View source for Impact and Probability in Risk Assessment

'''Impact''' and '''probability''' are the two main components of [[Risk analysis]]. Looking at '''Impact versus Probability''' is common in order to categorize and prioritize risks as some risks which may have a severe impact on projects objectives but only happen on rare occasions, while other which have a moderate impact might occur frequently. 

All organizations activities involve risk. Risks are events caused by uncertainties, which can have a positive or negative effect on the activities objectives. As all projects are unique and thus the associated risk varies between projects. Therefore, [[Risk Management]] is an important part of any organizations as proper management increases the success of a project <ref name=" Winch " />. Risk management involves identifying possible risks, analyzing each risk potential in order to respond to and control the most significant threats and opportunities <ref name="Maylor"/>.
The risk analysis is a two-stage assessment process. Initially, qualitative methods are used to examine the identified risk to categorizing and determine the main risk events which are relevant for a quantitative assessment. In risk analysis, risk is traditionally defined as a function of probability and impact <ref name=" Curtis " />. The probability is the likelihood of an event occurring and the consequences, the extent to which the project is affected by an event, are the impacts of risk. By combining the probability and impact, the Level of Risk can be determined. There are various aspects of the project that can be impacted by a risk event <ref name=" Curtis " />. These are aspects such as cost, safety, operational, quality, etc. A commonly used and popular method of risk assessment is preparing descriptive scales to rank risk in terms of probability and impact. These are often referred to as Impact/Probability Matrix or Risk maps and can take both qualitative and quantitative values. The Impact/Probability Matrix is a simple and easy to understand method of prioritizing risks and allocating resources. There are other methods for analyzing risks, such as Sensitivity analysis, Expected Monetary Value analysis and Monte Carlo Simulations.   . All these methods, though beneficial for management, have their limitations and drawbacks <ref name="MITRE"/>.


= Background =
Risk management is a four-stage process, the first being identification of risks, second analysis (assessment), then the risk response and finally the risk monitoring <ref name=" Winch " />. In risk analysis, risk can be defined as a function of impact and probability <ref name=" Curtis " />. During the analysis stage, the risks identified during the [[Risk Identification Process]] can be prioritized from the determined probability and impact of the risk event, using qualitative or quantitative methods. Other factors, such as the response time frame and the tolerance should be taken into account when analyzing and categorizing the risks <ref name=" PMI " />. 




{| class="wikitable" style="float:Right; margin-left: 30px"
|+ Table 1: Impact Scale Example <ref name=" PMI " />
|-
! rowspan = "2" style= "width:60px;" | Objective
! colspan ="6" |Relative / Numerical Scale
|-
!style="height:30px; width:110px; text-align:center; background:#F2F2F2; " | Very Low / 0.05 
!style="height:30px; width:110px; text-align:center; background:#F2F2F2; " |Low / 0.1
!style="height:30px; width:110px; text-align:center; background:#F2F2F2; " |Moderate / 0.2
!style="height:30px; width:110px; text-align:center; background:#F2F2F2; " |High / 0.4
!style="height:30px; width:110px; text-align:center; background:#F2F2F2; " |Very High /0.8
|-
!style="text-align:left; background:#F2F2F2; "|Cost
|style="height:30px; width:110px; text-align:center; background: white;"|Insignificant change in cost
|style="height:30px; width:110px; text-align:center; background: white;"|< 10% increase
|style="height:30px; width:110px; text-align:center; background: white;"|10 - 20% increase
|style="height:30px; width:110px; text-align:center; background: white;"|20 - 40% increase
|style="height:30px; width:110px; text-align:center; background: white;"|> 40% increase
|-
!style="text-align:left; background:#F2F2F2; "|Time
|style="height:30px; width:110px; text-align:center; background: white;"|Insignificant change in schedule
|style="height:30px; width:110px; text-align:center; background: white;"|< 5% increase
|style="height:30px; width:110px; text-align:center; background: white;"|5 - 10% increase
|style="height:30px; width:110px; text-align:center; background: white;"|10 - 20% increase
|style="height:30px; width:110px; text-align:center; background: white;"|> 20% increase
|-
!style="text-align:left; background:#F2F2F2; "|Scope
|style="height:30px; width:110px; text-align:center; background: white;"|Barely noticeable scope decrease
|style="height:30px; width:110px; text-align:center; background: white;"|Minor areas affected
|style="height:30px; width:110px; text-align:center; background: white;"|Major areas affected
|style="height:30px; width:110px; text-align:center; background: white;"|Unacceptable reduction
|style="height:30px; width:110px; text-align:center; background: white;"|Project end item effectively useless
|-
!style="text-align:left; background:#F2F2F2; "|Quality
|style="height:30px; width:110px; text-align:center; background: white;"|Barely noticeable quality degradation
|style="height:30px; width:110px; text-align:center; background: white;"|Only demanding applications effected
|style="height:30px; width:110px; text-align:center; background: white;"|Quality reduction requires sponsor approval
|style="height:30px; width:110px; text-align:center; background: white;"|Unacceptable quality reduction
|style="height:30px; width:110px; text-align:center; background: white;"|Project end item effectively useless
|}

