Steps to complete a project risk assessment
Conducting a project risk assessment is essential to ensure you and your project team are
prepared for handling the unexpected.
Stephen Covey author of the 7 Habits of Highly Effective People, recommends when planning,
“Begin with the end in mind.” One of the first things to think about before starting a project is –
what could potentially go wrong?
As any seasoned project manager will tell you, unforeseen problems will happen along the way.
When issues do arise, you need to have a strategy for managing risks for your project.
What does a project risk assessment entail?
Imagine this scenario – you’re a construction project manager and receive an urgent call from
someone on site, an elephant has escaped from the zoo and is stampeding through town. Luckily,
it was a baby elephant, so no one got hurt. Unfortunately, the baby elephant trampled right
through your project site, damaging thousands of dollars’ worth of material. All of the new
construction on a brand-new technology headquarters – everything you’ve worked on for months
was flattened. What’s next?
Life is full of surprises (sometimes of the circus variety!). Risk assessment helps you prepare for
uncertain and unexpected events that might negatively affect your project. Risk isn’t only about
safety. It involves technology, resources, people, and processes. There are five elements of
project management risks.
• Risk event: What can happen?
• Risk timeframe: When is it most likely to happen?
• Probability: What are the chances of this event?
• Impact: What is the impact?
• Factors: What can trigger the risk event?
Another way to think about it: Imagine you’re on your way to the most important business
meeting of your life. A million dollars of your own money is hanging in the balance. You’re on
the road and you get a flat tire. There isn’t time to call someone to help you and a tow truck
could be hours away.
However, you did your homework. The spare tire is in the trunk along with the tools to change it,
so you’re back on the road in no time. You also left the house early to give yourself a buffer for
the unexpected. Your spare tire, tool kit, and time buffer are all risk management.
Steps to perform a project risk assessment
Risk management is simply a process of identifying, addressing, and managing risk. Following a
thorough risk management process is like putting a fire extinguisher in the kitchen.
Of course, you will do all you can to prevent fires, but know that the time spent planning will
pay off should you ever need it. There are many benefits to performing a risk assessment before
a project kicks off. When you take into account all of the potential risks, you lessen the impact of
the unexpected. Your resource planning becomes more effective. In addition, your estimates on
costs and return on investment are more accurate.
Careful planning prevents legal hang-ups and injuries. And when things change, or unexpected
circumstances arise, you can meet your circumstances with flexibility, because you prepared for
it.
You’ll never be able to plan perfectly, but if you follow these steps to complete a risk
assessment, you’ll greatly improve your risk management.
Step 1: Identify risks
Analyse potential risks and opportunities. Before a project commences, take some time to
examine all of the possibilities: the good, the bad, and the ugly. Review best case scenarios and
worst case scenarios and leave no stone unturned. Although risk identification is continuous,
risks should be managed as soon as possible. Involve your client during the planning process.
Different viewpoints and experience levels will help identify as many risks up front as possible.
Step 2: Determine probability
An important step in a project’s risk assessment is examining the odds that a particular risk will
happen. While it’s more likely that inclement weather will delay breaking ground, you might
want to factor in a runaway elephant, say if you’re building next to a zoo. Rate every possibility
with high, medium, or low probability. That will ensure you’re focusing your resources on
mitigating the risks most likely to impact your project.
Step 3: Determine the impact
Every risk has an impact, some more than others. While a key member of your team being hit
with a nasty case of the flu might not set your project timeline back, if your entire team catches
the flu this might be a different matter. Think about what would happen if each risk you have
identified actually occurred. Would it affect your final delivery date? How would it affect the
budget? Identify the risks that have a large effect on the outcome of your project. Rate those risks
as high impact. Identify the rest of the risks as medium to low impact risks.
Step 4: Treat the risk
This part of the process is called risk response planning. Set a plan to treat and modify the
highest risks to acceptable levels. Risks can be treated with mitigation strategies, preventive
plans and contingency plans.
Step 5: Monitor and review the risk
Risk management is a continuous process because conditions change. Review, monitor, and
track risks periodically throughout your project. Uncertainty plays a major factor in risk
management. If you build a process around that uncertainty, you can minimise risk for your
project. With less risk, it improves your chances of achieving your project goals.
Building a good risk management plan will help protect your company’s resources,
reputation, and people.
