Project Risk Management

Project Risk Management

"Risk is inherent to any activity. A project risk represents an uncertain event or condition that, if it occurs, could have an undesirable effect on a project objective. A project manager may accept or ignore risks depending on the possible consequences." (University of Phoenix, 2003)

The risk management process follows three steps: identification, analysis, response. "Risk identification is generally done as part of a feasibility study, at the beginning of the active project work, and at each new phase of a large project. The process of identification is assisted by use of risk factor tables that capture indicators of commonly encountered risks." (Texas DIR, 2000) Some project managers add a tracking and control step - a post-mortem of sorts.

The identified risks are then "analyzed to establish the project exposure for each risk and to determine which risk items are the most important ones to address. Risk exposure is defined as the product of the likelihood that the risk will occur and the magnitude of the consequences of its occurrence." (Texas DIR, 2000) By addressing the most significant risks items, the project should proceed smoothly with optimal success.

Robert Tusler (1996) quotes Larry Krantz, Chief Executive of Euro Log Ltd as saying that "A risk is a combination of constraint and uncertainty." Every project has constraints and uncertainty. The risk to the project can be minimized either by eliminating constraints or by identifying and reducing uncertainty.

Risk Identification

Some risks are inherent in every project some are very specific. Generic risks such as lack of money, people or time and natural and manmade disasters are risks to every project in existence. Other risks such as the availability of a certain raw material or the need for a person with specific expertise may affect only a small percentage of projects.

"Risks should be defined in two parts. The first is the cause of the situation (Vendor not meeting deadline, Business users not available, etc.). The second part is the impact (Budget will be exceeded, Milestones not achieved, etc.). Hence a risk might be defined as 'The vendor not meeting deadline will mean that budget will be exceeded'. If this format is used, it is easy to remove duplicates, and understand the risk." (Tubit, 2005)

Risk Assessment

One tool that can be used for risk assessment is a two dimensional risk matrix. The matrix can be constructed with probability on one axis and impact on the other and then the field can be divided into four quadrants as shown below. The larger the number, the larger the impact or probability.

"Note that if probability is high, and impact is low, it is a Medium risk. On the other hand if impact is high, and probability low, it is High priority. A remote chance of a catastrophe warrants more attention than a high chance of a hiccup." (Tubit, 2005)

Risk Response

There are typically four things that can be done about a risk. These strategies are: avoidance, transference, mitigation or acceptance.

When a project manager avoids