Risk = Hazard + Outrage

I read this book Freakonomics [A Rogue Economist Explores the Hidden Side of Everything by Steven D. Levitt, Stephen J. Dubner ] around an year back. The book presents data that many of us are familiar with and leads us to conclusions that are different. One interesting point that caught my attention, in the book was about Risk Management. The authors explain convincingly why Congress funds more for fighting terrorism than researching heart disease, even though heart disease kills more people than terrorism every year.

The authors quote the formula Risk = Hazard + Outrage in their explanation. The formula is the brain child of a person called Peter Sandmann. Outrage is defined as how people react to a 'perceived' ( not yet happened) or 'realized' (happened)  risk. People usually exhibit Outrage through emotions like fear, anger or frustration. Hazard is the actual 'effect' of the risk. Managing this 'effect' is covered by traditional risk management and is explained through the formula Risk = Magnitude of Impact x Probability of occurrence.

I related this formula to how we manage risks in our projects - pre and post realization of risks - and came up with the following thoughts.

#1 The risks we normally identify and manage are the ones that have a higher Outrage factor and lower hazard factor.

Take the example of an architectural decision, decided early in the project. Sometimes, these architectural decisions don't get the kind of attention they deserve. If you go by the formula given above, the outrage factor is less in this scenario, though the hazard factor (long term impact ) is high. Compare this to a bug found at the customer site, say in UAT phase. Look at the reaction of everyone to the bug. Here the hazard factor is relatively less and outrage factor is obviously higher. Compare the reactions in the two scenarios and you will understand

#2 We must actually concentrate on risks with a higher hazard factor.
Usually these kind of risks ( like people issues, architectural decisions) have a lower outrage factor ( before realization) and go un-noticed. But these type of Risks, when realized, have a bigger impact on the final outcome of the project.

#3 Risk Mitigation.
When a risk is realized, we should work more on the outrage factor ( with customers, Senior Management and other stake holders) to reduce its immediate impact. This will have a better outcome in managing the fall out of the risk, than working only on the hazard factor (as prescribed by traditional risk mitigation techniques).

#4 Highlighting a Risk.
When you want to highlight a risk to the concerned stakeholders, try to work on the outrage factor in the stake holders mind. The risks should get immediate attention.

Your thoughts are welcome.

Refer http://www.psandman.com/
Refer http://www.freakonomics.com/