Project Risk Management
Efficiency Notes – Risk Series 1
What It Is Why You Need It
A process for identifying, assessing, and Risk Management is 1 of 10 Knowledge Areas
mitigating risks to scope, schedule and cost on in the Project Management Body of Knowledge
a project. Risks come in the form of (PMBOK®) which a Project Manager must
opportunities and threats and are scored on understand to get the Project Management
probability of occurrence and impact on project. Professional (PMP®) certification.
What You Need
1. A Risk Management Plan 4. Qualitative / Quantitative Analysis Tools
Defined process agreed upon by stakeholders Methods for analyzing / evaluating risks
2. Identify Risks – Risk Capture Form 5. Risk Response / Mitigation Plan
A way to efficiently capture identified project Determine if Risk is acceptable or not based
risks and add to Risk Register on assessment and plan for mitigation
3. Risk Register – Log Risks 6. Control Risks
A log of identified risks and their status Assess effectiveness (risk audits) and improve
Risk Register - Example
Risk Identified Probability Impact Action to Prevent / Manage Risk
Establish team with written
Failure to retain key project staff Low High commitment to timeline, ensure
knowledge captured through project
Qualitative Assessment Quantitative Assessment
Subjective evaluation of risk factors visualized Objective numerical probabilistic assessment
in a matrix (heat map – see reverse) and of impact and probability of risk factors.
prioritized based on probability and impact.
There are many methodologies available:
Rating scales are pre-defined. • Critical Path Method
• Fault Tree Analysis
Impact scales are tailored to the organization • Monte Carlo Simulation
and the project objectives. • Sensitivity Analysis
• FMEA
Get smart forms, reports and processes on your
tablet. [Link]
Project Risk Management
Efficiency Notes – Risk Series 1
Probabilities and Impact Matrix (Heat Map)
Probability Threats Opportunities
Risk Score = Probability x Impact High (RED) / Med (YEL) / Low (GRN)
0.90
0.05 0.09 0.18 0.38 0.72 High High High Med Low
Very Likely
0.70
0.04 0.07 0.14 0.28 0.56 High High Med Med Low
Likely
0.50 0.03 0.05 0.10 0.12 0.40 High High Med Low Low
Possible
0.30 Med Low Low
0.02 0.03 0.06 0.12 0.24 High Med
Unlikely
0.10
0.01 0.01 0.02 0.04 0.08 Med Low Low Low Low
Very Unlikely
Very Very
0.05 0.10 0.20 0.40 0.80 High Med. Low
High Low
Example Impact Definitions – May Be Tailored to Each Project Objective
Impact on an Objective (e.g. Cost, Schedule, Scope, Quality)
Risks on the log are scored to determine impact HIGH = Severe and likely to happen
on the project and what (if anything) needs to be
MEDIUM = Moderate risk; impact is not
done to mitigate and control that risk.
so severe
Evaluated risks with a mitigation / control plan LOW = Low risk of occurrence, low
are logged on a Risk Response Matrix project impact if it does occur
Mitigation
Objective is to reduce the probability and/or Mitigation actions may be costly / time
consequences of a risk event to an acceptable consuming; actions are balanced against
threshold and define appropriate response. priority level of the risk.
Questions To Ask: Organizations transfer risk where possible.
• What are the available options?
• Tradeoffs (cost / benefit) of each option? Low-risk factors may be recognized but
• Impacts of current decisions on options? absorbed as a matter of policy.
Risk Response Matrix
Risk Event Response Contingency Plan Trigger Responsible
Mitigate: vendor
Equipment
change Replace Failure J. Smith
Malfunction
Transfer: warranty
Get smart forms, reports and processes on your
tablet. [Link]