Category: Risk Management

Posted on by

Identify and Analyze Risk in Project Management

Business woman working on managing project risks

One of the most important steps when coming up with a plan for your next project is identifying and analyzing risks. Whether you’re new to project management or you want to become a better project manager, understanding how to accurately determine where the risks lie on your projects can help ensure you’ll meet your goals with fewer, if any, setbacks along the way.  We encourage you to find out how your lack of risk knowledge could be hurting your projects.

Identify and Analyze Risk in Projects

  1. What are Risks in Project Management?
  2. What Is Risk Management?
  3. The Benefits of Risk Management
  4. A Guide to Risk Identification and Analysis
  5. Risk Management Starts at the Planning Stage

What Are “Risks” in Project Management?

What is a risk, exactly? It’s any uncertainty that might affect your project in either a positive or a negative way, so a risk is really a potential threat or a potential opportunity.

A threat might delay your project, increase your costs, and reduce the level of quality that you deliver, as a few examples. An opportunity might improve project performance by doing things like reducing the cost, improving the schedule, or boosting the quality delivered.

Each project will have its own set of risks, so you shouldn’t assume that the risks involved in your last project will affect the one that you’re currently working on. In other words, every time you start a new project, it’s best to identify risks, analyze their possible impact on your project, and come up with plans to reduce negative risks or deal with them if they turn into actual problems, and take advantage of opportunities.

What Is Risk Management?

The purpose of risk management is to identify as many potential opportunities as possible, and to plan the project in such a way as to take advantage of them. Risk management also seeks to identify and eliminate as many threats as possible and reduce the negative impact of any remaining project threats. You can use risk management to prevent problems rather than dealing with them after they occur. You identify and assess risks, and then you plan accordingly.

So, you would start by identifying what could possibly go wrong throughout the duration of your project. Then, you would assess the probability of those risks manifesting into real problems, and you would figure out the impact that a risk would have on your project.

Next, you’d come up with strategies to eliminate or mitigate the effects of risks you’ve identified. Then, you’d create plans to resolve any issue that might arise so you’ll be able to act right away when necessary.

Finally, you’d perform ongoing risk assessments as the project progresses

The Benefits of Risk Management

A few of the main benefits associated with risk management are:

  • Savings on project cost and time.
  • Greater control over the project.
  • Fewer hours spent dealing with problems because solutions have been planned to improve efficiency if a risk occurs.
  • Minimizing scope creep (scope creep refers to uncontrolled changes or continuous growth in a project’s scope, and this can occur when the project isn’t properly defined, documented, or controlled).

A Guide to Risk Identification and Analysis

For the best results, take advantage of a systematic process for risk management like the one below.

Using this process, you can spend more time managing the creation of your project deliverables. And, if a risk were to occur, you’ll be able to quickly implement your planned risk responses (contingency and fallback plans), rather than determining a course of action when an issue has occurred. All in all, this allows for more proactive project management.  You can avoid losing a lot of time and resources when issues do not become problems.

  1. Plan Risk Management: Determine how risk management will be done on your project, who will be involved in it, and what procedures will be used.
  2. Identify Risks: Determine specific risks by project, as well as by work package or activity.
  3. Perform Qualitative Risk Analysis: Subjectively analyze the probability and impact of each risk (for example, by using a scale of 1 to 10 for each risk). Also, prioritize the risks and categorize them. Decide what high ranking risks move on to the Quantitative Risk Analysis process. Categorizing may also help you find common causes for some- risks.
  4. Perform Quantitative Risk Analysis: Numerically estimate the cost and time impact of the high ranking risks from the Qualitative Analysis process. Expected Monetary Value (EMV, or % Probability x $ Impact) is the most common way of quantifying these risks. With these calculations you can create a risk reserve.
  5. Plan Risk Responses: Determine a course of action to reduce the overall risk to the project by decreasing the probability or impact of threats, while increasing the probability or impact of opportunities.
  6. Control Risks: Execute the risk response plan to manage risks and control overall project risk. Continually look for new risks and keep the risk management plan updated.

Risk Starts During the Planning Stage

Risk management begins during project planning. However, because risk assessment starts during planning doesn’t mean it stops there. Instead, you should continue performing risk analyses, including qualitative and quantitative analyses, during each stage of your project.

Ultimately, by using risk identification and analysis throughout a project, you can increase the odds that it will go smoothly, that you’ll stick to your budget and anticipated resource requirements, and that you’ll finish on schedule to impress and satisfy your stakeholders.

