What are project risks and how can you identify them?
Assessing risks on a project, in a way that will add value and help you manage the project better, is not easy. Much of what will happen on a project is uncertain anyway so when do uncertainties become risks? We have, after all, merely estimated the resources we think we need or we may not fully understand the business needs so projects are inherently risky anyway. For some projects, such as ones using new, untried technology the whole project may be a risk.
Let's take, for example, estimating the time to build a new prototype car. Unlike building a standard car, building a prototype will involve new designs and technology so the estimate will not be entirely accurate. A bit of over-run may not be expected but if there is a tight deadline because the manufacturer wants the car ready for a particular motor show then the uncertainty combined with the deadline creates a real risk to the project's success.
So if we are going to assess risks successfully we need to clearly understand what risks are:
"an uncertain event or set of circumstances that, should it occur, will have an effect on achievement of one or more objectives" - APM Body of Knowledge 6th Edition.
That may sound fairly obvious but plenty of projects have lists of risks that everyone includes as a tick box exercise rather than really thinking through the possible risks for your particular project. Risks such as "the car will be delivered late" is far too generic to be of any use to the project team and stakeholders. Being late is the consequence of the risk. It is much better to look at the individual risks that could cause a late delivery and describe how each could impact any important deadline, for example "The use of new material may cause problems applying the paint layers".
One way to start is to review each task on your project schedule looking for elements of uncertainty; these could be, for instance, the use of new technology or a lack of suitably experienced people. If any uncertainties do not have serious constraints then they don't need to be flagged as a risk. So if you currently lack skilled employees but they are easy to come by then this is not a risk.
Many people will list all potential risks that could affect a project but you need to consider carefully whether to list common business risks on every project; otherwise the list of risks may become un-manageably long. A common project "risk" is key people leaving the project or company, or take extended sick leave. However these are better treated as business risks that are often beyond the direct influence of the project and are better managed by the business process, such are recruitment, training, succession planning and people development. Typically these are outside of the project's remit and so, if possible, should be escalated to the business risk assessment.
Priority risks are only those events that have a reasonable probability of happening and will have a significant impact on the project. By focusing your efforts on these priority risks you can apply some common sense to your risk assessment.
Don't be tempted to minimise any potential risks for political reasons, such as your own career prospects, or indeed maximise risks to cover a poorly planned schedule or inadequate requirements. It is unlikely that you will be able to anticipate all potential project risks because that is the nature of projects, and of risk, but if you can successfully identify and manage some risks then you will be in a better position to deal with the unexpected.
Other blogs in this series:
- Project management - an introduction
- Project management processes and phases
- Business requirements and project managers
- People and behaviours in project management
- Using a Gantt Chart to manage a project schedule
- Project managers don't forget about behaviours and attitudes
- The basics of an effective project plan
This is a project management fundamentals blog written and sponsored by Parallel Project Training. For more about our project management training courses visit our website or visit Paul Naybour on Google+.