Risk Management was first made interesting by Tom DeMarco and Timothy Lister in Waltzing with Bears. If you want to know more about the subject, that’s a good place to start. But what is the difference between Risk Materialisation and Crystallisation?
I will answer this question shortly, but let’s start from the beginning!
A risk is anything that could happen that will have an impact on your plans. I’m planning on playing some guitar after I write this. My plan to play guitar could be impacted by many different things. They can be more or less likely to happen, and they can impact my plan to a greater or lesser extent.
For example, my plan could face challenges such as:
- This article could take longer to write than I expect
- My guitar might be stolen
- A string might break
- Multiple strings might break
- All the strings might break
- I might get cramp after all this typing
There will also be risks I can’t imagine up front. They still exist, so they are still risks; I just can’t do much to mitigate them until I know what they are.
For the purposes of this article, we’re going to break a guitar string.
When I have a list of imaginable risks, I could think about what I can do to mitigate them. Risk mitigation is choosing to do something up front to reduce the chance of a risk actually happening, or to limit the impact it might have.
Let’s think about the chance of a string breaking on my guitar. I could mitigate this in several ways.
If I take care of my guitar by cleaning the sweat off the strings each time I play, it makes it less likely that a string will break. I could decide that this is enough, or I might do more.
I might spend some cash to have a spare set of strings available, so I can change a broken string. This doesn’t cost much and limits the impact of a string breaking.
If I am performing in front of an audience, I might spend significantly more money to have a second guitar available in addition to several spare sets of strings. The impact of breaking a string during a live performance is greater than the impact of breaking a string during practice. Switching guitars allows the performance to continue uninterrupted, while one of my guitar technicians fixes the guitar with the broken string.
I could decide to do nothing. I may consider the risk to be unlikely, or the impact to be low enough that I needn’t take any action to mitigate the risk. In many cases I can assess the cost of mitigation against the cost of the impact, multiplied by the probability of it happening.
Risk Materialisation occurs when the thing we thought was possible actually occurs. For example, when a string breaks on my guitar. Once that string snaps, the risk has materialised. You were proven correct to have listed the risk on your risk register. It has happened.
Risk Crystallisation occurs when you take the hit from the risk materialising.
If I mitigated the risk of a guitar string breaking by purchasing extra strings, the risk was mostly crystallised before it materialised. I already spent the money, but I also need to take some time to remove the broken string and put the new string in its place. Depending on the age of the strings, I may need to replace all six in order to achieve an appropriate brightness across them all.
If I decided not to mitigate the risk of a string breaking, I now need to take some action. I may immediately head out to buy strings and fit them, or I could decide to delay the action. If I got and get string immediately, I have now crystallised the risk.
If I delay the crystallisation, I end up in a similar situation to an investor with an open position. I might be able to buy strings immediately for £15, but the price may change if I wait. If I decide to buy the strings on the way to my next public performance, I could end up paying a premium if the price is higher than I expect. Equally, if it is December and my next performance is in January, I might get a good deal in the sales.
I could decide to invent a new playing style that uses fewer strings, or even give up guitar entirely. Doing so could effectively never crystallise the risk, even though it materialised.
So a risk can be mitigated by taking action up front to reduce the likelihood or impact of the risk materialising. A risk materialises when it happens, and crystallises when you pay the tab.