OK, so now we have a list of all of our key risks. The next step is to get management sign-off for each of the proposed treatments and agreement on the probabilities and impacts. Once this has happened the RM lead needs to determine the total contingency reserve for the project. This reserve is the sum of the exposure (probability multiplied by impact) and agreed treatment costs (this is different for different treatment types but here is a quick summary:

• Mitigation/Reduction – Cost of reducing/mitigating the risk plus the remaining risk exposure (probability multiplied by impact)
• Avoidance – Cost of avoidance
• Acceptance – Cost of risk exposure (probability multipled by impact)
• Transference – Cost of transferring the risk (e.g. insurance premiums)
• Contingency -  Contingency cost (how much needs to be spent to plan the risk treatment) plus the remaining risk exposure

You have now calculated the first part of your project contingency reserve rather than the archaic contingency estimation technique of putting a finger in the air and coming up with a number between 10-20% of total budget. You would be surprised how many companies still think this is an acceptable practice.

You now need to create the additional management reserve. The only allowable RM technique still in general practice is to create the additional estimate for the risks which you haven’t identified and hence don’t know the impact or probability…some call this ‘a summary of what you don’t know you don’t know’. Often this will be based on the complexity and size of the project and is in addition to those risk areas you have already identified (…this is where you are allowed to utilise a % of the total budget… and is in addition to the refined contingency estimate above).