Project Risk Management

Project management is all about optimizing the use of available resources and balancing priorities of multiple stakeholders. Everyone with experience in project management knows some of the basic variables, such as time, budget and personnel. For a high-level view of complex projects, however, it’s important to make risk management a part of your decision-making process.

The PMBOK guidelines list seven processes for managing project risk.

Practitioners have long felt that earlier versions of PMBOK focused too heavily on identifying and quantifying risks, instead of concentrating on executing the planned risk responses. Without implementing risk responses effectively any effort in creating a risk register will be in vain. The latest edition of PMBOK corrects this oversight.

What Is Risk in the Context of Project Management?

Risk is part of decision calculations for everyone, whether dealing with a project at work, choosing a route to an unfamiliar destination, or deciding to put trust in an unknown vendor. Put in the simplest terms, risk is the probability of loss or harm. People make judgments about risk constantly, although they don’t always have the knowledge to predict it accurately.

Project risk is a little bit different—it’s an uncertain event, one that may or may not occur, that would have a negative impact on a project outcome should it transpire. Naturally, there are countless negative events that could happen, so project managers must learn to identify and focus on the ones that are most likely.

We talk about risk mitigation rather than elimination because there is no such thing as a risk-free project. In most cases, trying to eliminate risks entirely will undermine the value of your assets and make the project outcome less effective even if you get the results you desire.

Imagine an example: Your company has an expensive server that carries a great deal of important information from many project stakeholders. The server is a valuable project asset required for the success of the project—and an adverse event, such as a hacking attack, would be a serious issue.
You could eliminate risk by unplugging the server from the network so only users with biometric access to the server room door could use it. However, such a course of action would profoundly undercut the server’s value and might make it impossible to realize the project’s objectives.

Why Is It Hard to Make Risk Management Part of Project Strategy?

Unfortunately, a cohesive risk management strategy is not part of many project plans. When there are significant, familiar risks—known risks—a project plan is much more likely to take them into account. Known risks, as serious as they may be, represent only a fraction of possible project risks: It’s truly the unknown risks that have the potential to be the most devastating.

Certain types of risks are associated with certain projects. For example, safety risks are among the most common and significant in construction projects. International projects are subject to fluctuation in the value of currency and the market price of key supplies.

Risk management strategy should begin with the known elements that have arisen in previous projects. There are likely processes in place to deal with them effectively. That still leaves the question, however: How can a project management leader apply the creativity and analytical skills needed to uncover other probable risks?

Improving Risk Management Posture in Project Strategy

Risk management deals with the unpredictable, but that doesn’t make it mysterious. By taking a structured approach, it’s possible for teams and individual project managers to recognize known risks that may have “flown under the radar” before.

Let’s consider some of the ways to apply risk management in practice:

Go from Risk Consequences to Causes

Ask someone to think about a risk, and without realizing it, he or she will probably focus on the consequences of that risk. For example, if a project relies upon the timely delivery of a certain parcel, late delivery is not a risk, but a consequence of risk. Drill down to the potential causes of the late delivery, and then focus on those within your influence.

Separate Business Risk and Project Risk

Certain adverse events that can affect your project are more effectively thought of as business risks rather than project risks. Key personnel could leave the organization unexpectedly, leaving the project in limbo, but this risk is outside the direct influence of the project. It exists on the organizational level. Again, the key here is to define the project team’s scope of influence.

Look for Areas of Uncertainty

Parts of your project plan that include ambiguity typically hide risk. However, uncertainty only becomes risk when there’s a significant business constraint involved. For example, you might be using a new, unfamiliar technology to achieve your project goals, but this will only evolve into a risk if there are no personnel who can manage the technology effectively.

Select and Emphasize Priority Risks

Once you have a list of potential risks, it is essential to narrow them down into priority risks. These events have two traits: a) They are actually probable, and b) They would have a significant adverse effect on the project. Focus on these.

Once a project manager sets aside the thought of taking on all possible risks and focuses on likeliest risks, he or she is positioned to make a significant contribution to the odds of success. Risk management is rarely lauded—one of life’s imperfections is that it’s hard to get credit for preventing something that never happened. When you add it to your project management toolkit, however, you could find risk management makes the difference between success and failure.

Risks are Good and Bad!

While many consider risks to be threats, it is important to recognize that risks are opportunities as well. Our recommendation is to mitigate the threats first and then set aside time and effort to identify good risks. For example, if it is an “events project” like a conference, is there any opportunity to reduce the project cost? Maybe via a sponsorship? If so we consider this as a risk event that reduces the cost of the project!

Learn More

Boston University’s MS in Project Management online program goes beyond the standard project management body of knowledge in course design and instruction. We teach you how to think critically, induce performance, manage ethical and cultural challenges, and respond to unforeseen obstacles that arise during the project life cycle. Anyone can learn how to manage projects on time and within budget. The difference at BU is that students learn how to manage multiple projects and how they integrate at an enterprise level.