Risk, Uncertainty and Resilience

Introduction

Projects create value by changing an existing state, but change also creates exposure. A project may face uncertain demand, technical failure, supplier insolvency, regulatory intervention, cyberattack, extreme weather, labour disruption or a shortage of specialist skills. Some uncertain events threaten objectives; others create opportunities to improve cost, time, quality or benefits. Effective project management therefore requires more than listing risks. It requires structured identification, analysis, response design, monitoring and organisational learning.

Risk management is not an attempt to eliminate all uncertainty. Elimination is usually impossible and may be uneconomic. The objective is to make uncertainty visible, prioritise material exposures, allocate ownership, prepare proportionate responses and preserve the project’s ability to absorb shocks. This chapter connects conventional project risk management with resilience: the capacity to anticipate, withstand, adapt to and recover from disruption while continuing to deliver intended outcomes.

Learning Objectives

By the end of this chapter, learners should be able to:

1. Distinguish risk, uncertainty, issue, ambiguity and opportunity.
2. Construct a risk breakdown structure and a useful risk register.
3. Apply probability–impact analysis and expected monetary value.
4. Use decision trees, sensitivity analysis and Monte Carlo simulation appropriately.
5. Design preventive, corrective, contingency and exploitative responses.
6. Develop resilient delivery plans using redundancy, flexibility, buffers and recovery mechanisms.
7. Critically evaluate governance, data quality, behavioural bias, ethics and the limitations of risk models.

1. Risk, Uncertainty and Project Performance

A risk is an uncertain event or condition that, if it occurs, has a positive or negative effect on one or more project objectives. A threat has a negative effect; an opportunity has a positive effect. An issue is a condition that has already occurred or is currently occurring. For example, “the supplier may fail” is a risk, whereas “the supplier has missed the contractual delivery date” is an issue.

Uncertainty is broader than risk. It includes incomplete knowledge, variability, ambiguity about meaning or objectives, and emergent conditions that cannot be fully specified in advance. In classical risk analysis, probabilities and consequences can be estimated. Under deep uncertainty, the decision-maker may not agree on the relevant states of the world, their probabilities or even the appropriate model.

A useful distinction is:

Risk exposure is shaped by both probability and consequence, but a simple product should not be treated as a complete representation of risk. A low-probability catastrophic event may deserve more attention than a frequent minor delay, even if both produce the same numerical product. Interdependencies, velocity, detectability, reversibility and stakeholder impact also matter.

2. Risk Governance and the Risk Process

A mature risk process is integrated with governance, planning and control rather than performed as a one-time workshop. It normally includes:

1. Establishing context: define objectives, assumptions, constraints, risk appetite, thresholds and reporting rules.
2. Identification: discover threats, opportunities, causes, events and effects.
3. Analysis: estimate probability, impact, timing, correlation and uncertainty in estimates.
4. Evaluation: compare exposure with thresholds and prioritise attention.
5. Response planning: select economical and feasible actions.
6. Implementation: fund, schedule and assign actions.
7. Monitoring and review: track triggers, residual exposure, emerging risks and effectiveness.
8. Communication and consultation: exchange information with decision-makers and affected stakeholders.

Risk governance determines who can accept exposure and who must escalate it. A risk owner is accountable for managing a particular risk; a risk action owner is responsible for executing a response. These roles may be held by different people. The project manager coordinates the system but should not become the owner of every risk.

Risk appetite describes the type and amount of uncertainty an organisation is willing to pursue or retain. Risk tolerance defines acceptable variation around an objective. Thresholds should be expressed in operational terms—for example, “no more than a 10% probability of exceeding the approved completion date by 20 working days”—rather than vague statements such as “keep schedule risk low.”

3. Identification: From Causes to Consequences

A strong risk statement separates cause, uncertain event and effect:

Because a single specialist supplier is financially constrained (cause), the supplier may fail during integration (event), causing rework and a delay to commissioning (effect).

This structure prevents vague entries such as “supplier risk,” which cannot guide action. Identification techniques include expert judgement, interviews, checklists, historical data, assumptions analysis, lessons learned, Delphi studies, prompt lists, interface analysis, SWOT analysis, scenario planning and cause-and-effect diagrams.

A risk breakdown structure (RBS) organises sources of uncertainty. Typical categories include technical, external, organisational, commercial, resource, schedule, cost, safety, security and stakeholder risks. An RBS is not a substitute for analysis; it is a completeness aid.

