A Risk Management Plan, Business Plan Example

Introduction

The management of risks is one of the most critical elements of project management. Despite the importance of this it is one of the least understood.  Risks can occur at any stage of a project development and the severity often increases with the depth the project has penetrated.  For example in an IT project a risk is far easily mitigated if detected at the requirements stage. If however a risk impacts in the design stage, then the consequences of mitigating the risk and taking corrective action is much more severe.  As such it is essential to have a proper risk management plan that has a formal association with the project plan where the necessary mitigation actions may be assigned, implemented and quantified.  Risks or Issues have the ability to quickly destroy the integrity of project plans and as there is no avoiding them it is essential to have a risk mitigation strategy in place. (Pacelli, L. 2011).

Figure 1: 5 step approaches to risk management

Risk management approach

The Project Management Body of Knowledge (PMBOK)[1] provides an excellent step-by-step guide to implementing risk management methodology in a project. The five step approach is illustrated in Fig 1 to the right.  (1) Identify the project risks – techniques used are brainstorming, interviews, business process and data analysis, observation etc.  At this stage of preliminary risk assessment we are trying to capture the main risks or threats. (2) Analyse the risks – understand what the threat is and what it constitutes in potential damage if it occurs (3) prioritize the risks – essentially in terms of severity to the project.  A colour code of Red, Amber, Green is useful her [Red = A Showstopper, will arrest the project Amber = Have an impact but not arrest the project Green = a likely threat but of low impact].  (3) Put risks in order of priority for action and produce appropriate mitigation statements (4) The risks are entered as line items in the project plan with resources assigned to them (5) The Project Manager monitors the risks and ensures that they are properly mitigated and retains the integrity of the project plan.  (NPD, 2011)

Risk identification

Risk identification techniques including:  checklists, project plan analysis, and facilitated risk identification. Project resource risks are those risks associated with the individuals involved in the project.  These may include skills, availability, commitment, and turnover.  Resources are not limited to project team members; stakeholders affected by the deployment of the new system may also introduce resource risks to the project. Schedule risks are those potential problems related to project schedules and milestone dates.  They include date (and often cost or resource) constraints and the ability of the project management to respond to schedule problems. Estimating risks include cost constraints such as fixed price or budget ceilings, and problems brought on by a lack of estimating techniques or experience.  Systems Risks: This is a broad category of risks associated with the size and complexity of the system being developed.  System requirement risks are related to the application’s data, processing, user interface and performance.

Stakeholder interviews: Stakeholder interviews can be conducted early in the project to identify potential risk events.  Some stakeholders can also assist with risk assessment and participate in risk response planning.

Workshops : Facilitated risk identification sessions can be conducted with the project team and other stakeholders to identify potential risks.  These sessions should be kept positive; the purpose is to identify potential problems for further risk assessment

Delphi Technique: Invented by the Rand Corporation in the 1960’s, the Delphi Technique is a means of coordinating input from experts where geographic separation or busy schedules make interactive sessions difficult.  Because the Delphi technique can be done anonymously, it is also useful where there is a need to minimize friction or remove bias.

Risk qualification and prioritization

Figure 2: Probability Risk Matrix

Probability Impact Matrix: This matrix indicates the impact of risk against the anticipated probability of the risk ( Fig 2 refers). The probability and impact matrix is a vehicle whereby the Project Manager and his team determine elements of risks involved in the project and the activities or phases where these may impact the project (Project Management Knowledge, 2011).

Risk monitoring, mitigation and avoidence

Risks and responses should be reported to the project sponsor and other management stakeholders on project status and progress reports.  Risk management items should be also part of regularly scheduled project Steering Committee meetings. When risk events occur, the impact and actual damage to the project are assessed.  Appropriate corrective response plans, workarounds and action items are executed. When a risk event does occur, it becomes an issue that  has an impact on the project deliverables and as such it is important that these are resolved at the earliest opportunity. The Illustration in Fig 3 illustrates a simple Excel table approach in order to record, monitor and manage a risk schedule.

Table 1 : Example of Risk Register (partial)

Notes:

01 = Unique identifier to the risk

Description = Describes the type of risk

Impact = the nature or severity of risk : Severe, Medium, and Low

Severity : Red, Amber, Green – assists in prioritising the risk]

Mitigation : Risk mitigation action taken

XRef : The activity line item on the plan implementing the mitigation action

References

NPD. (2011, 11 13). Project Risk Management: A Proactive Approach. Retrieved from New Product Dynamics (NPD): http://www.europa.com/~preston/project-risk-management.htm

Pacelli, L. (2011, 11 13). Manage project risks and issues. Retrieved from Microsoft Office: http://office.microsoft.com/en-us/project-help/manage-project-risks-and-issues-HA010007249.aspx

Project Management Knowledge. (2011, 11 13). Probability and Impact Matrix. Retrieved from Project Management Knowledge: http://project-management-knowledge.com/definitions/p/probability-and-impact-matrix/

[1] Produced by the Project Management Institute (PMI) in the US.