Free Shipping on orders $35+ within the continental US

6 Steps to Creating a Risk Management Plan for Any Project

Executive Summary

There are a host of risks ready to pounce on your project like a cheetah in the savanna. From slow suppliers and bad weather to personnel changes and technical difficulties, the factors that could threaten your project are limitless.

  • As an experienced project management consultant, Joseph Heagney has seen the detriments of contingency planning initiated too late or not at all.
  • Involve various stakeholders in the project risk management planning so you can identify the full range of potential problems. Determine the trigger point at which a risk becomes so pervasive that contingencies must go into action.
  • A successful project manager should create a formal process for assessing, managing, and responding to risks.

Project risk management is “the process of conducting risk management planning, identification, analysis, response planning, and monitoring and controlling risk on a project.” Without this foundation, projects often experience the negative impact of risks that become reality, risks that might have been prevented or mitigated through contingency planning. This is reactive behavior, and you must live in the proactive world to be successful as a project manager.

Conduct a Risk Assessment Before Starting Projects

Project risk management begins early in the life cycle. A clear understanding of the risks that face the project must be established. The sources of project risk are almost limitless, emphasizing the need for a well-thought-out, detailed plan.

Typical examples include:

  • the loss of a key team member
  • weather emergencies
  • technical failures
  • poor suppliers.

Many project managers wait too long to assess risk factors and delay creating a risk management plan because they assume they don’t know enough yet, that there are too many unknowns. This is a common trap that you should try to avoid.

Use a Formal Process to Reduce and Manage Risks

It is important for you to manage risks formally by applying an agreed-upon process to establish the risk management plan.

Given the realities and variables of the typical project environment, a certain amount of flexibility is appropriate. As you gain experience in managing risks, an intuitive feel for flexibility will develop depending upon style and the length, width, depth, and breadth of the projects.

Create a Risk Management Plan in 6 Steps

The Six-Step Process is a common and practical approach to establishing the project risk plan. This process should not be created in a vacuum and typically involves a great deal of research and collaboration with the project team.

Step 1: Make a List

Brainstorm. Making a list of potential risks to the project should not be an analysis but a formal brainstorming session, when all ideas are captured. Steps 2 and 3 of the process allow for a vetting of these ideas. It is important that the entire team get involved in identifying threats and highlighting what can go wrong…If one or more members are left out, it is likely that some risks will remain unidentified and pose a threat to project success.

Tips for Success

  • Prioritize Research: When you work with the support of an informal team, you will need to be disciplined and realize that a certain amount of research is necessary before moving forward. This may include phone calls, e-mails, office visits, or videoconferencing—whatever it takes to elicit the information you need.
  • Facilitate Conversation: You typically start with the informal team members or contributors to the project and initiate a dialogue as to what might go wrong. Usually, these discussions identify other ancillary individuals who should be contacted.

Steps 2 and 3: Determine the Probability of Risk Occurrence and Negative Impact

I am combining Steps 2 and 3 because they are the prioritization factors. They assist you in vetting the list of risks. These two steps allow you to prioritize all identified threats to the project and help you determine how much time, effort, staff, and money should be devoted to preventing or mitigating each. Again, this must be accomplished not in a vacuum but with full input from team members and subject matter experts (SMEs).

Questions to Consider

  • How probable is it that each risk will become a reality?
  • If the risk becomes a reality, how badly will it damage the project?
  • If the risk becomes reality, how will it affect the budget, schedule, resource utilization, scope of work, and so on?

To calculate the monetary impact of a risk, use the formula below. Assign each risk a probability on a scale of 1 to 10, with 1 being a low probability that the risk will occur and 10 being the highest probability that a risk will occur.

Probability x Impact (in dollars) = Budgetary Risk Impact

Step 4: Prevent or Mitigate the Risk

Some risks can be prevented; others can only be mitigated. Earthquakes or the retirement of an important stakeholder, for instance, cannot be prevented. Some risks can and should be prevented in Step 4. If a risk has been identified and you have the ability to prevent its occurrence, do so. Proactivity is the project manager’s best friend. Kill the risk before it has a chance to grow and flourish, and you won’t have to deal with it again.

  • Risk: The assigned vendor or supplier on a project has a reputation for delivering items on a slow timeline.
  • Preventative Option #1: Find an alternate supplier.
  • Preventative Option #2: Eliminate issues that could contribute to slow delivery on your end.

Step 5: Consider Contingencies

Preventive measures are those steps taken before the risk becomes reality. Contingencies represent the specific actions that will be taken if the risk occurs. Here, you answer the question, “If the risk becomes reality, what will we do?” Contingencies are directly linked to the prioritization factors introduced in Steps 2 and 3.

If the risk is a high priority (high probability, high negative impact), you will want to identify multiple contingencies. Since there is a good chance that the risk will occur and that when it does, it will hurt the project, you want to be covered. If the risk falls in the middle range of the prioritization scale, you should establish at least one contingency. Those risks that fall in the lower level should not require much attention; it is best to invest your efforts elsewhere. When establishing your contingencies, be careful of the very low probability, very high impact risk. These tend to be totally ignored because of the low probability, but they can and sometimes do bring projects down.

Step 6: Establish the Trigger Point

The trigger point is often the most important element of the project risk plan. There is a direct relationship between the trigger point and the contingencies. True to its name, the trigger point is the point at which the risk becomes enough of a reality that the project manager needs to trigger the contingency. It is a judgment call meant to maximize the value of the predetermined contingency by implementing it at the optimal time. Trigger too soon, and you will probably spend time, effort, or money for no good reason. Trigger too late, and you may end up experiencing the full impact of the occurrence, with little value added by implementing the contingency…The trigger should be a specific point in time or a defined range of time.

Attacking Risk from All Angles

The Six-Step Process to establishing a project risk plan includes making a list of potential risks, determining the probability of risk occurrence, determining its negative impact, preventing or mitigating the risk, considering contingencies, and establishing trigger points for activating contingencies.

Adapted with permission from Fundamentals of Project Management by Joseph Heagney, copyright Joseph Heagney.

Bring It Home

In my role as a content strategist at a small marketing agency, I routinely worked on client projects that required assets from different departments, organizations, and individual contractors. While organizing a massive ad campaign for a credit union, a deal with our broadcast media buying representatives fell through. We had been looking to the company to secure placements for us at a reasonable rate so we didn’t have to offset those costs by jacking up the price for our client. Luckily, we were able to get a reference to another media buying provider, however, we lost a few key placements in the switch.

Describe a time when you or your team failed to consider the range of risks that could impact your project. Did you have a project risk management plan in place? If so, did it work? If not, how did you overcome unexpected challenges? Explain your experience in the comments. ~ HarperCollins Leadership Essentials

Joseph Heagney

Joseph Heagney has been president of QMA International, LLC since 2001, providing a wide range of management learning solutions. He was previously the Global Practice Leader for Project Management Best Practices at the American Management Association where he currently serves as a faculty member.

Want to read more? Get the book!

Readers will learn how to: - Develop a mission statement, vision, goals, and objectives - Plan the project - Create the work breakdown structure - Produce a workable schedule - Understand earned value analysis - Manage a project team - Control and evaluate progress at every stage.

Sold out

Related Posts

Leave a comment

Name .
Message .

Please note, comments must be approved before they are published