In addition, each organisation communicates risk differently, and has their own internal culture
and risk management protocol. The risk management process should integrate both the internal
and external context when planning for risk.
Projects of all sizes require risk management in some form. If you think of your project as a road,
risks are potholes and sharp bends. Risk management is learning the roads, examining the
conditions of the route you’re about to take and any potential issues.
It isn’t enough to be prepared for the damage if the risk were to occur. A vital part of the role of
a project manager, is to put in place strategies to avoid, manage, and recover from risk.
All industries and organisations manage risk a little differently. However, there are 7 key risk
management principles that you can draw on when you’re looking at integrating a risk
management plan into your project.
Risk management principles
1. Ensure risks are identified early
This is probably the most important principle of risk management – make sure you’re ahead of
the game by completing your risk assessment before the project commences.
Identify the cause of a potential risk and design preventative measures and a response if it was to
occur. After risks have been identified and sourced, risk needs to be measured.
2. Factor in organisational goals and objectives
Ensure your risk management plan ties in with your organisation’s overall goals and objectives.
If a risk that you have flagged, does end up occurring how will it impact the organisation,
financially and reputationally?
Each organisation is going to have different desired outcomes and priorities and these should be
integrated into the risk management plan. The risk strategy should be consistent with the overall
goals and culture of the organisation.
3. Manage risk within context
Context is extremely important when considering project risk, as each organisation will have
different tolerance levels to risks. Various factors (political, technological, legal, societal, etc.)
will impact organisations and industries differently. For example, one organisation might be
particularly vulnerable to its legal environment, while another may need to consider their societal
impacts more closely.
In addition, each organisation communicates risk differently, and has their own internal culture
and risk management protocol. The risk management process should integrate both the internal
and external context when planning for risk.
4. Involve stakeholders
When you’re planning for risk, it’s important to call on the expertise of those who will be
involved in the project (e.g team members, contractors), as well as experts within your
organisation that can provide you with advice for planning for risk (e.g senior managers).
Throughout the risk management process, stakeholders should be involved in the decision-
making process. By drawing on stakeholders for your risk planning, you will identify and gain
insights into potential risks you may not have considered.
5. Ensure responsibilities and roles are clear
While the risk management plan may be owned by one individual such as the project manager or
change manager, it should be operated with transparency and visibility. Everyone should know
the role they play in mitigating risk and responsibilities should be clear and inclusive throughout
the risk management process.
Allow different voices to be heard and encourage questions and discussion. The more people that
are participating, the more risk can be managed creatively and effectively. Each team member
needs to be dynamic, flexible, and responsive. Everyone should be empowered to deal with risk
at their own level.
6. Create a cycle of risk review
Once you have identified the risks and made a risk management plan or strategy, it’s important
not to have a set and forget mentality. During each step in the process, all risks should be
evaluated and any interventions or preventative measures should be implemented if needed.
You can keep everyone in the loop related to the project by reporting on the risk and
communicating any changes with stakeholders in a timely fashion. By reporting throughout the
project you may be able to step in and address any problems that arise before they come to
fruition.
7. Strive for continuous improvement
Once a project has been completed, review how your risk management plan went and whether
there was any room for improvement. Always strive to adapt to how you manage risk and take
these learnings with you to your next project.
Professional project managers that do more than ‘drive a Toyota HiLux!’ – know that risk
management is a core element of project management and the planning process.
If a project manager does not undertake regular risk management activities and this process is
not sufficiently supported by decision makers, then it may lead to problems when activities and
deliverables do not go as planned.
Lack of risk attention can also result in project managers and teams spending more time dealing
with issues, impacting the project even further. All of which could have been resolved in
advance had the risk been appropriately identified and treated earlier.
So to rectify some of the above challenges, James Bawtree, former Director of the AIPM
Board has included five strategies to help you improve your use of risk management and the
likelihood of successful delivery of your projects.
Here’s 5 risk management strategies for your next project
Strategy 1 – Use a risk framework
Ensure your organisation is following a recognised risk management framework. The ISO3100-
2018 is a good starting point.
It is principle based, pragmatic, widely used and is not specific to an industry or sector. This will
help when a new staff or team member starts at your organisation, as there will be less of a
learning curve.
Strategy 2 – Capture risk controls
Make sure risks are captured correctly. For example, using a visual diagram, such as the risk
bow-tie is a great way to start.
