Risk and Uncertainty
Four things people responsible for decisions under uncertainty should be able to do.
Not four topics. Each path below defines a behavior it is built to develop in your own program, how far you can currently take it marked path by path below. The articles are instruction, the spreadsheets are practice, and the Forecast Ledger, when it opens, is the evidence that any of it changed a decision.
31 items across four paths. Three working spreadsheets. No sign up, no email gate.
Your Risk workspace
Choose the capability you need to build.
This workspace belongs to the standalone Risk platform. It remembers progress in this browser only; no account, assessment response, or organizational score is required.
Risk assessments and instruments
Start with a baseline, then test a real outcome.
The essays support the work. These instruments measure it.
Primary diagnostic · 64 questions
Comprehensive Risk Capability Diagnostic
Sixteen capabilities aligned to recognized practice, with evidence prompts, a full profile, three priorities, and Four A's operating-condition analysis.
Outcome test · Forecasts and ranges
Forecast Calibration Scorer
Check stated probabilities and ranges against what happened. Separate centering error from ranges that are too narrow.
Operating loop
Progress is evidence of practice, not a maturity score.
Move 1
ExploreChoose the capability that matches the decision problem.
Move 2
AssessEstablish a 16-capability evidence-oriented baseline.
Move 3
CalibrateScore forecasts against what actually happened.
Move 4
ActApply the activity or workbook to a live risk.
Move 5
ReassessReturn after outcomes arrive and score the next run.
Start where your problem is
Foundations
Write a risk with an identifiable cause, uncertain event, consequence and owner.
4 items
Judgment
Express uncertainty numerically and explain what would change the estimate.
3 items · practice in pilot
Quantification
Select an appropriate method and state its assumptions and limitations.
6 items
Governance and Learning
Escalate, resolve and convert an outcome into a changed decision practice.
18 items · practice in pilot
Foundations
4 itemsAvailableYou will be able to: Write a risk with an identifiable cause, uncertain event, consequence and owner.
Three stages: Make an entry worth reading (1), then Classify and surface (2), then Make it modellable (1).
Stage 1 of 3 · Make an entry worth reading · 1 item
Why does nobody read our risk register?
By the end of this stage: Write an entry that names a cause, an uncertain event, a consequence and an owner.
- The Risk Register Nobody Reads
Make a register entry someone would read unprompted.
Do this: Find the entries in your register nobody has read since the last required review, and say for each what would have to change for someone to read it.
Stage 1 ends when you have: Find the entries in your register nobody has read since the last required review, and say for each what would have to change for someone to read it.
Stage 2 of 3 · Classify and surface · 2 items
Is this a risk, an issue or an assumption?
By the end of this stage: Classify correctly, and get the risks nobody will write down onto the page.
- Is This a Risk or an Issue?
Classify a statement correctly and know which pot of money pays.
Do this: Reclassify ten register entries as risk, issue or assumption, and name the funding consequence of each change.
- The Organizational Pre-Mortem
Produce specific, ownable risk statements the team would not otherwise have written.
Do this: Run a pre-mortem and convert the output into register entries that each name a cause, an uncertain event, a consequence and an owner.
Stage 2 ends when you have: Run a pre-mortem and convert the output into register entries that each name a cause, an uncertain event, a consequence and an owner.
Stage 3 of 3 · Make it modellable · 1 item
Why can we not model what we already wrote down?
By the end of this stage: Rewrite entries until a simulation can accept them.
- From Risk Register to Quantified Model
Rewrite register entries until they can be modeled at all.
Do this: Take your register through the worksheet and produce entries with a quantified range, a probability and a mapped cost or schedule effect.
Download the Risk Register to Model Worksheet
Stage 3 ends when you have: Take your register through the worksheet and produce entries with a quantified range, a probability and a mapped cost or schedule effect. Use the Risk Register to Model Worksheet.
Judgment
3 itemsPractice in pilotYou will be able to: Express uncertainty numerically and explain what would change the estimate.
Three stages: Replace the word with a number (1), then Estimate under sparse evidence (1), then Defend it to a decision body (1).
Instruction available, interactive practice in pilot. The practice this path needs requires commitment before revelation, which no workbook can enforce, so it is the first Forecast Ledger workflow rather than a fourth spreadsheet.
Stage 1 of 3 · Replace the word with a number · 1 item
What does 'likely' actually mean here?
By the end of this stage: State a probability instead of a word, and say what the number means.
- Why 'Likely' Is Not a Probability
Replace a word with a number and state what the number means.
Do this: Have each member of a risk review privately assign a percentage to the words your register uses, then compare the spread.
