Before you can manage a risk, you have to write it down in a form you can actually reason with. That form is probability.
Every project decision worth making is made in a fog. Will the ground conditions hold? Will the long-lead item arrive? Will the client sign off on time? A risk register full of adjectives — “high”, “likely”, “severe” — feels like a handle on that fog, but adjectives don’t combine. You cannot add “high” to “moderate”. Representation is the discipline of encoding what you believe in a form that does combine: numbers that obey consistent rules, arranged so a team can compute with them.
1Belief as a number
A probability is a degree of belief — a number between 0 (certain it won’t happen) and 1 (certain it will). It doesn’t claim the world is random; it measures your confidence given what you know. Two rules keep beliefs coherent: the probabilities of a complete set of mutually exclusive outcomes sum to 1, and nothing sits outside that range. That is almost the entire foundation. Everything else is bookkeeping built on top of it.
A probability distribution spreads belief across the values a variable can take. For a discrete variable — will the permit clear this month: yes or no — it’s a small table. For a continuous one — how many days late will delivery be — it’s a curve (a density) such as the familiar bell-shaped Gaussian, described compactly by a mean and a spread.
2The trap of the joint distribution
Real risk lives in the interactions. Rain matters because it stalls the subcontractor, which matters because it slips the schedule, which matters because it triggers a penalty. To capture all of that at once you’d write a joint distribution: the probability of every combination of every variable together.
This is where naïve modelling collapses. Ten yes/no risk factors have 210 = 1,024 combinations; twenty have over a million; thirty, over a billion. You could never fill that table in from experience, and no one could read it. The joint distribution is the honest, complete object — and it is hopeless to work with directly.
3The lever: conditional independence
The escape is an observation about how influence actually flows. A conditional probability, written P(slip | rain), asks: given that it rained, how likely is a slip? The chain rule lets any joint distribution be rebuilt as a product of such conditionals. On its own that doesn’t save you — but most factors don’t depend on most others. Once you know the schedule slipped, the cost overrun barely cares whether the cause was weather or labour. That is conditional independence: once you know the intervening cause, the earlier ones tell you nothing more.
Conditional independence lets you delete terms from the factorization. Each variable needs to be described only in relation to the few things that directly influence it — not the whole project at once.
4The Bayesian network
A Bayesian network makes this concrete. Draw each uncertain factor as a node; draw an arrow from a direct cause to its effect; forbid cycles. Each node carries a small conditional probability table giving its likelihood for each combination of its parents. The full joint distribution is then just the product, node by node, of these local tables — the graph is the set of independence assumptions you’re willing to make.
The payoff is enormous. The exponential joint over five factors becomes five small, local tables — each of which a scheduler or estimator can actually populate from experience. Better still, the structure is now explicit and auditable: anyone can look at the diagram and challenge a specific arrow (“does rain really only act through the subcontractor?”) rather than arguing about a vague overall feeling.
A Bayesian network trades one impossible table for many small, local ones — and in doing so turns a private hunch about risk into a shared, inspectable map of cause and effect.
5What this buys a risk manager
A well-built risk model is not a longer register; it is a causal one. The moment you commit to a network you have to state which factors drive which — and that conversation alone surfaces disagreements that a colour-coded heat map hides. The structure also becomes the scaffolding for everything that follows in this series: updating beliefs when evidence arrives (Chapter 2), calibrating the tables from data (Chapter 3), and even learning the structure itself when you’re unsure of it (Chapter 4).
Replace the adjectives with a small diagram of causes and effects, and put a defensible number on each direct link. You don’t need a probability for every combination of everything — only for how each risk relates to its immediate drivers. That single reframing makes your risk model something a team can question, combine, and compute with, instead of merely nod at.