How to identify and manage risk in projects

Risk management is the key that helps you predict the future and have things ready in your “back pocket” to “fight fires”.

However, you can extinguish only one “fire” at a time so risk management helps you spot the positive things you can do to complete a project and achieve the outcomes more quickly.

Identifying risk

Identifying risk is probably one of the first things you do when starting a project. Risk is uncertainty and is highest at the start but the risks are not always obvious and often need to be teased out. This needs a collaborative effort to identify what the risks are, especially if you don’t have experience or background in a particular sector.

A simple way to get people contributing their ideas when identifying risks is to ask them: “what are your worries about this project?” This is useful, because it’s not a difficult question and it will give you something to investigate in more detail.

I actually run “worry workshops”, getting people to write their worries on sticky notes. Some of these “worries” will eventually be identified as genuine project risks

The risk register

Review your risk register regularly. Hold risk workshops which run through the risks and check whether your mitigations have been implemented and are still valid. The risk register is fundamental to the project manager’s role; it’s not something I suggest you can delegate, though you can delegate elements, such as mitigations.

Common mistakes

People in your team need to understand what risk management is and that it’s part of their job too.

So, you need to encourage people in the team to contribute to identifying risks to avoid an observation such as: “I knew that was going to happen…”. If they knew, why didn’t they say something?

People are afraid of risk and fear it will kill a project. That’s not altogether true: risks are just things we need to keep an eye on and create extra protection for.

However, more junior project managers can make the mistake of picking 5-10 risks but not really engaging the teams to find out what else might happen. There needs to be a shared vision for what may trouble the project.

Common risks

Resource-related risks are probably the ones I encounter most often: that is lack of availability, especially among people who are involved in the project only part-time.

This is difficult to mitigate and you need to look at how dependent you are on particular resources and factor the risk into your schedule.

Project risk and best practice

PRINCE2^® is clear that you’ve got to be thinking about risk all the time and ensuring you are communicating clearly about risk.

With Agile approaches, the idea is to de-risk by not over-planning the detail, therefore not travelling in the wrong direction for too long. That’s good, but it still requires a broader risk management approach, especially finding out what business users are afraid of.

For this, I use a “worries wall” on which people can write their concerns about the project. Then the project manager can look at the wall, remove the silly comments and investigate the useful ones!

Identifying and managing risk runs through the DNA of a project manager and their project. The more mature project managers appreciate risk management and the importance of being in control.

Read David McCreey's previous AXELOS Blog Post, PRINCE2® 2017 Update: a good thing gets better.