Uncertainty. Those things we do not know. These are sometimes called "Epistemic Risks" because we can usually mitigate these by learning more about something. One of the hidden elements of Epistemic risk is the systemic component of risk .. that is what we as an organization contribute due to our organizational structure, our management procedures, etc. The second component is Aleatory Risk … the fact that every time we do something the time it takes us to do it or the outcome is slightly different. This is an inherent randomness. Both these factors are commonly addressed by a factor +/- some percentage of the estimate. But what is an appropriate factor to use? This is an area where I specialize
While we too will identify risks, record them in a risk register, and document various risk characteristics e.g., polarity (risk or opportunity), likelihood, and impacts - we also use that data for analytical purposes.
By using various tools such as Intaver's Risky Project and the resource loaded project schedule we can assign risks to various activities or phases of the project and then calculate the odds of achieving on-time on-budget performance. The figure shown here is typical of the analytical products the software can produce and includes risk adjusted estimates of project cost, duration, and completion date.