Project Risk Management – A Basic Approach

Project Risk Management

Many project management practitioners start their project focused in the scope, schedule and cost.  Taking care of the Triple Constraint (Scope, Schedule and Cost) is an important practice when executing projects.  But how the Triple Constraint can be protected against unexpected internal or external factors?

Project risks are uncertain events or conditions that may have a positive (Opportunity) or negative (Threat) effect on one or more project objectives (e.g., Scope, Schedule, Cost, Quality) if occur.  A risk may have one or more causes and may have one or more impacts.

Project Risk Management is a valuable part of project management and when performed appropriate, it enhances the complete project management execution and its change to success.

As define by PMI, “Project Risk Management includes the processes of conducting risk management planning, identification, analysis, response planning, and controlling risk on a project.  The objectives of project risk management are to increase the likelihood and impact of positive events, and decrease the likelihood and impact of negative events in the project” (PMBOK 5thEd.)

Project Risk Management concentrates on project’s uncertainties. Some uncertainties are known (e.g., Lessons Learned, Historical Data) and some are unknown or emerge during project execution.  For this reason risk identification should be performed as early as possible in the project.

When performing Project Risk Management, the following steps should be observed:

Plan Risk Management – This process defines and establishes how the project risk management will be performed. The output is the Project Risk Management Plan and it should be developed and approved early in the project and should be part of the Project Management Plan. 

Identify Risks - The process of identify those risks that may affect the project and documenting their characteristics.  During this process observe early risks identification, iterative identification, emergent identification, explicit identification of opportunities, multiple perspectives and link risks to project objectives, complete risk statement (Scope, Schedule, Cost, Quality, etc.).  The output is the Project Risk Register.  Risk Owners are preliminary assigned.  

Perform Qualitative Risk Analysis – This process evaluates the characteristics of those risks previously identified during the Identify Risk step.  During this process risks are prioritized for further analysis by assessing their probability of occurrence and impact.  Categories, level of probability and impact should be previously stated and agreed in the Project Risk Management Plan.  The output is the updated Project Risk Register.

Perform Quantitative Risk Analysis – This process analyze numerically the effect of identified risks on overall project.  Using quantitative techniques such as Monte Carlo simulation may produce a better estimate of risks impact on schedule or cost.  Not all projects require Quantitative Risk Analysis.  The Project Risk Management Plan should state the type of risk analysis that will be performed.  The output is the updated Project Risk Register.

Plan Risk Responses - The process establish effective response actions in accordance the priority of the identified and assessed risks, and complying with applicable organizational and project constraints.  In other words, establish actions to enhance opportunities and to reduce threats to project objectives.  The output is the updated Project Risk Register.

Control Risks – This process tracks identified risks, monitor residual risks, identify new risks, reevaluate identified risks, continuously monitor risks trigger conditions, maintain risks awareness, ensure response action are performed and implemented appropriate on time as expected and evaluate responses effectiveness throughout the project.  This Control Risks should be integrated with the Project Monitoring and Control.  The output is the updated Project Risk Register.  Perform risks assessment periodically as stated in the Project Risk Management Plan.

As part of the Project Manager role, the following responsibilities should be performed to enhance project risk management performance:

-  Encourage senior management to support Project Risk Management process

-  Promote the Project Risk Management process for the project

-  Facilitate open and honest communication about project risks

-  Regularly report risks status to project sponsor and key stakeholders

-  Escalate identified risks to senior management when required

-  Monitor risks response actions effectiveness

-  Documents Project Risk Management Lessons Learned

Remember that Project Risk Management is an iterative process and should be performed starting early in the project until project completion, including its discussion during the Lessons Learned session.