Build Your Risk Management Skills

The ability to effectively manage risk is an essential skill for professionals managing projects.  You can learn more about how to clearly identify and prevent many of the problems commonly faced on projects using our Risk Management – Tricks of the Trade® for Project Managers – Third Edition practical and easy-to-use Course in a Book®. It’s essential reading for anyone looking for a clear explanation of risk management and how it fits into the project management process.  RMC also offers our Risk Management eLearning course, and Learn things you can apply to your projects today!

Sources:

A whitepaper by RMC Learning Solutions, “6 Essential Elements to Effective Project Management.”

https://www.projectmanager.com/training/how-to-analyze-risks-project

https://www.clarizen.com/whats-risk-analysis-process-project-management/

https://www.pmis-consulting.com/example-project-risks-good-and-bad-practice/ 

Posted on by

Is Your Lack of Risk Management Hurting You?

Business man taking notes on risk management

Risk management is the process by which you identify and analyze the uncertainty associated with your project, no matter how large or small. This is important because it gives you the chance, during the planning process, to figure out what risks might affect your project. That way you can take steps to avoid those risks becoming a real problem. And, if those risks do become reality, you can immediately take action.

Despite the benefits of risk management, many businesses still have huge misconceptions about the risk management process, as well as what risk is. As a result, they waste time, money, and resources, and run into problems that could have been avoided.

Lack of Risk Management and Its Effects on Projects

  1. Are You Making the Most of Risk Management?
  2. Understanding Risk Misconceptions
  3. Missed Categories and Methods of Risks
  4. Other Common Mistakes Made When Trying to Manage Risk

Are You Making the Most of Risk Management?

To figure out if your lack of risk management is a problem that needs to be addressed, ask yourself the following questions:

  • Do you want to control your project or have your project control you?
  • Can you imagine going on vacation at the beginning of the execution of your project because everything is under control?
  • Would you like to prevent 45-90% of the problems on your project?

You can do all of these things, as long as you know and implement risk management. It starts with understanding some of the biggest misconceptions about risk, along with some of the major mistakes that people make in risk management.

Understanding Risk Misconceptions

Because misconceptions about risk can do a lot of damage and hinder your ability to take full advantage of the benefits of a strong risk management approach, here are some of the things that you should know about risk and risk management.

With this knowledge, you’ll be able to implement risk management into any project you lead, and you can boost the odds of successfully completing projects without hitting snags along the way.

  1. Risk identification cannot begin without inputs to the process.

Risk management isn’t completed using only a checklist or a Monte Carlo simulation. It involves identifying risks for the project and by work package. Inputs to risk identification include the project scope statement, a WBS or backlog, the project team and other stakeholders, a network diagram, and a project budget and schedule.

  1. Risk identification cannot stop after only a brief effort that results in a short list of risks.

Rather than putting in minimal effort in identifying potential problems and their odds of arising during a project, it’s important to really take your time, and it is best to involve as many of the project’s stakeholders as possible. By the time you’re done, you shouldn’t be surprised to find that you have identified hundreds of risks on a large project.

  1. Risks should not be evaluated as they are identified.

Risk identification is its own process, then it is followed by qualitative and quantitative risk analysis. Evaluating risks as you identify them bogs down the process and decreases the number of risks identified. Focus on one step at a time, and the first step is to simply identify risks.

  1. Remember: The risks that are identified are only probabilities.

To clarify, a risk is an event that is uncertain. It is something that may negatively impact anything from your budget to your team’s ability to complete their tasks. So, as an example, if your project has too few resources, this is not a risk. It is a fact. One risk of operating with too few resources is going over budget; another is going over schedule. The fact of too few resources must be addressed in the project management plan.

  1. Risks need to be clearly and properly stated.

For example, a risk of “poor communication” is too nondescript to be useful in the risk management process. Risks should be described fully. So, in this example, the risk would be identified as such: “poor communication of customers’ needs regarding installation of system XYZ will cause two weeks of rework.”

Missed Categories and Methods of Identifying Risks

Some project managers and their teams focus only on technical, cost and schedule risks. There are many of types of risk so using risk categories is helpful. For example, technology, cost, and schedule are good risk each knowledge area can represent a risk category (scope, quality, procurement, stakeholders, communications, and resources), as well company culture, existing systems, operations, regulations, the marketplace, and other categories related to your industry.

You should also not use just one identification method, such as a checklist for example. It’s best to use a combination of methods and brainstorming with the team and other stakeholders is another good method. Surveys are also good, especially when meetings with all appropriate stakeholders.

