Project management in practice: risk management

In this three-part miniseries, we are exploring some of the principles and tools you can use to help you manage a variety of projects in your practice. In the first part, we looked at the roles and relationships; in the second part, we explored project scope. In this final part, we will look at managing risk.

Risk assessment

The principles of risk assessment in a project are the same as in any other aspect of practice or business life – identify the risks, assess their potential impact and the likelihood of them occurring, and take steps to reduce or manage them (Figure 1).

Risk logs

In project management, unforeseen risks can, of course, arise, and it is up to the project manager to collate the information needed to manage any risks as they are identified. A “risk register” or “risk log” should be kept to keep track of any risks that have arisen and how they have been dealt with (Figure 2).

Depending on the scale and complexity of a project, a risk register should include:

• The nature of the risk identified
• The category of the risk (is it financial, technical, physical or emotional? Is it internal or external?)
• An analysis of the likelihood and potential impact of the risk and an associated priority rating
• The response(s) and action(s) taken to mitigate the effect of the risk on the project
• The person responsible for monitoring the risk and reporting or taking any ongoing action

Anticipating risk

Planning for what might happen means considering exactly what the risks to the project’s success might be. One of these, as discussed in the previous part of this series, was “scope creep” – where additional requirements are needed, requested or added to the project once it is already underway. Risks can be challenging for the project team and incredibly frustrating for the project manager! So why does it happen?

There are a few common reasons that a project manager can easily anticipate, assess and add to a potential risk register. The first is a loss of resources. A team member could leave or a budget be cut, meaning that either the project needs to be completed with fewer people or less money, or the project outcomes will need to be adjusted.

Secondly, there may be technical problems with a project, eg a piece of software may not work, or an item of equipment may not be available.

Planning for what might happen means considering exactly what the risks to the project’s success might be

Thirdly, it may be that errors were made in the planning stages that only become apparent later in the project’s life cycle. The most common of these is over-optimism, either with timescale or budget, again meaning that your plans will need adjusting. From the other direction, you may find new people joining your project – which could have a positive impact in terms of capacity, but could also mean that they want to make their mark and incorporate new ideas into an existing project plan.

Finally, you may find that additional benefits develop during the project’s lifetime, for example a technological advance that offers additional opportunities you might want to add in.

All of these will need careful risk management to ensure that threats are minimised, opportunities are optimised and your project stays on track.

Managing risk

There are five general approaches to risk management in a project: preventing, reducing, rerouting, transferring and accepting. It may be that more than one approach will need to be combined in any particular situation.

1. Preventing the risk – this means you change your plans for the project so that the risk does not arise in the first place
2. Reducing the risk – this means you take action to lower the likelihood of the risk occurring or put measures in place that will limit the impact of the risk if it does arise
3. Rerouting the risk – this means you use a different means or method of achieving the same outcome and, therefore, avoid the risk occurring
4. Transferring the risk – this means you spread the risk so that if it does arise, its impact will be reduced
5. Accepting the risk – this means you weigh the advantages and disadvantages carefully and decide that the cost of addressing the risk is greater than the benefit to be gained from avoiding it

There are five general approaches to risk management in a project: preventing, reducing, rerouting, transferring and accepting

Risk monitoring

Good risk management will rely on several of the above approaches. By the time a project has started, a project manager should have carried out a thorough risk assessment and taken steps to prevent and reduce the impact of anticipated risks. But what about those that are unforeseen?

There are several good practices that a project manager should be able to call on:

• Clear risk communication plans: ensure that everyone involved in the project, including yourself, is aware of who (how and when) to contact in case anyone notices anything that needs addressing. Identifying risks (or potential risks) early means that action can be taken before they become unmanageable
• Effective delegation: risk monitoring should be the responsibility of everyone on the project team. Avoid micromanagement and delegate responsibility for risk in specific areas to appropriate team members. A project manager can’t be everywhere at once, so having open lines of communication means that risks arising can be spotted early by team members and flagged for action quickly
• Regular check-ins: as well as the team in your organisation, ensure that external people or groups are kept up to date. If they don’t proactively contact you, check in with suppliers and contractors to ensure that everything is on track

By the time a project has started, a project manager should have carried out a thorough risk assessment and taken steps to prevent and reduce the impact of anticipated risks