Stage 1 ends when you have: Have each member of a risk review privately assign a percentage to the words your register uses, then compare the spread.
Stage 2 of 3 · Estimate under sparse evidence · 1 item
How do we put a number on something that has never happened?
By the end of this stage: Produce and defend an estimate where there is no frequency history.
- Can You Put a Number on a Risk That Never Happened?
Produce and defend a quantified estimate under sparse evidence.
Do this: Take an exposure your organization has left qualitative because there is no frequency history, and produce a defended numerical estimate with the reasoning that supports it.
Stage 2 ends when you have: Take an exposure your organization has left qualitative because there is no frequency history, and produce a defended numerical estimate with the reasoning that supports it.
Stage 3 of 3 · Defend it to a decision body · 1 item
How do we present a range without it being read as ignorance?
By the end of this stage: Answer the four questions a governing body will ask of a range.
- How to Present a Probabilistic Cost Range to a Council
Defend a range to a body that has to decide on it.
Do this: Prepare the four answers a governing body will ask of a range, and the one sentence that says what you are asking them to decide.
Stage 3 ends when you have: Prepare the four answers a governing body will ask of a range, and the one sentence that says what you are asking them to decide.
Quantification
6 itemsAvailableYou will be able to: Select an appropriate method and state its assumptions and limitations.
Three stages: Read an output honestly (1), then Choose a method and know its limits (3), then Interpret and re-run (2).
Stage 1 of 3 · Read an output honestly · 1 item
What does our P80 actually promise?
By the end of this stage: Read a percentile for what it claims and not for what people hear.
- What P80 Means, and What It Does Not Promise
Read a percentile without over-reading it.
Do this: State, for a percentile your program already publishes, what it promises and what it does not.
Stage 1 ends when you have: State, for a percentile your program already publishes, what it promises and what it does not.
Stage 2 of 3 · Choose a method and know its limits · 3 items
Which method fits, and where does it break?
By the end of this stage: Select a method, state its preconditions, and name where it misleads.
- Are Risk Matrices Valid? What Cox Actually Proved
Know when a matrix genuinely misleads, and what to do when the format cannot be abandoned.
Do this: Test your matrix against the conditions under which ordinal ranking inverts the quantitative ordering, and record which of your risks sit in that region.
- Is This Schedule Good Enough to Run a Risk Analysis On?
Decide whether a schedule can carry a simulation before running one.
Do this: Check a schedule against the preconditions and produce a written go or no-go with the specific defects that would be inherited.
- The Premortem and the Reference Class
Choose between two bias corrections that are weak exactly where the other is strong.
Do this: Build a reference class for one current commitment and compare its distribution with the inside-view estimate already on record.
Stage 2 ends when you have: Build a reference class for one current commitment and compare its distribution with the inside-view estimate already on record.
Stage 3 of 3 · Interpret and re-run · 2 items
The model disagrees with the plan. Which one is wrong?
By the end of this stage: Diagnose a disagreement between model and plan, and decide when to re-run.
- Why the Simulation Disagrees With Your Critical Path Date
Tell merge bias from a modeling defect when both look identical on the report.
Do this: Take a simulated date that disagrees with the deterministic critical path and produce the diagnosis, with the evidence that distinguishes the two causes.
- How Often Should You Re-Run a Risk Analysis?
Trigger re-analysis by conditions rather than by the calendar.
Do this: Write the conditions that will trigger a re-run on your program, and retire whichever calendar cadence you are currently defending.
Stage 3 ends when you have: Write the conditions that will trigger a re-run on your program, and retire whichever calendar cadence you are currently defending.
Governance and Learning
18 itemsPractice in pilotYou will be able to: Escalate, resolve and convert an outcome into a changed decision practice.
Three stages: Locate authority (4), then Set thresholds and act (9), then Oversee, resolve and learn (5).
Practice available, closed-loop ledger in pilot. Stages one to three are usable now. The closing step, resolving a forecast and converting the outcome into a changed rule, is the pilot.
Stage 1 of 3 · Locate authority · 4 items
Who actually owns this, and who is allowed to decide?
By the end of this stage: Name the accountable party and the decision each owner can take alone.
- Who Owns Risk Under the Three Lines Model
Settle who is accountable when three groups each name one of the others.
Do this: Map your three lines and name, for one significant risk, who is accountable for it and who owns the judgment inside the number.
- Risk Ownership Without Authority
Diagnose an owner who has been named but cannot decide.
Do this: For each named owner, write down the decision they can take alone. Where the answer is none, the risk is unmanaged.