Other Common Risk Management Mistakes

Here are additional mistakes to avoid:

  • The first risk response strategy identified is selected without looking at other options to find the best option or combination of options.
  • Project meetings address everything except what they should be addressing: risks!
  • Contracts must not be created or signed until the project manager is assigned and a risk analysis is complete. Remember, contracts should be risk mitigation tools and contractors you use should have their own risk strategy in place.
  • Companies forget that risks can be good or bad. They are sometimes referred to as threats and opportunities. As well as diminishing negative risks, look to enhance positive risks..
  • Due to lack of knowledge, some businesses equate risk management with adding a pad to the project schedule and cost. A pad in the budget is hidden. Proper risk management will result in a reserve identified as part of a specific risk strategy with each line item tied to a specific risk.

Take Advantage of Good Risk Management in Every Project

Having the right risk management strategy in place and being aware of the common risk mistakes to avoid will allow you to move through projects from start to finish while remaining on schedule and budget. Risks that arise will be handled smoothly through a risk plan you have in place, and reserve money not used for those that don’t arise is returned to the organization.

If you want to improve your skills in this area, check out RMC’s online course, Risk Management Tricks of the Trade for Project Managers.

Sources:

https://www.projectmanager.com/blog/risk-management-process-steps

Posted on by

5 Tips for Qualitative Risk Analysis on Projects

Close up of two colleagues reviewing risk analysis on projects

Whether you’re an experienced project manager or just getting started, keep in mind that all projects, big or small, have risks. And these uncertainties can have a positive or negative effect on your objectives and outcomes. It is also true that risks vary by project. Therefore, understanding why and how to conduct risk analysis on projects can help you manage threats and opportunities.

For most projects, you can use effective risk management methods to efficiently identify, evaluate, categorize and manage the main risks. Let’s get started by introducing you to some tips to simplify your project qualitative risk analysis.

5 Tips for Project Qualitative Risk Analysis

  1. Use a Probability and Impact Grid
  2. Create the Grid in a Spreadsheet
  3. Chose a Simple Scale and Define It
  4. Set a Threshold of What Risks to Address
  5. Determine a Risk Score
  6. Facilitate a Discussion of Divergent Views

1. Use a Probability and Impact Grid

Impact and probability are the two main components of qualitative risk analysis. Probability estimates the likelihood of an event occurring. Impact estimates the relative consequences of dealing with the event. This impact is evaluating the implications for cost and schedule.

These estimates are not precise. Using a scale like the one in the image of 1-10, you can estimate the probability and impact of an event and allowing you to have a facilitated discussion with stakeholders and determine where to plot the identified risks on the chart. This grid allows for easy collaboration. This visual representation of each risk makes the interaction with stakeholders simpler and makes it easier to agree on probability and impact a particular risk.

2. Create the Grid in a Spreadsheet

The easiest way to create a probability and impact grid is to use a spreadsheet. You can graphically depict the stakeholders’ ranking which makes is easy to understand, discuss and prioritize risks with team members and other stakeholders. The grid also allows you to sort many risks quickly and to easily share in virtual meetings.

3. Chose a Simple Scale and Define It

There are many options of how you can create a scale. However, make sure you have definitions for your scale. It is important to establish and agree upon the definition of the scale so your stakeholders will not misinterpret or create their own definitions.

For example, if you are going to use a 1-10 scale, a rating of 1 may be defined as “no real impact” and 10 may be defined as project failure.  It should define probability – the likelihood a risk will occur and impact – the effect a risk will have if it occurs. Also see a simpler definition for the 1-10 scale in Figure 5.4 page 127. You can use any scale that makes sense to you and your stakeholders like 1-5 or high, medium, or low.

4. Set a Threshold of What Risks to Address

When a threat is great enough that the risk becomes unacceptable or an opportunity significant enough that action should be taken to benefit the project on a predetermined scale, you need to set a threshold for what risks you will address. Risks below this threshold will be identified but not dealt with meaning there will be no contingency plans created to deal with these risks. No special action needs to be taken to prepare for these risks as the probability and impact is low enough that additional time and effort aren’t necessary. Active acceptance of risks that score above the threshold require a response strategy. The response strategies could include actions to avoid, mitigate, or transfer negative risks or exploit, enhance, share positive risks.

5. Determine a Risk Score

Defining a risk score for each risk is one way to determine your risk threshold. Your risk score is the calculation of probability times impact (P x I = Risk Score).  The example in figure 5.8 shows scores for each risk and how those scores might be evaluated for setting the risk threshold.