= Impact =
Impacts are often defined as the consequences, or effect, of a risk event on the project objectives. These impacts can be both beneficial or harmful to an enterprises activity <ref name=" Curtis " />. The impact of risk events on different project objectives can be defined in both a qualitative and quantitative manner. These project objectives are cost, schedule, quality, scope, health, safety, etc. The Impact scale can vary, but the most common scale is the five-point scale. Typically, the impacts are described relative as very low, low, moderate, high and very high, but often also with defined numerical scales. Dependent on the objective, the scales are given a description of what the impact entails <ref name=" PMI " />. One risk event can affect more than one objective, so the impact of all the possible objective effected must be considered <ref name=" Curtis " />. Table 1 shows how impact can be defined for various objectives. The possible impacts on each objective is described and given a ranking. The ranking in table 1 is both relative, from very low to very high, and numerical, given some numerical values based on the specific project.       



{| class="wikitable" style="float:Right; margin-left: 30px"
|+Table 2: Probability Scale Example
|-
! colspan ="2"|Likelihood
! colspan ="1" rowspan = "2" |Description
|-
!style="height:20px; width:100px; text-align:center;" | Relative 
!style="height:20px; width:100px; text-align:center;" | Numerical
|-
|style="height:20px; width:100px; text-align:center;background: white;" | Very Low  
|style="height:20px; width:100px; text-align:center;background: white;" | 0.1
|style="height:20px; width:170px; text-align:center;background: white;" | Highly unlikely to occur.
|-
|style="height:20px; width:100px; text-align:center;background: white;" | Low 
|style="height:20px; width:100px; text-align:center;background: white;" | 0.3
|style="height:20px; width:170px; text-align:center;background: white;" | Will most likely not occur
|-
|style="height:20px; width:100px; text-align:center;background: white;" | Moderate 
|style="height:20px; width:100px; text-align:center;background: white;" | 0.5
|style="height:20px; width:170px; text-align:center;background: white;" | Possible to occur
|-
|style="height:20px; width:100px; text-align:center;background: white;" | High
|style="height:20px; width:100px; text-align:center;background: white;" | 0.7
|style="height:20px; width:170px; text-align:center;background: white;" | Likely to occur
|-
|style="height:20px; width:100px; text-align:center;background: white;" | Very High
|style="height:20px; width:100px; text-align:center;background: white;" | 0.9 
|style="height:20px; width:170px; text-align:center;background: white;" | Highly likely to occur
|}

= Probability =
Risk probability, or likelihood, is the possibility of a risk event occurring. The likelihood can be expressed in both a qualitative and quantitative manner. When discussing probability in a qualitative manner, terms such as frequent, possible, rare etc. It is also possible to describe the probability in a numerical manner. These can be scores, percentages and frequencies defined by the organizations dependent on the relative description <ref name=" Curtis " />. Table 2 show an example on how an organization can define the ranking for likelihood for a project. The ranking is both a relative and numerical manner and a description of the ranking is given.


= Risk Assessment Methods Using Impact and Probability =
Risk analysis is a two-stage process. Qualitative assessment is the first stage in the risk analysis. By using qualitative methods for risk assessment, the risk can be prioritized for further quantitative assessment or even risk response planning. Quantitative assessment is the next stage in risk analysis. The process is involves analyzing the effects of risks on the overall project objectives. They primarily focus on the risks which have been prioritized in the qualitative assessment. To ensure the quality and credibility of the analysis, general definitions of impact and probability levels must be fitted to individual project context <ref name=" PMI " />. 
 

