You’re a project manager and you’ve just identified a new risk. What’s your next move?

As a project manager, identifying and assessing risks is a critical part of ensuring the success of any project. When a new risk emerges, it's essential to follow a structured approach to evaluate its potential. A simple approach to assessing it involves an analysis of its potential impact and likelihood and developing strategies to mitigate or manage it effectively. Then, evaluate the risk considering its potential impact on the project objectives, timeline, budget, and resources, as this is what executives want to know. The likelihood of the risk occurring helps us understand the probability of it materializing and its potential consequences that we can use when communicating and managing stakeholders' and sponsors' expectations.

Record the Risk, document with all possible details. Analyze thoroughly and identify if this could be mitigated, a yes or no helps in the decision making. Include the ROI from risk mitigation as a part of analysis, though sometimes it takes time to get a clear ROI picture.

Firstly, I would conduct a risk assessment. If there is a need for experts' opinion, I would ask them to study the seriousness of the situation. Once the level of risk is known, we will work out the mitigation to control the risk.

While it is tempting to immediately share a risk, especially with senior level stakeholders, this is rarely the best course of action. A moment of pause, reflection, and fact gathering can often lead to a more realistic assessment of the risk, as well as mitigation strategies. Senior leaders prefer to know about risks quickly, but they equally prize accuracy and contingency planning. Just bringing the risk raises fear without offering any path forward.

Risk Assessment: The quality of assessment impacts our ability to mitigate the risks. Key challenges in risk assessment are: - Incomplete Data - Biased Analysis - Unclear Definitions - Overlooking Secondary Risks - Inadequate Expertise - Assumption Errors - Poor Communication - Time Constraints - Failure to Update We should minimise the occurrence of these issues to be effective in risk assessment.

Once a risk is identified, use ROAM model to categorize the risk, and document in the Risk Register for further actions. ROAM: - Resolved: It is determined that the risk is not a threat at this time, and hence no further action is necessary. - Owned: The risk cannot be resolved immediately, and an ‘owner is selected to ‘own’ the lifecycle of that risk. This ‘owner’ is responsible to ensure proper risk management process is followed. - Accepted: The risk cannot be resolved, and is accepted as-is. - Mitigated: A plan is put in place to eliminate the threat of the risk. It is critical to monitor and manage risks continuously and relentlessly.

Risk registers are practical tools for tracking risk, but it is also important to recognize their program management philosophy plays a role in how we employ these tools in our teams. I am particularly fond of Uzulāns et al (2016, 2018) work “Project Risk Register Analysis Based on the Theoretical Analysis of Project Management Notion of Risk” & “Ontological Analysis of the Project Risk Management Concept ‘Risk’” These articles delve into how our unconscious bias affects how we use the risk register toolset, and how we can be more aware of our own biases program managers to create more inclusive teams, and better results for our organizations.

Over 15 years ago I was a 'project manager' with 0 authority and the best tool that helped me influence the direction of the project is the discipline of documenting and reviewing a risk register. At PACE.global our employees know this as the RIDO Log - which stands for a Risk Issues, Decisions and Opportunities log. As a change management company, this is our primary way of managing uncertainty and getting alignment from project sponsorship and other stakeholders. If a risk is not documented in the risk log and the project manager simply goes ahead to try and mitigate the risk or take any other action without consulting with a project team, he or she is creating a new risk that might result in disengagement from key project stakeholders.

It's a challenging experience to change the team's perception on the benefits of updating the risk register. It is usually interpreted as a prerrequisite during the project design phase, but with limited impact during the implementation. It has to become a continuous and systematic process during the whole life of the project. And the project manager has to promote the regular monitoring and updating of the risk register. I use simple formats to reduce the burden of updating the risk register, in a way to reduce resistance from the team.

Once a new risk has been identified, it is necessary to document said risk and its implications to the project. Then the next step would be to communicate the risk to the stakeholders and the necessary interventions to minimize or eliminate said risk.

Risks are the program manager's Crystal ball. They allow the concerned parties to take necessary actions to eliminate the risk altogether or reduce the impact significantly. The program manager's objective assessment, non partisan articulation and clear communication are important to get support from those required to act to mitigate the risk. Some of the most common reasons for risks becoming issues are egos and politics - the right communication can avoid these.

Effective communication is the key combined with face to face meetings and be up front. Proactive versus reactive. Pull together the key stakeholders, review the issues, and brainstorm as a team. This is a great way to update the team and empowers them to be part of the solution.