A risk register should normally record:

Workshops can suffer from anchoring, groupthink, dominance by senior participants and availability bias. Anonymous pre-work, independent estimates, evidence review and explicit challenge improve quality. Identification should continue throughout the life cycle because risks change as knowledge increases.

4. Qualitative Analysis

Probability–Impact Analysis

For each risk, the team assesses the likelihood of occurrence and its effect on objectives. Scales may be ordinal, such as 1–5, or expressed as ranges. A heat map highlights priorities, but colour alone is not analysis. The organisation must define what each score means and how escalation follows from it.

For a simple score:

Here, S is a prioritisation score, P is the probability rating and I is the impact rating. If both are ordinal scores, S is ordinal or semi-quantitative—not a true monetary expectation. It should not be interpreted as a precise probability of loss.

For example, a risk rated probability 4 and cost impact 5 has a score of 20. This identifies a priority relative to other risks under the same scale; it does not mean that the risk is four times as likely as a score-1 risk.

Qualitative analysis should also consider urgency, detectability, manageability, connectivity and stakeholder sensitivity. A risk with a high score but a response lead time of six months may be more urgent than a higher-scoring risk that can be controlled immediately.

Assumptions and Dependency Analysis

Every plan rests on assumptions, such as resource availability, stable exchange rates or timely approval. An assumption may be converted into a risk if evidence weakens. Dependencies should be mapped because correlated risks can invalidate a portfolio-level view based on simple addition. For example, several suppliers may depend on the same port, cloud provider or regulatory approval.

5. Quantitative Analysis

Quantitative analysis is justified when decisions are consequential, uncertainty is material, data are adequate and the cost of analysis is proportionate. It should support—not replace—managerial judgement.

Expected Monetary Value

For mutually exclusive scenarios, expected monetary value (EMV) is the probability-weighted average consequence:

where pᵢ is the probability of scenario i, xᵢ is its monetary consequence, and the probabilities sum to 1. Positive values may represent gains and negative values losses. EMV is a long-run average under repeated comparable decisions; it is not a prediction of the outcome of one project.

For a single threat with probability p and cost C, expected cost is:

If a response costs R and changes the probability and consequence to p_r and C_r, its expected net benefit is:

A positive ENB supports the response financially, subject to non-financial, legal and ethical considerations. This calculation assumes that consequences can reasonably be monetised and that alternatives are comparable.

Worked example. A project faces a 30% probability of a delay costing $200,000. A preventive test costs $25,000 and reduces probability to 10%; the consequence remains $200,000.

Without the test: EC = 0.30 × 200,000 = $60,000. With the test: 25,000 + 0.10 × 200,000 = $45,000. Expected saving is $15,000, so the test has a positive expected net benefit of $15,000. The result does not prove that the test should be purchased: safety, reputation, contractual exposure and risk aversion may strengthen or weaken the decision.

Decision Trees

A decision tree represents choices, uncertain events and outcomes. Decision nodes are normally shown as squares; chance nodes as circles. At each chance node, probabilities should be exhaustive and mutually exclusive. The tree is evaluated from right to left by calculating expected values, while recognising that a risk-neutral EMV decision may be inappropriate for catastrophic or irreversible outcomes.

Figure: A decision tree comparing a preventive test with uncertain delay outcomes.

The example assumes the test cost is incurred in all test branches. Its EMV is −$45,000, compared with −$60,000 without testing; therefore, the test is preferred under risk neutrality.

Sensitivity Analysis

Sensitivity analysis examines how an output changes when one input changes while other inputs remain fixed. For a linear cost model:

where C₀ is fixed cost, xⱼ is an uncertain driver and aⱼ is its cost coefficient. The local sensitivity of cost to driver xⱼ is:

This is useful only where the relationship is adequately represented by the model and the one-at-a-time assumption is reasonable. Tornado diagrams rank drivers by their effect on an output. They reveal influential assumptions but do not represent correlations well.

Monte Carlo Simulation

Monte Carlo simulation propagates uncertainty through a model by repeatedly sampling values from specified input distributions. For each iteration, the model calculates an output such as total cost or completion date. The resulting distribution supports statements such as “there is an 80% probability of completing by date D,” rather than a single deterministic estimate.

A generic simulation is:

1. Define the model and output measure.
2. Assign distributions to uncertain inputs, based on data and expert judgement.
3. Represent dependencies and correlations.
4. Sample one value for each input.
5. Calculate the output.
6. Repeat many times.
7. Inspect percentiles, tail outcomes, drivers and validation results.

