In Part 1, we covered Identifying and Categorizing risks. After identifying what could happen to derail your project, what next? Spending the time to analyze and mitigate risk before undertaking a project can save you heartache, worry, and money in the long run. We all inherently identify and analyze risks at different levels of detail.
As a reminder, to perform risk analysis and mitigation, the following activities should be performed:
- Identifying Risks
- Categorizing Risks
- Analyzing Risks
- Mitigating Risks
- Embracing Risks
Part 2 will cover Analyzing, Mitigating, and Embracing Risks.
Analyzing Risks:
Once risks have been identified, the impact to the project as well as the probability should be assessed. The two focuses of analyzing risks are:
- Probability of Occurrence
- Impact to project
With the probability of occurrence and project impact determined, the risk can be mapped out on a risk table to determine the overall ranking of the risk. Extreme risks should be mitigated immediately to determine if there is a way to reduce the impact or the probability.
Probability of Occurrence
How likely will the risk turn into an issue? For natural disasters, it may be higher in some parts of the country than others. I’ve been evacuated to the basement and the stairwell due to tornadoes, but we don’t get many earthquakes in the mid-west. Years ago, many of us may have joked about a pandemic but now that’s reality. The risk now is whether there will be more absences than planned for the joint project team.
Insurance risk assessors have formulas and statistics to determine the probability as a percentage. Risk assessment on software and consulting projects don’t typically require that level of calculation. Using the categories of Extreme, High, Moderate, Low or Extremely Low probability is sufficient.
Impact to Project
As discussed earlier, there is a differentiation between a risk and an issue. A risk is something in the future. An issue is something that is occurring in the present. If the risk turns into an issue, what is the impact to the project? A risk generally can impact one or multiple aspects of the project: financial, resources, timeline, and overall project success. While a tornado evacuation may have a moderate to low probability for a project in Tornado Alley during the season, the impact tends to low for the project since it is more of an inconvenience for the project team. A direct hit by a tornado has a larger impact to the project (likely financial and timeline) but has a lower probability of occurring.
Mitigating Risks:
At this point, the project team is aware of the potential issues (risks), has categorized them, and has performed some level of analysis. Your risk ledger should be sorted to focus the mitigation details on the Extreme, High, Moderate, Low. All risks should have a level of mitigation performed, but the time spent on those that either have a low probability of occurring or a low project impact should be minimal.
Mitigating risks is really determining if there is anything up front that can be done to either reduce the probability or the project impact. With the tornado evacuation example mentioned earlier, the following mitigation steps could be performed:
- Make sure everyone understands the alert signals and evacuation protocol
- Enforce a process of regularly backing up work and implement auto-save where possible
- Detail a communication plan for the impact after the threat has passed.
Embracing Risks:
Congratulations! You’ve identified, classified, analyzed, and mitigated risks – now to execute the project!
But wait… just like a project plan, a risk ledger is a living document. Risks will come up and risk will drop away. The only way to completely close a risk ledger is to successfully complete a project. Throughout the project, remember to refer to the risk ledger on a regular basis and update it as needed. Have conversations during status calls about any new risks. Encourage team members to voice their concerns about the project. Their concerns may be active issues, or they could be risks – but it’s important to listen. Embrace the risks and mitigate away!
