Risk

• Purpose
• Risk defined
  • What is a risk?
  • What is at risk?
  • What is risk management?
• Management of Risk
  • M_o_R_principles
• Risk management in projects
• Risk Management Strategy
• Risk Register
• Risk management procedure
  • Overview
  • Identify part 1
  • Identify part 2
  • Assess
  • Plan
  • Implement
  • Communicate
• Risk budget
• Responsibilities

Key sections

• Introduction
• Business case
• Organization
• Quality
• Plans
• Risk
• Change
• Progress
• Introduction to processes
• Starting up a projectDirecting a project
• Initiating a project
• Controlling a stage
• Managing Product Delivery
• Managing a Stage Boundary
• Closing a Project
• Tailoring PRINCE2 to the project environment
• Directing Projects with PRINCE2

The PRINCE2® approach

Risk management procedure

© Crown copyright 2005 Reproduced under licence from OGC

Identify – part 2

An effective way of identifying risks is to use a risk workshop.
This is a group session designed to identify threats and opportunities.
The session should be facilitated by someone who is able to use a range of identification techniques, such as those listed in the ‘Risk identification techniques’ example below.

Workshops should lead to the identification of a broad range of risks and possible risk owners.

Risks can be identified using a number of techniques, such as:

Review lessons

Risks are driven by uncertainty, so one of the most effective ways to reduce uncertainty is to review similar previous projects to see what threats and opportunities affected them.

Risk checklists

These are in-house lists of risks that have either been identified or have occurred on previous similar projects.
Risk checklists are useful aids to ensure that risks identified on previous projects are not overlooked.

Risk prompt lists

These are publicly available lists that categorize risks into types or areas and are normally relevant to a wide range of projects.
Risk prompt lists are useful aids to help stimulate thinking about sources of risk in the widest context.

Brainstorming

This enables group thinking, which can be more productive than individual thinking.
However, it is important to avoid criticism during the brainstorm as this can stop people contributing.
In addition to identifying risks, brainstorming can also be used to understand the stakeholders’ views of the risks identified.

Risk breakdown structure

This is a hierarchical decomposition of the project environment assembled to illustrate potential sources of risk.
Each descending level represents an increasingly detailed definition of sources of risk to the project.
The structure acts as a prompt and an aid to support the project management team in thinking through the potential sources of risk to the objectives.
There are numerous ways to break down risk and it may be useful to do more than one list.
For example, a risk breakdown structure could be broken down by PESTLE (political, economical, sociological, technological, legal/legislative, environmental), product breakdown structure, stage, benefits/objectives etc.

The diagram shows a risk breakdown structure relating to financial risk.
These structures will help to identify appropriate risk owners to develop responses.

An important aspect of identifying risks is being able to provide a clear and unambiguous expression of each one.

A useful way of expressing risk is to consider the following aspects of each risk:

Risk cause

This should describe the source of the risk, i.e. the event or situation that gives rise to the risk. These are often referred to as risk drivers. They are not risks in themselves, but the potential trigger points for risk. These may be either internal or external to the project

Risk event

This should describe the area of uncertainty in terms of the threat or the opportunity

Risk effect

This should describe the impact(s) that the risk would have on the project objectives should the risk materialize.
The cause, event and effect relationship is shown in the diagram.

The cause, event and effect relationship could also be expressed in a sentence, for example:

Threat

Because it has been raining heavily (risk cause), there is a threat that the river flowing through the farmer’s field might overflow (risk event), which would severely damage the farmer’s crop (risk effect)

Opportunity

Because the weather has been particularly mild this winter (risk cause), there is an opportunity that fewer people will be hospitalized with influenza (risk event), which will mean that there will be less disruption to planned routine operations (risk effect).

Risk management is a large area and is covered in depth in ‘The Complete Risk Management package’.

PRINCE2® is a Registered Trade Mark of the Office of Government Commerce in the United Kingdom and other countries.