Decision tree analysis

Decision tree analysis is a quantitative technique that models choices and uncertain events to compare alternatives using probabilities and payoffs. It typically applies expected monetary value and rollback calculations to identify the risk-adjusted best option.

Key Points

  • Visual model that maps decisions (squares) and uncertain events (circles) with branches for outcomes.
  • Compares alternatives by calculating expected monetary value (EMV) and rolling back the tree from right to left.
  • Useful for risk response selection, vendor choice, make-or-buy, and go/no-go decisions.
  • Requires clear assumptions: probabilities that are complete and mutually exclusive, and monetized outcomes.
  • Can include mitigation costs, residual risk, and value of information (e.g., paying for a test before deciding).
  • Informs, but does not replace, judgment, risk appetite, and non-financial constraints.

Purpose of Analysis

Provide a structured, quantitative way to choose among alternatives under uncertainty by combining probabilities and impacts. It helps justify decisions, compare risk-adjusted costs or benefits, and communicate trade-offs transparently to stakeholders.

Method Steps

  • Define the decision objective and whether you are minimizing cost or maximizing value.
  • List feasible alternatives and decision criteria.
  • Identify uncertain events and mutually exclusive states for each branch.
  • Estimate probabilities using expert judgment, historical data, or models.
  • Estimate monetary outcomes for each end path, including costs, benefits, penalties, and residual risk.
  • Draw the tree with decision and chance nodes; annotate probabilities and payoffs.
  • Compute EMV at each chance node by summing probability × payoff across branches.
  • Roll back from right to left, selecting the branch with the best EMV at each decision node.
  • Perform sensitivity analysis on key probabilities and impacts; consider utility or constraints if risk tolerance is a factor.
  • Document assumptions, data sources, and rationale.

Inputs Needed

  • Defined alternatives and decision criteria.
  • Probability estimates for each state of uncertainty, including conditional probabilities when applicable.
  • Impact estimates (costs, benefits, penalties, rework, savings).
  • Costs and effects of risk responses or tests, and residual risk after responses.
  • Time value of money assumptions (discount rate) for multi-period cash flows.
  • Risk register entries, historical data, and expert judgment.
  • Constraints, risk thresholds, and utility or preference considerations.

Outputs Produced

  • Recommended alternative based on EMV and rollback results.
  • EMV calculations for each path and a clear decision tree diagram.
  • Sensitivity analysis results and break-even conditions.
  • Documented assumptions, probabilities, and data sources.
  • Optional: value of information metrics (EVPI/EVSI) to assess whether additional analysis or testing is worth the cost.

Interpretation Tips

  • For cost-focused problems, choose the lowest expected cost; for value-focused problems, choose the highest EMV.
  • Use consistent units by monetizing schedule or quality impacts where practical.
  • Ensure probabilities are complete and appropriate (mutually exclusive and collectively exhaustive); handle conditional probabilities carefully.
  • Consider risk appetite: EMV may not reflect stakeholder utility for one-time, high-impact risks.
  • Run sensitivity tests to identify inputs that could flip the decision and to gauge robustness.
  • Update the tree as new information arrives; revise probabilities rather than forcing outcomes.

Example

A team must select a vendor. Vendor A offers a fixed price of $300,000 with a 30% chance of a $50,000 delay penalty. Vendor B is time-and-materials with an expected base cost of $260,000 and a 40% chance of an $80,000 scope increase.

  • Vendor A EMV (cost) = 300,000 + 0.30 × 50,000 = 315,000.
  • Vendor B EMV (cost) = 260,000 + 0.40 × 80,000 = 292,000.
  • Decision: Choose Vendor B because it has the lower expected cost.

Pitfalls

  • Overprecision: assigning exact-looking numbers to weak estimates, creating false confidence.
  • Incomplete or overlapping states that cause probabilities not to sum correctly.
  • Ignoring correlations or double-counting risks across branches.
  • Relying solely on EMV for single, high-impact decisions without considering utility or constraints.
  • Omitting time value of money or lifecycle effects for multi-period outcomes.
  • Overly complex trees that are hard to validate and explain to stakeholders.

PMP Example Question

A project manager is evaluating whether to implement a $40,000 mitigation that eliminates a 25% chance of a $200,000 failure. Using decision tree analysis, what should the PM recommend?

  1. Implement mitigation because its expected cost (40,000) is lower than the expected failure cost (0.25 × 200,000 = 50,000).
  2. Do not mitigate because it adds certain cost now.
  3. Perform qualitative risk analysis first and postpone any decision.
  4. Escalate the decision to the sponsor due to uncertainty.

Correct Answer: A — Implement mitigation because its expected cost is lower than the expected loss.

Explanation: Decision tree analysis compares EMVs; the mitigation has an EMV of 40,000, which is less than the 50,000 expected loss if the risk is accepted.

ICS/OT Cybersecurity Fundamentals — Security Built for Industrial Systems

Industrial control systems cannot be secured like ordinary IT. A forced reboot, aggressive scan, or incompatible patch can interrupt production and create real safety consequences. Effective OT security begins with understanding the systems, constraints, and risks unique to industrial environments.

This course gives IT professionals, engineers, operators, and security practitioners a practical foundation in ICS threats, zone and conduit design, risk assessment, passive asset visibility, and vendor evaluation. You will learn how IEC 62443, NIST CSF, and MITRE ATT&CK for ICS apply where availability and safety come first.

Eight reconstructed incidents—including Stuxnet, Triton, Ukraine 2015, Colonial Pipeline, and PIPEDREAM—show how attackers move through OT environments, what they target, and which defenses could have changed the outcome.

Watch the course preview, then build the vocabulary, frameworks, and judgment needed to take credible first steps in ICS/OT cybersecurity.

Explore the Course


ICS/OT Cybersecurity Fundamentals course preview

Stop Managing Admin. Start Leading the Future!

HK School of Management helps you master AI-Prompt Engineering to automate chaos and drive strategic value. Move beyond status reports and risk logs by turning AI into your most capable assistant. Learn the core elements of prompt engineering to save hours every week and focus on high-value leadership. For the price of lunch, you get practical frameworks to future-proof your career and solve the blank page problem immediately. Backed by a 30-day money-back guarantee-zero risk, real impact.

Enroll Now