Risk Management
Risk is unknown, that's why it's so risky. For the project manager and the project team, risk should be constantly reviewed and changes made to avoid unwanted risk in the project. One of the tools of a project manager is the risk assessment. By performing a risk assessment, the project team can work to identify potential risks early on and develop a strategy to deal with the risk. Click here for an example of a Risk Analysis template. |
| Risk Analysis | Header Information |
| Number Column | Risk |
| Risk Level | Currently Assigned |
| Risk Strategy | Risk Plan |
|
A risk, as defined by the Project Management Body of Knowledge, Third Edition, is "an uncertain event or condition that, if it occurs, has a positive or negative effect on a project's objectives" (PMBOK Guide Third edition, Glossary pg. 373). While there is risk inherent with any project, the project manager and project team should be constantly aware of any risks that will impact the successful completion of any project. Once way to accomplish this is by completing a risk analysis for any identified risk and to review risks periodically with the team. Risk analysis is one way that the project team can identify potential problems or opportunities early so that a strategy can be developed should the event occur. A strategy does not to be completed for every indented risk, however the project team should make a decision on the level of risk that the project will support and develop a plan for every risk above that level. For instance, a project team may say that for it's project, any risk that has a medium or high impact, a risk assessment will be completed. During the risk analysis a risk plan will be developed with alternatives if the risk occurs. Most people associate risks with an event that the project team does not want to occur with the project. There are, however,some risks that, if they occur, could have a positive outcome. These risks are called opportunities. Identification of these opportunities should also be included as part of the risk assessment and potential benefit identified. |
|
At the top of the spreadsheet you will see some basic information that you will need to provide about the project. This includes the project name, project manager and revision date. The revision date should be updated every time that there is a change to the spreadsheet. There is no need to save previous copies, as all information will be retained on the avoided page. Once a risk is avoided it is simply moved to the closed page for historical reference. |
|
While the number column may seem unimportant, it is actually very important in remaining on track. The number column should increment by one each time an new risk is added to the log. If there are gaps in the numbers, this will serve as a reminder that the risk has passed or been mitigated so that it is no longer a risk. The closed item should be moved to the second page of the spreadsheet on the closed risk list. |
|
This column should include a detail description of the identified risk. If the risk arose from an identified issue, then the issue number should be included as part of the description. Be sure to include any date that may be a risk factor. The rule of thumb should be that the more information that can be provided, the better the planning that can be completed. |
|
In determining a risk's impact to the project, there are two items to consider:
The Georgia State University PMO uses a three by three grid to identify a risk based on these two dimensions. Along one axis includes the impact while the other axis deals with likeliness. This represents a graphical view of the risk that is easily seen by the project team members.
While a project team may not need to complete a risk assessment on any risk that falls into one of the three lightest shaded boxes, the team should still review them to make sure that the risk does not escalate. |
|
Every risk should be assigned to an owner who will track and report on the risk. This person will be responsible for following up and tracking the risk. The person assigned should be able to understand the risk and be able to make a recommendation to the project team on the response. The owner of the risk may change over the course of the project. That is the reason for the currently assigned title. If a risk is changed so that it now affects a new group, make sure that the currently assigned column is updated with the new team member. |
|
Once a risk has been identified, then there are several strategy options that the project team can take. The Georgia State University PMO has identified three strategies to deal with negative risks and three to deal with opportunities and one that will work with either type. The are:
|
|
The risk plan is where the project team needs to identify the specific steps that will be taken to deal with the risk. This will include an elaboration of the strategy and how the team plans to implement the plan. If necessary, additional tasks will need to be added to the project plan and noted. If the plan is very lengthy, then the project manager may want to create a separate report outlining the risk in detail and the purposed solution. |
The project team will need to identify the threshold of risk that is is willing to take. Anything above this level, the team will establish a full risk plan for the event. For example, using the grid to the left, a project team may identify that any risk that has a medium or high impact AND a likely or very likely probability, will have a risk assessment completed. This means that if the red dot is in any of the darker six shaded boxes that a risk assessment will be completed.