Managing Project Risks

1. Types of Project Risk

A project manager will need to continually monitor risks by making the effort to identify and classify events that threaten a project's success. Unexpected challenges always occur on projects, but it's the project manager's responsibility to use their expertise to find these risks and uncertainties early in a project and implement mitigations that will reduce their impact.

Risks are often found and triggered in this phase of a project. No matter how diligently a project is documented during the scope and planning phases, there's just no way to define every deliverable perfectly. So risks will occur, and it's up to the project manager to find and investigate them.

A risk can relate to any of the following listed in the table below.

Risk can occur anywhere on a project, but this list should provide guidance about the most common places where risk appears.

term to know

Monitoring Risks

The process of continuously identifying, assessing and tracking risks that potentially will impact a project negatively.

2. Risk and the Triple Constraint

When thinking about risk, it helps to remember the triple constraint from an earlier lesson. Any impact to scope, time, or cost will impact the other two variables.

If the project manager identifies risk in the schedule, then the risk to scope and cost must also be identified. Then the risk and the mitigations should be documented in the risk register.

3. Risk Register

The risk register is a document that keeps track of the identified risks throughout a project. It includes:

• Date when the risk was noted in the register
• Description of the risk
• Risk level that identifies the probability and impact of the risk to the project
• Contingencies that lists the actions that can be taken to mitigate the risk
• Type of risk

It's the project manager's responsibility to keep the risk register updated. But every member of the team should be encouraged to identify risks and notify the project manager when they're discovered. Risks in the risk register should be reviewed at every team meeting, and the project manager should also take that opportunity to remind the team of the importance of risk identification and mitigation.

Using the risk register, current risks should be evaluated to determine the current status of the risk and the current effectiveness of any mitigation. A good question to ask is, "Has the probability of the risk occurring and the impact of the risk changed since the risk was first identified?"

EXAMPLE

In the above risk register, the deliverable risk was identified early in the process. It has a high impact, so the mitigations need to be aggressive.

The earlier a risk is identified, the easier it will be to mitigate that risk. More options will be available to a project manager if a risk is identified in earlier phases when resources might be easily added to tasks to help mitigate the risk.

A project manager should constantly search for new risks that might impact the project. It's their role to take the big picture view of the project, and that often involves identifying dangers that might affect a project in the future. Again, the project manager should also encourage and involve the team in this process.

4. Contingency Planning

Whenever an identified risk either occurs or is considered too dangerous to be allowed to happen, the project manager should plan contingencies to mitigate the risk. Contingencies are actions taken to address the risk.

The project manager and any team members who can assist should devote the time necessary to develop these contingencies. Project managers should encourage open, what-if thinking when discussing these contingencies. Any ideas that manage the risk effectively should be considered.

Risks that are high impact and high probability must have contingencies, and perhaps more than one. These contingencies should be discussed and recorded in the risk register.

5. Risks Become Reality

No matter how prepared a project is, risks will happen. And when they do, the project manager must be ready to take action.

The following steps should occur:

1. Risk happens: The triggering of the risk starts the process.
2. Recognize risk has happened. The project manager documents the occurrence and communicates the status to the team and stakeholders.
3. Reference contingency plans: If mitigations have already been identified, those should be considered if they are still appropriate. New mitigations might also be developed.
4. Select the contingencies to use
5. Consult with team and stakeholders: The project manager meets with team members who have expertise with the elements of the risk to determine how the mitigations might impact the project. The project manager then meets with the project sponsor and/or the stakeholders to review the contingency plan and determine if it is still the right course of action.
6. Finalize contingency plan: Implementing a contingency plan often involves changes to the schedule, cost, and scope of a project. So change requests might need to be created for the stakeholders also. Once the plan and any necessary change requests are approved, the project manager can then move forward.
7. Implement plan: If the contingency plan is approved, the project manager will then make the appropriate changes to the project documents, such as the scope, schedule, budget, and requirements. They will need to shift or reassign resources and tasks to implement the contingency plan.
8. Update risk register: Once the plan is executed, the risk register should be updated to reflect the actions that were taken.

term to know

Contingency Planning

Identifying various actions to manage risks if they occur.