Example of calculating the aggregate risk value

This example provides an overview of how BMC Helix ITSM: Change Management calculates aggregate risk value and how the weighting works.

This example works through a very simple case with two questions and one derived performance rating.

Question 1 — Can the change be easily rolled back? (Question Weight 20)

• Yes (Risk 1)
• No (Risk 5)

Question 2 — How many people does the change impact? (Question Weight 100)

• 1-20 (Risk 1)
• 21-40 (Risk 2)
• 41-60 (Risk 3)
• 61-80 (Risk 4)
• 81 or more (Risk 5)

Derived risk — Change manager's performance (Weight 60)

For the change request example, the following data is used:

• Question 1 — No (Risk 5)
• Question 2 — 21-40 (Risk 2)
• Derived Risk — Mary Mann

First, you must determine the risk of Mary Mann. Mary has been involved in 10 changes as CAB Manager. In these changes, Mary has acquired an overall performance rating of 2. You can use the performance rating to determine risk. The relationship between Performance Ratings and Aggregate Risk Value is inverse, so the overall Risk of Mary Mann is 4. The lower the performance, the higher the risk.

You now can perform the calculations on this data.

 (Risk1 × Weight1 ) + (Risk2 × Weight2) + (Risk3 × Weight3)
------------------------------------------------------------ = Calculated Risk Weight1 + Weight2 + Weight3

(5 x 20 ) + (2 x 100) + (4 x 60) 540
--------------------------------- = ------ = 3 20 + 100 + 60 180

Using the formula for calculating risk weight, the aggregate risk value is 3. Each change request has a risk value computed for it as the information about the change is modified. When you first save the change, a risk is initially computed based on the derived factors. Then when you answer, or change the answer to risk questions, and then save the change, the risk is computed again.

You can run a risk report to aid you in understanding what information was used to compute the risk that is shown on the change request. For more information about Risk Reports, see Computing risk levels.

Risk level is the anticipated risk for the proposed change. The values are from 5 (highest risk) to 1 (lowest risk). For more information, see the following figure: