Prevention is better than cure

Risk is a fundamental part of almost every human activity. We are unable to exist without it. Our lives are inextricably intertwined with fate itself which seems to expose us to varying degrees of risk. Some of us even seek risk out ourselves just to make us feel alive! Given its universal appeal, it is surprising how little is done to ensure that uncertainty is addressed and planned for appropriately.

 Let me start this with a small story. In this pandemic, a team of software engineers, along with their Project Manager is burning the midnight oil working on a tight delivery schedule for a project when a critical resource becomes unavailable due to Covid. Not long after the delivery, the Project Manager tells his team about their phenomenal efforts and hard work in meeting the deadline. Would you have been proud of yourself and your team, had you been in the Project Manager’s shoes?

The Project Manager was aware that anyone can get sick at any time, so he knew to anticipate them, and therefore he saved the extra time and effort that would be spent on making up for it. The Project Manager’s work is not only to focus on dealing with problems as they arise, but also to focus on foreseeing potential issues and preventing any major mishaps that could potentially affect the timeline of a project.

Let us reflect on this. Imagine, for a moment, how many times we, as Project Managers, may have said, “No worries! We saw it coming and included it in our planning!” How professional do we stand to look in front of management and our primary stakeholders? How much time and money would we save that would have otherwise been spent addressing the problem? And how much less stress would we have in our lives?

Having a risk management plan in place for a project almost invariably saves time and effort and contributes towards keeping costs in control. This reduces the likelihood of uncertainties. Following are some points to follow when formulating a risk management strategy.

1. Plan!

To get you started, the first step is to make a risk management plan. The plan will define how the project risk will be assessed and how it will be organized. It should define the methodologies that need to be adopted, the roles and responsibilities assigned to team members, the kind of budget set aside to deal with a certain category of risk, how the stakeholders view risks and their threshold of tolerance for it. 

 2. Risk Identification

The exercise of risk identification should involve all stakeholders. You can brainstorm to identify risk as well as utilize other tools such as the Delphi technique, Interviewing or Root Cause Analysis to make a Risk Register. A Risk Register is your main document where you keep a list of risks, their potential responses and their root causes.

3. Qualitative Risk Analysis

Once you have identified risks, you must determine how you will deal with those risks. You cannot possibly deal with all the risks identified (such endeavors require time and resources). Here you must sort the risks based on the impact of each risk and its likelihood. This exercise, known as Qualitative Risk Analysis, is an entirely subjective method of evaluation and may vary from person to person. The following diagram depicts the qualitative assessment matrix.

4. Quantitative Risk Analysis

After assessing the probabilities and impacts, one needs to numerically analyze the probability and impact of risks through quantitative analysis of the risk. You may evaluate the Expected Monetary Value (EMV) of the risk. The formula for EMV is as follows: Probability (P) times Impact (I). For example, there is a 40% chance of a delay in expecting goods from a factory, which cost the project $4000, so the EMV is $1600.

5. Plan Risk Response

After the above mentioned points are in place, you are all set to eliminate the risks and to ensure the opportunities are realized. Maybe you will be able to keep a reserve of money to handle the cost of the most likely risks. Perhaps there is some planning you can do from the beginning to be sure that you avoid it. You might even find a way to transfer some of the risk with an insurance policy. In short, you can avoid, mitigate or transfer the negative risks or you can enhance, share or exploit the positive risks or simply accept it.

6. Monitor and Control Risk

You cannot plan for every risk at the start of the project. Even the best planning cannot predict everything. There is always a chance that a new risk could crop up that you had not thought about. That is why you need to constantly monitor how your project is doing compared to your risk register. If a new risk happens, you have a good chance of catching it before it causes serious trouble. When it comes to risk, the earlier you can react, the better for everybody. And that is what the Monitor and Control Risks process is all about. Risk Reassessments, Variance and Trend Analysis, Risk Audits and status meetings are some of the tools and techniques to monitor and control risk.

There are some risks, however, which remain a risk even after your risk response planning. Those risks are called Residual Risk. Residual Risk should be properly documented and reviewed throughout the project to see if their ranking has changed.

The essence of risk management is not avoiding or eliminating risk but deciding which risks to exploit, which ones to let pass through to investors, and which ones to avoid or hedge. With all this to take into consideration, risk management not only helps you deal with the problem, it also saves time and money (not to mention your career!) by preventing it.

References:

• PMP 7th Edition by Rita Mulchay
• Head First PMP 2nd Edition by Jennifer Greene & Andrew Stellman