PROJECT RISK MANAGEMENT

Project risk management is systematic process of identifying, analyzing, responding to and

monitoring risk that could affect a project’s objectives. It aims to increase the likelihood and
impact of positive events and reduce the likelihood and impact of adverse events through
structured practices, such as risk identification, assessment, prioritization, response planning and
on going monitoring and communication. Kerzner, H 2017.

Purpose of project risk management

The main goal is to:
 Minimize negative risks (threats).
 Maximize positive risks (opportunities).
 Increase the chances of project success.

Example: In a school construction project in Harare, risks such as delayed cement delivery or
heavy rains can cause delays. Through risk management, the project team can prepare alternative
suppliers or plan work around weather forecasts.
Importance of Project Risk Management

 Predicts Problems Early

Helps the team identify possible issues before they occur.
Example: Predicting that political unrest could delay material imports.

 Saves Time and Money

By anticipating and preventing costly delays.
Example: Planning for backup power sources prevents work stoppages.

 Improves Decision-Making
Managers make smarter choices when they understand risk impacts.

 Builds Stakeholder Confidence

 Clients and funders trust a project that has a clear risk plan.

 Increases Project Success Rate

Projects with strong risk management are more likely to finish on time and within budget.

TYPES OF PROJECT RISKS

Risk at strategic level
 Commercial risks
 Financial risks
 Directional risks
 Macro- environmental risks
Risk at operational level
 Contact risks factors
 Legal risks
 Negotiation risks
 Financial risks
RISK AT STRATEGIC LEVEL
The source of risks at strategic level involves factors that may affect the long-term direction of
the business. Bromiley,2015.
Commercial risks
Commercial risks encompass potential threats and challenges that can impact an organization’s
financial health, operational efficiency and legal compliance.

 Lack of direction by the board or poor direction of the board.

 Lack of knowledge of new markets or products.
 Failure to manage volatile market places or material cost.
 Poor selection supply chain partners.

Example: A company launches a new housing project in Harare, but demand drops because
many people cannot afford the prices.
Example: A supplier fails to deliver materials on time, delaying the project and increasing costs.
Financial risks
Financial risks refer to the uncertainty surrounding the future financial outcomes of an
organization, encompassing the potential for monetary loss or adverse impact on its asserts and
earning. Damodaran, 2007.
 Arises from financial structures and transactions for example an assessment of how the
capital structure of a company may change and it may indicate the financial risk of the
company.
 Cash flow and working capital.
 Mismanagement of funds.
Example: A project funded in USD becomes more expensive due to a fall in local currency value
(ZWL).
Example: The interest rate on a project loan increases, making repayment difficult.

Directional risk
Directional risks are risks related to the strategic choices, legal, leadership decisions and
organizational directions taken by management. They occur when the project or organization
choses the wrong strategic path or fails to adapt to changing circumstances.
 These risks arise from poor vision, unclear goals, wrong priorities, or failure to align the
project with the overall organization strategy.
Example: A company decides to expand into a new market without adequate research leading to
failure.
Example: Management chooses a technology or project that does not fit the organization’s long-
term goals.
Macro-environmental risk
 Occurs after a change in legislation, rule or regulation as well as PESTEL factors which
might then have a direct or indirect impact on the performance of the organization for
example the need to reduce population to required legal standards.
 Compliance, arises from the need to comply with law and regulation and policy.
 Such risks affect all organizations operating within the same environment and can change
the success conditions of a project.

Examples:
Political: Change of government policy or instability disrupts project funding.
Economic: Economic recession or high inflation affects affordability of products.
Social: Changing social trends reduce public support for a project (e.g., opposition to mining in
rural areas).
Technological: New technology makes the current project’s system obsolete.
Environmental: Drought or flooding halts construction projects.
Legal: New labor or environmental laws increase compliance costs.

Contract Risks
Contract risks occur when there are uncertainties or failures related to the terms, performance, or
enforcement of contracts between the project and its partners, suppliers, or clients.
 Contracts are legally binding agreements that define obligations, deliverables, timelines,
and penalties. Poorly written or misunderstood contracts can lead to disputes, delays, and
financial losses.

Examples: The project fails to clearly define deliverables in a contract, leading to

disagreements with the contractor.
Example: A supplier breaches a contract by not delivering materials on time.

Impact

 Project delays due to disputes.

 Legal action or contract termination.
 Financial loss due to penalties or compensation claims.

How to Manage:

 Use clear, detailed contracts reviewed by legal experts.

Monitor contract performance regularly.
 Keep proper documentation of all contractual communications.

