What if you don't know all the risks?

Often in an initiative, there is some uncertainty of the likelihood of any specific risk occurring and what the exact impact would be. The role of the business analyst is to work with stakeholders in relation to any identified risks and aim to elicit as much information as possible about the risk, its likelihood, and the potential impact. Even if this proves challenging, it is still worth documenting as much information as possible about the risks and to prepare a plan to mitigate or manage the risks should they occur.

Let's look at a real-world example. Let's consider the risks associated with a point-of-sale device upgrade project. Within a retail organization, there is a requirement to upgrade to new point-of-sale devices. The new devices will be supplied by a different manufacturer than the current devices.

As a business analyst, you identify some risks relating to the data integration and device communication aspects. You also realize that there might be other risks that you are not able to define yet that may occur or become known once the new devices have been installed and are functioning. This leads you to recommend a risk mitigation strategy, which is to do some testing on the new devices before rolling out all devices to the retail outlets.