10 Golden Rules of Project Risk

Management
ByBartJutte
Thebenefitsofriskmanagementinprojectsare
huge.Youcangainalotofmoneyifyoudealwith
uncertainprojecteventsinaproactivemanner.The
resultwillbethatyouminimisetheimpactof
projectthreatsandseizetheopportunitiesthat
occur.Thisallowsyoutodeliveryourprojecton
time,onbudgetandwiththequalityresultsyour
projectsponsordemands.Alsoyourteammembers
willbemuchhappieriftheydonotentera"fire
fighting"modeneededtorepairthefailuresthat
couldhavebeenprevented.
Thisarticlegivesyouthe10goldenrulestoapplyriskmanagement
successfullyinyourproject.Theyarebasedonpersonalexperiencesofthe
authorwhohasbeeninvolvedinprojectsforover15years.Alsothebigpile
ofliteratureavailableonthesubjecthasbeencondensedinthisarticle.

Rule1:MakeRiskManagementPartofYour
Project
Thefirstruleisessentialtothesuccessofprojectriskmanagement.Ifyou
don'ttrulyembedriskmanagementinyourproject,youcannotreapthefull
benefitsofthisapproach.Youcanencounteranumberoffaultyapproaches
incompanies.Someprojectsusenoapproachwhatsoevertorisk
management.Theyareeitherignorant,runningtheirfirstprojectortheyare
somehowconfidentthatnoriskswilloccurintheirproject(whichofcourse
willhappen).Somepeopleblindlytrusttheprojectmanager,especiallyifhe
(usuallyitisaman)lookslikeabatteredarmyveteranwhohasbeeninthe
trenchesforthelasttwodecades.Professionalcompaniesmakerisk
managementpartoftheirdaytodayoperationsandincludeitinproject
meetingsandthetrainingofstaff.

Rule2:IdentifyRisksEarlyinYourProject
Thefirststepinprojectriskmanagementistoidentifytherisksthatare
presentinyourproject.Thisrequiresanopenmindsetthatfocusesonfuture
scenariosthatmayoccur.Twomainsourcesexisttoidentifyrisks,people
andpaper.Peopleareyourteammembersthateachbringalongtheir
personalexperiencesandexpertise.Otherpeopletotalktoareexperts
outsideyourprojectthathaveatrackrecordwiththetypeofprojectorwork
youarefacing.Theycanrevealsomeboobytrapsyouwillencounterorsome
goldenopportunitiesthatmaynothavecrossedyourmind.Interviewsand
teamsessions(riskbrainstorming)arethecommonmethodstodiscoverthe
riskspeopleknow.Paperisadifferentstory.Projectstendtogeneratea
significantnumberof(electronic)documentsthatcontainprojectrisks.They

maynotalwayshavethatname,butsomeonewhoreadscarefully(between
thelines)willfindthem.Theprojectplan,businesscaseandresource
planningaregoodstarters.Anothercategoriesareoldprojectplans,your
companyIntranetandspecialisedwebsites.
Areyouabletoidentifyallprojectrisksbeforetheyoccur?Probablynot.
Howeverifyoucombineanumberofdifferentidentificationmethods,youare
likelytofindthelargemajority.Ifyoudealwiththemproperly,youhave
enoughtimeleftfortheunexpectedrisksthattakeplace.

Rule3:CommunicateAboutRisks
Failedprojectsshowthatprojectmanagersinsuchprojectswerefrequently
unawareofthebighammerthatwasabouttohitthem.Thefrightening
findingwasthatfrequentlysomeoneoftheprojectorganisationactuallydid
seethathammer,butdidn'tinformtheprojectmanagerofitsexistence.If
youdon'twantthistohappeninyourproject,youbetterpayattentiontorisk
communication.
Agoodapproachistoconsistentlyincluderiskcommunicationinthetasks
youcarryout.Ifyouhaveateammeeting,makeprojectriskspartofthe
defaultagenda(andnotthefinalitemonthelist!).Thisshowsrisksare
importanttotheprojectmanagerandgivesteammembersa"natural
moment"todiscussthemandreportnewones.
Anotherimportantlineofcommunicationisthatoftheprojectmanagerand
projectsponsororprincipal.Focusyourcommunicationeffortsonthebigrisks
hereandmakesureyoudon'tsurprisethebossorthecustomer!Alsotake
carethatthesponsormakesdecisionsonthetoprisks,becauseusually
someofthemexceedthemandateoftheprojectmanager.

