Risk Management

Risk management means anticipating risks and planning what to do if they occur. It saves time, money, and effort, reduces unnecessary stress on the team, and prevents some problems while making others less likely.

Risk management is part of a project manager’s daily work. It helps the project manager take control by preparing for events that might affect the project.

Risk Management Fundamentals

Risk management includes planning how to manage risk, identifying risks, analyzing them qualitatively and quantitatively, planning responses, and monitoring and controlling those responses. These efforts make positive events more likely and negative events less likely.

Threats and Opportunities

Threats are events that can harm the project if they occur. Opportunities are events that can benefit the project if they occur.

Open Full-Size Diagram ↗

This lesson estimates that up to 90% of threats identified and investigated during risk management can be eliminated.

Uncertainty

Uncertainty is a lack of knowledge about an event that might occur. It reduces confidence in conclusions drawn from the available data.

Risk Factors

• How likely is the event to occur?
• What impact would it have?
• When might it occur during the project?
• How many times might it occur?

Risk Aversion, Tolerance, and Thresholds

A person who avoids taking risks is risk averse. Risk tolerance is the degree or level of risk considered acceptable. A risk threshold is the specific point at which risk becomes unacceptable.

The Risk Management Process

Effective risk management means making risk a standing item at every meeting and always having a plan for risk events. With robust response planning, risks can be eliminated even when they occur. This gives the project manager more time for other critical project work.

The six risk management processes are:

1. Plan Risk Management
2. Identify Risks
3. Perform Qualitative Risk Analysis
4. Perform Quantitative Risk Analysis
5. Plan Risk Responses
6. Monitor and Control Risks

Plan Risk Management

Involve the project manager, sponsor, team, customer, other stakeholders, and experts. Structure risk management to fit the project’s size and complexity and the skills of the people involved. Draw on experience from past projects while tailoring your work beyond the standard checklist.

Plan how much time to spend on risk management, which resources you will need, and how you will carry out the process. Use organizational process assets to inform the plan.

Risk Management Plan

The Risk Management Plan may include the following elements.

• Methodology. Define how risk management will be carried out.
• Roles and responsibilities. Identify who will perform risk management work.
• Budgeting. Determine the cost of risk management.
• Timing. Determine when risk management should start.
• Risk categories. Define how risks will be grouped.
• Definitions of probability and impact. Both are generally rated from 1 (lowest) to 10 (highest). Two people who give a risk a rating of 6 may mean different things. Definitions standardize these subjective ratings and help teams compare risks across projects.
• Stakeholder tolerances. Identify stakeholder tolerance for different categories, such as cost and quality, during initiation and clarify those levels regularly.
• Reporting formats. Identify and finalize the format of risk management reports.
• Tracking. Define how people involved in the project will track risks regularly.

Risk Categories

Broad categories may reflect sources of risk the organization has encountered.

• External. Government, regulation, the environment, and the market.
• Internal. Service, customer satisfaction, cost, and quality.
• Technical. Changes in technology.
• Unforeseeable. The lesson estimates that about 9% to 10% of risks may be unforeseeable.

Types of Risk

• Business risk. Can result in a gain or a loss.
• Pure (insurable) risk. Can result only in a loss, as with robbery or fire.

Identify Risks

Talk to stakeholders and people outside the stakeholder group. Review organizational process assets. Begin at project initiation by identifying high-level risks while creating the project charter. Identify detailed risks during planning. The scope baseline is a critical input and includes the project scope statement, the WBS, and the WBS dictionary.

Documentation Reviews

Review relevant documents such as lessons learned, articles, and organizational process assets.

Information Gathering Techniques

Risk identification uses several techniques similar to those used to collect requirements.

Brainstorming

Bring a group together to identify risks to the project.

Open Full-Size Diagram ↗

Delphi Technique

Consult a group of experts anonymously. Send them a list of the information you need, compile their responses, and return the results for another round of review. Repeat until the experts reach consensus.

Interviewing

Interview project participants, stakeholders, and experts to identify risks.

Root Cause Analysis

Find the root causes of known risks, then use those causes to identify additional risks.

SWOT Analysis

SWOT stands for strengths, weaknesses, opportunities, and threats. Identify the project’s strengths and weaknesses to help determine its risks.

Open Full-Size Diagram ↗

Additional Identification Techniques

• Checklist analysis. Use the checklist of risk categories to identify additional risks.
• Assumption analysis. Identify the project’s assumptions and test their validity to uncover risks.
• Diagramming. Use techniques such as cause-and-effect diagrams and process flowcharts to identify risks.

Risk Register

Identify Risks produces the Risk Register. It is a living document that the team updates throughout the project life cycle. Keep it with the project documents and retain it in the historical records for future projects.

Open Full-Size Diagram ↗

The register includes the list of risks, potential responses, root causes, and updated risk categories.

Perform Qualitative Risk Analysis

Qualitative risk analysis is a subjective assessment of identified risks and when they may occur during the project. Rate the probability of each risk using a scale such as low, medium, and high or 1 to 10. Rate impact on an appropriate scale as well.

Probability and Impact Matrix

Use the matrix to identify risks that require an immediate response. Customize it to the project’s needs or use a standard company template. A standardized matrix makes the results easier to reproduce across projects.

Open Full-Size Diagram ↗

Risk Data Quality Assessment

Collect data on the identified risks and assess whether it is precise enough for qualitative analysis. For each risk, consider how well it is understood, what data is available, and the quality, reliability, and integrity of that data.

