It is good practice when putting together a proposal to define and assess or quantity in as much detail as is practical the risks associated with the proposed program. If possible, risks should be assigned to a specific WBS within your proposal work-breakdown structure. Assigning a risk to a WBS is the same as defining a risk in the estimate which pertains to the BOE-WBS concerned.

When you open an estimate or basis of estimate work breakdown structure element (BOE-WBS) any risks assigned to that BOE-WBS or to any lower level WBS or task below the BOE-WBS are available on the RISK tab of your estimate

Click on the RISK tab in your estimate to view or add risks to your estimate. See also how to track proposal risks.

1. The description of each risk, along with its overall heat-map score, assigned WBS, owner and probability of occurrence are displayed
2. The risk's cost impact is displayed in both local currency of the specific organization delivering this BOE-WBS and in the primary business unit's currency (the currency of your company which is leading this proposal)
3. If you created a response plan for this risk this is displayed here. Responses are more common with operational vs. proposal risks
4. Each assessed risk has a weighted cost impact which becomes part of the risk adjusted cost of your proposal
5. Click the "add risk" link above right of the risk table to add a new risk in a new browser tab. You may need to reload this table to see your newly added risk.

Some people might argue that estimating the cost of a proposal is enough work without having to think about risks which "are very unlikely" until the proposal is won. This is not good practice for larger proposals and bids because a large proposal can come with many different risks, some of which could be very likely to happen. In fact the sum of the weighted cost impact of every risk is the reserve you must put aside during the program delivery phase, so it is recommended to understand this during the bidding phase and adjust your proposed price, or at least your internally assessed profit margin, accordingly. This is what is meant by the term "risk adjusted cost" - it is the baseline cost of your proposal plus the weighed impact of each risk, minus the weighted cost reduction or revenue increase impact of each opportunity.

The risk adjusted cost can be assessed at various different levels of confidence. For example the risk adjusted cost at 50% confidence is the sum of all weighted impacts for risks minus opportunities, however at a higher confidence such as 90% it can be assumed that fewer risks and more opportunities will occur so the risk adjusted cost is reduced. Conversely at a lower confidence a "worst-case" is assumed with more risks and fewer opportunities. While the "target margin" is often based on the risk adjusted cost at 50% confidence, many companies want to be sure that they will break even in case of only 10 or 20% confidence in the risk/opportunities occurring.  Monte-Carlo analysis is often used to compute the total weighted cost impact of a set of risks and opportunties at various different confidence levels.

It is possible to do three point estimating when you create your labor estimates, which is a way of saying "the minimum expected effort is X, the most likely effort is Y and the maximum expected effort in the worst-case scenario is Z". Some companies prefer to adopt three-point estimating for all proposals and other companies prefer discrete or single-point estimates, and to log risks. The danger if you company does both is that these two concepts can overlap; how do you manage an engineer who puts in a best and worst-case estimate for the labor AND logs a series of risks which are based on the same underlying events or risks which drove the worst and best-case labor estimates in the first place?

The answer is that your company needs to carefully instruct anyone performing an estimate for your organization and document these instructions in a risk management and estimating policy. When should three-point estimates be used vs. parametric vs. single-point? What kinds of events or risks should be logged discretely in the risk register and what risks can be "lumped together" under a single "catch-all" risk or even are simply covered within the three point estimate?  All of these decisions should be part of your risk policy.

Confidence is different to three point estimating and the risk register in that it does not affect your estimated cost, rather it describes how comfortable or confident you are with each estimate. High confidence means less risk and if you used three point estimating a smaller spread between the worst and best-case estimates; but at the same time confidence does not have to go hand in hand with the weighted value of risks or the three-point estimating spread. You might have a small and relatively finite estimate with fewer risks but you just have no idea how to estimate that cost, so your confidence is very low. Or you might have a large estimate with very significant risks, but the fact that you have done so much work defining and weighting each risk increases your confidence in that estimate.

Click here to learn more about confidence scoring in general.