6.3. Risk Identification and Evaluation

Managing risks on projects is a process that includes risk assessment and a mitigation strategy for those risks. Risk assessment includes both the identification of potential risks and the evaluation of the possible impact of the risk. A risk mitigation plan is designed to eliminate or minimize the impact of the risk events—occurrences that hurt the project. Identifying risk is both a creative and a disciplined process. The creative process includes brainstorming sessions where the team is asked to list everything that could go wrong. All ideas are welcome at this stage, and the evaluation of the ideas will come later.

Risk Identification

A more disciplined process involves using checklists of potential risks and evaluating the likelihood that those events might happen to the project. Some companies and industries develop risk checklists (also called Risk Registers) based on experience from past projects. These checklists can be helpful to the project manager and project team in identifying specific risks on the checklist and expanding the team’s thinking. The past experience of the project team, project experience within the company, and experts in the industry can be valuable resources for identifying potential risks on a project.

Identifying the sources of risk by category is another method for exploring potential risks in a project. Some examples of categories for potential risks include the following:

• Technical
• Cost
• Schedule
• Client
• Contractual
• Weather
• Financial
• Political
• Environmental
• People

Risk Evaluation

After identifying the potential risks, the project team evaluates each risk based on the probability that a risk event will occur and its possible loss. Not all risks are equal. Some risk events are more likely to happen than others, and the cost of a risk can vary greatly. Evaluating the risk for the probability of occurrence and the severity or the potential loss to the project is the next step in the risk management process.

Having criteria to determine high-impact risks can help narrow the focus on a few critical risks that require mitigation. For example, suppose high-impact risks could increase the project costs by 5% of the conceptual budget or 2% of the detailed budget. Only a few potential risk events meet these criteria. These are the critical potential risk events that the project management team should focus on when developing a project risk mitigation or management plan. Risk evaluation is about developing an understanding of which potential risks have the greatest possibility of occurring and can have the greatest negative impact on the project (Figure 6.1). These become the critical few.

Risk evaluation often occurs in a workshop setting. Building on identifying the risks, each risk event is analyzed to determine the likelihood of occurrence and the potential cost if it did occur. The likelihood and impact are rated high, medium, or low. A risk mitigation plan addresses the items with high ratings on both likelihood and impact.

This and other risk management tools can be useful because they provide an objective framework for evaluating the seriousness of risks to your project. However, any risk assessment tool can do more harm than good if it lulls you into a false sense of security, so you make the mistake of believing you have foreseen every possible risk that might befall your project. You don’t want to make the mistake of believing that the tools available for managing risk can ever be as precise as the tools we use for managing budgets and schedules, even as limited as those tools are.

Perhaps the most important risk management tool is your ability to learn about the project. The more you know about a project, the better you will be at foreseeing the many ways the project could go awry and what the consequences will be if they do, and the better you will be at responding to unexpected challenges.

“9.2. Risk Management and Project Success” and “9.3. Risk Management Process” from Essentials of Project Management by Adam Farag is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License, except where otherwise noted. Modifications: both sections were combined and risk mitigation was removed.