

A project with a $10,000 K baseline and 520 working days carries eight risks, each with a probability, triangular cost and schedule impacts (low / likely / high), a response (accept, avoid, transfer or control) with its cost and post-response values, and a standing cost of 8 $K per day of delay; the occurrences of R1–R5 and R2–R7 are correlated 0.5 and 0.4. Score the register on the DoD likelihood bands and consequence levels, place it on the guide's 5 × 5 matrix, find the expected monetary value before and after the responses with the net value of the response plan, and simulate the register for the P80 contingency and the delay.

Inputs to Enter

R1 supplier late 40 %, cost 150/300/600, 10/20/45 days, control for 60 → 20 %, 100/200/400, 5/15/30; R2 structural margin 30 %, 200/400/900, 15/30/60, control for 120 → 15 %, 150/300/600, 10/20/40 (performance level 3); R3 staff loss 25 %, 80/150/300, 5/10/25, accept; R4 regulatory 20 %, 50/120/300, 20/45/90, accept
R5 test facility 35 %, 60/100/200, 10/20/40, avoid for 40 → 10 %, 30/60/120, 5/10/20; R6 requirements growth 50 %, 200/350/700, 10/25/50, control for 80 → 35 %, 120/250/500, 5/15/35 (level 2); R7 software defects 45 %, 100/200/400, 10/20/40, control for 50 → 30 %, 60/120/250, 5/10/25 (level 3); R8 price escalation 30 %, 100/250/500, transfer for 30 → 10 %, 50/100/200
Bands 20 / 40 / 60 / 80 / 99 %, impact levels 0.1 / 1 / 5 / 10 % of the baseline, DoD matrix, P80, 20,000 iterations, seed 1, pairs R1-R5: 0.5, R2-R7: 0.4

Open the Risk Register and Quantitative Risk tool (loaded with this example)

Answers

Levels: R6 and R7 likelihood 3, consequence 3 (score 9, moderate); R2 likelihood 2, consequence 4 (moderate); R1, R3, R5, R8 low; R4 likelihood 1, consequence 4 (low); 3 moderate and 5 low before the responses, all 8 low after (the Figure 3-5 cell pattern reproduces the guide's Figure 3-6 count of 14 red / 29 yellow / 37 green)
EMV = p (mean cost + mean days × 8): total 1,341.8 $K before the responses (cost part 805.8, expected delay 67.0 days), 594.5 after; response cost 380, net value of the plan 367.3; best net value R6 (88.9; R1 86.7, a return ratio of 1.44:1), every treated risk positive
Monte Carlo (20,000 iterations, seed 1): total cost impact mean 1,339 $K, P50 1,285, P80 1,973, P90 2,350 (numpy 2,000,000 draws: 1,341.6 / 1,284.8 / 1,982.6 / 2,363.4); P(no risk occurs) 4.2 %; delay P80 100.2 days (numpy 101.1); after the responses P80 976.7 $K (numpy 978.0)
P80 contingency 1,973 $K = 19.7 % of the baseline, risk-adjusted budget 11,973 $K, 631 $K above the EMV; the P80 tornado puts R6 first (−382 $K when removed), then R2 and R1

Notes

The tool's default inputs are this register; press Submit. The register is illustrative (stated on the page); the acceptance values are closed forms and the numpy / scipy run in References/Risk-Register/checks/, checked by test_risk_register.php (300 checks), which also reproduces the DoD guide's Table 3-3 EMV and return-on-investment example and NASA's two-risk occurrence rule. The guide's Table 3-3 total row prints $21M for a column that sums to $26.4M.