It’s difficult to persuade executives to invest time and money on risk management to avoid or limit risks. They prefer “being ready to react” when bad stuff happens. They think that is cheaper than spending money on what they often see as a bureaucratic process with pointless meetings and lots of paperwork. So their decision is to “keep our eyes open for trouble.” They don’t want to waste money, and possibly delay the project’s start, by identifying and planning for risks. This is a poor decision. Even a small amount of risk management, as little as one hour, can have a significant payback if it allows you to avoid one or two problems.
Project managers need to make the case that even a small amount of time on Risk Management, like a lunch meeting with the right people, can repay the investment by avoiding problems. The best way to make this point is to discuss some recent project failures. You can cite the problems that brought those projects down and explain how a bit of risk management, response planning and early problem solving might have saved the day. Risk Management Plan
Risk Management for Different Size Projects
After you gain approval for a Risk Management effort, you need to move ahead carefully with a bare bones approach. In the beginning, you need to build your credibility and that of risk management with a handsome return for the risk investment. You also need to use the correct set of risk management techniques to fit the size and scale of each project. One size does not fit all. You need to tailor your approach so it fits the project and yields a high return on the investment.
Watch this video on risk identification.
There are five components in the full Risk Management process. But you will rarely use all of them.
- Risk identification – identify those positive and negative risks that might affect the project
- Qualitative risk analysis – fast, low-cost risk evaluation with no research or data gathering
- Quantitative risk analysis – slower, expensive research into the risk’s probability and impact
- Risk response planning – ways to mitigate, avoid or eliminate the risk’s effect. Risk Strategy
- Risk monitoring & control – monitoring so you can launch a risk response when needed.
You must control how much time and money you spend in each of these steps. Depending on the project, you may entirely skip one or two of the steps to cut the time and cost. You will do the less expensive qualitative risk analysis on most projects. On a small project, you can invest as little as an hour in total on risk identification, qualitative risk analysis and risk response planning. You will spend only what it cost to buy coffee for the group. But on some projects, your qualitative risk analysis might deserve 6 hours of work and include getting ideas and data from a dozen stakeholders. On larger projects with massive risks, you may do all five of the steps and spend weeks or months and thousands of dollars.
Risk Management: Examples of Three Plans
Let’s look at some Risk Management examples and see how you might use them for three different size projects:
- A project done within a department where the PM and team all report to the project sponsor
- A cross-functional project that affects several departments in an organization
- A strategic initiative that affects all areas in a large organization
Project #1: Risk Management for a Small Project
In assessing the situation, you remember the boss made a big point about starting fast and avoiding a lot of project management paperwork and unnecessary meetings. So you decide to use a very small risk management process. When you finish the discussion about the project scope, you ask the boss, “What are the major risks you think we face in delivering that scope?” The boss gives you three examples of risks that had damaged similar project efforts. Then you ask, “What do you think we can do on this project to avoid having our efforts hurt by the same kinds of risks?” The boss suggests that you avoid the problems with inter-department cooperation by involving the other departments early in the effort. He also points out that you can avoid delays resulting from people not coming to meetings by letting people attend by video conference. Finally, the boss suggests that you record the video conferences (after letting everyone know you’re doing it) and send the video to the people who couldn’t attend the meeting. You thank the boss without explaining that the two of you have just completed risk identification, qualitative risk analysis and risk response planning. All you say is that you will add those elements to the project plan and schedule.
In this example of a small project, you asked a couple of open-ended questions to tap into the boss’s experience. You completed a very small Risk Management process. The project plan will now include risk responses and risk mitigations that may help this project avoid some known risks. Project Risk Management
Project #2: Risk Management for a Cross-functional Project
This somewhat larger project involves stakeholders from several departments in the organization. Many of them may also be project team members. In a meeting with all the identified project stakeholders and team members, you describe the scope of the project and the major deliverables. Then you ask the people to think about risks that could affect each deliverable. Your project charter has five high-level deliverables and you focus the discussion on each of those. You limit the discussion to identifying the risks and their ideas about those risks. You ask them to hold off on defining the kind of risk response they think is appropriate. You also discourage people from criticizing any of the suggestions or evaluating their likelihood. In qualitative risk analysis, you want the group to come up with a list that’s as long as possible.
With your list of identified risks, you’re ready to begin qualitative risk analysis. You will assemble your group and focus on screening the risks using relatively quick and inexpensive qualitative techniques. You want to rank the risks in terms of their likelihood and potential impact on the project. You use qualitative risk analysis as the only analysis to support risk response planning. The project’s scale does not justify the time and cost of quantitative analysis. Neither the boss nor the team members have any experience in Risk Management so they will subjectively rate the impact and likelihood values for your risk and impact analysis.
