Risk Management (2024)

1. Home
>
2. Blog
>
3. Risk Management

The world in which we live is undoubtedly full of risks: What are the chances of a natural disaster hitting a certain region? How likely is a car accident under certain conditions? What is the possibility of a construction failure? Although we encounter some level of danger every day, risk management allows us to put measures in place to avoid disasters most of the time.

While we could continue to speak of natural risks or those present in our day-to-day lives, “project risk” is an entirely different type of risk which will be discussed here. We will explain not only what risk management in project management is, but also the essential processes, tools, and methods used in managing risk.

Please note that opportunity management is just as important and goes hand in hand with risk management. We often refer to “R&O Management” for this reason. To simplify reading, however, we will refer to both risk and opportunity management as simply “risk management”.

Simply put, Project Risk Management is the set of processes a company implements to protect their projects from possible threats and to take advantage of opportunities.

According to the PMBOK® Guide, risk management is defined as the “systematic process of identifying, analyzing, and responding to project risks.”

Risk management allows us to:

• Identify events that are either undesired (threats) or desired (opportunities).
• Understand the impacts of these events on a project’s objectives.
• Work to reduce their negative effects (or to reap their benefits in the case of an opportunity).

In many sectors today, risk management is not only gaining importance, but has also become a regulatory requirement, and several standards (such as ISO 31000) now exist. Therefore, it must be integrated into the organizational strategy and become part of all project activities.

When integrating R&O Management into project management activities, it’s important to have a robust risk management process, an important tool that project managers should implement right from the start of their projects. This allows us to identify and characterize risks for a more informed view of the project, to accommodate for the cost of risks early-on, and to make informed decisions throughout the life of the project.

While Project Risk Management is a framework aimed at protecting projects from threats, Enterprise Risk Management (ERM) is a set of processes that a company implements to protect its organization from possible threats (or to take advantage of opportunities). Therefore, Enterprise Risk Management usually concerns the entire portfolio of initiatives and can extend across their supplier network.

ERM involves identifying risks to the business, preparing a mitigation strategy, and managing this strategy across different business units. Such risks are often strategic and can have significant financial implications for the company.

Unlike project risks, which can be treated on a much smaller scale, enterprise risks may require the cooperation of several departments or divisions. Therefore, it can be helpful to have a dedicated team of Enterprise Risk Managers who can liaise with the departments. This team would also work closely with the Program and/or Portfolio Management Offices as well as the Risk Center of Competence.

Although an ERM strategy is more strategic and high-level, an organization with a robust Risk Management framework is likely to also excel in their management of project risks as well.

Now that we understand what processes govern R&O Management, it would be helpful to define what individual risks or opportunities would look like for a project.

A project risk is an uncertain event that would have a negative impact on at least one of the project’s objectives (Time, Cost, Quality, Scope, Performance) if it occurs.

For example, ariskeventcould be:“the inability of supplier X to conduct feasibility studies on a modification Y by the end of next year”. Thecauseof this risk could be a result of the supplier’s resources being heavily utilized on other projects. Theconsequenceswould be a delay in implementing change Y. Arisk response strategycould be to subcontract out the work or to identify other internal resources capable of conducting the study.

Notice that risks are best described by 3 basic characteristics:

• An event description,
• A probability of its occurrence, and
• Its potential impact on the project objectives.

Each risk must be self-explanatory (clear to the reader) and can be supplemented by its causes.

An opportunity on the other hand, is anuncertain eventthat would have a positiveimpacton at least one of the project’s objectives if it occurs.

For example, anopportunityevent could be: “Do not perform activity Z”.Thecausesof this opportunity could be that other feasibility studies are in progress, and theconsequenceswould be a financial gain equal to the cost of activity Z. To allow this opportunity to occur, the response strategywould be to simply not carry out activity Z.

It is common to confuse the notion ofunknown, contingency,risk, issue, and improvement.However, understanding these terms and how to classify each event is important to ensure consistent and effective Risk Management across your entire team.

The key questions to ask are:

• Can you identify what the event is?
• How likely is the event to occur?
• Will the event have a positive or negative impact?
• How much will the impact be on your organization?

After understanding how to identify risks (and opportunities), it can be useful to develop a way to further classify each. Think of this like a tag associated with each risk, allowing you to filter or group them. How risks are grouped or classified often depends on the nature of the organization or the project itself.

In many cases, project risks are based on how they will impact a project’s core objectives: time, scope, cost, quality. For example, you may see the following, in terms of project objective: schedule risk, financial risk, risk of scope creep, quality risk, etc.

In a different scenario, an organization with a complex supply chain may be interested in internal vs external risk to identify potential issues with their supplier network. In any case, recognizing and categorizing these risks allows organizations to develop more targeted strategies for mitigation and response.

Risk management is all about anticipation. Its objective is to guide companies in preparing for, reducing, or avoiding the negative impacts created by any known event. It also helps to seize opportunities that provide improvements, or positive outcomes.

But why now? It is often only in the face of new difficulties (after a significant risk has already become an issue) that we realize how important risk management is. That is usually when companies implement ways to anticipate and protect against uncertainties. The trick, however, is to do it now, before something happens, and to establish the structure and processes to manage uncertainties long-term.

This begins with developing an organizational Risk Management strategy, in which you can define your risk management process and engage a team of experts to drive it. A sound risk management strategy helps you to look to the future, capture opportunities that come your way, and deploy the right efforts against any threats.