Project Risk Management

Improving the Management of Project Risk

All real projects carry risk through uncertainty. However, few organisations would claim to be satisfied with the application of risk management on their projects, or be able to demonstrate it successfully. This can be a major constraint to successful project delivery.

Improving project risk management involves two principal objectives:

• improving the ability to identify and influence risk while we still have opportunity in the project lifecycle to do so, and
• embedding the management of risk into the mainstream of delivering projects.

The reality of Projects and risk

(Context: for the purposes of this discussion, the term project refers to a project of significant size, complexity and/ or challenge.)

All projects carry risk, i.e. uncertainty. The most obvious examples of sources of project risk comes from:

• dependencies (internal or external)
• assumptions made by project team members (in relation to any aspect of the project).

At the start of all projects, the potential impact of risk (in cost and / or schedule terms) is almost unlimited. The simple choice is to either dedicate proper and timely attention to understanding and managing risk, or suffer its consequences (impacts) downstream. Historically, it could be said though, that organisations have not always been proactive at managing project risk - it is not even uncommon to hear project managers say "I've not had time to to look at risk as I'm too busy developing the project plan".

On larger projects, there are few areas where a disciplined project manager can have a greater positive impact on a project than the area of risk.

From a corporate perspective, all key projects should be challenged (through governance) to demonstrate a disciplined approach to the management of risk and that their project's exposure to risk is similarly reducing in a disciplined way, in particular through the early stages of the project lifecycle.

Improving Risk Identification and Capture

Few project teams have comprehensive risk management plans, or a clear account of the risks that face their projects. This is partly cultural, partly ‘mechanical'. Both can be addressed.

Improving the management of risk involves improving a project's ability to identify risks early, via productive methods linked to the project's strategic decision-making lifecycle, along with effective methods of presenting and using this data.

Many risk databases hold poor quality, partially complete or limited data. Often this results in a limited understanding of project risk and little attention or resource being dedicated to the management of risk. It also makes risk data of lesser use to others (e.g. stakeholders), and can foster a false sense of security relating to the delivery of a project.

It is imperative and to employ innovative and effective methods to:

• significantly improve the identification of risk and the capture and presentation of risk data
• integrate risk management into the definition of the project, and
• improve the quality of risk management information substantially and its communication to others.

Improving the Assessment and Understanding of Risk

In all the literature on risk, much has been written on modelling its impact (e.g. statistical analysis). This has its place and value when major project decisions are being taken, however, many organsaitions believe that far greater benefit is achieved by ensuring that mitigation activities are carried out with discipline in a timely manner (relative to the schedule) on projects.

As a minimum, all risks should be assessed to decide:

• the probability of its occurrence (against a relatively simple scale expressing the likelihood of occurrence, e.g. low / medium or high)
• the impact of the risk should it occur (again either in simple overall terms, or perhaps impact on schedule, budget or quality)

When presenting risk data to stakeholders and decision makers it is often very productive to include the impact of the risk, especially when engaged in decision making around committing to mitigation strategies or fall-back plans.

Improving the Management of Individual Risks

The strategies and actions to manage risks that pose a real threat to a project must be built into the baseline project plan, from the outset. Risk mitigation must never be treated outside the mainstream project management processes, yet in many projects today, this is exactly how it occurs.

Teams need to understand the difference between mitigation and contingency planning, and when each needs to be applied:

• Mitigation strategies are proactive actions that reduce either: a) the probability of a risk occurring or b) the impact of the risk if it still does.
• Fall back (also called contingency) plans are the alternative plans that will be executed if the occurrence of a risk gives rise to the need.

Moreover, teams also need to know how to integrate risk management data with the mainstream technical, management and performance measurement processes (e.g. Earned Value Management).

Once a project starts to approach the task in this way, risk management can turn into a controlled, productive process that systematically reduces project risk, thereby enabling projects minimise its impact on the project.

Managing the Overall Process

As with any process, project risk management must itself be controlled. There should be periodic reviews and events scheduled into the mainstream project plan to address risk. These reviews must be managed with enormous discipline, as they are not brainstorming or analysis sessions - they should review the status of risk mitigation strategies, and assign actions as appropriate.

In addition, there are simple but very powerful metrics that can be employed, at the project and business levels, to monitor the application of the risk management process and the status of health of projects.

Improving Opportunity Management

While projects need to manage risks, they will similarly have opportunities, which in many way are the exact opposite of risk. Many organisations now use the same core process for managing both together, where opportunities have a positive impact on the project. There can be some merits to this, perhaps the most important of which is to raise the focus on opportunity management and to offer a realistic balance to the overall picture during significant project decisions.

today to find out more on how we can help you improve Risk Management.