- The ATO Is an Authority Problem, Not a Security One
Tell a supply constraint from an exposure constraint before funding a fix for the wrong one.
Do this: Take the approval your program waits on longest and write what the approver carries if they sign and it goes wrong. If nothing is written there, every fix you are funding is aimed at supply.
- What Is Our Top Risk?
Replace an unanswerable executive question with three that can be answered.
Do this: Answer all three replacement questions for your program and show where they disagree with each other.
Stage 1 ends when you have: Answer all three replacement questions for your program and show where they disagree with each other.
Stage 2 of 3 · Set thresholds and act · 9 items
What are we willing to accept, and who releases the money?
By the end of this stage: Set a threshold that can be violated, choose a response, and hold release authority.
- Risk Appetite, Tolerance and Capacity Are Not Synonyms
Set a threshold that can actually be violated.
Do this: State your appetite as a confidence level and identify what would constitute a breach of it.
- Risk Appetite Is Not Alignment
Close the gap between a published appetite and how the organization behaves.
Do this: Find one decision taken in the last quarter that was outside the published appetite, and establish why nothing stopped it.
- Should We Mitigate, Transfer, Accept or Avoid?
Choose a response knowing that transfer moves the invoice rather than the event.
Do this: Take three treated risks and state what the treatment actually changed, separating the event from who pays for it.
- Ordering Work by Risk-Adjusted Value
Sequence work by what most changes the decisions still ahead of you.
Do this: Take the top drivers from a sensitivity ranking, filter them through the resolvable and decision-changing tests, and re-sequence the next two cycles.
- Who Controls Contingency, the Owner or the Contractor?
Establish who holds release authority before the argument starts.
Do this: Write down which definition of contingency and management reserve your agreement uses, and who is named to release each.
- Releasing Contingency as Risks Retire
Release contingency as uncertainty resolves, rather than holding it by default.
Do this: Track drawdown against retired risks in the tracker and produce the release recommendation the arithmetic supports.
Download the Contingency Drawdown Tracker - When the Least Experienced Person Owns Risk
Recognize what a staffing decision gave away, and recover it.
Do this: Name what the risk role on your program requires that the person holding it was never given, and decide which half you are changing.
- The Risk Experience Deficit
Stop risk identification rotating away from the experience it requires.
Do this: Establish how long your risk role has been held by its current occupant, and what identification capability leaves when it rotates.
- Why the Biggest Risk Is Never in the Register
Surface a known but unwritten risk without requiring anyone to accept blame.
Do this: Identify one risk everyone knows and nobody has written down, and design the route by which it could be raised.
Stage 2 ends when you have: Identify one risk everyone knows and nobody has written down, and design the route by which it could be raised. Use the Contingency Drawdown Tracker.
Stage 3 of 3 · Oversee, resolve and learn · 5 items
What does the board need, and did any of this work?
By the end of this stage: Report movement, meet the oversight standard, and score what you stated against what happened.
- What the Duty of Oversight Actually Requires
Build the board-level system the standard actually asks for.
Do this: Produce the record that would show a board received risk information and used it.
- The Board Has Two Governance Records
Reconcile what the organization says about its governance against the evidence of how it decided.
Do this: Take one thing the declared record says the board oversees and assemble twelve months of operating evidence for it, including what never arrived.
- What Should Risk Reporting to the Board Contain?
Report movement rather than position, in three formats rather than one.
Do this: Rebuild one risk report so every item shows what changed since the last one and what decision is being asked for.
- What FTA Oversight Procedure 40 Actually Requires
Produce what a sponsor is actually required to produce, at the required percentile.
Do this: Check your program against the cost and schedule rules separately, since they are not the same rule.
- How Do We Know Our Risk Management Is Working?
Score the uncertainty the organization already stated against what actually happened.
Do this: Score your published ranges against arriving outcomes, separate a centering fault from a width fault, and name the practice you are changing as a result.
Download the Forecast Calibration Scorer
Stage 3 ends when you have: Score your published ranges against arriving outcomes, separate a centering fault from a width fault, and name the practice you are changing as a result. Use the Forecast Calibration Scorer.
The three workbooks, on their own
If you would rather start with the practice than the reading, take the spreadsheet. Live formulas and a worked example in each.
Forecast Calibration Scorer
Do our stated confidence levels mean anything?
Contingency Drawdown Tracker
Is the risk profile deteriorating before the forecast admits it?
Risk Register to Model Worksheet
Which of our register entries can actually be modeled?
Everything else
The paths are a route through the material, not a wall around it. The full collection of 31 risk articles, with its own index and search, is in the Builder's Library.
Browse the full risk collection