Overview

Every project has risks.

While it is common for risks to be perceived as negative, risks can have a negative or positive impact on your project. We call positive risks opportunities. If either type of risk arises, a project manager must respond appropriately to mitigate any related problems or to take full advantage of the opportunity.

Below, we will explore three steps to anticipating and managing risks.

Step 1: Determine Possible Risks and Their Likelihood
- Risk Register
- Risk Matrix
Step 2: Identify When Risks Have Materialized
Step 3: Respond
- Responding to negative risks
- Responding to positive risks (opportunities)

Remember the Project Management Knowledge Areas from the Introduction module? Project Risk Management was one of the knowledge areas introduced there!

Step 1: Determine Possible Risks and Their Likelihood

When planning your project, it is important to dedicate time to anticipating potential interference. This should be done well in advance of the execution phase of the project. You must consider how much risk your plan can reasonably tolerate, in relation to the likelihood (or probability) of the risk and its level of impact.

For many aspiring and new professionals, having accurate estimations of risk likelihood and impact is difficult. It is important to use your judgement based on previous experiences, ask questions to professionals who have anecdotal evidence, and conduct research when necessary to derive your determinations. The more that you practice this skill, the better at it you will become!

In this section, we will explore two tools to help you evaluate risks:

Risk Register
Risk Matrix

Activity: Managing Anticipated Risk for ASIPStudio Project

Let's check in with Yasmin and her ASIPStudio Project. In the PD3 Universal Design module, Yasmin looked for ways to implement the Principles of Universal Design into her research presentation. Now, she continues to work on ASIPStudio.

The purpose of the exercise below is to practice clearly articulating ways to manage anticipated risk in written form since documentation is an essential part of project management. The process of writing will help and require you to clarify your ideas and combat the illusion of understanding that comes from mere thinking.

Instructions:

For each of the three questions below, type your answer. You may use paragraph format or bullet points in your responses.
Click the blue circle with an arrow to go to the next page of the activity.
If you would like to save a copy of your responses, click the blue button "Download Your Responses" and then click the "Export" button. The Word document will be saved to your computer's downloaded files with a file name "exported-text". You can change the file name of the document on your computer.

Risk Register

One of the ways that you (and Yasmin) can further analyze anticipated risks is with a risk register. Regardless of a project's complexity or size, a risk register can help you document and track risks.

The image below is an example of a risk register. You may encounter other versions in your jobs, but this one contains the most common elements.

Instructions:

Click on each question mark in the image below to learn more about the columns in this risk register.

Risk Matrix

Not all risks are equal. The extent to which a particular risk can impact your project and how likely it is to happen should determine how much attention it should receive. You would not want to spend significant time and energy on activities to manage risks that are unlikely to occur or have little to no effect on your project.

A risk matrix is a visual way to categorize each risk according to its:

impact (consequence) and
probability (likelihood).

Conducting this assessment correctly requires a keen understanding of circumstances surrounding this risk; while you will be able to evaluate some risks immediately, others may require further thought or research.

Video: Risk and How to Use a Risk Matrix

Let's explore the concept of risk through the lens of an everyday activity: crossing the road, in this video Risk and How to Use a Risk Matrix.

Video player icon with the words "embed video here".

This external video has auto-generated captions, which may contain errors. Download the transcript (PDF | DOC).

Activity: Yasmin's Risk Matrix for ASIPStudio

Yasmin and her laptop

Now, let's evaluate the risks that Yasmin identified earlier.

Risk 1: There was an update to the software between now and report completion that presented new, unanticipated features.

Risk Evaluation: Based on previous updates, if this update were to occur, it is unlikely that it would change the software significantly enough to alter Yasmin's recommendations for the team; this will have "little to no effect". Yasmin reviewed the update logs and found that the next update was announced to launch six months after her project is completed. This risk is "improbable".

Risk 2: She has emailed the ASIPStudio Sales and Marketing Team to respond to a few of her questions. What if they do not reply or are unable to answer her questions in a timely manner?

