The risk management process: Step by step | IAPM

A well-structured risk management process is essential to identify potential risks early, assess them carefully and monitor their progress on an ongoing basis. This is particularly important for the team developing the new keyboard that we introduced in the last two articles. By identifying and assessing risks at an early stage, the team can be proactive and deal effectively with any challenges that arise. This not only ensures the quality of the final product, but also helps to avoid delays and cost overruns.

Risk identification

Risk identification is the first step in the risk management process. To gain an overview, it is advisable to first define risk categories and then assign identified risks to these categories. However, risks should not be considered in isolation, as it is important to understand their interdependencies. For example, a risk at the business level may affect other areas such as objectives, project requirements, production, the project team or the programming system used. Early identification of these risks and their interdependencies allows appropriate action to be taken to protect the project from disruption.

It is important that risk identification is not limited to the beginning of a project, as risks may change over time or new risks may emerge. It is therefore useful to carry out the identification process regularly at different stages of the project. One should not rely solely on previous risk analyses or checklists, as new risks may emerge even in similar projects. While past project experience can be valuable, the process remains subject to uncertainties that need to be uncovered using various techniques.

To better manage these uncertainties, it is essential to have access to up-to-date information and to ensure that the team supports the process, even if it means reviewing their work. In addition, risk identification should be as comprehensive as possible to provide a complete and accurate list of potential risks.

Techniques

Various techniques can be used to identify risks, and the choice will depend on a number of factors, including the specific requirements of each project phase, the resources required and available, the competence of the people involved and access to relevant information. It is also important to remember that there are both obvious and less obvious risks. While known risks do not require complex methods such as brainstorming, creative techniques can be helpful in identifying less obvious or unknown risks. It is therefore advisable to use a combination of techniques to get the most complete picture of potential risks.

Checklists

Checklists are one of the most important risk identification tools. They are based on experience from similar projects and provide a structured collection of known risks. These risks can be classified by type, cause, impact and likelihood of occurrence. However, checklists are only suitable for identifying known risks. Other techniques should be used to identify unknown risks.

Examples of checklist questions are

What conflicts exist between the groups involved? For example, there may be a conflict between software developers and designers. While designers strive for an aesthetically pleasing product, developers may prioritise functionality and efficiency, leading to disagreements over time and content.

Are the customer’s needs known? The product can only be designed successfully if the needs of the target audience are clear. Unclear customer needs can lead to project failure.

How much time is available and what happens if there are delays? Inadequate time planning can lead not only to delays, but also to significant cost increases.

Are all parties interested in the success of the project? A lack of commitment or motivation in the team could hinder the progress of the project.

What risks are not covered by the supplier? For example, who is liable if goods are damaged in an accident?

Is there an alternative supplier? Can the supply chain be maintained if a supplier fails?

Brainstorming

Brainstorming is a useful supplement to checklists because it can quickly generate a wide range of potential risks. In an open exchange of ideas, team members can identify risks that might otherwise have been overlooked. However, brainstorming should not be used as the only technique, as group pressure or premature conclusions can lead to misjudgements.

Interviews

Interviews are another valuable risk identification technique. Detailed risk assessments can be obtained by conducting interviews with the various departments involved in the project. It can be beneficial to conduct interviews separately, as departments often have different perspectives and information on potential risks.

Risk analysis and assessment

The second step in risk management is risk analysis. This involves identifying both the positive and negative potential impacts of a risk. The next step is to assess the likelihood of these impacts occurring and the effectiveness of possible mitigation measures. There are a number of methods available for this analysis, including qualitative and quantitative approaches. Qualitative analysis involves rating the impact, likelihood and level of risk on a scale from ‘low’ to ‘high’. Quantitative analysis calculates a specific level of risk. A detailed explanation of this process will be provided in an upcoming article.

Risk analysis is followed by risk assessment. Based on the results of the analysis, a decision is made on how to deal with the identified risks: whether to manage, mitigate or accept them. This decision can be supported by a cost-benefit analysis that distinguishes between risks that are unacceptable and require action, and those that are considered acceptable. A risk matrix is a useful tool for this assessment, where the likelihood and impact of a risk are plotted against each other to determine appropriate action.

Different strategies can be used to manage risks:

• Risk avoidance: Taking steps to avoid the risk altogether.
• Risk reduction: Minimising the risk by taking preventive action.
• Risk transfer: Transferring the risk to a third party, such as an insurer.
• Risk limitation: Developing proactive measures to respond effectively in the event of a risk occurrence.
• Risk acceptance: Deliberately accepting the risk when it is deemed acceptable.

Risk monitoring and control

The aim of risk monitoring is to regularly review identified risks and to identify early on if they occur or change during the project. As soon as there are signs of a risk materialising, the measures defined in the analysis and assessment need to be implemented to avoid damage. As risk management is an ongoing process, clear responsibilities should be assigned. It is advantageous for people involved in potential actions to be directly involved with the risks involved. For example, designers should oversee actions related to the colour scheme of the keyboard, rather than software developers.

Another important aspect of monitoring is the regular review of the effectiveness of the measures taken. There is a need to ensure that the actions taken are effective in preventing the risk from occurring or mitigating its impact.

At the end of the project, the risks identified, assessed and monitored should be thoroughly documented. This documentation is valuable for future projects as it builds on past experience. While risks are not always transferable, the lessons learned can be useful in the form of checklists or other tools.

Conclusion

The risk management process is critical to the success of a project, such as the development of a new keyboard. The steps of identification, analysis, evaluation and continuous monitoring enable early identification and effective management of potential risks. Using a variety of techniques, a comprehensive risk picture can be created and appropriate mitigation measures can be implemented based on the likelihood of occurrence. This ensures that the project can be delivered as planned and completed successfully.

Originally published at https://www.iapm.net.