How to Successfully Manage Reducible and Irreducible Risk

Do you know the difference between event and non-event risks? The PMBOK^© 6th Edition now takes a major step forward in its treatment of risk. It does not only address a wider range of Uncertainty than the simple event, but also acknowledging the necessity to integrate project risk management with enterprise-wide risk management. This article gives you an insight into the event and non-event risks but also about the reducible and irreducible uncertainty and the related risk that are usually missed from the typical risk process—and this goes a step further than the PMBOK^©. Never heard of it? Then read on immediately!

Event Risks and Non-Event Risks

The PMBOK^© Guide 6th Edition takes a big step forward in the treatment of risks and now distinguishes between event risks and non-event risks. Have you ever heard or read about this distinction? Probably not.

• Event Risk: Here you know WHAT could happen with a certain probability.
• Non-Event Risks: This is where you know there is uncertainty in an area, but you don’t know exactly what it is, what could happen, or to what extent something will occur.

I know that sounds a bit complicated now. But hang in there! More in-depth explanations and a few examples will follow later.
If you limit your risk identification to event risks only, you will not proactively manage all risks that could affect the success of your project – and you will end up taking risks without knowing it.
What the PMBOK^© doesn’t make clear is that there is also a difference between reducible and irreducible risks. This makes it a bit more complicated, but you will quickly understand this difference as well.

When most people talk about uncertainty and risk in projects, they are thinking only about uncertain future events that could have a negative (or positive) effect on achievement of their project objectives. However, the definition of risk includes much more than threats or opportunities to deliverables, the project schedule or budget.

Most projects focus only on risks that are uncertain future events that may or may not occur. Examples of these Event-Risks include:

• We may lose a key resource at a critical time in the project
• A key supplier may go out of business during the project
• The customer may change the requirements after the design is complete
• A subcontractor may propose enhancements to the standard operating processes

There is an increasing recognition that also Non-Event Risks need to be identified and managed. The following list and figure shows you an overview of Event Risks and Non-Event Risks with their underlying uncertainty.

1. Event risk (Stochastic Uncertainty)
2. Ambiguity risk (Epistemic Uncertainty)
3. Variability risk (Aleatoric Uncertainty)
4. Emergent risk (Ontological Uncertainty)

As you have probably noticed, there is another distinguishing feature in these four risks: if the uncertainty is reducible or irreducible. So, let’s get to the bottom of this.

Read more about: What is the Difference Between Uncertainty and Risk?

Reducible Uncertainty

Event Risk (is the result of “Stochastic Uncertainty): ”Uncertainty exist about possible events in the future, An event risk is something that has not yet happened and it may not happen at all, but if it does happen then it has an impact on one or more objectives. Most risks identified in the project risk register are event risks.

You can define actions to reduce the probability of occurrence or the impact of event risks or you can eliminate the risk completely.

Ambiguity Risk (is the result of “Epistemic Uncertainty”): The term epistêmê means knowledge in Greek. There are things that we are uncertain about simply because of the lack of knowledge, and the uncertainty might be reduced by gathering more information.

With ambiguous risks there is uncertainty about what might happen in the future. Areas of the project where imperfect knowledge might affect the project’s ability to achieve its objectives include: elements of the requirements or technical solution, future developments in regulatory frameworks, or inherent systemic complexity in the project.
   You can reduce ambiguous risks by defining those areas where there is a deficit of knowledge or understanding, then filling the gap by obtaining expert knowledge or benchmarking against best practices. You can also reduce ambiguity, for example, through incremental development, prototyping, or simulation.

Irreducible Uncertainty

Variability Risk (is the result of  “aleatoric uncertainty”): Alea in Aleatory is Latin and means dice. Aleatoric uncertainty comes from an inherent randomness, natural stochasticity, environmental or structural variation across space and time in the properties or behavior of the system under study. Here you know that something will definitely happen, but the uncertainty is in what the result will be. The accumulation of more data or additional information cannot reduce aleatory uncertainty.

Aleatory uncertainties can often be singled out from other uncertainties by their representation as distributed quantities that take on values in an established or known range. The exact values will vary by chance from unit to unit or time to time.

Typical examples of aleatory uncertainty include the outcomes of tossing dice and drawing cards from a shuffled pack. Aleatory uncertainty in projects may include: Unseasonal weather conditions may occur during the construction phase. The exchange rate could be much higher or lower when the material is delivered.
   For variability risks, we cannot buy more information nor take specific risk reduction actions to reduce the uncertainty and resulting risk. The objective of identifying and managing variability risks is to be prepared to handle the impacts when risk is realized. The method for handling these impacts is to provide margin for this type of risk, including cost, schedule, and technical margin. Aleatoric uncertainty can be modeled in a Monte Carlo simulation tool. Here the range of variation is reflected in the probability distribution.

The distinction between aleatory and epistemic uncertainties is valuable in many areas where it is important to appreciate which uncertainties are potentially reducible by further investigation. But it is easy to see how much more fundamental it should be for statisticians, for whom randomness and uncertainty are their very raison d’être.

Tony O’Hagan 2004

Emergent Risk (is the result of “Ontological Uncertainty): Uncertainty exist from what we don’t know—from our blind-spots. They arise from limitations in our conceptual frameworks or worldview. These are risks which we are unable to see because they are outside our experience or mindset, so we don’t know that we should be looking for them.
Another popular term for emergent risks is “the unknown unknowns,” which are things that we do not know but where we are unaware of our ignorance. In fact “unknown unknowns” can be divided into two types, one of which is a true emergent risk (“Black Swan”) and the other is not. These are:

1. The “unknown-but-knowable unknowns.” There are some uncertainties that we currently do not know, but which we could find out about. This is where the risk process can help, through creative risk identification, exploration, and education.
2. The “unknown-and-unknowable unknowns.” These are much more difficult to deal with, since by definition we can never discover them unless and until they happen. They are genuine emergent risks, which we could not predict with even the best risk process.

Separating Aleatory and Epistemic Uncertainty

I have to admit, this article describes not an easy topic. Here I have an example that might help you to understand it a little bit better: One recurring issue in separating aleatory and epistemic uncertainty concerns the limits of what could be learned in the future. There is a school of thought that there is no aleatory variability in the earthquake process. In principle, earthquakes are responding to stresses and strains in the earth. Eventually, given enough time, we will collect enough data to develop detailed models of the earthquake process that give the magnitudes and locations of future earthquakes. Since the earthquake process is in theory knowable, there is only epistemic uncertainty due to our lack of knowledge which will be reduced in time.

When you are identifying risks, it is important to be aware that it is not only event risks that threaten your project, and you do not focus solely on them. Otherwise you may missing a large number of uncertainties that matter that could affect our projects.
Knowing the difference between event and non-event risks, but also between reducible and non-reducible risks is also important when defining your risk response strategy. You can read more about this in this article.

There are thousands of ways to fail … most have not been explored

Dr. Steve Jolly