You need only the best, worst and most likely outcomes to draw an effective triangle distribution. The best way to create the risk dice is with a triangle distribution. Determine three data points: the best case outcome, the worst case and the most likely case. Assume the best and worst cases have low probabilities and the most likely case is somewhere in between.

In the staff turnover example, the worst case might be a two-year delay due to 80 percent turnover. The best case may be no delay due to no turnover. The most likely--based on experience and research--might be the previously stated six-month delay from 20 percent turnover. Chart this on a probability distribution grid, and you get a triangle.

Take that triangle and others you create for all project risks, run Monte Carlo simulations, and you'll come up with the smooth anthill curve that shows overall risks to your project.

Vitro, a $2.6 billion glass company in Monterrey, Mexico, has done this on many IT projects (it's now required for projects valued at more than $20,000). "No one wanted to measure at first," says Gustavo Benitez, manager of Vitro's IT supply chain. "Because measuring makes you accountable. We're not that deep into it; we only use best case, worst case and most likely, and already it helps. It helps you see different scenarios."

Certain risk metrics are predetermined. DeMarco and Lister's five core risks to software projects have been given probability distributions based on historical data. If you're still worried about assigning a meaningful number to risks, Lister says relax and just guess. "Guess a number just to get going," he says. "Even that will be better than how IT approaches risk today."