Risk Management Processes

Managing risks in project is imperative for its success. We need to have a process (or processes) in place for risk management to be effective. Here are the five steps project manager can use for risk management:

1. Identify Risks – Identify risks that affect the project (positively or negatively) and documenting their characteristics

2. Assess & Analyze Risks - Assess the risk impact, Analyze the probability of risk occurrence and prioritize the risks, numerically analyze the effect of identified risks on project objectives (usually on cost, schedule and scope targets)

3. Plan Actions – Explore all the possible ways to reduce the impact of threats (or exploit opportunities). Plan actions to eliminate the risks (or enhance the opportunities). Action plans should be appropriate, cost effective and realistic.

4. Monitor & Implement the Action – Track the risks throughout the project. If risks occur then implement the risk strategy based on action plan. Ex. If mitigation strategy is selected, execute the contingency plan based on risk triggers. In case contingency plan fails, execute fallback plan.

5. Measure the effectiveness & Control the risk impact - Measure the effectiveness of the planned action and controlling the risk impact by understanding risk triggers & timely implementation of planned actions.

Risk management processes are cyclic which starts from identification of a risk and it may result in identification of another new risk.

Usually, each individual have different opinions & ways to deal with risks. Some go for avoidance. Others go with risk taking. So, while working for a project, the approach to risk should be consistent to meet project objectives & this need to be documented in a risk management plan. Communication of risk and its approach to be done to risk team member/risk owners/stakeholders.

What are different Risk Reserves?

We can divide risks into following three broad category based on their identification & response planning:

1. Known – Responded (with avoidance, mitigation, transference)

2. Known – Not responded (or accepted)

3. Unknown (here also default strategy is acceptance)

Eliminating maximum number of risks is the main objective. But not all can be eliminated or responses would be too costly or time consuming and hence the risks are accepted.

In case of transference – project cost need to include the insurance amount

In case of mitigation – project cost and schedule need to consider the extra effort to execute contingency plan and subsequent fallback plan in case of contingency failure.

So even implementing planned responses increases cost and schedule of the project to execute the activities. These are not extra. They are inherent to the project based on the risk responses and it should not omitted during planning phase. These added cost and schedule due to risks are called ‘Reserve‘.

There are two types of reserves.

Contingency reserve is needed to tackle residual risks or “Known – Unknowns”. Risks that are identified but they are accepted.

Management reserve handles the “Unknown” risks. Those risks that are not identified as part of risk management process are “Unknown” risks. We don’t know what the risk is and we don’t have any response plan for them. They falls under ‘accepted’ risks.

Project manager has to take these into consideration in project schedule & budget plans. General representation of the project total budget & total schedule is:

Project’s Total Budget = Sum(Project’s Activity Cost) + Contingency Reserve + Management Reserve

Project’s Total Schedule = Critical path duration + Contingency Reserve + Management Reserve

Risk Response Planning Strategies

General risk response strategies.

Risk Response for Negative Risks:

Avoidance: “I want to eradicate the risk by eliminating its cause” strategy. In this either the risk eliminated by different means or by changing the project plan. Hence probability of risk becomes zero which will improve safety to project success. This is the best possible strategy. But it is not possible to follow avoidance all the time. Example for avoidance: House construction during summer instead of rainy season.

Transference: “In case of risk occurrence, third party will bear the impact” strategy. This one is next to avoidance in terms of project safety (esp. financial risks). Here risk is not eliminated but the risk impact is transferred to another one with extra project budget cost. Example: Annual Maintenance Contract, Shop Fire Insurance, Theft Insurance, Natural Disaster Insurance.

Mitigation: “Reduce the probability & impact of risk to accepted level by good planning before hand” strategy. Mitigation is taking calculated risk. We know there could be a risk. We can not avoid it. But we know we can reduce the probability & impact by taking some measures at the start of the project. Hence we added few activities for that in execution phase.

Acceptance: “In case of risk occurrence, nothing to do” strategy. This is the Worst ever strategy & most of the risk books do not call this as strategy at all ! All unidentified risks falls under this response category.

Risk Response for Positive Risks:

Exploitation: “I want to take advantage of an opportunity” strategy. We know there is a sure thing happens with this risk. Plan all actions to get more results of that. In this way we are increasing the impact. For example adding talented resources to reduce project time.

Sharing: “Having partnership in utilizing maximum advantage” strategy. Leaving ownership of the risk to another party who can tap the opportunity for our benefit. Good example on this is outsourcing to specialized groups.

Enhancing: “Getting it done by doing the right things” strategy. Identify few enhancers or drivers for the event, perform that in such a way it increases the probability and/or impact of it.

Acceptance: “In case of risk occurrence, nothing to do” strategy. Though this is a worst negative response strategy, it is a nice one for positive risks. No need to throw stones on the tree, fruit automatically falls on your lap in the windfall!

Secondary Risks

You came up with initial identification, analysis and responses of project risks. But you found one new risk arises because of implementing already planned response for a risk.

What to do with the new risk?

The new risk is called as ‘Secondary risk’. Secondary risks should also follow the same process like qualified, quantified and responses planned for them like in original risk.

Definition from PMBOK^® Guide: Secondary risks that arise as a direct outcome of implementing a risk response.

In some cases, secondary risks remain after responses. They all all accepted for which the contingency plan & fallback plan need to be prepared.

Residual Risks

Risk management is a cyclic process. But for a project, it cannot go on for ever. Right? Project manager, his team & management has to find a stop point on further assessment & responses. Those risks that remain even after developing responses to the project’s primary (or original) risks are called as Residual Risks.

Impact of residual risks are usually actively accepted. The project team has to document & monitor these risks throughout the project as they may occur anytime. Contingency plans & fallback plans are created to handle the situation when these risks occur.

Residual Risks are termed sometime as ‘Known Unknowns’ i..e these are identified risks(‘known’) but their impact is ‘unknown’ and it is accepted.