Many of our clients have undertaken programmatic risk management efforts and many more are on the verge of doing so. 

In nearly all cases these organizations apply basic risk management tools to assess risk level, which provide some quantification of the level of risk.  For example, frequently used FMEA assessments typically result in a Risk Priority Number (RPN) to quantify risk level for a particular process or process step.   These RPN’s can be sorted in ascending or descending order to establish a relative risk priority.  Similarly, other risk assessment tools result in a quantification of risk level, which can be sorted in the same way.

However, since time, money, and human resources are limited, the question still remains, “How do we determine what the threshold should be in determining a high priority risk process or process step?”  In other words, what is the cut-off point for what will be considered high priority?

Most often we see organizations take a very unsophisticated, tough to defend approach to answering this question…they say they’ll take the top Y% of risk areas and call them high priority, or they’ll pick a hypothetical threshold number beyond which the risks will be considered high priority (e.g. risks with RPN’s greater than Y).

We suggest a different way to consider making this decision – a two-slope curve analysis.  This method applies a bit more rigor and highlights, in a very visual manner, the high priorities.  The first step in this process is to construct a bar chart where each different risk quantification value (e.g. RPN’s for an FMEA) has a bar on the x-axis.  The y-axis measures the value for each of the bars (not the number of occurrences).  An FMEA example:

 
More often than not, when this chart is created, there is a clear inflection point where the risk quantification values jump up.  Also on the chart it’s possible to draw two best fit lines, one for the values prior to this inflection point, and one for the values beyond the inflection point – thus the two-slope curve.

Processes or process steps with risk values beyond the inflection point we typically consider high priority.  Incidentally, this method often maps pretty closely to the 80/20 rule, with 20% of the risk values ending up as high priority.

I’m curious if you have any thoughts on this method or if you have used other methods for establishing the high priority risks.

Fred Greulich

Tags: Risk Management

This entry was posted on Monday, March 8, 2010 at 1:32 pm and is filed under Uncategorized. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site, or  Forward