== Qualitative Analysis==
Qualitative methods for risk assessment are relatively rapid in practice, cost effective and easily understood <ref name=" Curtis " />. The result form qualitative assessments are not an accurate estimate of risk. However, they provide a rather a descriptive result and often with sufficient information for planning responses. The results from qualitative assessment also lay the foundation for more detailed quantitative analysis, if possible and warranted. It is performed regularly throughout a projects life cycle as new risk may emerge at later stages as well as response to a risk may result in other risk events <ref name=" PMI " />. Classifying the risks enables organizations to reduce uncertainty levels and focus primarily on the high-risk events.  There are two qualitative methods of assessing risk events in terms of impact and probability, both involving rating the impact and probability. These are Risk Probability and Impact Assessment and Probability and Impact matrix <ref name=" PMI " />. t.

=== Risk Probability and Impact Assessment ===
The probability assessment involves estimates the likelihood that the risk will occur. The impact assessment estimates the effect of a risk event on a project objective. These impacts can be both positive and negative, that is opportunities and threats. The project objectives are numerous, the schedule, cost, quality and scope to name a few. For each identified risk, the impact and probability are assessed. Interviews and meeting with experienced project participants, stakeholders, and experts in the subject are the basis for the impact and probability assessment. These impacts and probabilities are rated and the level of impact and probability is assessed. The risk which receive high ratings are investigated further or an appropriate response is planned. The low rated risks do not require an emaciated action but should be included in the [[Risk register]] or monitoring <ref name=" PMI " />. 

=== Probability and Impact Matrix ===
The Probability and Impact Matrix is one the most commonly used qualitative assessment method. It is based on the two components of risk, probability of occurrence and the impact on objective/objectives if it occurs. The matrix is a two-dimensional grid that maps the likelihood of the occurrence and its effects on the project objectives <ref name=" PMI " />. The risk score, often referred to as risk level or the decree of risk, is calculated by multiplying the two axes of the matrix.

<div class="center" style="width: auto; margin-left: auto; margin-right: auto;">Risk = Impact x Probability </div>

