As shown in the previous blog about risk, risk identification, assessment, and management are different for services owned and managed by IT (TCS risks) compared to assets owned by IT (TCO risks). The Total Cost of Service\u2013 Risk Management (TCS-R) is the identification, assessment, and visualization of an organization\u2019s service-based systems and project portfolio.\n\n\nThis goal of this blog is tell you the top TCS-R approaches that can be used to quantify digital business services risk. I will focus on how to measure risks \u2013 and not list common digital business project risks of which there are many sources (pick your # of risks such as 5 here, 6 here, 7 here,).\n\n\nA representative high-level risk assessment process is:\n\n Peter Brooks \/ IIIE \n\nTypical Risk Assessment Process\n\n\n\nBut how do you assess and measure risk? We will look at the top techniques, using a sample digital business project \u2013 create an online product catalog \u2013 for example risks.\n\n\nTop Techniques To Identify and Manage Digital Business Risks\n\n\nRisk Map\n\n\nA risk map is a heat map visualization of risk, typically using axes of \u201cimpact\u201d and \u201cprobability of occurrence\u201d. The axes are generally delineated into high (red), medium (yellow), and low (green) regions.\n\n Peter Brooks \/ IIIE \n\nRisk Map\n\n\n\nRisk Register\n\n\nRisks are listed in a list and assessed quantitatively as high, medium, or low along with other pertinent information.\n\n Peter Brooks \/ IIIE \n\nRisk Register\n\n\n\nROI, TCO, NPV, Payback Period\n\n\nThough most organizations use one or more of these metrics to measure the viability of an IT investment, few use a systemic process to understand the involved risk. A positive ROI (or TCO, etc.) does not mean the investment will be successful.\n\n\nThese metrics are financial not risk measurement metrics. The investment risk in achieving (or not) your organization\u2019s favorite metric can be estimated by performing a sensitivity analysis of the major investment cost and benefit drivers. If there is a sufficient ROI for the baseline case and for all potential major changes in the cost and benefit drivers, the project is low risk.\n\n\nFollowing is a chart showing two investment options and the breakeven point. For each investment, calculations are:\n\n\nReturn On Investment: (net profit)\/investment cost\n\n\nTotal Cost of Ownership: sum of all direct and indirect costs, e.g. purchase costs, operating expenses, indirect (support) costs\n\n\nNet Present Value: each cash inflow and outflow discounted back to its present value based on an opportunity cost of capital. NPV = sum of (Rt\/(1+i)t ) over time, where t is the time of the cash flow, Rt is a cash flow at time t, and I is the discount rate.\n\n\nPayback Period: The period of time at which the benefits of an investment match the funds expended. Below, we can see two alternative investments available to an organization\u2013 Building an online catalog using vendor tools will yield lower income but faster payback period (lower risk) while building a catalog by creating custom catalog management tools will produce higher income but have a longer payback period (higher risk).\n\n Peter Brooks \/ IIIE \n\nBreakeven Analysis\n\n\n\nReal Options Analysis (ROA)\n\n\nApplying real option analysis to IT capital budgeting can result in what most people would consider a better decision than simply using NPV or ROI. Real options analysis can support decisions relating to topics such as the order of investments, timing, scale-up, IT development flexibility, benefits \/ revenue expectations, and continuation \/ termination opportunities. ROA assumptions regarding outcome probabilities, value of the various alternatives, and discount rate makes it is difficult to understand. Black-Scholes is one mathematical technique to calculate ROA value.\n\n\nThe following graphic is a representation of a real options analysis show the NPV of various alternatives. We can see in this example that there are several potential alternatives \u2013 Build Catalog V1 and stop, or continue Build Catalog V2 with 2 different options \u2013 each with varying NPVs. This provides more information than a one simple NPV calculation per alternative, but is more complex to create and understand.\n\n Peter Brooks \/ IIIE \n\nReal Options Analysis\n\n\n\nSimulation (Monte Carlo)\n\n\nBy assigning probabilities to decision events, a probability distribution can be created by randomly modeling event occurrences. For example, each NPV value in the above options analysis could be given three values \u2013 average expected, high, and low \u2013 with a probability associated with each value. The simulation probability distribution can be summarized to show the expected value and probability risk. While mathematically based, results can be very sensitive to the assigned values and probabilities, which are often a SWAG.\n\n Peter Brooks \/ IIIE \n\nMonte Carlo Simulation\n\n\n\nExpected Value Analysis (EVA)\n\n\nThe expected value \u2013 probability of occurrence times the value of the alternative - of each alternative is evaluated, with the highest expected value being the recommended choice.\n\n\n\u00a0\n\n Peter Brooks \/ IIIE \n\nEconomic Value Add\n\n\n\nRecommendation\n\n\nWith all these techniques, what to do?\n\n\nFor portfolio analysis, risk maps, risk registers, and expected value analysis are all good. A combination is best:\n\n\nRisk maps for visualization\nEVA for value quantification. Create several EVA scenarios to create a range of expected values.\nRisk register to capture the details.\n\n\nExcept for specialized situations, real option analysis and simulation are too complex for typical project risk analysis. Use an NPV map \u2013 not just the NPV number itself - to measure expected return and to quantify project risk. The risk probabilities and financial impact of the risks associated with each probability need to be highly visible.