Risk Evaluation: If the Sales and Marketing Team does not respond to Yasmin, her project will have a few pieces of useful information missing. She knows that she will likely not get final approval without this information, and she has determined that this "could result in a disaster". In speaking with her team members who have worked with the Sales and Marketing Team in the past, she discovered that they are notorious for not responding to requests for information; it is "probable" that they will not respond in a reasonable amount of time.

Risk 3: What if there is an increase in the team's budget and the team can now consider purchasing a more advanced subscription for the software that offers superior services and more features?

Risk Evaluation: If the team has access to a more advanced subscription, the additional features may curve Yasmin's recommendations positively. This depends on the results of other aspects of her research. Yasmin's manager has put in a request for an increased budget. In their last meeting, her manager said that their chances were "50/50" that it will be approved.

Instructions:

Place each risk corresponding to the evaluations above in the appropriate category on the risk matrix.
Click the blue "Check" button to check your answers.

Step 2: Identify When Risks Have Materialized

During your monitoring and controlling activities, you may find that an anticipated risk has come to fruition.

Be sure to observe your project carefully to catch risks as soon as possible.

By identifying risk events early, you will have more options with which to respond to the risk event results.

Step 3: Respond

Your response to a risk event should depend on whether it is a negative risk or an opportunity and where it falls in your risk evaluation.

Responding to risks in the "green" category: These risks are not likely and are acceptable, so you should spend little or no time responding to them.
Responding to risks in the "yellow"/ "orange" category: These events might happen and, if they do, will have a moderate impact on your strategy. If a risk in this category was to happen, you should initiate risk management strategies within reason.
Responding to risks in the "red" category: Exercise a high degree of caution and take every step in your capacity to navigate these risks effectively. If this risk was to arise, addressing it should become a high priority.

How you respond to a negative risk or opportunity may also be impacted by your organization or team's normal processes. Much of it is discretionary and can be influenced by surrounding circumstances.

Responding to Negative Risks

Negative risks can hurt your project if they materialize. Here are a few ways you can deal with negative risks:

Mitigate - Reduce the probability or impact of the risk.
Avoid - Remove the threat or alter the plan to eliminate the possibility of it happening.
Transfer - Shift or delegate the impact or probability to an external or third party source.
Accept - Allow the risk to occur.

Responding to Positive Risks (Opportunities)

Positive risks are opportunities that may or may not benefit your project. You may engage with these opportunities in several ways:

Enhance - Take active steps to increase the impact and probability of the risk event.
Exploit - Take full advantage of the opportunity by taking active steps to support the event in happening
Accept - Take advantage of the opportunity if it occurs by allowing it to happen.
Share - Assign partial or full ownership of the opportunity externally or to a third party, allowing more people to gain the benefits of the event.

Adapted from IST Project Management Office (n.d.).

Activity: Risk Evaluations

Let's check in with Yasmin. How should she respond to these risks?

Yasmin and her laptop

Instructions:

The activity below has three questions.

Read each question and click on your answer.
Click the blue circle with an arrow to go to the next question.

Reflection

Risk management is part of "Your SI Challenge Project Management Plan - Starter Kit" assignment. Start thinking about:

What risks might you encounter?
How would you record them in a risk register?
How would you use a risk matrix to assess their impact and probability?

Take a Break

This is a good place for a break. Stretch, grab a coffee, or simply leave this module for a while and come back to it later.

References

Appuhamy, R., & Clark, C. [Let's Learn Public Health]. (2018, June 8). Risk and how to use a risk matrix [Video]. YouTube. https://www.youtube.com/watch?v=-E-jfcoR2W0

IST Project Management Office. (n.d.). Risk responses. University of Waterloo. https://uwaterloo.ca/ist-project-management-office/risk-responses

Project Management Institute (PMI). (2018, November 8). Anticipating risk - PM Edge [Video]. YouTube. https://www.youtube.com/watch?v=BazPJVpoieE