If simulated completion times are T₁, T₂, …, Tₙ, the sample mean is:

and the empirical percentile is obtained by ordering the simulated values and selecting the value below which the stated percentage of observations falls. A P80 completion date therefore has approximately 80% of simulated outcomes at or before that date, assuming the model is credible.

Simulation quality depends more on model structure and input assumptions than on the number of iterations. Common errors include using unjustified distributions, ignoring correlation, treating optimistic estimates as independent, and reporting false precision. Results should be stress-tested and communicated as ranges with assumptions.

6. Response Strategies and Contingency Planning

Responses should address the cause where possible, not merely the consequence. For threats, standard strategies are:

• Avoid: change scope, method or technology to remove the threat.
• Mitigate: reduce probability or impact.
• Transfer or share: allocate financial or operational consequences to another party through insurance, contract or partnership; accountability is not eliminated.
• Accept: monitor and tolerate the exposure, possibly with a contingency reserve.
• Escalate: move the risk to a higher governance level when it exceeds project authority.

For opportunities, strategies include exploit, enhance, share, accept and escalate. An exploit response ensures an opportunity occurs; enhancement increases its probability or benefit; sharing allocates ownership to a party better able to realise it.

A contingency plan specifies what will be done if a defined trigger occurs. It should identify decision authority, actions, resources, timing, communications and exit criteria. A contingency reserve is allocated for known–unknown risks; management reserve may be held for unforeseen work under appropriate governance. Neither is a licence to conceal poor estimating or uncontrolled scope.

Responses can create residual risks and secondary risks. For example, dual sourcing may reduce supply interruption but create additional qualification cost, interface complexity and quality variation. The register must be updated after response selection.

7. Resilient Delivery Plans

Resilience extends risk management from event response to system design. A resilient project can:

• anticipate plausible disruption;
• absorb shocks without unacceptable loss of function;
• adapt resources, sequence or configuration;
• recover within an agreed time; and
• learn and improve after disturbance.

Resilience is achieved through a portfolio of mechanisms:

A resilient schedule is not simply a schedule with a large float. It protects critical interfaces, identifies recovery paths, sequences irreversible decisions carefully and defines escalation thresholds. A resilient supply chain may use qualified alternatives, transparent tier-two dependencies and contractual obligations for continuity evidence. Resilience must be evaluated against the project’s value proposition: excessive redundancy can make a project uneconomic.

Useful resilience indicators include time to detect, time to respond, time to recover, percentage of critical suppliers with tested continuity plans, concentration of dependencies and the proportion of critical controls exercised. These are indicators rather than universal standards; targets should reflect context.

8. Applied Case: MetroLink Signalling Upgrade

This is an illustrative case. MetroLink, a metropolitan rail operator, is replacing signalling equipment on a busy corridor. The project has a fixed commissioning window, strict safety requirements and a single approved supplier for a specialised interface module.

Background and problem

The baseline budget is $20 million. A supplier failure could cause a three-month delay, with an estimated consequence of $2 million in disruption and rework. Engineering estimates a 15% probability of failure. A qualification programme for a second supplier costs $180,000 and reduces the probability to 5%, but introduces a $70,000 integration cost. A cyber vulnerability is also identified, with a 10% probability of a $1 million consequence. The two risks are partially correlated because both depend on the same integration environment.

Analysis

The expected cost of supplier failure without qualification is:

0.15 × $2,000,000 = $300,000.

With qualification, expected supplier-related cost is:

$180,000 + $70,000 + 0.05 × $2,000,000 = $350,000.

On supplier failure alone, qualification is not justified by EMV. However, the project board identifies that a three-month outage could compromise public confidence and breach service obligations. It therefore rejects a purely financial decision.

The team performs sensitivity analysis on the failure probability. The break-even condition is:

180,000 + 70,000 + 2,000,000pᵣ < 2,000,000p.

With pᵣ = 0.05, qualification becomes financially favourable when p > 0.175. The current estimate of 15% is below that threshold, but uncertainty around the estimate is substantial. A review of supplier financial data and independent testing is commissioned.

For cyber risk, the team avoids relying on a single control. It adopts secure configuration baselines, independent penetration testing, network segmentation and a rehearsed restoration plan. The contingency plan defines a controlled rollback if commissioning tests fail. A dashboard tracks supplier liquidity, defect closure rate, test coverage and cyber alerts.

