Mission Intelligence Systems

Risk and Uncertainty

Four things people responsible for decisions under uncertainty should be able to do.

Not four topics. Each path below defines a behavior it is built to develop in your own program, how far you can currently take it marked path by path below. The articles are instruction, the spreadsheets are practice, and the Forecast Ledger, when it opens, is the evidence that any of it changed a decision.

31 items across four paths. Three working spreadsheets. No sign up, no email gate.

Your Risk workspace

Choose the capability you need to build.

This workspace belongs to the standalone Risk platform. It remembers progress in this browser only; no account, assessment response, or organizational score is required.

Operating loop

Progress is evidence of practice, not a maturity score.

  1. Move 1

    Explore

    Choose the capability that matches the decision problem.

  2. Move 2

    Assess

    Establish a 16-capability evidence-oriented baseline.

  3. Move 3

    Calibrate

    Score forecasts against what actually happened.

  4. Move 4

    Act

    Apply the activity or workbook to a live risk.

  5. Move 5

    Reassess

    Return after outcomes arrive and score the next run.

Foundations

4 itemsAvailable

You will be able to: Write a risk with an identifiable cause, uncertain event, consequence and owner.

Three stages: Make an entry worth reading (1), then Classify and surface (2), then Make it modellable (1).

Stage 1 of 3 · Make an entry worth reading · 1 item

Why does nobody read our risk register?

By the end of this stage: Write an entry that names a cause, an uncertain event, a consequence and an owner.

  1. The Risk Register Nobody Reads

    Make a register entry someone would read unprompted.

    Do this: Find the entries in your register nobody has read since the last required review, and say for each what would have to change for someone to read it.

Stage 1 ends when you have: Find the entries in your register nobody has read since the last required review, and say for each what would have to change for someone to read it.

Stage 2 of 3 · Classify and surface · 2 items

Is this a risk, an issue or an assumption?

By the end of this stage: Classify correctly, and get the risks nobody will write down onto the page.

  1. Is This a Risk or an Issue?

    Classify a statement correctly and know which pot of money pays.

    Do this: Reclassify ten register entries as risk, issue or assumption, and name the funding consequence of each change.

  2. The Organizational Pre-Mortem

    Produce specific, ownable risk statements the team would not otherwise have written.

    Do this: Run a pre-mortem and convert the output into register entries that each name a cause, an uncertain event, a consequence and an owner.

Stage 2 ends when you have: Run a pre-mortem and convert the output into register entries that each name a cause, an uncertain event, a consequence and an owner.

Stage 3 of 3 · Make it modellable · 1 item

Why can we not model what we already wrote down?

By the end of this stage: Rewrite entries until a simulation can accept them.

  1. From Risk Register to Quantified Model

    Rewrite register entries until they can be modeled at all.

    Do this: Take your register through the worksheet and produce entries with a quantified range, a probability and a mapped cost or schedule effect.

    Download the Risk Register to Model Worksheet

Stage 3 ends when you have: Take your register through the worksheet and produce entries with a quantified range, a probability and a mapped cost or schedule effect. Use the Risk Register to Model Worksheet.

Judgment

3 itemsPractice in pilot

You will be able to: Express uncertainty numerically and explain what would change the estimate.

Three stages: Replace the word with a number (1), then Estimate under sparse evidence (1), then Defend it to a decision body (1).

Instruction available, interactive practice in pilot. The practice this path needs requires commitment before revelation, which no workbook can enforce, so it is the first Forecast Ledger workflow rather than a fourth spreadsheet.

Stage 1 of 3 · Replace the word with a number · 1 item

What does 'likely' actually mean here?

By the end of this stage: State a probability instead of a word, and say what the number means.

  1. Why 'Likely' Is Not a Probability

    Replace a word with a number and state what the number means.

    Do this: Have each member of a risk review privately assign a percentage to the words your register uses, then compare the spread.

Stage 1 ends when you have: Have each member of a risk review privately assign a percentage to the words your register uses, then compare the spread.

Stage 2 of 3 · Estimate under sparse evidence · 1 item

How do we put a number on something that has never happened?

By the end of this stage: Produce and defend an estimate where there is no frequency history.

  1. Can You Put a Number on a Risk That Never Happened?

    Produce and defend a quantified estimate under sparse evidence.