After they have completed their task, you have a list of 14 potential risks. You then say, “Here’s a form we’ll use to get everyone’s assessment of the risks we face on the project. We want to describe each risk in terms of two separate dimensions:
- The probability or likelihood of the risk event occurring
- The impact it will have on the project’s costs or finish date or both, if it occurs.
We’ll use a simple scale of 1 to 6 with three choices for likelihood and for impact. Low – meaning very unlikely to occur or a small impact. High – meaning very likely to occur and a large impact. And Medium – meaning between those two extremes.”
Figure 1 – Risk Management Qualitative Risk Scores from Team Members
You get ratings from the team members: 1=Low 6=High. Then you enter them in the form and have the qualitative risk analysis results below. Using this data, you would select a risk response.
|1. Risk event||2. Likelihood||3. Impact||4. Risk Response|
Type of Response
|Turnover among engineers is over 20%||
|Transfer, Mitigate, Avoid 0r Accept with Contingency|
Figure 2 – P/I Results for Three Risks
|Magnitude Low Medium HighProbability|
|Medium||Don’t use new procedure|
|Trouble Reports increase|
Then you say, “We all seem to agree that while we have several risks, only one risk has both a high probability and a high magnitude and that’s the risk of engineer turnover.
The boss says, “I thought this risk stuff would be a waste of time but I’m already thinking of things we can do to reduce engineer turnover. That is a surprise I wouldn’t want to hear about right before the end of the project.”
For this department project, you engaged the sponsor and the team in risk identification and qualitative analysis. Now you’re ready to move on to risk response planning. The aim of risk management is to take action by forming risk responses before the risks do any harm to the project. It doesn’t require fancy risk management techniques, just an effective process.
Project #3: Risk Management for a Strategic Project for a Larger Organization
- The project risk management plan calls for using qualitative risk analysis as a screening tool to select the risks that you will put through quantitative analysis. You anticipate analyzing a dozen or more risks with quantitative analysis.
- Three committees will do qualitative risk assessment. Each one is focusing on a particular market segment the company serves.
- The risk steering committee will make a final decision about which risks go on to quantitative analysis. That committee includes the sponsor, senior VPs and you, the project manager.
You distribute the project risk management qualitative risk assessment form to the three risk committees. Since the team members are familiar with estimating probabilities and magnitudes, you use a 1-10 scale for the estimates.
Then you give the committee leaders their project risk management instructions, “Here’s what we’re going to do here. Each person will make an independent judgment about the probability of each of our risk events occurring and the impact on the project if they do. We’ll use a scale of 1 to 10 for each assessment. So if a risk event is very likely to occur, you should give it a 9 or even a 10. For a risk event that is very unlikely, give it a score of 1 or 2. When you come to the impact decision, forget the probability of the risk event occurring. Simply assess how big an impact it will have. If its impact will bury the project and do us irreparable harm, you should score it a 10. If a risk event has minimal impact on the project, score it a 1 or 2.”
One team member asks, “Aren’t we going to discuss each risk first?”
You answer, “No, I think it’s best if each person gives their assessment without being influenced by the others. Remember that we have people whose immediate superior is on this committee. If people share their opinions before we each score the risks, the managers’ opinion may count too heavily. I want everyone to make their own judgment without knowing what the managers think. We may get better information with independent judgments and avoid some of the politics. For that same reason, we’ll keep the ballots anonymous. You’ll notice there is no place to fill in your name.”
A few days later, you tabulate the data from the completed forms into a spreadsheet designed for this purpose. The result is a table of data values and a graph for each committee. You take the risk management data and the recommendations from each committee to the risk management committee. That committee includes the sponsor and an executive vice president. You select one or two risks from each committee’s qualitative analysis and recommend conducting a quantitative analysis.
Because three of the risks have probabilities and impacts above eight, the committee decides that all three need quantitative analysis. They are particularly concerned about the risk of customers not using the new trouble report procedure. They ask you exactly what they will get from this quantitative analysis.
You say, “We will start with an influence diagram we developed during risk identification. Then we’ll gather some opinions from industry experts and build a decision network to analyze where we can have our biggest influence in avoiding that risk.”
As the quantitative analysis proceeds, you and the other members sketch out ideas for mitigating, avoiding or transferring these risk to other organizations. You will apply those strategies when the quantitative data is ready. You will have an expected value for each risk which will tell you the time and cost you can justify to avoid that risk. Risk Management Plan Presentation
Risk Management Summary
You can do a worthwhile risk analysis for a small project in a matter of minutes. You’ll invest more time and use more advanced techniques, like qualitative and quantitative risk analysis, for projects with greater scale and significance.
You can learn how to manage risks in our advanced project management courses. You’ll work privately and individually online with an expert project manager. You control the schedule and pace and have as many phone calls and live video conferences as you wish. Take a look at the course in your specialty.IT Projects Business Construction Healthcare Consulting