As the impact and probability can be described in both a relative and numerical manner so can the risk score. The higher the combined ratings are, the higher the score and thus risk level. These ratings are generally defined from low to high or very low to very high <ref name=" Curtis " />. The ratings for likelihood and impact are made using gathered opinions from interviews <ref name="Maylor"/>. These ratings of must be classified by each organization, specific for each activity, as they must define what would result in high, moderate or low risk for their activity. Creating these definitions of impact and probability levels can help reducing the influence of bias <ref name=" PMI " />. The result from these risk matrices are used to prioritize the risks, plan the risk response, identify risk which need to be examined further, possibly by quantitative methods and guide resource allocations <ref name="Cox" />. However, the objective which is effected by the risk must also be considered. For example, a risk events which has high safety or health risk would be prioritized over a risk event which would have very high financial risk <ref name=" Curtis " />.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Table 3: Impact vs Probability Matrix <ref name=" PMI " />
|-
!colspan = "1" style="height:20px; text-align:left; background: #F2F2F2; " | Probability
!colspan = "5" style="height:20px; background: white; border color: white" | Threats
|-
!style="height:20px; width:110px; text-align:center; background:#F2F2F2; " |Very High / 0.9
|style="height:20px; width:50px; text-align:center; background: green; " |0.05
|style="height:20px; width:50px; text-align:center; background: yellow; " |0.09
|style="height:20px; width:50px; text-align:center; background: red; " |0.18
|style="height:20px; width:50px; text-align:center; background: red; " |0.36
|style="height:20px; width:50px; text-align:center; background: red; " |0.72
|-
!style="height:20px; width:110px; text-align:center; background:#F2F2F2; " |High      / 0.7 
|style="height:20px; width:50px; text-align:center; background: green; " |0.04
|style="height:20px; width:50px; text-align:center; background: yellow; " |0.07
|style="height:20px; width:50px; text-align:center; background: yellow; " |0.14
|style="height:20px; width:50px; text-align:center; background: red; " |0.28
|style="height:20px; width:50px; text-align:center; background: red; " |0.56 
|-
!style="height:20px; width:110px; text-align:center; background:#F2F2F2; " |Moderate  / 0.5 
|style="height:20px; width:50px; text-align:center; background: green; " |0.03
|style="height:20px; width:50px; text-align:center; background: green; " |0.05
|style="height:20px; width:50px; text-align:center; background: yellow; " |0.10
|style="height:20px; width:50px; text-align:center; background: red; " |0.20
|style="height:20px; width:50px; text-align:center; background: red; " |0.40 
|-
!style="height:20px; width:110px; text-align:center; background:#F2F2F2; " |Low       / 0.3 
|style="height:20px; width:50px; text-align:center; background: green; " |0.02
|style="height:20px; width:50px; text-align:center; background: green; " |0.03
|style="height:20px; width:50px; text-align:center; background: yellow; " |0.06
|style="height:20px; width:50px; text-align:center; background: yellow; " |0.12
|style="height:20px; width:50px; text-align:center; background: red; " |0.24
|-
!style="height:20px; width:110px; text-align:center; background:#F2F2F2; " |Very Low  / 0.1 
|style="height:20px; width:50px; text-align:center; background: green; " |0.01
|style="height:20px; width:50px; text-align:center; background: green; " |0.01
|style="height:20px; width:50px; text-align:center; background: green; " |0.02
|style="height:20px; width:50px; text-align:center; background: green; " |0.04
|style="height:20px; width:50px; text-align:center; background: yellow; " |0.08 
|-
!style="height:20px; width:110px; text-align:center; background:#F2F2F2; " |Impact
!style="height:20px; width:60px; text-align:center; background:#F2F2F2; " |Very Low / 0.05
!style="height:20px; width:50px; text-align:center; background:#F2F2F2; " |Low / 0.1
!style="height:20px; width:50px; text-align:center; background:#F2F2F2; " |Moderate / 0.2
!style="height:20px; width:50px; text-align:center; background:#F2F2F2; " |High / 0.4
!style="height:20px; width:60px; text-align:center; background:#F2F2F2; " |Very High / 0.8 
|-
|colspan= "6" style="height:10px; background: white; border color: white" |  
|-
|colspan = "1" style="height:15px; text-align:center; background: red; "    | High risk |
|colspan = "2" style="height:15px; text-align:center; " | Score > 0.9
|rowspan = "3" colspan = "3" ; text-align:left | A organization defines its risk thresholds, low, moderate and high. These thresholds are differ between projects.   
|-
|colspan = "1" style="height:15px; text-align:center; background: yellow; " | Moderate risk
|colspan = "2" style="height:20px; text-align:center; " | 0.05 < Score < 0.9
|-
|colspan = "1" style="height:15px; text-align:center; background: green; " | Low risk
|colspan = "2" style="height:20px; text-align:center; " | Score < 0.05
|}


[[File:winch PIM.JPG|400px|thumb|right|Risk Impacts and Probability Matrix, <ref name=" Winch" />]]

'''Low impact – Low probability:''' The risks that are characterized as low, or very low, risks have both a low impact and likelihood of occurrence. For negative risks, threats, the response required is not necessarily as proactive management action. However, they should be included within the risk register for future monitoring. Positive risks, opportunities, within the low-risk category should be monitored or just simply accepted. Opportunity acceptance means taking advantage of the opportunity if it arises, but not actively pursuing it <ref name=" PMI " />.

'''High impact – Low probability:''' Risks with high impact but low likelihood of occurrence can be characterized from low to high risks but most often within the moderate category. The characterization is dependent on the organizations defined threshold. These events rarely occur, defined as rare catastrophes. It is difficult to determine the probability based on historical records due to lack of data. Therefore, the probabilities must be estimated subjectively. The most commonly responses are to insure or mitigate the problem <ref name="NRC" />.  

'''Low impact – High probability:''' Risks with low impact but high likelihood of occurrence can be characterized from low to high risks but most often within the moderate category. The characterization is dependent on the organizations defined threshold. These risks are mostly due to uncertainties of numerous elements that individually, are minor risks but combined, could amount to higher risks. These are such uncertainties as actual cost and duration of different aspects of a project, changes to activates or other similar uncertainties, that alone, have little impact <ref name="NRC" />.
 