The template from Julian Talbot provides a useful guide to the bow-tie diagram. It helps with
capturing each of the core risk elements. My experience is the controls are often missed and
there is often one risk event to one consequence.
Strategy 3 – Assign actions to address risk
Capturing risks is not enough, you need to do something about them. All too often, when I
review or rescue programs and projects, a list of risks exists however they are often out of date
and no one is assigned actions to mitigate them.
Often the steering committee and/or governance groups are not even aware of the key risks that
the program or project faces. So always make sure there is an action assigned to address each
risk.
Strategy 4 – Regularly review risks
Risks must be re-assessed and “residual risk” - the remaining risk post the risk control - updated
on a regular basis. For all but small projects in your organisation, I would recommend this be
undertaken on a monthly basis.
A good way to help achieve this is through a digital platform. A quality tool can help you
capture, share, and discuss risk status. Project teams will know how often updates are made, plus
what has changed including where risk levels are increasing in probability or impact - or both, as
they should be assessed independently.
Strategy 5 – Continually report on risks
Risks must be reported. So ensure each risk has an owner and a person assigned to do something
about the risk.
Report on inherent risk until you are satisfied that you have sufficiently decreased the residual
risk to an acceptable level. Continue reporting on both assessed and residual target acceptable
risk, and who is taking responsibility.
Projects are risky by nature, however by planning ahead and proactively assessing what could go
wrong with the plan, you will be able to manage any associated risks and successfully deliver
your project.
Having a clear risk management process to follow is a vital part of project management. It will
help you identify any potential issues before they occur and ensure you’re monitoring those risks
during the project lifecycle.
Potentially, implementing good risk management could see you mitigate those risks altogether or
prevent small risks from developing into larger ones.
The risk management process
The risk management process is a plan, which outlines the actions and appropriate responses that
will be taken in regards to potential risks.
Step 1: Define the risks
Before your project commences, the first step is conducting a risk assessment and identifying
what the potential risks are. Here are some things to consider when defining risks:
• Event: What could happen?
• Probability: How likely is it to happen?
• Impact: How bad will it be if it happens?
• Mitigation: How can you reduce the probability (and by how much)?
• Contingency: How can you reduce the impact (and by how much)?
Step 2: List all risks and assign a probability
Each risk will have different impacts if they were to occur and some less so than others. After
you have defined what the potential risks are, consider what each of the different risks impact
would be on the project – high, medium or low. If you need to use numbers, you can arrange a
probability scale: 0.01 to 0.33 = Low, 0.34 to 0.66 = Medium, 0.67 to 1.00 = High.
Remember there is no universal formula, as it will vary by the project and organisation. So it
pays to be flexible!
Step 3: Brainstorm with stakeholders and your team
During the risk management process, it is important to receive input from others. If this is an
unfamiliar type of project for your organisation, it also might be beneficial to set up interviews
with industry experts, more experienced project managers, or long term employees.
What to ask:
• What could happen?
• How can it be prevented?
• What to do if it does happen?
When brainstorming with others, it’s important to keep an open mind, as you never know when
an out-of-the-box idea could be the solution you need for resolving a potential risk.
Step 4: Examine risk consequences
From your brainstorming session, you should have information on the possibilities and outcomes
associated with each risk. Each risk should have specific consequences listed – be as specific as
possible.
Over budget is general and does not accurately portray the risk. However a late delivery of
cement to your construction site resulting in a budget blow out of 13% is much more useful.
Step 5: Develop mitigation strategies
It’s common practice to develop mitigation strategies for high or medium risk elements, which
will help reduce their impact or eliminate them altogether. Address critical risks first, which you
identified as having a high impact on the project and assign roles and responsibilities for each
risk.
Step 6: Monitor and update your risk management plan
The process of risk management doesn’t stop after you’ve initially created a thorough risk
management plan, as it should continue throughout the project lifecycle.
Continually monitor risks and update stakeholders by creating a reporting system for risks. Keep
in mind, risks can change over time and one that you had initially assigned as low could turn into
a high risk at a later stage.
Step 7: Analyse the effectiveness of your risk management strategy
Lastly don’t forget to take learnings away from the project and how you can implement them
into your next project.
By following a risk management plan, you will help define uncertainty surrounding your project
and create a system to reduce negative risk.