Legal Risks
Legal risks are risks that arise when a project or organization fails to comply with laws,
regulations, or legal obligations that apply to its operations.

 Every project operates under certain legal frameworks — for example, labor laws,
environmental laws, procurement laws, or safety regulations. Violations can lead to
penalties, lawsuits, or suspension of the project.

Examples: The project fails to follow labor laws in hiring workers, leading to legal
complaints.
Example: Environmental laws are violated due to improper waste disposal.

Impact

 Fines or penalties from regulatory bodies.

 Project shutdown or delays due to investigations.
 Loss of reputation and stakeholder trust.

How to Manage:

 Ensure continuous legal compliance checks.

 Engage legal advisors for contract and policy review.
 Train employees on relevant laws and regulations.

Negotiation Risks

Negotiation risks occur when negotiations with stakeholders, suppliers, funders, or employees
fail or produce unfavorable outcomes for the project.
 Projects often depend on negotiations for contracts, funding, partnerships, and
pricing. Poor negotiation can result in unfavorable terms, misunderstandings, or
loss of opportunities.

Examples: The project team agrees to unrealistic deadlines under pressure during
negotiations.
Example: Failure to negotiate fair prices increases project costs.

Impact
  Increased project costs or reduced profit.
 Loss of trust and poor relationships with partners.
 Delays due to re-negotiation or contract cancellation.

How to Manage
 Prepare thoroughly before negotiations.
 Involve experienced negotiators.
 Ensure transparency and documentation of all agreements.

Financial Risks
Financial risks are risks that affect the availability, management, or control of financial resources
during project implementation.
 These risks arise from poor budgeting, cost overruns, cash flow problems, or funding
delays — directly threatening the project’s ability to operate effectively.

Examples: Budget overruns due to rising material costs.

Example: Delayed payments from clients or funders disrupt cash flow.
Example: Mismanagement of funds or accounting errors.
Example Fraud or corruption in handling project finances.

Impact

 Suspension or delay of project activities.

 Loss of investor or donor confidence.
 Incomplete or low-quality project outcomes.

How to Manage:

 Maintain accurate financial records and audits.

 Use contingency budgets for unexpected costs.
 Monitor financial performance regularly.

RISK MANAGEMENT PLANNING

Risk Management Planning is the process of deciding how to approach, plan, and execute risk
management activities for a [Link] involves developing a structured plan that explains how
risks will be identified, analyzed, monitored, and controlled throughout the project lifecycle.
According to the Project Management Institute (PMI, 2017): “Risk management planning is the
process of defining how to conduct risk management activities for a project.”In simple terms, it
means creating a roadmap that guides how the project team will deal with uncertainties both
threats and opportunities.

The main goals of risk management planning are to:

 Ensure that risk management is systematic and consistent.

 Identify who is responsible for managing risks.
 Decide what tools and methods will be used to analyze risks.
 Prepare response strategies in advance to reduce negative impacts.
 Improve communication and decision-making when risks occur.

Key Components of a Risk Management Plan

A good risk management plan typically includes the following elements:

1. Methodology
This section explains how the team will perform risk management activities including tools,
techniques, and data sources.
Example: Using brainstorming, SWOT analysis, and risk matrices to identify and assess risks.
2. Roles and Responsibilities
It defines who is responsible for identifying, analyzing, and responding to risks.
Example: The project manager oversees all risk activities.
Example: The finance officer handles financial risks.
Example : The legal advisor manages contract and compliance risks.
3. Risk Categories
These are groups or classifications of possible risks to ensure a comprehensive analysis.

Examples
Strategic risks: political, economic.
Operational risks: human resources, quality, equipment.
Financial risks: budget overruns, funding shortages.
Legal/Compliance risks: policy changes, regulatory issues.

4. Risk Identification Process

Describes the approach for finding potential risks that could affect the project.
Example: Using checklists, interviews, and historical project data to identify possible threats.
5. Risk Analysis Approach
Specifies how risks will be analyzed both qualitatively and quantitatively.

Qualitative analysis: Ranking risks based on probability and impact (e.g., high, medium, low).
Quantitative analysis: Using numerical methods like expected monetary value or simulations to
estimate effects.

6. Risk Response Planning

Outlines strategies to deal with risks once identified.

Example:
Avoidance: Changing the plan to remove the risk.
Mitigation: Reducing the likelihood or impact of a risk.
Transfer: Shifting the risk to another party (through insurance or outsourcing).
Acceptance: Acknowledging the risk and preparing contingency plans.

7. Risk Monitoring and Control

Explains how the project team will track risks and evaluate response effectiveness during the
project.
Example: Regular risk review meetings.
Example: Updating the risk register as new risks emerge.

