Each risk mitigation option also needs description and rating. Examples of typical properties are:
how quickly will the risk mitigation occur (timeframe), what is the cost of this option, what resources are required, are there dependencies (e.g. clustering, backup), can this be put in place before the event (incident), or is it reactive. What is the expected risk of damage/outage if this option is selected (risk coverage). These considerations give one a basis for assessing options against the risk of occurrence (likelihood) and cost if risk occurs.
The options are then graded in a table against each risk. Note that risks are also graded at the higher level in terms of likelihood and cost of occurence.
The objective is to identify the highest risks to mitigate, and the most effective and cost-effective (not the same thing) options available within a given budget. If major risks remain uncovered, there is then a proper business case for a budget variation.
From the perspective of a Project Manager the main concern is to determine max. and min. duration of certain task to which will correspond to a min. and max. cost of the task! the problem formulation was firstly written by J.E. Kelly and M. R: Walker, "Critical path planning and scheduling", Mauchly Associates, Inc., Ambler, Pa.,1959