    Do this: Take an exposure your organization has left qualitative because there is no frequency history, and produce a defended numerical estimate with the reasoning that supports it.

Stage 2 ends when you have: Take an exposure your organization has left qualitative because there is no frequency history, and produce a defended numerical estimate with the reasoning that supports it.

Stage 3 of 3 · Defend it to a decision body · 1 item

How do we present a range without it being read as ignorance?

By the end of this stage: Answer the four questions a governing body will ask of a range.

  1. How to Present a Probabilistic Cost Range to a Council

    Defend a range to a body that has to decide on it.

    Do this: Prepare the four answers a governing body will ask of a range, and the one sentence that says what you are asking them to decide.

Stage 3 ends when you have: Prepare the four answers a governing body will ask of a range, and the one sentence that says what you are asking them to decide.

Quantification

6 itemsAvailable

You will be able to: Select an appropriate method and state its assumptions and limitations.

Three stages: Read an output honestly (1), then Choose a method and know its limits (3), then Interpret and re-run (2).

Stage 1 of 3 · Read an output honestly · 1 item

What does our P80 actually promise?

By the end of this stage: Read a percentile for what it claims and not for what people hear.

  1. What P80 Means, and What It Does Not Promise

    Read a percentile without over-reading it.

    Do this: State, for a percentile your program already publishes, what it promises and what it does not.

Stage 1 ends when you have: State, for a percentile your program already publishes, what it promises and what it does not.

Stage 2 of 3 · Choose a method and know its limits · 3 items

Which method fits, and where does it break?

By the end of this stage: Select a method, state its preconditions, and name where it misleads.

  1. Are Risk Matrices Valid? What Cox Actually Proved

    Know when a matrix genuinely misleads, and what to do when the format cannot be abandoned.

    Do this: Test your matrix against the conditions under which ordinal ranking inverts the quantitative ordering, and record which of your risks sit in that region.

  2. Is This Schedule Good Enough to Run a Risk Analysis On?

    Decide whether a schedule can carry a simulation before running one.

    Do this: Check a schedule against the preconditions and produce a written go or no-go with the specific defects that would be inherited.

  3. The Premortem and the Reference Class

    Choose between two bias corrections that are weak exactly where the other is strong.

    Do this: Build a reference class for one current commitment and compare its distribution with the inside-view estimate already on record.

Stage 2 ends when you have: Build a reference class for one current commitment and compare its distribution with the inside-view estimate already on record.

Stage 3 of 3 · Interpret and re-run · 2 items

The model disagrees with the plan. Which one is wrong?

By the end of this stage: Diagnose a disagreement between model and plan, and decide when to re-run.

  1. Why the Simulation Disagrees With Your Critical Path Date

    Tell merge bias from a modeling defect when both look identical on the report.

    Do this: Take a simulated date that disagrees with the deterministic critical path and produce the diagnosis, with the evidence that distinguishes the two causes.

  2. How Often Should You Re-Run a Risk Analysis?

    Trigger re-analysis by conditions rather than by the calendar.

    Do this: Write the conditions that will trigger a re-run on your program, and retire whichever calendar cadence you are currently defending.

Stage 3 ends when you have: Write the conditions that will trigger a re-run on your program, and retire whichever calendar cadence you are currently defending.

Governance and Learning

18 itemsPractice in pilot

You will be able to: Escalate, resolve and convert an outcome into a changed decision practice.

Three stages: Locate authority (4), then Set thresholds and act (9), then Oversee, resolve and learn (5).

Practice available, closed-loop ledger in pilot. Stages one to three are usable now. The closing step, resolving a forecast and converting the outcome into a changed rule, is the pilot.

Stage 1 of 3 · Locate authority · 4 items

Who actually owns this, and who is allowed to decide?

By the end of this stage: Name the accountable party and the decision each owner can take alone.

  1. Who Owns Risk Under the Three Lines Model

    Settle who is accountable when three groups each name one of the others.

    Do this: Map your three lines and name, for one significant risk, who is accountable for it and who owns the judgment inside the number.

  2. Risk Ownership Without Authority

    Diagnose an owner who has been named but cannot decide.

    Do this: For each named owner, write down the decision they can take alone. Where the answer is none, the risk is unmanaged.

  3. The ATO Is an Authority Problem, Not a Security One

    Tell a supply constraint from an exposure constraint before funding a fix for the wrong one.