8. Risk Register

A risk register (or risk log) is a living document that lists all identified risks, their likelihood,
impact, owners, and response strategies.

Example (simplified):

| Risk Description | Probability | Impact | Risk Owner | Response Plan |

| ---------------- | ----------- | ------ | ------------------- | -------------------------- |
| Supplier delays | High | High | Procurement officer | Identify backup supplier |
| Cost overrun | Medium | High | Finance manager | Add 10% contingency budget |

Importance of Risk Management Planning

[Link] the project team to handle uncertainties effectively.

[Link] project delays and cost overruns by anticipating problems early.
[Link] accountability by assigning risk ownership.
[Link] stakeholder confidence in the project’s ability to manage threats.
5. Supports informed decision-making through structured analysis.
Example in a Zimbabwean Context

Imagine a road construction project in Harare:

 The project manager develops a risk management plan identifying possible risks such as
inflation, fuel shortages, and delays in material delivery.
 The plan assigns each risk to a responsible person and outlines mitigation strategies such
as bulk fuel purchasing, local sourcing, and financial contingencies.
 As the project progresses, risks are monitored and updated monthly.

RISK IDENTFICATION AND ANALYSIS

Risk identification
Risk identification is the process of recognizing and documenting potential risks that could affect
the project’s objectives either positively (opportunities) or negatively (threats). According to the
Project Management Institute (PMI, 2017)

“Risk identification involves determining which risks might affect the project and documenting
their characteristics. “In simple terms, it means finding out what could go wrong (or right) before
it happens.
Purpose of Risk Identification
To anticipate problems early before they affect the project.
To ensure no major risks are overlooked.
To create a complete list of risks to be analyzed and monitored later.
To help managers plan responses in advance and reduce uncertainty.
Steps in Risk Identification
Step 1: Review Project Documents
Start by reviewing the project plan, scope, budget, and schedule to find possible risk areas.
Example: If a project depends on imported materials, there is a risk of customs delays or
exchange rate fluctuations.

Step 2: Identify Risk Sources

Look at all possible sources of risk — internal and external.

Step 3: Use Risk Identification Techniques

Common techniques include:

 Brainstorming – Project team members discuss and list possible risks.

Example: Engineers, accountants, and procurement staff brainstorm potential project delays.

 Interviews/Expert Judgment– Consulting experienced individuals or professionals.

Example: Interviewing a construction consultant to identify past project risks.
  SWOT Analysis – Looking at project Strengths, Weaknesses, Opportunities, and Threats.

 Checklists – Using a standard list of common risks from previous projects.

 Cause-and-Effect (Ishikawa/Fishbone) Diagram – Helps trace the root causes of possible

problems.

 Assumption Analysis– Testing project assumptions to see what could go wrong if they are
false.
 Delphi Technique – Anonymous expert opinions collected in rounds until agreement is
reached.
Step 4: Document the Risks
All identified risks should be recorded in a Risk Register a key tool in risk management.
Each risk should include:
 A short description.
 The cause of the risk.
 The potential impact.
 The possible response.
 The person responsible.
Example (simplified Risk Register):

| Risk ID | Risk Description | Cause | Impact | Owner |

| ----------- | ----------------------- | ------------------- | ------------- | ------------------- |
| R1 | Delays in cement supply | Transport shortages | Project delay | Procurement officer |
| R2 | Budget overrun | Inflation | Extra costs | Finance manager |

Risk Analysis
After identifying risks, the next step is to analyze and assess them to understand their probability,
impact, and priority.

There are two main types of risk analysis:

 Qualitative Risk Analysis
 Quantitative Risk Analysis
Qualitative analysis is the process of prioritizing risks based on their probability (likelihood and
impact (severity), using descriptive or ranking scales (like high, medium, low).

Purpose:
 To determine which risks, need urgent attention.
 To focus limited resources on the most significant risks.
 To create a basis for detailed quantitative analysis.
Steps in Qualitative Analysis

1. Assess Probability and Impact

Each risk is rated for likelihood (chance of happening) and impact (effect on project).
Example rating scales:

| Rating | Probability (%) | Impact Description |

| ------ | --------------- | ---------------------------- |
| High | >70% | Major delay or cost increase |
| Medium | 30–70% | Moderate impact |
| Low | <30% | Minor impact |

2. Use a Probability-Impact Matrix

This is a grid used to rank risks as High, Medium, or Low priority.
Example:
 | Impact ↓ / Probability → | Low | Medium | High |
| ------------------------ | -------- | ---------- | --------- |
| High Impact | Medium | High | Very High |
| Medium Impact Low | Medium | High |
| Low Impact | Very Low | Low | Medium |

Risks in the High–High zone are the most critical and require immediate mitigation.