Rule4:ConsiderBothThreatsandOpportunities
Projectriskshaveanegativeconnotation:theyarethe"badguys"thatcan
harmyourproject.Howevermodernriskapproachesalsofocusonpositive
risks,theprojectopportunities.Thesearetheuncertaineventsthat
beneficialtoyourprojectandorganisation.These"goodguys"makeyour
projectfaster,betterandmoreprofitable.
Unfortunately,lotsofprojectteamsstruggletocrossthefinishline,being
overloadedwithworkthatneedstobedonequickly.Thiscreatesproject
dynamicswhereonlynegativerisksmatter(iftheteamconsidersanyrisksat
all).Makesureyoucreatesometimetodealwiththeopportunitiesinyour
project,evenifitisonlyhalfanhour.Chancesarethatyouseeacoupleof
opportunitieswithahighpayoffthatdon'trequireabiginvestmentintime
orresources.

Rule5:ClarifyOwnershipIssues
Someprojectmanagersthinktheyaredoneoncetheyhavecreatedalist
withrisks.Howeverthisisonlyastartingpoint.Thenextstepistomake
clearwhoisresponsibleforwhatrisk!Someonehastofeeltheheatifarisk
isnottakencareofproperly.Thetrickissimple:assignariskownerforeach

riskthatyouhavefound.Theriskowneristhepersoninyourteamthathas
theresponsibilitytooptimisethisriskfortheproject.Theeffectsarereally
positive.Atfirstpeopleusuallyfeeluncomfortablethattheyareactually
responsibleforcertainrisks,butastimepassestheywillactandcarryout
taskstodecreasethreatsandenhanceopportunities.
Ownershipalsoexistsonanotherlevel.Ifaprojectthreatoccurs,someone
hastopaythebill.Thissoundslogical,butitisanissueyouhavetoaddress
beforeariskoccurs.Especiallyifdifferentbusinessunits,departmentsand
suppliersareinvolvedinyourproject,itbecomesimportantwhobearsthe
consequencesandhastoemptyhiswallet.Animportantsideeffectof
clarifyingtheownershipofriskeffects,isthatlinemanagersstarttopay
attentiontoaproject,especiallywhenalotofmoneyisatstake.The
ownershipissueisequallyimportantwithprojectopportunities.Fightsover
(unexpected)revenuescanbecomealongtermpastimeofmanagement.

Rule6:PrioritiseRisks
Aprojectmanageroncetoldme"Itreatallrisksequally."Thismakesproject
lifereallysimple.However,itdoesn'tdeliverthebestresultspossible.Some
riskshaveahigherimpactthanothers.Therefore,youbetterspendyourtime
ontherisksthatcancausethebiggestlossesandgains.Checkifyouhave
anyshowstoppersinyourprojectthatcouldderailyourproject.Ifso,these
areyournumber1priority.Theotherriskscanbeprioritisedongutfeeling
or,moreobjectively,onasetofcriteria.Thecriteriamostprojectteamsuse
istoconsidertheeffectsofariskandthelikelihoodthatitwilloccur.
Whateverprioritisationmeasureyouuse,useitconsistentlyandfocusonthe
bigrisks.

Rule7:AnalyseRisks
Understandingthenatureofariskisapreconditionforagoodresponse.
Thereforetakesometimetohaveacloserlookatindividualrisksanddon't
jumptoconclusionswithoutknowingwhatariskisabout.
Riskanalysisoccursatdifferentlevels.Ifyouwanttounderstandariskatan
individuallevelitismostfruitfultothinkabouttheeffectsthatithasand
thecausesthatcanmakeithappen.Lookingattheeffects,youcandescribe
whateffectstakeplaceimmediatelyafterariskoccursandwhateffects
happenasaresultoftheprimaryeffectsorbecausetimeelapses.Amore
detailedanalysismayshowtheorderofmagnitudeeffectinacertaineffect
categorylikecosts,leadtimeorproductquality.Anotherangletolookat
risks,istofocusontheeventsthatprecedeariskoccurrence,therisk
causes.Listthedifferentcausesandthecircumstancesthatdecreaseor
increasethelikelihood.
Anotherlevelofriskanalysisisinvestigatetheentireproject.Eachproject
managerneedstoanswertheusualquestionsaboutthetotalbudgetneeded
orthedatetheprojectwillfinish.Ifyoutakerisksintoaccount,youcandoa
simulationtoshowyourprojectsponsorhowlikelyitisthatyoufinishona
givendateorwithinacertaintimeframe.Asimilarexercisecanbedonefor
projectcosts.
Theinformationyougatherinariskanalysiswillprovidevaluableinsightsin

yourprojectandthenecessaryinputtofindeffectiveresponsestooptimise
therisks.

