Project Risk Management

Risk:

A risk is an uncertain event or condition that, if it occurs, has a positive or negative effect on project objectives. A risk also has a cause and a consequence e.g. a cause may be a change in scope requirements and in the event that the product has to be redesigned, this uncertainty will impact the cost, schedule, and quality of the project.

The key objective of project risk management:

Risk Management is a proactive attempt to recognise and manage internal events and external threats that affect the likelihood of a project’s success. It identifies as many risk events as possible (risk event), minimises the risk event’s impact (consequences), looks at what can be done before an event occurs (anticipation), manages responses to those events that do materialize (contingency plans) and provides contingency funds to cover those risk events. Figure 1 represents a risk event graph. Risk management can mean different things on different types of projects e.g. for large-scale projects, risk management strategies might include extensive detailed planning for each risk to ensure mitigation strategies are in place if issues arise however for smaller projects, risk management might mean a simple, prioritised list of high, medium and low priority risks.

Figure 1

Risk management process:

There are 4 key elements of a risk management process:

1.    Risk Identification

2.    Risk Assessment

3.    Risk Response Development

4.    Risk Response Control

Risk Identification:

This process begins by generate a list of possible risks that could affect the project through brainstorming, problem identification and risk profiling. It is vital to focus on events that could produce consequences rather than the objectives e.g. team members may identify failing to meet schedule as a major risk but what they need to focus on are the events that could cause this to happen i.e. poor estimates, adverse weather, shipping delays, etc. The focus at the beginning should be on risks that can affect the whole project as opposed to a specific section of the project or network.

Risk Assessment:

After the risks have been identified in step 1, managers have to develop methods or techniques for sifting through the list of risks, eliminating inconsequential or redundant ones and stratifying worthy ones in terms of importance and need for attention. Examples of these techniques are presented in the table below.

Risk Response Development:

When a risk event is identified and assessed, a decision must be made concerning which response is appropriate for the specific event. Responses to risk can be classified as:

· Mitigating – Reducing the likelihood an adverse event will occur or reducing impact of adverse event

· Avoiding – Changing the project plan to eliminate the risk or condition

· Transferring – Paying a premium to pass the risk to another party

· Sharing – Allocating risk to different parties

· Retaining – Making a conscious decision to accept the risk

Risk Response Control:

Risk control involves executing the risk response strategy, monitoring triggering events, initiating contingency plans and watching for new risks. Establishing a change management system to deal with events that require formal changes in the scope, budget, and/or schedule of the project is an essential element of risk control. It is vital that project managers establish an environment in which participants feel comfortable raising concerns and admitting mistakes as well as organising and carrying out repeating risk identification and assessment exercises. A second key for controlling the cost of risks is assigning and documenting responsibility for managing risk.

Risk management & change management process:
A major element of the risk control process is change management. Change management and risk management have an interrelated relationship. A change management system involves reporting, controlling and recording changes to the project baseline. It is crucial that the two process work hand in hand to be prepared and to provide solutions to risk events that may arise.