Outcome and learning

The board retains the single-supplier design but approves a limited second-source qualification gate, triggered if supplier liquidity or defect indicators deteriorate. It funds the cyber controls because the consequences include safety and public trust, which are not adequately represented by expected monetary value. A two-week protected commissioning buffer is created by resequencing non-critical work rather than simply extending the final date.

The case demonstrates that quantitative analysis informs decisions but does not determine them automatically. Resilience is created by conditional options, early warning, tested recovery and governance that recognises safety, reputation and public value.

9. Limitations, Ethics and Contemporary Practice

Risk models can create an illusion of objectivity. Probabilities may be politically influenced, impact scales may hide distributional effects and historical data may not represent unprecedented conditions. Schedule models often underestimate correlation and optimism bias. A risk register can become a compliance document if owners do not act on it.

Ethical practice requires honest escalation, protection of whistle-blowers, transparent assumptions, appropriate treatment of affected communities and avoidance of transferring risk to parties with less bargaining power. Safety, privacy, accessibility and environmental impacts should not be reduced to financial values without careful justification. Contractual risk transfer should not be used to evade responsibility for foreseeable harm.

Digital tools and AI can support natural-language risk extraction, anomaly detection, scenario generation and simulation. They also introduce risks: biased training data, fabricated evidence, opaque recommendations, confidentiality breaches and automation bias. AI-generated risk statements require human validation, traceability to evidence, access controls and model-risk governance. High-impact decisions should retain accountable human approval.

Contemporary practice increasingly combines enterprise risk management, systems thinking, climate and cyber resilience, supply-network mapping and scenario analysis. The trend is away from isolated risk registers toward dynamic risk sensing and integrated decision-making. Nevertheless, advanced tools cannot compensate for unclear objectives, weak ownership or poor organisational learning.

Best-Practice Checklist

• Define objectives, thresholds and risk appetite before scoring.
• Express risks as cause–event–effect statements.
• Include opportunities as well as threats.
• Assign owners with authority and resources.
• Use qualitative analysis for prioritisation and quantitative analysis where it changes a consequential decision.
• Model dependencies and avoid false precision.
• Link responses to triggers, budgets and schedules.
• Test contingencies rather than merely documenting them.
• Review residual, secondary and emerging risks.
• Communicate ranges, assumptions and confidence honestly.
• Integrate resilience into design, procurement, sequencing and governance.
• Capture lessons and update models after events and near misses.

Chapter Summary

Project risk is the effect of uncertainty on objectives, while uncertainty also includes ambiguity and incomplete knowledge. Effective management establishes context, identifies causes and effects, analyses probability and consequence, plans responses, monitors triggers and learns. Qualitative probability–impact analysis is useful for prioritisation, but ordinal scores are not precise expected losses. EMV and decision trees support probability-weighted choices under stated assumptions; sensitivity analysis identifies influential inputs; Monte Carlo simulation produces outcome distributions when input uncertainty and dependencies can be modelled credibly.

Responses may avoid, mitigate, transfer, accept or escalate threats, and exploit, enhance, share, accept or escalate opportunities. Contingency planning converts triggers into authorised actions. Resilience complements risk management by designing redundancy, diversity, buffers, modularity, flexibility, visibility and recovery capability. Quantitative outputs must be interpreted alongside safety, ethics, stakeholder consequences, irreversibility and organisational risk appetite. Strong governance, transparent assumptions, accountable ownership and tested recovery plans are more valuable than elaborate but poorly grounded models.

Key Terms

Risk: Uncertainty that affects an objective positively or negatively.

Threat: A risk with a negative potential effect.

Opportunity: A risk with a positive potential effect.

Uncertainty: Incomplete knowledge, variability or ambiguity about conditions and outcomes.

Issue: A condition or event that has already occurred or is occurring.

Risk owner: Person accountable for managing a risk.

Risk register: Controlled record of risks, analysis, owners, responses and status.

Risk breakdown structure: Hierarchical classification of risk sources.

Risk appetite: Amount and type of uncertainty an organisation is willing to pursue or retain.

Risk threshold: Level at which exposure requires action or escalation.

Probability–impact analysis: Assessment combining likelihood and consequence for prioritisation.

Expected monetary value: Probability-weighted average consequence across scenarios.

Decision tree: Graphical model of decisions, chance events and outcomes.

Sensitivity analysis: Examination of output change when an input changes.

Monte Carlo simulation: Repeated random sampling used to propagate input uncertainty through a model.

