The risk analysis proceeds in 4 simple steps: identify, analyze, respond and control the risks of your project. It is present in all kinds of project and could be all the things that affect the stability of your business - with more than one impact. The desired outcome of the risk analysis is to propose a list of concrete actions. You can do this risk analysis with your team, which will ensure you that anyone is aware about all the risks you are taking together.
A risk is threat or an opportunity
The PMBOK, which is one of the project management bibles, defines the risk as “an uncertain event or condition which, if it occurs, can have a positive or a negative impact on a project’s objective, such as time, cost, scope, quality,etc”. Indeed, before starting to identify the risk, you have to remember that a risk could be either a threat OR an opportunity. For example, in Japanese, the words “risk” and “opportunity” are actually one single word. Here is a typology of the different categories of risk:
- Financial: what is happening if this investor is finally not supporting you?
- Legal: someone may have stolen your idea, what are you going to do?
- Political: a new standard or a new taxation is going to be set in your country, and you have to be prepared.
- Physical: your office is set on an earthquake zone, too bad.
- Intangible: you thought than learning iOS programming would have been way easier...
- Technical: did you know there were some internet cuts in this part of the world?
Finally a risk has to be distinguished from an issue, which according to the PMBOK is: “a point of matter or disagreement, or a point or matter that is not settled and is under discussion”.
The risk identification
Identifying the risk is the key to success. You can see the desired outcome in the second picture. First, make a list of 20 risks you believe are a real possibility. To clearly identify them, you have to qualify each risk by using the following sentence: as a result of a, anmay happen within the followingthat may lead toanof the project. Since you have identify all your risks, you have to know how to prioritize in terms of probability of occurrence and impact ( from low to critical) and dispose them accordingly in a matrix, as shown in the second picture.
Find the positive response
Here we come to the most important part of the work. You have multiple choice of response for each risk according to its position in the matrix: avoid it, transfer it, accept it, ignore it, mitigate it or understand it as a contingent event. Some examples of risks with low impact and probability could simply be ignored, while risks with high impact and probability should be avoided.
Choosing to avoid a risk will consist of eliminating the threat at the very beginning of the project. You can also choose to transfer the responsibility of risk to another party, which basically means you invest in insurance, or accept the risk and the consequences by simply acknowledging it with rest of your team. Finally, if you choose to set a mitigation or contingency plan, here are some special aspects that you can focus on.
Contingency plan vs mitigation plan
First possibility, you can choose to reduce the impact of the risk with a so called contingency plan. This plan should list all of the actions that have be done in order to identify the risk trigger. Second possibility, you can choose to reduce the probability of the event by taking actions in advance and then create a so called mitigation plan to put into action when the risk materializes. But still, these two plans should determine clearly the impact date, assign actions owners, be monitored regularly and have sufficient resources.
Finally, if you are working in a team, it could be a challenge trying to involve everybody in this risk analysis, as people often don’t want to spend time focusing on something that will “maybe” happen. “Why not focus on what is happening right now?” or “why be so pessimistic?” will probably be the arguments you will be hearing a lot. That is why even when your team understands the importance of risk analysis, it is important to communicate on a regular basis about the evolution or monitoring of your plan.
Image: courtesy of Bigstockphoto.com