Last updated: 2022-03-16
In this sub-section about project risk management, we describe what is a risk and how we prepare a plan or strategy for managing risks.
The following diagram shows an overview of the process that consists of four generic steps. We go through these four steps in every risk management workshop.
Let's start with a definition of terms.
Our daily life language usually refers to risks as events that could have a negative impact. A closer look into the dictionary Longman, 1998, offers us: A risk is the possibility that something harmful or undesirable may happen. For our purposes, we adopt the definition also used in the insurance business. A risk is the probability that an event might occur which could have a negative impact. Such an event we call risk event.
Risk = probability (event with negative impact may happen).
(Similarly, we can define the term opportunity as the probability that an event might occur which could have a positive impact. Entrepreneurs of the gambling industry count on that as well.)
Risk management focuses on the question: What can we do about those events that might impact our project negatively?
We can prevent some of these events by taking actions which make the event impossible to happen. For most of them we can take actions that decrease their probability. Finally, for those we cannot prevent we can prepare actions that make it easier for us to deal with their impact.
The following form (there is a template in section Free Downloads) reflects this in a more detailed way.
Following the process, we start with step 1, identifying risks, i.e. identifying as many risk events as possible, usually in a brainstorming session. The result is a list of such events. In step 2, evaluation of risks or risk analysis, we estimate probability (in %) and impact (in $) of each event. By multiplying these figures we obtain the expected value of risk, or just risk value. Risks with high risk value will be high on our priority list. Another way of showing the different priorities of risks is by arranging them in the probability-impact-diagram. Mathematically spoken, the risk value is the statistically expected value of impact or damage that risk event could cause.
It is common practice to include those risks with either very high probability or very high impact into the top priority risks, even if their risk values are low.
Step 3 focuses on identifying preventive or corrective actions, again in brainstorming sessions, and by referring to lessons learned from earlier projects. In step 4, evaluation of actions and residual risks, we estimate the cost of each action. For most events, we cannot reduce the probability of its occurrence down to 0 %. After taking preventive action, we usually end up with a residual probability which, of course, is lower than the original one. If we now multiply residual probability with the impact we obtain the residual risk value. By adding the cost of action we get the expected value of action.
By comparing risk value with the expected value of action we can decide if we want to take the action, i.e. integrate it into the WBS or not.
The decision to prepare for corrective actions depends on the company’s or organization’s accounting principles: it is good practice to include them in the project contingency.
As we proceed through the planning phase, and later through the implementation and closure phase, we repeat these risk management workshops periodically since new risk events can come into our view which we should not miss.
To save you time in your daily work as a project manager, I packaged more than 35 project management templates, tools, and checklists into one zip file.
Return to Planning Phase
Return from Project Risk Management to Home
Your CommentsHave your say about what you just read! Leave me a comment in the box below.