'''High impact – High probability:''' The risks that are characterized as high risks have both a high impact and likelihood of occurrence. A risk which has a negative impact, is a threat to the objective, may need priority actions and aggressive responses. These aggressive responses could be mitigation of the risk or even terminating the project if the risk is to great. A risk that has a positive impact, is an opportunity, is most likely obtained easily, with the greatest benefits and should thus be targeted first <ref name=" PMI " />.

== Quantitative Analysis ==
Quantitative assessment methods provide a more accurate analysis results than the qualitative assessment. However, they are costlier and often time consuming, so only the risk prioritized by the qualitative assessment are analyzed.  These methods are mostly used to analyze the combined effect of all affecting risks. The most important benefit is that the information produced support decision making and reduce project uncertainty. In some cases, quantitative methods are not applicable due to lack of sufficient data but that must be evaluated by the project manager. The analysis should be repeated as a part of risk control to determine whether the overall risks are reaching a desirable state. There various methods for quantitative analysis, Sensitivity analysis, Expected Monetary Value analysis and Monte Carlo Simulations to name a few <ref name=" PMI " />.

=== Sensitivity Analysis ===
Sensitivity analysis is a quantitative technique useful to determine the variables which have the greatest effect on the risk <ref name="NRC" />. They help estimating risks with the most potential impact and how variations in the objectives and different uncertainties are correlated, the effect of each element on the objectives <ref name=" PMI " />. They also help assess probability of the project decisions being affected by the concrescences and risk actions which result in the desired outcome can be identified. Generally, it is only the highest risk scenarios which are considered in the sensitivity analysis. These analyses can be time consuming and costly, this is often why qualitative analysis such as Probability and Impact Matrix is used to identify the highest concerning risks <ref name="SA" />. 


=== Expected Monetary Value Analysis ===
[[File:EMV.JPG|500px|thumb|right|Figure 2: Decision Tree diagram for EMV, <ref name=" PMI" /> (click for a clearer picture)]]
The main concept of Expected Monetary Value (EMV) is similar to the Impact and Probability Matrix as it involves multiplying the probability and impact. The probability of a risks occurring determined and the impact given a monetary value. Opportunities are typically expressed as positive values and the threats as negative. The EMV analysis calculates the average outcome of a future event, which may or may not occur. Decision Trees are often used to calculate the EMV (PMBOK). 


Figure 2 shows an example of Decision Tree Diagram being used for EMV analysis. For a power plant in need of renovation, two possible actions are possible; to build a new plant or to upgrade the current one. The uncertainty that needs to be considered is the magnitude of the power demand. Stronger demand yields in higher benefits but both outcomes result in higher benefits for the new power plant. For each action, there are two outcomes that need to be considered. The total benefits/losses when considering the cost of the plant and the benefits from the power demand. There is a 40% probability of weak power demand and a 60% probability of strong power demand. By multiplying the probability with outcome benefits, and summing them up, the expected monetary value of the actions can be calculated. The action which offers higher benefits is then chosen. When using Decision Tree diagrams; the tree is drawn from right to left, considering all possible outcomes from the available data; and then adding the appropriate numbers from left to right (PMBOK). EMV analysis is highly dependent on accurate, risk-neutral assumption. The outcome of th EMV is used to plan and prioritize possible risk responses.

 



[[File: MCS.JPG|300px|thumb|right|Figure 3: The respective probability of achieving specific cost targets, <ref name=" PMI" /> (click for a clearer picture)]]
=== Monte Carlo Simulation ===
Monte Carlo Simulations, MCS, are typically used for project simulations to quantify risks (PMBOK). These random simulations can be considered “experiments” and give insight into the likelihood of each outcome, impact (NRC). In risk management, the inputs into the simulation are estimates of project objectives, e.g. cost of the project or schedule duration (Maylor). A probability distribution is created for these variables and a project model iterated many times with randomly chosen inputs using random number generators. The model outputs are the probability of each outcome due to the specific uncertainties. These outputs can then be used to plan the response. When performing MCS there are some things that need to be considered for the validity of the outcomes. Variables may not be independent, number of iterations may not be sufficient as more iterations are costlier and time consuming. Figure 3 shows the outcome of a MCS analyzing the cost estimation of a project. There is only a 12% probability of meeting the budget of $41M. If an organization wants 75% probability of success, the budget would need to be $50M. 

