Risk management – part 2 - General approach
Identify the risks and cost the process
Typical areas where risk will require assessment are:
- Project based (resources, deliverables, outcomes, implementation, overall programme)
- Health and safety
- Environmental effects
- Property
- Business / commercial / financial
- Data
- Security
- Legal
Assess the chances of occurrence
Identifying risk is all about trying to address areas of uncertainty that may affect the project (or just a task) outcome.
Uncertainty can express itself in varying ways, for example, range of costs, durations, differing pathways dependant on the outcome of certain assumptions and results.
Assess the impact on the project / organization
In its simplest form, major risk areas are identified and consideration is given to minimising their impact.
A risk may be low and acceptable, it may be high and require the preparation of contingency plans.
Risk management will have additional benefits apart from minimising potential impacts.
Without good risk management procedures a project is less likely to succeed.
Hence, confidence in project success will lead to enhanced team performance.
Under PRINCE2® 2009 the aim is to support better decision making through a good understanding of risks – their causes, likelihood, impact, timing, and the choice of responses to them.
Without an ongoing and effective risk management procedure it is not possible to give confidence that the project is able to meet its objectives and therefore whether it is worthwhile for it to continue.
Hence effective risk management is a prerequisite of the continued business justification principle.
[see Risk - Purpose]
Identify measures for their prevention
Identifying options to pursue may result from a simple brainstorm technique.
A list of options could result which would then require prioritisation.
Contingency plans to reduce their effect
Typically budgets may be inflated (say 10%) to take account of the perceived risk … but how do we know this is high enough? It is often not a good idea to use this method as it has a tendency to over-inflate estimates and costs.
Preparing contingency plans can take a long time to prepare and may still be fallible.
These are prepared for predicted risks and are implemented when a trigger action occurs.
If a risk occurs and there is no satisfactory action to reduce its effect you may need to reduce the scope of the product concerned.
This presumes that the effect leads to a quality aspect exceeding specification.
The project team and stakeholders may agree to alter the scope of the project or the specification of the product.
All of this requires careful consideration by the project management team.
Record risks, assessment method and actions in the Project Notebook
Whatever risks are assessed they should be recorded, together with the method of assessment and the corresponding actions, together with the individual responsible for the action, in the Project Notebook.
Previously, under PRINCE2 2005, risks were recorded in the Risk Log.
[see Managing Stage Boundaries (SB) - part 5 - Updating the Risk Log (SB4)]
Under PRINCE2 2009 [see ‘The Complete Project Management plus PRINCE2’] risks are recorded in the Risk Register.
[see Risk - The PRINCE2 approach - Risk Register]
Review at intervals
The process of risk assessment should be reviewed with regard to future improvements.
Review the risks at regular intervals (e.g. at key milestones) and if necessary start the risk assessment from scratch.
Don’t forget to include the management cost of carrying out the risk assessment in the plan.
It is possible, with more up front effort, to use a statistical approach to better evaluate the effect of a range of costs and durations for major activities leading to a superior assessment of the overall risk to the project of total cost and end dates.
This requires a specialist approach and suitable software.
This is discussed further in 'The Complete Risk Management package'.
PRINCE2® is a Registered Trade Mark of the Office of Government Commerce in the United Kingdom and other countries.