Project Risk Management: Analyzing Project Risks
- June Tucay
- Jan 17, 2017
- 6 min read
Performing qualitative risk analysis
Considering the number of potential risks that can occur on any project. Every project manager faces a troubling dilemma. How can you manage a project without spending 120% of your time managing all the possible risks? When will you ever get a chance to perform the numerous other responsibilities you’re expected to fulfill? The answer is to perform a qualitative risk analysis to filter and prioritize your risks.
With qualitative analysis you do this base on a quick high-level assessment of their probability and impact of actually occurring.
Here are simple steps to use so you can do this quickly and efficiently
Each Risk impact should be assess as High, Medium or Low in order to keep it simple and straight forward.
A high impact risk = are events that can blow your triple constraints of time, budget and scope.
A medium impact risk = are events that are difficult but manageable
A low impact risk = events that would end up being nothing more than a bother and easily manageable
Each Risk Probability should also be asses similarly to keep it simple. It really doesn't matter if it's not finer in detail than high medium and low.
High Probability = events that have a chance to occur 80% of a time
Medium Probability = events that have a chance to occur more that 40% of the time
Low Probability = events that have a chance to occur less than 40% of the time
Depending on your risk tolerance you can adjust the percentage depending on your organizations' risk tolerance
Once you have gone through all the risks and written down the ratings, sort the results. This will give you a high-level reference for which ones need to be examined further, and which ones can be left for a while. Just make sure you keep this initial master list of risks. Keep reviewing the list, throughout the project life-cycle to make sure all low risks still rated as low risk.
Here are a few tips for ensuring your qualitative risk analysis is efficient and effective:
Don't make it too complicated. Don’t be too fine in your determinations for high medium and low risks. Remember, you're just trying to regulate the effort you go through, not to chase every risk. You just want to know where to focus your risk management energy.
To help everyone on your project team understand your qualitative analysis, draw up a table known as the 3x3 risk matrix. It has probability on one axis, and impact on the other. By recording your findings in this format you can easily see the risks.
After you complete your 3x3 matrix, look where your risks lie.
If there are a large percentage of medium-medium risks, ensure you didn't put them into that segment by default. Maybe it’s out of habit. The question you need to ask yourself is, did I really label the risks qualitatively in relation to the others. Basically, you're going to have to address your high probability high impact risks first. These have to be your priority. Then you look at your risks rated high-medium and medium-high. You may also consider your medium-mediums. For all of your lows, you probably not going to do much at all, and that's okay.
If you go through the qualitative risk analysis process quickly and efficiently .you are well on your way to making your risk management approach manageable and well suited to the needs of your project.
Performing quantitative risk analysis
Project risks can haunt you, if you don't address them. Constantly waiting to catch you when you're distracted. Risks need your attention before they cause chaos on your project. So how you know what risks to address and when you need to purge them from your project?
First, after you perform the qualitative analysis, you then conduct a quantitative risk analysis on your most substantial risks. Quantitative analysis is the process that guide you, and how much you can spend to address a risk. For example, you don't want to spend $10,000 to address a risk that will cost you $5000.
Here are a few steps that you can take that will help you ensure your addressing the right risks on your project.
Look more closely at the probability of each risk occurring. Because were looking for more refined estimate in this qualitative analysis stage, I would assign a probability in increments of 10. So 10% 20% and so forth.
Estimate the cost to your project or your organization, if a risk came to fruition. The dollar values you choose to estimate the cost, will depend upon the overall budget of your project.
Multiply your estimates for the probability and cost impact, and sort the answers so you have a guide to determine what your most important risks are that you should address.
Take your most important risks and ask, if I was going to address this risk, how much would that cost? You certainly should spend an appropriate amount of money to mitigate a risk that is vital to your project success. There could potentially be number of ways to address a risk, however, the greater the potential impact, the more analysis you may want to perform to investigate alternatives to relieve your project of the risk.
The thing you should remember is that quantitative analysis can be a bit of a balancing act. You want to dedicate enough time so that you get a thorough analysis, but not too much time so you get bogged down with your estimates.
Allocate your time based on the potential impact of each risk. This will give you the information you need, and let you get on with the job of managing your risks. Performing a quantitative risk analysis help you ensure that you have control over the elements that can adversely impact your project. When you have those adverse elements under control you were well on your way to ensuring your project can be delivered with integrity.
Assessing and prioritizing analyzed risks
The science of risk management is fairly straightforward. Prioritize your risks by potential impact and manage your most significant project risks. Many project managers do this and believe they are on the right track and they usually are, most of the time. The problem is, stakeholders don't always think scientifically. To effectively manage risks on your projects you need to consider stakeholder risks sensitivities before you can say your risk analysis is complete.
It’s important to remember in any risk analysis that your stakeholders, sponsors and project team may all tolerate risk differently. In cases where your stakeholders are very sensitive to some types of risk, complete your risk analysis by incorporating that into your risk management.
Here are at the steps you can take to make sure you and your risks sensitive stakeholders will be aligned when it comes to managing your project risks.
Split your risks into impact type: time impacts, scope impacts, and cost impacts. Once you have done this, consider your stakeholders or sponsors tolerance with these three types of risk.
Consider re-prioritizing your risks to ensure the impact type with the lowest stakeholder tolerance gets a high-priority. By understanding the sensitivities of your stakeholder and sponsor, and adjusting the way you prioritize things, you'll have an easier time managing risk on your project. It shouldn't be difficult or time-consuming. The addition of stakeholder priorities to your risk analysis simply gives you a final prioritize risks list.
Consider your potential risk treatment actions and their cost against the actual costs the risk would add to your project, and most importantly the impact of the perception of your stakeholders. A project manager and sponsor rarely have a large fund to mitigate risks, as a result you need to decide how to allocate these prudent plan.
Share your final prioritize risks with your sponsor.
Here are some final tips as you use these steps to finalize your risk analysis:
Risk prioritisation involves a lot of judgement calls and estimations. Don’t be afraid of going forward without a lot of facts. You rarely have solid facts when it comes to risks.
It is important that you communicate your estimate and assumptions and consider those of your sponsor and stakeholders. Although there is science involved, most good risk analysis exercises involve a healthy dose of art, in the form of intuition and frequent communication.
Fault on the side of being inclusive. Involve as many stakeholders as you can. Not only will you produce a better risk analysis product in the event and unexpected risk does become an issue, you won’t be alone when answering the “why you didn’t think of that” type questions that may be raised by senior leaders.
There are a number of steps to take when identifying and Analyzing risks, but engaging in methodical effort is worth it. As risks come into fruition as issues are likely to seriously impact your project, leading the project team and stakeholders to a practice of diligent risk analysis, you will be well positioned to manage the good and bad ebbs and flows of your project.
For other articles in Project Risk Management, see also:
If you are looking for even more information on managing risk, I encourage you to check out some very insightful books:
Risk Management: Concepts and Guidance by Carl Pritchard is a great book that addresses risk concepts that can be applied to any project.
Here are good references for handling IT-based projects.
Waltzing with Bears: Managing Risk on Software Projects by Tom DeMarco and Timothy Lister
Managing Risk: Methods for Software Systems Development by Elaine M. Hal
Comentários