Home > Articles > Information Technology

  • Print
  • + Share This
Like this article? We recommend

What Is the Probability That It Will Happen?

Here’s where a lot of people fall down in their bid to management. Let’s say that you jolt management with the "What can happen?" slide, and you’re really rolling. A manager says, "I agree about the fire issue, but where did you get that 5% probability figure?" You reply, "Well, it seemed like a good figure to me."

The meeting just ended.

What seemed to be a good figure to you isn’t necessarily a good figure to management. As I said earlier, people’s perception of risk differs. Here’s a much better answer to the manager’s question: "I checked with the National Fire Protection Association (NFPA) and with our insurance carrier. They said that a company like ours stands a 5% probability in a given year of having a catastrophic fire, absent the protective systems I’m recommending." That answer will get you much further with management.

I also suggest taking a shot at conducting a failure mode effects analysis (FMEA). An FMEA takes probabilities of specific events, weights them, and then presents them in a format that management can understand. Consider the following four exhibits as an example.

Step 1: Consider What Can Happen and Approximate Its Probability

What kinds of events can you imagine fitting into each category in Figure 1?

  • High probability, high damage. Probably already corrected, such as with an uninterruptible power supply.
  • Low probability, low damage. Who cares if it happens?

Where would you spend your effort? Probably in the middle of the curve, with medium probability, preventable disasters.

Step 2: Assign a Severity Number Based on the Event

When a component fails, severity is classified in a 10-point system.



If one user is affected


If a workgroup is affected


If an entire bay is affected


If an entire floor is affected


If an entire building is affected


If the entire backbone is affected


Step 3: Assign a Frequency Number

The frequency of an event is a concern, regardless of the severity, if it occurs often enough.

Occurrence Level or Frequency


Every day


Weekly intervals


Monthly intervals


Quarterly intervals


Every 12 months or longer


If the occurrences continually happen on a daily basis, the critical rating is the highest. Occasional interruptions are rated lower.

Step 4: Factor in Difficulty of Detection and Repair

Detection works in the reverse of the occurrences, whereby the easier it is to detect the problem and begin to corrective measures, the lower the critical rating. The longer it takes to detect and repair, the higher the rating.



Resolution achieved within 1 hour


Greater than 1 hour but less than 4 hours


Greater than 4 hours but less than 8 hours


Greater than 8 hours but less than 24 hours


Greater than 24 hours


Tally the Final Figure

Voilà! With the help of the tables in the preceding steps, you actually get figures that management can understand—and believe!

The final product is an assessment, or risk priority number (RPN). This is a mathematical computation:

S x O x D = RPN

For example:

10 x 10 x 10 = 1,000

The higher the risk priority number, the higher the risk associated with a specific component, and the higher the value that would be placed on solving the problem. A 720 score would be worse than a 450, for example. This gives management (and you) a critical frame of reference. For example, if a support system was composed of several critical components, each of which had very high RPNs, you would have to show where the system could be improved to support the service levels that are expected.

  • + Share This
  • 🔖 Save To Your Account