Project Risk Management

Risk Management is something that we always do even without thinking about it. Risk management involves minimizing the consequences of adverse events as well as maximizing the results of positive events. Therefore, risks can be good or bad events which are commonly called as opportunities or threads.

Risk management is a part of the project management process, and consistently following that process is important for getting results. It allows you to take control of the project, rather than letting the project control you. 

The six processes in Risk Management based on PMBOK Guide is designed to help manage end-to-end project risk. An acronym was developed to remember the steps in this process is PIER-C, Plan, Identify, Evaluate, Respond, and Control.

Risk Definition

Project risk is defined as "An uncertain event or condition that, if it occurs, has a positive or negative effect on at least one of the project's objectives" Project objectives are defined as scope, time, cost, and quality.

The PMI Risk Management Process: PIER-C

PMI developed an interrelated six (6) step approach to manage project risk.The PIER process activities or steps occur during Project Planning Process Group. The Monitor and Control Risks activity occurs during the Project Monitoring and Controlling Process Group, this is the C.

 

1.  Plan Risk Management:  This initial step defines how risk management will be accomplished (methodology). The ultimate goal is to develop a Risk Management Plan which describes how the entire end-to-end Risk Management Process will work.
2. Identify Risks: This steps requires you to develop a list of risk by project, activity, work package, etc. During this step, you define the risk, assign initial ownership, define risk causes, develop initial responses, and categorize each risk. The key output of identify risks is a document referred to as the Risk Register.
3. Perform Qualitative Risk Analysis: This step is the first evaluation step. This is subjective process. During this step, you use the Risk Register to classify risks by probability (likelihood the risk will occur) and impact (effect of the risk consequence on the project). At the end of this step, prioritize all risks and establish a short list of risks that must be aggressively managed. This is often referred to as the Urgent List. You also place low probability and impact risks in a separate section of the Risk Register, which is called Watch List. At the conclusion of this step is the risk register updated.
4. Perform Quantitative Risk Analysis: This step is optional. The Project Manager decides ! You may or may not Perform Quantitative Risk Analysis. This decision is determined by factors such as time, project priority, level of effort as compared to benefits, etc. This evaluation method numerically analyzes the impact of multiple risks to the project. This is an objective method that helps determine probability that stated budgetary and schedule outcomes can be met. The risk register updated is the output of this step.
5. Plan Risk Responses: During this step, develop responses to risks on the urgent or "short"list of risks. The level of response detail is dictated by the priority of the risk. Strive for the responses that address both positive risks (opportunities) and negative risks (threats). The risk register updated is the output of this step as well. In addition, contractual agreements may be developed to support responses that require third party involvement.
6.  Monitor and Control Risk: This is the final step in the Risk Management Process. During this step, monitor and reassess risks on the Risk Register. Implement risk responses as necessary. Identify new or emergent risks that were not identified during the identify risks activity. In addition, evaluate the effectiveness of the risk program for the overall project. 

When to Start Risk Management
PMBOK has nine knowledge areas. Risk management comes at the end of the project planning stage, because, for risk management, you need input from other knowledge areas. The only knowledge area that is planned after risk management is procurement management, because you often need to include causes to manage specific risks in your project. This only becomes clear after risk response planning. For example, you decide the contractor should be responsible for risks that may occur due to expected new legislations, then this must be spelled out in the agreement with the contractor.

Knowledge Area	Contribution to Risk Management
Scope Management	What is included in the project and what is not
Time Management	Work breakdown structure and schedule baseline
Cost Management	Cost baseline and budgeting
Quality Management	Quality standards and specification required for the project
Human Resource Management	Organizational chart, project team members, staff availability, etc
Communication Management	Know the stakeholders and their expectations, and the communication plan

References:

1. Abdulla J. Alkuwaiti, RMP, PMP. "Study Guide for the PMI. RIsk Management Professional Exam".
2. Daniel C. Yeomans, PMI-RMP, PMI-PMP, CMQ/QE. "Passing the Risk Management Professional (PMI-RMP) Certification Exam, The First Try"".
3. Rita Mulcahy, PMP. "Risk Management. Tricks of the trade for Project Managers and PMI-RMP Exam Prep Guide".