Rule8:PlanandImplementRiskResponses
Implementingariskresponseistheactivitythatactuallyaddsvaluetoyour
project.Youpreventathreatoccurringorminimisenegativeeffects.
Executioniskeyhere.Theotherruleshavehelpedyoutomap,prioritiseand
understandrisks.Thiswillhelpyoutomakeasoundriskresponseplanthat
focusesonthebigwins.
Ifyoudealwiththreatsyoubasicallyhavethreeoptions,riskavoidance,risk
minimisationandriskacceptance.Avoidingrisksmeansyouorganiseyour
projectinsuchawaythatyoudon'tencounterariskanymore.Thiscould
meanchangingsupplieroradoptingadifferenttechnologyor,ifyoudealwith
afatalrisk,terminatingaproject.Spendingmoremoneyonadoomedproject
isabadinvestment.
Thebiggestcategoryofresponsesaretheonestominimiserisks.Youcantry
topreventariskoccurringbyinfluencingthecausesordecreasingthe
negativeeffectsthatcouldresult.Ifyouhavecarriedoutrule7properly(risk
analysis)youwillhaveplentyofopportunitiestoinfluenceit.Afinal
responseistoacceptarisk.Thisisagoodchoiceiftheeffectsontheproject
areminimalorthepossibilitiestoinfluenceitprovetobeverydifficult,time
consumingorrelativelyexpensive.Justmakesurethatitisaconscious
choicetoacceptacertainrisk.
Responsesforriskopportunitiesarethereverseoftheonesforthreats.They
willfocusonseekingrisks,maximisingthemorignoringthem(if
opportunitiesprovetobetoosmall).

Rule9:RegisterProjectRisks
Thisruleisaboutbookkeeping(howeverdon'tstopreading).Maintaininga
risklogenablesyoutoviewprogressandmakesurethatyouwon'tforgeta
riskortwo.Itisalsoaperfectcommunicationtoolthatinformsyourteam
membersandstakeholderswhatisgoingon(rule3).
Agoodrisklogcontainsrisksdescriptions,clarifiesownershipissues(rule5)
andenablesyoutocarryoursomebasicanalyseswithregardtocausesand
effects(rule7).Mostprojectmanagersaren'treallyfondofadministrative
tasks,butdoingyourbookkeepingwithregardstoriskspaysoff,especiallyif
thenumberofrisksislarge.Someprojectmanagersdon'twanttorecord
risks,becausetheyfeelthismakesiteasiertoblamethemincasethingsgo
wrong.Howeverthereverseistrue.Ifyourecordprojectrisksandthe
effectiveresponsesyouhaveimplemented,youcreateatrackrecordthatno
onecandeny.Evenifariskhappensthatderailstheproject.Doingprojects
istakingrisks.

Rule10:TrackRisksandAssociatedTasks
Theriskregisteryouhavecreatedasaresultofrule9,willhelpyoutotrack
risksandtheirassociatedtasks.Trackingtasksisadaytodayjobforeach

projectmanager.Integratingrisktasksintothatdailyroutineistheeasiest
solution.Risktasksmaybecarriedouttoidentifyoranalyserisksorto
generate,selectandimplementresponses.
Trackingrisksdiffersfromtrackingtasks.Itfocusesonthecurrentsituation
ofrisks.Whichrisksaremorelikelytohappen?Hastherelativeimportance
ofriskschanged?Answeringthisquestionswillhelptopayattentiontothe
risksthatmattermostforyourprojectvalue.
The10goldenriskrulesabovegiveyouguidelinesonhowtoimplementrisk
managementsuccessfullyinyourproject.However,keepinmindthatyoucan
alwaysimprove.Thereforerulenumber11wouldbetousetheJapanese
Kaizenapproach:measuretheeffectsofyourriskmanagementeffortsand
continuouslyimplementimprovementstomakeitevenbetter.
Successwithyourproject!
BartJutteisafounderandconsultantatConcilio,aNLbasedcompany
specialisinginprojectriskmanagement.Conciliooffersconsultancy,training
andsellsitsowneasytouseriskmanagementsoftware.

2015ProjectSmart.Allrightsreserved.