Key Risk Management Principles

A proactive management philosophy underlies the key principles of project risk management. By effectively managing project risks using these principles, a project manager remains in control of the project at all times, enables better project decisions, and provides the project the best opportunity for success.

The key principles to managing project risks include the following:

• It’s all risk management—All project management is risk management. The current approaches and rules of modern project management—especially those surrounding portfolio management, project definition, and project planning—are all risk management focused. From past experiences, we now know how to structure a project for total success and how to greatly increase the likelihood the project will achieve its objectives.

• “Healthy paranoia”—It’s all attitude, even if it is a little psycho. Effective project managers take responsibility for managing risks on their project—believe me, no one else wants the job. As a result, you must strike the balance between having a paranoid outlook about your project (constantly thinking about what could go wrong) and doing everything you can to make sure the project is executed as planned.

• Appropriate—The level, type, and visibility of risk management should be consistent with the level of risk and the importance the project has to the organization. The cost of the risk response should not be greater than the impact loss the risk event might cause.

• Systematic—Any factor or risk that could impact the project should be identified, quantified, and assessed for possible effects to the project. This includes all people, process, technology, organizational, and environmental influences.

• Continuous—The identification of risks is an iterative process. Risk identification is repeatedly performed throughout the project, not just at the beginning.

• Relentless—The project manager and the organization must be committed to risk management for the entire project life cycle.

• Focused—Focus on the risks that you can control—starting with the high-priority risks.

The Essential Process for Managing Project Risks

To be consistent with our principles, we need a systematic approach that enables us to focus time and resources on the highest priority risk elements. The power in the process is not in its complexity—it’s relatively simple and straightforward—the power is in the management approach it inspires.

Let’s review the essential steps for managing project risks:

• Identify—This is the critical step of identifying the risks to the project. The best way to start this process is also the best way to leverage the lessons from the past—use a risk profile. A risk profile, also referred to as a risk checklist or risk assessment form, lists the common sources of project risk that you need to consider. Although most risk profiles help you evaluate the majority of risk factors that are common to all projects, including the listing later in this chapter, the best risk profiles are ones that are specific to your industry, organization, and project type. In addition, the less experience that you have in project management or in the project domain, the more you should facilitate this process with the key stakeholders and subject matter experts on your project team.

• Determine probability—For each risk factor that has been identified, determine the likelihood that the risk event will occur. The goal is to quantify the uncertainty as much as possible, although in reality, this is still a judgment call. Common methods include numeric scales (1–5, 1–10) and subjective scales (High, Medium, Low).

• Assess impact—For each risk factor, determine the potential impact the risk event would have on the project critical success factors if it occurred. Like the probability element, the goal is to quantify the potential impact as much as possible. Generally, the same type of scale is used here, too. It is a good idea to document the specific impact (which critical success factor) and the magnitude of the impact.

• Prioritize—Now that we have a probability and an impact level, we tabulate a final ranking for each risk factor by combining the two values. If you have used numeric scales, this is straightforward; just multiply the two values together to get a final score. If you have used qualitative scales (L, M, H), you should be able to easily translate these to numeric values (1, 2, 3) to figure your final score. This step shows you the highest priority, most important risks, and the ones where you need to focus your initial efforts.

• Develop responses—Document a response plan for each risk using one of the five risk response options detailed later in this chapter. Planning efforts are iterative in nature because risk response strategies might entail the allocation of additional resources, tasks, time, and costs to the project plan.

• Get buy-in—Review the risk response strategies with the key stakeholders to increase their awareness, get their feedback (if you have not already), and get their acceptance of the planned approaches.

• Monitor—Don’t stop. Nothing stays the same. Continue to keep your eye on the risk factors—watch for triggers to activate other planned responses, be mindful of the appearance of new risk factors, and don’t totally forget about the low-level risks. Either via circumstances changing or initial miscalculations, you might find some of these have a higher probability of occurring (or higher impact) than originally perceived.

The Common Sources of Project Risk

The first key to managing risk on your project is to know where to look for it. The good news is that 80% or more of all risks originate from the same sources on every project. After you know the project characteristics that contribute to higher risk levels and the common sources of most project risks, you can quickly and effectively identify risk factors for any project. These factors should be first evaluated during project definition and are the main reason why several iterations of planning are often necessary. In Table 14.3, most of the key project risk factors are listed to better guide your risk identification activities. Note that many of these are emphasis points for project definition and detail project planning.

