Risk Management in Project Environments

Risk!!! when we see this word, what comes in our mind? Something negative, something uncertain, something difficult to manage. Yes, risk is something negative, but it can be positive also. No matter either it’s positive or negative; it’s an opportunity for sure! Let me put an example here, in a project the Project Manager assessing a risk that there may be high procurement cost. Considering this fact, s/he plans accordingly and keeps a reserve when negotiating with client. In reality, if the procurement manager (a member of the project team) successfully manages this risk through his/her skills then the reserve will positively hit profit vis versa if the risk occur it will also not make any loses as there is a reserve for it.

Again, risk is uncertain which may or may not occurs in future and when it occurs, it becomes issue. Risk is difficult to manage but it’s not unmanageable if we know the art. Before planning for the risk management, we need to keep something in our mind. These are risk tolerance, risk threshold, risk trigger, etc. risk tolerance and threshold are varying organization culture to culture, industry to industry, stakeholder to stakeholder. Trigger is a signal as like car dashboard which indicates when a risk going to happen so that we can take actions accordingly.

Now, ‘risk management’ the most critical and important part but very interesting if we can follow some points properly.

Risk Identification – Most easy tasks if we can spend some quality time with concern stakeholders and subject matter experts. As well as past trouble databases, market dynamics, government policies, etc often need to consider for identifying risk. Accordingly, we have to prepare a risk register; what I have observed many Project Managers who are straggling here and managing his/her project without a risk register or not toughly done risk register. If this step is not done properly all others are invalid.

Qualitative and Quantitative Risk Analysis – In a project there may be hundreds of risks and it’s not possible to plan and work for all with same intense. Thus, identified risks should be assessed based on probability, impacts, and other attributes. Once assessment is done then we may prepare a response plan based on the criticality.

Risk Response Plan – No matter risk is either positive or negative, there should be a response plan for it. Easiest plan is ‘ACCEPTANCE” either actively or passively. For negative risk others are ‘AVOID’, ‘MITIGATE’, or ‘TRANSFER’ on the other hand for positive risk ‘EXPLOIT’, ‘ENHANCE’, or ‘SHARE’. Also, there should be contingency reserve and fallback plan along with an owner.

Monitor and Control Risk – What will happen if we did everything above rightly but do not monitor and control the risk? The risk will occur, but nobody will take any action. Thus, regularly have to monitor the risks and take actions accordingly when we see a risk trigger.

All the above points are continuous process. We have to regularly search for new risks, check for priority change, plan or/and adjust risk response, and regularly monitor & control.