Alert project members, collectively coming up with mitigation strategies solely tailored for that particular risk. Testing all strategies before final implementation

All risks in the project must be identified and then communicated clearly and transparently promptly to all stakeholders in your project. To support timely communication to the right people at the right time, we should combine documents such as the Stakeholder register and communication management plan.

When communicating about risks, prioritize clarity and conciseness. Avoid sugarcoating or minimizing the potential impact; present the facts objectively and without emotional language, utilizing visuals or charts for clarity. Additionally, outline mitigation strategies, including potential solutions, timelines, and resource requirements for implementation. Encourage collaboration by inviting input from stakeholders, fostering discussions about alternative approaches, and addressing potential challenges. This approach ensures effective and transparent communication, enhancing the understanding and collaboration of all involved parties in managing and mitigating risks.

In my experience, except avoidance, all other methods to implement a risk response involve spending more resources or compromising on deadlines. Hence, When implementing a response, the project manager must have a clear understanding of the optimum response which will ensure the risk is mitigated enough that it doesn’t derail the project and not spend too many resources on the risk which affects resources and schedule adversely. A good response may not be the best solution but it sure must be an appropriate solution given the circumstances.

In the high-tech engineering realm, risk is an inevitable companion on the path to innovation & commercialization. How we respond to risk can define the trajectory of our projects and shape the future of or segments. Pro tips: 1. Proactive Preparedness for Residual Risk: Not all risks can be eliminated, and managing residual risk proactively is key. 2. Agile Adaptability w/ Documentation: Embracing agile methodologies empowers teams to pivot swiftly and effectively in the face of uncertainty (and a good tech writer is worth their weight in gold ??). 3. Collaborative Problem-Solving: Don’t forget the leverage the collective expertise— most poor outcomes in risk implementation result from wrong/missing stakeholders at the table.

Risk mitigation, like many undertakings, has procedural and substantive aspects. You can not ignore the other aspect. Substantively, you must understand the mechanics of the risk. If necessary, recognize many risks go beyond the scope of an individual organization's ability to mitigate. However, the procedural aspects must be addessed to establish cognizance of the risks and how the event will be recognized and handled even if mitigation is not attainable. Like a customer with a product failure, its how quickly the failure is addressed etc. to ensure ongoing confidence and reasonable conduct follows. It should be understood that both aspects of risk are the pillars of confidence--the ultimate objective whatever situation materializes.

Implementing responses to identified risks is the essence of effective project management. It's the actionable step that ensures proactive mitigation, allowing teams to navigate challenges swiftly and maintain project momentum. Embracing this approach ensures projects stay on track and resilient in the face of uncertainties.

The implementation of the selected response marks the closure of the risk management cycle. Strategies, whether avoid, mitigate, transfer, accept or exploit, are chosen according to the level of risk and the project context. Assigning a risk owner is crucial for effective execution and monitoring of the response. This step ensures timely action and continuous monitoring, optimising the resilience of the project to identified uncertainties.

In my experience, my next move after identifying a new risk would be to assess the impact and likelihood of the risk, document it in the risk register, and develop a risk response plan. This involves analyzing the potential consequences of the risk, determining the probability of occurrence, and creating strategies to mitigate or manage the risk effectively. Additionally, I would communicate the identified risk to the relevant stakeholders and ensure that the risk response plan is integrated into the project management process.

Per my experience, we should understand the organization's culture and the mutuality of our members in risk management. Then, you should define the risk and issue management working process based on your needs. It would be better than following any standard/template of other teams/companies, etc.

After identifying a new risk, the next step is to assess its likelihood and impact, document it in the risk register, and communicate it to the relevant team and stakeholders. Next, it is crucial to develop strategies for mitigating, transferring, or accepting the risk, assigning responsibilities, and implementing action plans to address the risk. Close monitoring of the risk throughout the project and adjusting strategies as necessary is also essential to ensure project success.

A plan/do/ review approach is always very important. When you are assessing such risks, it is important to check back on your company’s knowledge management bank to see whether similar risk have come up to avoid duplication of work. It is also worth discussing with colleagues to see if anyone else had tackled some thing similar before and whether it can be applied here. I’m a big fan of “there’s nothing new under the sun.” and as such communication is vital with the stakeholders of the project.

I feel strongly that after your Risk team has captured all the necessary information in the Risk Register and have gathered sufficient artifacts there is one task you should accomplish PRIOR to conducting a Risk Review Board. I would highly suggest having an independent set of eyes look at the risk(s). Depending on the size of the risk and the potential impact, you may want to convene a formal independent review. Recall what took place with the Space Shuttle O-Ring disaster.