 
= Limitations =
Qualitative methods are imprecise. They are just estimates and it can happen that unlikely risk do happen and likely things sometimes never come to pass. The quality of the information available influences the quality of the results so the information must be evaluated to help determining the risks importance but it can also <ref name=" Curtis " />. When using the Probability and Impact Matrix, risk that are quantitative different can get the same rating and often the risks are overestimated. The results from the Probability and Impact Matrix are subjective and are thus open to more than one interpretation <ref name="Cox" />. The matrix doesn’t provide the possibility of assessing the overall project risks nor address risk interactions and correlations. Not all concepts of risk of risk can be mapped to a Probability and Impact Matrix, as the tool is designed around an event oriented risk concept. The practice often is impractical until a certain maturity level where some of the best opportunities for risk management may have passed <ref name="PIM" />. 
Quantitative methods often provide more accurate results but are costly and time consuming. Using numbers may imply more precision in results than there is. The data and techniques used in these methods also need to be considered. If the models used are incorrect or don’t represent reality the result is meaningless. Same with the inputs. If the inputs are wrong the result from the analysis is useless. In risk analysis, this is a problem as assumptions are not always apparent <ref name=" Curtis " />. 
 

= Annotated bibliography =

'''Winch, G.M. (2010) ''Managing Construction Projects: An Information Processing Approach, Second Edition.'' Oxford: Wiley-Blackwell Publishing.
'''
The book contains a description of the practice of managing risk and uncertainty in a construction project. It describes briefly the four activities of risk management process. The definitions of risk and uncertainty is described and the importance of risk management supported. Winch describes briefly the purpose of risk analysis and defines Probability and Impact matrix as the most commonly used tool for categorizing risks. The planned responses to risks that have been prioritized and categorized are also described within the same matrix as the probability and impact.   

'''Curtis, P. & Carey, M. (2012). ''Risk Assessment in Practice.'' Deloitte & Touche LLP.'''
Risk Assessment in Practice is a framework developed by five private sector organizations with the goal of thought leadership. It focuses on risk assessment process and criteria, impact and probability and the practice of qualitative and quantitative methods for the assessment, categorization and prioritization of risk. The limitations and advantages of the methods are also discussed.   



'''Project Management Institute, Inc. (2013). ''A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Fifth Edition.'' Newtown Square, Pennsylvania :Project Management Institute, Inc.'''

The Project Management Institute’s “A Guide to the Project Management Body of Knowledge” is a guideline for managing individual projects and defines project management related concepts as well as the life-cycle and processes of projects and project management. It defines nine knowledge areas and risk management is one of them. Risk analysis is one of the steps of risk management. The guidline describes various qualitative and quantitative methods for risk analysis, among them are the Impact and Probability Assessment, Impact and Probability Matrix and Sensitivity Analysis.  



= References =
<references>
<ref name="Winch"> Winch, G.M. (2010) Managing Construction Projects: An Information Processing Approach, Second Edition. Oxford: Wiley-Blackwell Publishing </ref>
<ref name="Maylor"> Maylor, H. (2010) Project Management, Fourth Edition. Harlow, England: Pearson Education Limited </ref>
<ref name="Curtis"> Curtis, P. & Carey, M. (2012) Risk Assessment in Practice. Deloitte & Touche LLP </ref>
<ref name="MITRE"> The MITRE Corporation. (2014) MITRE Systems Engineering Guide. The United States: MITRE Corporate Communications and Public Affairs </ref>
<ref name="PMI"> Project Management Institute, Inc. (2013). A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Fifth Edition. Newtown Square, Pennsylvania: Project Management Institute, Inc </ref>
<ref name="NRC"> National Research Council. (2005). The Owner’s Role in Project Risk Management. Washington, D.C: The National Academies Press </ref>
<ref name="Cox"> Cox, L. (2008). What's Wrong with Risk Matrices? Risk analysis: an official publication of the Society for Risk Analysis. 28(2), 497-512 </ref>
<ref name="SA"> Iloiu, M. & Csiminga, D. (2009). Project RISK Evaluation Methods - Sensitivity Analysis. Annals of the University of Petroşani, Economics, 9(2), 33-38 </ref>
<ref name="PIM"> Risk Management Capability Ltd. (2005). Probabilit- Impact Matrix (PIM). http://www.rmcapability.com/resources/Capability+Guidance+Sheet+-+Probability-Impact+Matrix.pdf </ref>

</references>