Contingency plan: Predefined action plan activated by a trigger.

Residual risk: Exposure remaining after a response.

Secondary risk: New risk created by implementing a response.

Resilience: Capacity to anticipate, absorb, adapt to and recover from disruption.

Risk trigger: Observable condition indicating that a risk is becoming active or requires action.

Review Questions

Short Answer Questions

1. Distinguish a risk from an issue and provide an example of each.
2. Why should a risk statement separate cause, event and effect?
3. What is the difference between a risk owner and a risk action owner?
4. State two limitations of a probability–impact heat map.
5. Define residual risk and secondary risk.

Long Answer Questions

1. Explain the complete project risk management process and its relationship with governance.
2. Compare EMV, decision trees, sensitivity analysis and Monte Carlo simulation, including when each is appropriate.
3. Discuss how a project can design resilience through redundancy, flexibility, buffers and recovery capability.
4. Critically evaluate the ethical and managerial limitations of monetising project risks.
5. Explain how risk responses can alter the risk profile through residual and secondary risks.

Analytical / Application Questions

1. A project has a 25% probability of a $400,000 delay. A mitigation costing $50,000 reduces probability to 8%. Calculate the expected cost before and after mitigation, then discuss two non-financial factors that could affect the decision.
2. Design a risk register entry for a project dependent on a single cloud provider. Include cause, event, effect, owner, trigger, preventive response, contingency and residual risk.
3. A project team reports an 80% probability of completing by 30 September based on a Monte Carlo model. Explain what this statement means, identify two modelling assumptions that should be challenged and recommend one governance action.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes an issue from a risk?

A. An issue is always financially significant, whereas a risk is not.

B. An issue has occurred or is occurring, whereas a risk is uncertain.

C. An issue is positive, whereas a risk is negative.

D. An issue belongs to the sponsor, whereas a risk belongs to the project manager.

Correct Answer: B. An issue has occurred or is occurring, whereas a risk is uncertain.

Question 2

A threat has a 20% probability and a potential cost of $300,000. What is its expected cost?

A. $6,000

B. $60,000

C. $150,000

D. $600,000

Correct Answer: B. $60,000

Question 3

What is the principal purpose of sensitivity analysis?

A. To prove that an uncertain event will occur

B. To identify how changes in inputs affect an output

C. To assign ownership to every stakeholder

D. To replace all expert judgement with historical data

Correct Answer: B. To identify how changes in inputs affect an output

Question 4

In Monte Carlo simulation, a P80 completion date means that:

A. The project will certainly finish on that date.

B. 80% of simulated outcomes finish on or before that date.

C. The project has an 80-day schedule buffer.

D. The average simulated duration is 80 days.

Correct Answer: B. 80% of simulated outcomes finish on or before that date.

Question 5

Which response changes the project method to remove a threat entirely?

A. Accept

B. Transfer

C. Avoid

D. Monitor

Correct Answer: C. Avoid

Question 6

What is a secondary risk?

A. A risk that has a lower probability than the primary risk

B. A new risk created by implementing a response

C. A risk recorded after project closure

D. A risk that affects only secondary stakeholders

Correct Answer: B. A new risk created by implementing a response

Question 7

Why must correlation be considered in quantitative risk analysis?

A. Correlated risks can make simple aggregation misleading.

B. Correlation guarantees that a risk will occur.

C. Correlation converts ordinal scores into monetary values.

D. Correlated risks cannot have owners.

Correct Answer: A. Correlated risks can make simple aggregation misleading.

Question 8

Which feature most directly supports resilience?

A. A single highly optimised supplier with no alternative

B. Untested assumptions about recovery

C. Qualified alternative supply and a rehearsed recovery plan

D. Removing all schedule buffers

Correct Answer: C. Qualified alternative supply and a rehearsed recovery plan

Question 9

A risk score of 4 × 5 in an ordinal probability–impact matrix should be interpreted as:

A. A precise 20% probability of loss

B. A $20 loss per project unit

C. A relative prioritisation score under the defined scale

D. Proof that the risk is four times more likely than a score-1 risk

Correct Answer: C. A relative prioritisation score under the defined scale

Question 10

Which statement about expected monetary value is most accurate?

A. It predicts the exact outcome of one project.

B. It is a probability-weighted average and may not reflect risk aversion.

C. It can be used only when all consequences are positive.

D. It eliminates the need to consider safety or ethics.

Correct Answer: B. It is a probability-weighted average and may not reflect risk aversion.