Although most sources of risk are inherent attributes of project initiatives or are outside the project manager’s control (as the preceding table summarized), there is another common source of project risks that is generally self-inflicted. These are the project risks we create by not performing adequate project definition or detail project planning.

For a complete listing and explanation of those factors, you can review Part II, “Project Planning.” For a quick review, Table 14.4 lists many of the key factors. Please note that some risk source categories are listed again in this table. This is intentional. In some areas, there are universal, inherent factors that contribute to project risk, and there are other risk factors that are introduced due to inadequate project planning. One example is the project schedule. Estimate assumptions not holding true and inadequate contingency buffer are inherent risks on any project. However, a poorly developed schedule is self-inflicted and a result of project planning deficiencies. Yet, it can be as devastating to your project critical success factors as anything.

Typical Problems

As with any project management process, there are always challenges and things for which you should be on the lookout. Let’s first review the four general problems that are typical with managing project risk:

• Undetected risks—These are the risks that will get you because you didn’t even see them coming. The most common reasons for this are project managers not having the proper risk management mindset, project team members not raising awareness of specific risk factors, and planning defects that are not detected.

• Unacknowledged risks—These occur in dysfunctional organizations or in immature project management organizations. For whatever reason, often political in nature, an obvious risk factor is not formally acknowledged and, as a result, not properly managed. This is the proverbial “elephant in the room.” A common example of this is an impossible schedule deadline.

• Not enough process—It is not uncommon to see this area of project management totally ignored, at least from a systematic standpoint.

• Too much process—On the other end of the spectrum, I have often seen gung-ho, analytical project managers overdo the risk management process. They can spend so much time on risk management that planning is never completed, or they get so focused on risks that they become overly cautious and won’t take any chances. Remember: project risk management is not about avoiding all risks.

In addition to the major problems typically found, a number of other smaller issues are common to the risk management process we discussed earlier. Table 14.5 summarizes those common gaps.

Powerful Risk Control Strategies

This section breaks out of the strict risk management process and considers some powerful strategies you should consider to either deal with the high-priority risks you now have or reduce the number of new risks from occurring as your project goes forward.

• Tackle high risks first—Develop a work plan that attacks your high-risk factors right out of the gate Why? If you are going to have a problem, it is best to know sooner than later. If something is not feasible or acceptable, determine this as soon as possible, so senior management can decide whether the project is worthy of organizational investment and resources.

• Use iterative, phased approaches—By breaking the work of the project into multiple iterations and phases, you provide a systematic method of providing tangible output to the stakeholders sooner and more often. The multiple points of review and feedback with the stakeholders enable you to better control your greatest risk—stakeholder expectations and satisfaction.

• Test it like you mean it—This strategy overlaps with quality management but is worth emphasizing here too. There’s no better way to avoid and reduce risks with a new work product than to use effective, prioritized testing. An effective test plan will identify defects before the final project work item is deployed to production or made available to the customer audience.

• Verify deployments—And for those in the IT software world, this strategy is focused on verifying the deployment of the project work product into a new environment. Often, this is referred to as a “smoke test” and is commonly used with IT services and resources. The project work item might have met all requirements, but if it is not deployed and set up correctly in the target environment, the customer will not be able to tell the difference.

• QA the planning process—This strategy has been mentioned before but is worth mentioning again: Be sure to do a quality review on the planning process. This step helps identify planning defects that, if undetected, will become unknown risks with a high-impact potential.

• Leverage independent QA audits—Leveraging an independent, experienced, and objective viewpoint can be a powerful way to identify risk factors and determine the best response strategies. This can be especially useful in project situations where the key stakeholders are inexperienced, the climate is very political, or multiple vendors are involved.

Are You Sure It’s a Risk?

Before we end our review of managing project risks, it is worth mentioning that one common problem associated with project risk management is terminology and the proper labeling of risks. This is more of an academic issue, and generally, the subtle differences are not key factors on projects. To make sure you avoid problems here, Table 14.6 quickly reviews the definition of terms closely related to project risk and clarifies those distinctions.

Figure 14.1 summarizes the main points reviewed in this chapter.