Divide risks into two categories--local and global. The risk of staff turnover during a project is a local risk. War is a global risk. Often, those new to risk analysis focus only on the local risks, but they need to consider the global risks and their impact. Create a template for each risk. The template should include a unique risk number, a risk owner, potential costs (in dollars and other terms), a probability of occurrence (a low-medium-high scale will do at this point), any potential red flags or signs that the risk is materializing, mitigation strategies and a postmortem for noting if the risk factor actually happened.

One important footnote for developing this process: Value consistency over accuracy. If you do things in a consistent manner and the numbers are off, at least they'll be off in a consistent--and therefore fixable--way. "The process," says Raytheon's Rhoads, "is so much more important than the math rigor. Mature, consistent processes--you need that first."

How to Use Monte Carlo Simulations

Once you have a repository of project risks, you can get statistical. The most commonly used tool for this is the Monte Carlo simulation. This technique was developed in the 1940s for the Manhattan Project. It's used today for everything from deciding where to dig for oil to optimizing the process of compacting trash at a waste treatment facility. It's a deceptively simple but powerful tool for risk analysis. All Monte Carlo really does is roll the dice (hence the name).

Here's the theory: Roll a die 100 times, and record the results. Each face will come up approximately one-sixth of the time--but not exactly. That's because of randomness. Roll the die 1,000 times, and the distribution becomes closer to one-sixth. Roll it a million times, and it gets much closer still.

The die represents risks--albeit evenly distributed, predictable risks--where each side has about a one-sixth probability of occurrence or a five-sixths probability of not occurring. What if each die were a project risk and each side represented a possible outcome of that risk? Say one die was for the risk of project delays due to staff turnover. One side would represent the possibility that the project is six months late because of 20 percent turnover. Another side could represent a two-year delay due to 80 percent turnover. The die could also be unevenly weighted so that certain outcomes are more or less likely. There would, of course, be dice for other risks--sloppy development, budget cuts or any other factor unearthed during preliminary research.