If an organization had a risk governance rule that the threshold was 50 (on a 1-80 scale), then all risks 50 and over would need active acceptance (e.g. further actions to be taken such as setting aside contingency to offset the effect of the risk) and those under 50 would be passive acceptance (requires no action beyond documenting the decision).  Risk can be detailed by high, medium, and low risk scores. For example:

  • Risk above the threshold, also known as high risk, must be dealt with via qualitative analysis or plan risk response. The risks that are characterized as high risks have both a high impact and likelihood of occurrence. The often require immediate strategies of avoid or exploit.
  • Risks with a medium score might mean considering mitigation/enhancement/transfer/share efforts or qualitative analysis. The characterization is dependent on the organizations defined threshold.
  • Risks with a lower score get documented or put on a risk register or watch list. The risks that are characterized as low, or very low, risks have both a low impact and likelihood of occurrence.

Figure 5.8 page 132: Example of a Risk Score  Risk Management – Tricks of the Trade® for Project Managers – Third Edition

Key:

  • Yellow: Low risks. Simply document (low) on the Watch List.
  • Peach: Medium risks. Consider moving to Perform Quantitative Risk Analysis and/or Plan Risk Responses process. They needs contingency responses like mitigate, enhance, transfer and share.
  • Tan: High risks. Move to Perform Quantitative Risk Analysis and/or Plan Risk Responses process. Theses need responses like avoid and exploit.

6. Facilitate a Discussion of Divergent Views

When leading stakeholders in a qualitative risk analysis discussion, differences of opinions may emerge. Be prepared for the disagreement and move toward agreement and consensus on the analysis of each risk.

When leading stakeholders in a qualitative risk analysis discussion, differences of opinions may emerge. Be prepared for the disagreement and move toward agreement and consensus on the analysis of each risk. You might have to establish ground rules for the discussion and decision making to avoid conflict.

Communicating information about risks helps keep the team and your stakeholders invested in the success of the project.  Maintain open communication and intentionally ask questions.  Listen to the answers to capture the views of your stakeholders and team members by documenting assumptions, concerns, and outcomes. These efforts will promote accountability, help manage expectations and improve you and your team’s efforts to manage project risk.

Build Your Qualitative Risk Analysis Project Skills

As you continue to develop and practice your risk analysis skills, consider taking RMC’s instructor-led course on Risk Management Tricks of the Trade® for Project Managers.  Simply contact us to learn more. If you prefer to study at your own pace, we also offer a Risk Management eLearning course or our book Risk Management – Tricks of the Trade® for Project Managers.

You can also listen to our recorded webinar Five Tips for Easy Qualitative Risk Analysis and earn 1 free PDU.

Sources:

https://www.projectmanagement.com/blog/blogPostingView.cfm?blogPostingID=66734&thisPageURL=/blog-post/66734/Qualitative-Risk-Analysis–Process-Overview#_=_

https://www.safran.com/blog/how-to-communicate-risk-to-project-stakeholders

Posted on by

Project Management Risk Analysis

Team meeting to discuss project management risk analysis

Risk analysis and management are important skills to practice. They help reduce surprises and uncertainties that can negatively impact your project’s scope, schedule, performance, or budget. Risk is not just about threats. Project management risk analysis also identifies opportunities to reduce project cost or time.

Analyzing Project Risk

A good risk management plan identifies, analyzes, manages, and closes out risks during each project phase before they become real issues. This allows you evaluate the likelihood and impact that a risk will emerge during a project.

Project Management risk analysis begins with qualitative methods to examine, rank, and score the risk events.  Once identified risks are sorted and prioritized. Higher priority threats and opportunities are focused. For more detailed risk analysis requires quantitative techniques which are not discussed in this article.

What is Qualitative Risk Management?

Here is an overview of qualitative risk management:

1. Risk Tolerance: Decide the level of risk that is acceptable. The level of tolerance you have for risk will determine the amount of risk you are willing to take on in your project.   Risk tolerance tends to be subjective however, in determining your risk tolerance you should consider past projects and how risks taken on during them played out.

2. Identify Opportunities and Threats: Two tools that are useful for identifying risks are Risk Categories and Risk Breakdown Structure.   Risk Categories separate different risks based on their common characteristics.  For example, one category could be natural disasters.  Another category could be market or interprets rate fluctuations.  Risk Breakdown structure is a process where large risks categories are broken down into smaller packages.  To take the above example, interest rate fluctuations of 5 percentage points will require a certain risk response while a 50% change would require an entirely different response.  One thing to keep in mind is that risks can also be opportunities, like a key commodity used in your project is available at a lower price thus reducing overall project cost.