    Do this: Take the approval your program waits on longest and write what the approver carries if they sign and it goes wrong. If nothing is written there, every fix you are funding is aimed at supply.

  4. What Is Our Top Risk?

    Replace an unanswerable executive question with three that can be answered.

    Do this: Answer all three replacement questions for your program and show where they disagree with each other.

Stage 1 ends when you have: Answer all three replacement questions for your program and show where they disagree with each other.

Stage 2 of 3 · Set thresholds and act · 9 items

What are we willing to accept, and who releases the money?

By the end of this stage: Set a threshold that can be violated, choose a response, and hold release authority.

  1. Risk Appetite, Tolerance and Capacity Are Not Synonyms

    Set a threshold that can actually be violated.

    Do this: State your appetite as a confidence level and identify what would constitute a breach of it.

  2. Risk Appetite Is Not Alignment

    Close the gap between a published appetite and how the organization behaves.

    Do this: Find one decision taken in the last quarter that was outside the published appetite, and establish why nothing stopped it.

  3. Should We Mitigate, Transfer, Accept or Avoid?

    Choose a response knowing that transfer moves the invoice rather than the event.

    Do this: Take three treated risks and state what the treatment actually changed, separating the event from who pays for it.

  4. Ordering Work by Risk-Adjusted Value

    Sequence work by what most changes the decisions still ahead of you.

    Do this: Take the top drivers from a sensitivity ranking, filter them through the resolvable and decision-changing tests, and re-sequence the next two cycles.

  5. Who Controls Contingency, the Owner or the Contractor?

    Establish who holds release authority before the argument starts.

    Do this: Write down which definition of contingency and management reserve your agreement uses, and who is named to release each.

  6. Releasing Contingency as Risks Retire

    Release contingency as uncertainty resolves, rather than holding it by default.

    Do this: Track drawdown against retired risks in the tracker and produce the release recommendation the arithmetic supports.

    Download the Contingency Drawdown Tracker
  7. When the Least Experienced Person Owns Risk

    Recognize what a staffing decision gave away, and recover it.

    Do this: Name what the risk role on your program requires that the person holding it was never given, and decide which half you are changing.

  8. The Risk Experience Deficit

    Stop risk identification rotating away from the experience it requires.

    Do this: Establish how long your risk role has been held by its current occupant, and what identification capability leaves when it rotates.

  9. Why the Biggest Risk Is Never in the Register

    Surface a known but unwritten risk without requiring anyone to accept blame.

    Do this: Identify one risk everyone knows and nobody has written down, and design the route by which it could be raised.

Stage 2 ends when you have: Identify one risk everyone knows and nobody has written down, and design the route by which it could be raised. Use the Contingency Drawdown Tracker.

Stage 3 of 3 · Oversee, resolve and learn · 5 items

What does the board need, and did any of this work?

By the end of this stage: Report movement, meet the oversight standard, and score what you stated against what happened.

  1. What the Duty of Oversight Actually Requires

    Build the board-level system the standard actually asks for.

    Do this: Produce the record that would show a board received risk information and used it.

  2. The Board Has Two Governance Records

    Reconcile what the organization says about its governance against the evidence of how it decided.

    Do this: Take one thing the declared record says the board oversees and assemble twelve months of operating evidence for it, including what never arrived.

  3. What Should Risk Reporting to the Board Contain?

    Report movement rather than position, in three formats rather than one.

    Do this: Rebuild one risk report so every item shows what changed since the last one and what decision is being asked for.

  4. What FTA Oversight Procedure 40 Actually Requires

    Produce what a sponsor is actually required to produce, at the required percentile.

    Do this: Check your program against the cost and schedule rules separately, since they are not the same rule.

  5. How Do We Know Our Risk Management Is Working?

    Score the uncertainty the organization already stated against what actually happened.

    Do this: Score your published ranges against arriving outcomes, separate a centering fault from a width fault, and name the practice you are changing as a result.

    Download the Forecast Calibration Scorer

Stage 3 ends when you have: Score your published ranges against arriving outcomes, separate a centering fault from a width fault, and name the practice you are changing as a result. Use the Forecast Calibration Scorer.

Everything else

The paths are a route through the material, not a wall around it. The full collection of 31 risk articles, with its own index and search, is in the Builder's Library.

Browse the full risk collection