Risk Categorization

Label individual risks or group them by category. This shows which types of work packages, processes, people, or other potential causes account for the most risks.

Risk Urgency Assessment

Identify which risks require urgent attention alongside the work of identifying risks and planning responses. Consider urgency together with probability and impact ratings.

Risk Register Updates After Qualitative Analysis

• The project’s risk ranking compared with other projects.
• Prioritized risks and their probability and impact ratings.
• Risks grouped by category.
• Risks requiring additional analysis and response.
• Risks requiring additional analysis in the near term.
• A watch list of noncritical risks.
• Trends.

Perform Quantitative Risk Analysis

Quantitative risk analysis follows qualitative analysis by analyzing probability and impact numerically. Use it to identify responses that need urgent attention, determine the project’s risk exposure and the impact on its objectives, estimate the cost and schedule reserves needed if risks occur, and identify risks that need more attention.

Techniques for Quantifying Probability and Impact

• Interviewing
• Cost and time estimating
• Delphi technique
• Historical records
• Expert judgment
• Expected monetary value analysis
• Monte Carlo analysis
• Decision trees

Monte Carlo Analysis

Monte Carlo analysis uses a computer program to simulate project cost or schedule outcomes. Its main inputs are the network diagram and the estimates for completing the project.

• Evaluates overall project risk.
• Estimates the probability of completing the project on a specific date or at a specific cost.
• Estimates the probability of an activity being on the critical path.
• Accounts for convergence of paths in the project network.
• Assesses cost and schedule impacts.
• Produces a probability distribution.

Decision Tree

A decision tree models a real situation and helps compare several alternatives at the same time. It accounts for future events when making a decision today, helps calculate expected monetary value in complex situations, and involves mutually exclusive outcomes.

Outputs of Quantitative Risk Analysis

• A prioritized list of quantified risks.
• The amount of contingency time and cost reserves needed.
• Realistic, achievable completion dates and project costs with confidence levels, compared with the project’s time and cost objectives.
• The quantified probability of meeting project objectives.
• Trends in quantitative risk analysis.

Plan Risk Responses

Plan ways to reduce or eliminate threats and increase the impact of opportunities. Work to eliminate threats before they occur and to make opportunities happen. Reduce the probability and impact of threats, and increase the probability and impact of opportunities.

For threats that cannot be mitigated, prepare a robust contingency plan and a fallback response in case the contingency plan fails. Time and resources limit how many risks you can eliminate. Review risks throughout the project. Continue qualitative and quantitative analysis and response planning after project work begins.

Response Strategies for Threats

• Avoid. Eliminate the cause to eliminate the threat.
• Mitigate. Reduce the impact of a risk that cannot be eliminated.
• Transfer. Shift the risk to another party through measures such as insurance, warranties, or guarantees.

Response Strategies for Opportunities

• Exploit. Add work or change the project to make sure the opportunity occurs.
• Enhance. Increase the likelihood and positive impact of the opportunity.
• Share. Assign ownership of the opportunity to a third party.

Acceptance and Response Selection

Accept applies to threats and opportunities. In passive acceptance, decide what to do if the event occurs. In active acceptance, plan contingencies and set aside time and cost reserves. Communicate the decision to accept a risk to stakeholders.

Set a time limit for carrying out each response, and match the effort to the severity of the risk. One response can address several events. The project manager, team, stakeholders, or experts can select a strategy.

Outputs of Plan Risk Responses

Update the Risk Register, Project Management Plan, and project documents. As you revise the Project Management Plan, add or remove activities and work packages or assign them to different resources. This makes planning an iterative process.

Update the documents used to manage the project with these details as applicable.

• Residual risks. Risks that remain after response planning. Accept these risks and develop contingency plans for them.
• Contingency plans. Specify what to do if particular opportunities or threats occur.
• Risk response owners. Assign people to develop responses and implement them if a threat or opportunity occurs.
• Secondary risks. Risks that may arise from implementing a response.
• Risk triggers. Events that set a contingency response in motion.
• Contracts. Record any contracts issued to address risks in the Risk Register.
• Fallback plans. Specify what to do if contingency plans or risk response plans are ineffective.
• Contingency reserves. Set aside reserves for both time and cost risks.

Monitor and Control Risks

• Watch for risk triggers.
• Identify and monitor residual risks.
• Repeat risk identification, analysis, and monitoring throughout the project.
• Evaluate whether the Risk Response Plan is effective.
• Collect and communicate risk status.
• Monitor how rigorously risk management procedures are followed.
• Determine whether additional responses are needed.
• Recommend corrective action.
• Look for unexpected effects or consequences.
• Update the risk management and response plans.
• Analyze variances and trends.
• Use contingency reserves and adjust them for approved changes.

Techniques for Monitoring and Controlling Risks

• Workarounds. Develop unplanned responses to unexpected project events or problems.
• Risk reassessments. Review the Risk Management Plan and Risk Register periodically and update the documentation as needed.
• Risk audits. Verify that all risks have been identified, each major risk has a mitigation plan, and response owners are ready to act.
• Reserve analysis. During execution, check how much reserve remains and how much may be needed.
• Status meetings. Make risk a major topic at all team project status meetings.
• Closing risks. Close risks that no longer apply so the team can focus on the open ones.

Outputs of Monitor and Control Risks

• Risk Register updates
• Change requests and recommended preventive and corrective actions
• Project Management Plan updates
• Project document updates
• Organizational process asset updates