General introduction to Risk management

Every day we take risks. If we cross the street we risk being run over. If we go down the stairs, we risk missing a step and tumbling down. Taking risks is such a common occurrence, that we tend to ignore it. Indeed, life would be unbearable if we constantly worried whether we should or should not carry out a certain task or take an action, because the risk is, or is not, acceptable.

With projects, however, this luxury of ignoring the risks cannot be permitted. By their very nature, because projects are inherently unique and often incorporate new techniques and procedures, they are risk prone and risk has to be considered right from the start. It then has to be subjected to a disciplined regular review and investigative procedure known as risk management.

Before applying risk management procedures, many organizations produce a Risk Management Plan. This is a document produced at the start of the project which sets out the strategic requirements for risk assessment and the whole risk management procedure. In certain situations the risk management plan should be produced at the estimating or contract tender stage to ensure that adequate provisions are made in the cost build-up of the tender document.

The Project Management Plan (PMP) should include a resume of the Risk Management Plan, which will first of all define the scope and areas to which risk management applies, particularly the risk types to be investigated. It will also specify which techniques will be used for risk identification and assessment, whether SWOT (Strengths, Weaknesses, Opportunities and Threats) analysis is required and which risks (if any) require a more rigorous quantitative analysis such as Monte Carlo methods.

The Risk Management Plan will set out the type, content and frequency of reports, the roles of risk owners and the definition of the impact and probability criteria in qualitative and/or quantitative terms covering cost, time and quality/performance.

The main contents of a Risk Management Plan are as follows:

• General introduction explaining the need for the risk management process;
• Project description. Only required if it is a stand-alone document and not part of the PMP;
• Types of risks. Political, technical, financial, environmental, security, safety, programme etc.;
• Risk processes. Qualitative and/or quantitative methods, max. nos of risks to be listed;
• Tools and techniques. Risk identification methods, size of P-I matrix, computer analysis etc.;
• Risk reports. Updating periods of Risk Register, exception reports, change reports etc.;
• Attachments. Important project requirements, dangers, exceptional problems etc.

The Risk Management Plan of an organization should follow a standard pattern in order to increase its familiarity (rather like standard conditions of contract) but each project will require a bespoke version to cover its specific requirements and anticipated risks.

Risk management consists of stages, which, if followed religiously, will enable one to obtain a better understanding of those project risks which could jeopardize the cost, time, quality and safety criteria of the project. The first three stages are often referred to as qualitative analysis and are by far the most important stages of the process.

Stage 1 Risk awareness: This is the stage at which the project team begins to appreciate that there are risks to be considered. The risks may be pointed out by an outsider, or the team may be able to draw on their own collective experience. The important point is that once this attitude of mind has been achieved, i.e. that the project, or certain facets of it, are at risk, it leads very quickly to . . .

Stage 2 Risk identification: This is essentially a team effort at which the scope of the project, as set out in the specification, contract and WBS is examined and each aspect investigated for a possible risk.

Stage 3 Risk assessment: This is the qualitative stage at which the two main attributes of a risk, probability and impact, are examined.

Stage 4 Risk evaluation

Stage 5 Risk management: Having listed and evaluated the risks and established a table of priorities, the next stage is to decide how to manage the risks.