Principle 1.  Quantify requirements

All critical quality and resource requirements must be identified and quantified numerically.

Risk is negative deviation from requirements. So, if we are going to understand risk, we must have some way of specifying exactly what we want. If we use vague ways like “State of the Art, World Class, Competitor-Beating Levels of Quality”, we cannot understand and assess risk.

Planguage helps because it demands numerically quantified requirements. Using Planguage, we must go through the following steps:

• Identify all critical quality and resource attributes of the system. In practice, this could be ten or more critical qualities (e.g. availability) and, five or more critical resources (e.g. operational costs).
   

• Define exactly how to understand variation in each attribute by specifying a scale of measure, e.g. ‘Scale: Probability of being fully operational during the office day’ and ‘Scale: Total of all monetary operational expenses including long term decommissioning costs’
   

• For each attribute, define one or more critical points on the defined scale of measure which are needed for the system to function properly and profitably.
  
  There are two important categories: ‘Must’ and ‘Plan’. A ‘Must’ level defines the system survival level. A ‘Plan’ level defines the planned point for success. For risk management, ‘Must’ is the first level and ‘Plan’ is the second level for risk determination. A value for any attribute less than its required Must level means total system failure. Only when all Plan levels for all the attributes have been met can a system be declared a success.
   

• For all the Must and Plan levels, define additional qualifying information. We call this using ‘qualifiers’. You are basically defining time, place and event, i.e. when it is critical for you to achieve a certain level of an attribute, where it is critical and under what conditions. For example...

In other words the range of results 40% to 80% is an acceptable upper and lower limit, but below 40% is unacceptable.

Here is a more complete example:

It should be obvious that the degree of risk can be expressed in terms of the deviation from the target levels. For example...

A template specification of risk levels

In addition to the basic statements described above, it should be noted that there are a wide variety of ways within Planguage to indicate that the information contains some element of risk. Here are some examples:

All of the above signals can be used to warn of potential risk. Of course, the culture must encourage such specification rather than intimidate people from using it.

more...