Every project manager knows the moans and groans for the evil not always objective “traffic light” chart used to denote risks to a project.  In sufficiently complex projects, risk is based on a risk matrix (typically a 5×5 matrix) with consequence of a risk occurring on one axis and likelihood of the risk being realized on another.  Then depending on the mix of likelihood and consequence you are giving a low, medium, or high risk.  That low, medium, and high risk typically associated with the color green, yellow, and red, respectively.  Now with the advent on newer versions of Excel, you may see gradient colors green/yellow mix indicating risk is moving from low to medium rating.  Or sometimes a fourth color such as orange is added for high, and red is reserved for critical risk.  Now in any case, the need for pre-determined, objective thresholds for the various step of the likelihood and consequence matrix is need for any of this to be useful.  For example, consequence could be related to cost overrun such that $0-$100 is a 1, $101 to $500 is 2, etc.  That way after you do the crosswalk of likelihood and consequence that risk rating (and associated color code) have some sort of meaning rather than an ambiguous high, medium, low.

I for one am not a fan of the gradient color schemes, high to medium, low to medium, etc.  At the time a risk is measured it should be one of the other.  Sure it could change, and that possibility could be documented in backup, but for the purposes of a stop chart, let it be one color of the other.

Now that it is not to say that I believe there should be only three colors.  As the image above alludes to, I actually prefer 6 colors.  I will assume we all agree on the need for the green, yellow, and red for their typical denotation of low, medium, and high risk; however you determine that.  I have become enamored with a scheme I was recently introduced to that includes Blue, Gray, and Black.  Here is why they are important:

• Black:  In short black means the fit has hit the shan.  Once a risk actually happens, it is no longer a risk.  It actually has happened and you have to react.  No more mitigation strategy.  You are in recovery mode.  Black, to me, is what warrants the highest attention.
• Gray:  Sometimes you have no way of knowing, either communication is lost, data is not ready, etc.  Instead of going high and right by saying you have a high risk, you are specifically denoting the fact that you do not have enough information to determine at this time.  You should look at these after you look at items coded black or red.
• Blue:  Sometimes leadership gives us predefined risks we must track.  Sometimes though one-size-fits-all works and sometimes it doesn’t.  You use blue to indicate Non-Applicable risk items.  It is better to use Blue vice Green for items that cannot occur because to me, something coded Green still has the possibility of going bad.  So I still need to track it.  Blue indicates to me don’t worry, this is not even applicable to this specific case.

So there you, my preference for a color coding scheme for risk management.  Agree or disagree let me know below!