APPENDIX X8
RISK CLASSIFICATION

Potential risks can be classified into one of four quadrants based on the degree of available information, ambiguity, and variability (see Section 3.3.1 and Figure 3-3). Organizations work to reduce the degree of unknown factors so they can be progressively converted to known-knowns or at least known-unknowns. This appendix details this concept, which was introduced in Section 3 of this standard.

• Known-known. A known-known is a fact, not a risk. These are typically identified as part of requirements and scope. The entity working on the endeavor is aware of these facts, which are incorporated in the portfolio, program, or project scope.
• Known-unknown. A known-unknown is an identified risk. The entity working on the endeavor is aware of the uncertain event and the potential consequences. Known-unknown risks are identified and proactively managed.
• Unknown-known. An unknown-known is a hidden fact. Knowledge about the fact might exist; however, the entity may not be aware of it at the time of the endeavor. An example of an unknown-known is a hidden or ignored assumption. The identification, assessment, and development of a strong understanding of unknown-known risks occur over time. For complex and innovative activities, there is a high degree of guesswork in which risks can be identified, but with limited visibility. Unknown-knowns are typically addressed through progressive risk elaboration integrated with execution of the endeavor.
• Unknown-unknown. Unknown-unknown risks may be emergent risks that are essentially unknowable within the context of portfolio, program, and project management. That lack of knowledge makes any type of evaluation or exploration impossible. Unknown-unknowns can be managed through organizational resilience. Due to the unpredictability, resilient organizations encourage research, raise awareness, encourage teams to question the status quo, and increase the flow of information. These actions stretch the boundaries of influence and prepare organizations to better respond to and recover from such events.