3. Categorize Risks
Group risks by type (e.g., financial, technical, legal) to find which areas are most vulnerable.

4. Update the Risk Register

Add probability and impact ratings to each identified risk.
Example:

| Risk | Probability | Impact | Priority | Action |

| -------------------- | ----------- | ------ | -------- | -------------------- |
| Supplier delay | High | High | Critical | Find backup supplier |
| Currency fluctuation | Medium | High | Moderate | Create buffer budget |

Quantitative Risk Analysis

Quantitative analysis involves numerical methods to estimate the potential financial or time
impact of identified risks.
It uses data, models, and statistics to measure overall project risk exposure.
Purpose:
 To quantify the possible cost or schedule impacts of risks.
 To help in making informed financial decisions.
 To evaluate alternative responses using data.
Steps in Quantitative Risk Analysis

1. Collect Numerical Data

Use project cost estimates, schedules, and past project data.
2. Determine Risk Probability and Impact Values
Assign numerical probabilities (for example, 0.1, 0.3, 0.7) and impact amounts (example,
$5,000, 2 weeks delay).
3. Calculate Expected Monetary Value (EMV)
Formula:
[ EMV = Probability \times Impact]
Example:
If a risk has a 30% chance (0.3) of causing a $10,000 loss\,
EMV = 0.3 × 10,000 = $3,000 expected loss.

4. *Perform Sensitivity Analysis*

Identifies which risks have the greatest potential effect on project outcomes.

5. Monte Carlo Simulation (Advanced)

A computer-based method that simulates different scenarios to estimate the range of possible
outcomes.

Output of Risk Analysis

After analysis, you get:

 A prioritized list of risks based on significance.
 A numerical estimation of potential cost or schedule impacts.
 Updated risk register with mitigation plans.
 Improved decision-making for resource allocation.
Example in a Zimbabwean Context
For a water supply project in Bulawayo:
Identified risks: water pipe delivery delays, inflation, poor weather, and strikes.
Qualitative analysis: inflation (High probability, High impact).
Quantitative analysis: inflation might increase total cost by 15%, equal to US$100,000 extra.
Action: include a contingency budget and plan for local material sourcing.

Risk Monitoring and Control

Risk Monitoring and Control is keeping an eye on all the risks in a project, checking if the plans
to handle them are working, and taking action if things go wrong or new risks appear.
Purpose (Simple Version)

1. Check if risk plans are working – Are the actions we took reducing the risks?
2. Spot new risks – Sometimes new problems appear during the project.
3. Update the risk list – Keep track of all risks, old and new.
4. Make decisions – Adjust plans if risks change or treatments aren’t effective.

How It Works (Step by Step)

1. Track existing risks – Watch the risks we already know about.

Example: Supplier is late delivering cement — check weekly.
2. Look for new risks – New problems can appear.
Example: Sudden fuel price hike or heavy rains.
[Link] effectiveness– Are our solutions working?
Example: Backup generator works during power cuts?
4. Take action if needed – Adjust plans or add new solutions.
Example: Hire security if equipment theft risk rises.
5. Communicate and update – Share risk updates with the team and keep the risk register current.

Example in Zimbabwean Context

Project: Building a school in Harare
Known risks: delayed materials, inflation.
New risks: heavy rains, local labor strike. Action: Track deliveries, adjust budget for inflation,
plan work around rain, hire temporary staff during strike.
Result: The project continues smoothly because risks are monitored and controlled.
References

Project Management Institute (PMI), 2017. *A Guide to the Project Management Body of
Knowledge (PMBOK® Guide). 6th ed. Newtown Square, PA: Project Management Institute.

ISO 31000:2018, 2018. *Risk Management — Guidelines. Geneva: International Organization

for Standardization.
Hillson, D., 2017. Practical Project Risk Management: The ATOM Methodology. 3rd ed. New
York: Ro…
Turner, R., 2000. The Handbook of Project-Based Management. 2nd ed. New York: McGraw-
Hill.

Turner, R. & Müller, R., 2005. The project manager’s leadership style as a success factor on
projects: a literature review. Project Management Journal, 36(1), pp.49–61.

.Zwikael, O. & Globerson, S., 2006. From critical success factors to critical success processes.
International Journal of Production Research, 44(17), pp.3435–3449.

Zwikael, O. & Ahn, M., 2011. The effectiveness of risk management: an analysis of project risk
planning acros