Project Risk Management

Many projects, regardless of size or subject matter, tend to have some level of risk. Risks can include anything that may threaten the goals, objectives or deliverables of a project, making risk management a critical component of effective project management. Risk management can be so critical to project success that the Project Management Institute (PMI) listed it as one of the nine core competencies, or knowledge areas, of project management. PMI has placed such a high level of importance on risk management that it now offers a specialized certification in project risk management.

Risk management is defined by the PMI’s A Guide to the Project Management Body of Knowledge (PMBOK^® Guide) as the process of deciding how to approach, plan and execute risk management activities for a project. Project risk management includes proactively identifying, analyzing and planning for anticipated risks, as well as monitoring and controlling risks that materialize during the course of the project. Because risks have the inherent capacity to derail or destroy a project, those who can effectively anticipate and manage project risk are typically in high demand. These project managers are more likely to deliver their project on time and within budget and scope.

Identify Risks Early

The first step to effectively managing risk is to identify anticipated threats as early in the project as possible. To do this, managers and their team members can use their personal experience to try to forecast future events. Brainstorming sessions can also be helpful. Reviewing the documentation for other similar completed projects can also be a goldmine of information. Depending on who produced the documentation, risks may not always be labeled clearly as such, but a careful read is usually all it takes to find them.

Project teams can also interview experts outside of the team that have experience with the same type of project or work. Experts may be able to help shed light on potential risks that the project team can prepare for. Regardless of how thorough the team is, it’s unlikely that it will be able to identify every risk. But by identifying the majority of risks, the project team may have more time and resources to successfully handle unexpected problems that may arise.

Communicate the Risks

The lack of proper risk communication is often found in unsuccessful projects. Risk communication includes project team members informing the project manager of a potential issue and the project manager notifying the sponsor or client of the same. Project managers should include discussions of risk at team meetings and allow enough opportunity for team members to share any concerns they might have. They should also create additional one-on-one opportunities for team members to report any concerns. In turn, project managers should make sure to thoroughly document risks and report them to the client(s) and stakeholders. Often, risk mitigation exceeds the decision-making authority of the project manager and requires the input of those who are higher up.

Hold People Accountable

Once the team generates the list of risks, it’s up to the project manager to identify who will be responsible for monitoring and addressing each risk. By giving people ownership over certain risks, it can help motivate them to decrease the potential risk and seek opportunities to bypass the risk entirely. Unfortunately, despite the most thorough planning and practice, risks sometimes come to fruition and it’s important to know who is responsible for rectifying things or bearing the cost of the risk. This is particularly important for projects that involve large expenses or revenues, multiple departments or outside parties.

Analyze, Prioritize and Mitigate Risks

Not all risks are created equal, as certain risks have varying levels of impact on the project. Some impact the level of success while others can impact the project’s very survival. Project managers should prioritize risks based on impact and likelihood, putting those with the greatest impact and probability at the top of the list.

Once the project manager has prioritized risks, the next step is to develop mitigation plans. Plans can include avoidance, minimization and acceptance. Avoidance is theoretically the less problematic option, but minimization is often the most common. In most cases, acceptance is the choice for low-priority risks or for risks in which the cost or effect to mitigate it outweigh the benefits.

Risk Management Can be Critical to Company Operations

Projects can serve as effective examples of how risk can adversely affect the course and outcome of a work team. Risk can have a similar impact on an organization as a whole. The same processes and practices that effective project managers use to manage project risk can be applied to company operations as well. By anticipating, communicating, analyzing and prioritizing risk at the organizational level, companies can mitigate risks and avoid facing the negative consequences of unidentified or unaddressed risk.

PMBOK is a registered mark of the Project Management Institute, Inc.