3. Qualitative Risk Analysis: Qualitative analysis is a subjective analysis to estimate probability and value for each risk. One way of doing this is to use a risk matrix. The risk matrix allows you to rank each and its potential effect on the project resulting in a ranking within the context of the project. Ultimately this will allow you to determine the overall risk for the entire project.  The rankings will also allow you to prioritize risks within the project.

4. Quantitative Risk Analysis: This process is optional because not all projects and not all risks need this level of analysis. Big, strategically important projects would be more likely to need quantitative risk analysis. For example, you might need the probability that there will be a concrete shortage during a road building project or a shortage of processors from a third-party country as the result of strike or factory closure. There are mathematical tools for doing this kind of risk analysis, but they are beyond the scope of this article.

5. Strategies for Higher Ranked Risks: Simply put, the higher ranked the risk, the more likely that you need a contingency plan for dealing with it.

6. Follow the Contingency Plan: If a risk occurs then the contingency plan for that risk should be followed. These contingency plans act as a roadmap for the team to follow.

7. Evaluate and Analyze if Risk Management is Working: You have to watch, evaluate and determine if the risk efforts that you planned are working. If not, you need a reassessment of the risks to identify necessary changes in your plans for the risks.

Qualitative Risk Analysis Process

Qualitative Risk Analysis allows you determine which risks warrant a response. You’ll need to establish evaluation criteria to avoid putting your energies in the wrong place. You also need to make sure that your subject matter experts that are participating in the evaluation are using the same criteria for consistency. (See item 1 below for examples and watch for our next blog for more information on the establishing these criteria.)

A common error encountered is not focusing our efforts on the highest value risks to generate the best results. Having a qualitative risk analysis process can be help, here is one you can use:

1. Subjectively evaluate the probability and impact of each risk: Using a matrix (1-5 scale, high medium, low) allows you to be able to have consistent criteria used in that evaluation.

2. Create a shorter list of risks: This allows you to create a smaller set of risks you are working on and a watch list of the ones, that if they occur, are not going to have significant impact on your schedule, budget, or resources and you can absorb that small impact to the project.

3. Determine the top or critical risks you will quantify and/or will require a response plan: This short list is prioritized by the risk’s qualitative ranking and is used to decide what to do next. For large/high priority projects, quantitative risk analysis can give further prioritization to the short list. For other projects that are smaller or are not as high in the organization’s priorities you can go directly to employing risk strategies and creating contingency plans.

4. Make a go/no-go decision: Consider creating an overall risk rating for the project to determine if the project is within acceptable risk levels for your organization. This ranking can be helpful in making a go/no-go decision. It will help answer the question: “After evaluating the risks, do you still want to do this project?”

Why Qualitative Risk Analysis is Important?

As you look at next steps and how to proceed about the risk, qualitative analysis of risk is critical to make sure that you are doing work in the right way at the right time.

You would proceed to Quantitative Risk Analysis if:

  • You identified all the project risks
  • It is worth the time and money
  • It has high priority or visible project
  • There is a low tolerance for cost or schedule overruns
  • You possess tools and capabilities

You would proceed to Risk Response Planning if:

  • The project has a smaller budget or is shorter project
  • You are new to risk management and have yet not developed your risk analysis skills
  • There are a small number of risks
  • The risk ratings identified warrant moving directly to response strategies

Passively Accepting Risk: Watch list

When you reach the threshold where you need to address the risks identified, using a watch list is the way of tracking the identified risks that you can passively accept.

Table 1 Risk Register Example from Rita Mulcahy’s™ Risk Management Tricks of the Trade® for Project Managers, 3rd Edition

Page 138, Fig 5.13

All risks will be documented in the risk register. Their score will be compared to the risk threshold and those under it will be ranked lower and will make up the watch list within the risk register. These low priority risks do not move forward in the risk management process as they do not require quantitative risk analysis or response strategies. Risks that need to be addressed will rank higher and continue through process and the additional documentation is added to the to the risk register.

Table 2: Risk Register with additional columns for documentation for short list risks. Page 138, Fig 5.13

Learn More About Project Managent Risk Analysis

Need real-world, step by step approach to using Risk Management in your current projects to help minimize the occurrence and impact of project risks?

RMC offers a variety of ways to improve your risk management skills including Rita Mulcahy’s Risk Management Tricks of the Trade for Project Managers eLearning course, Instructor-led virtual or book. You can also listen to our recorded webinar Five Tips for Easy Qualitative Risk Analysis and earn 1 free PDU.

Sources:

https://projectriskcoach.com/evaluating-risks-using-quantitative-risk-analysis/

https://www.mindtools.com/pages/article/newTMC_07.htm