Don’t Let Risks Bury Your Project

We’ve all been there before. A change in scope, loss of a resource, unforeseen errors, lack of availability from a key stakeholder or, simply stated, risks cause delays in a project. The reasons for delays can be numerous, but the ability to restore order and bring a project to the finish line usually involves five attributes: identification, assessment, mitigation, monitoring, and actively managing the risks.

Every project starts with the same enthusiasm and excitement. Requirements are defined, financial estimates are created, resources are assigned, and schedules are defined for each project. However, the day-to-day activities of a project usually lead to some form of departure from the original plan. The ability of a team to recognize potential delays and create a plan for resolution will determine the fate of a project. The risk or risks must be analyzed with two major goals in mind: risk mitigation and determination of the long-term impacts on a project.

At the onset of a project, Project Stakeholders are identified and categorized by their pending role within a project. Understanding the players in the game and their roles will be key with respect to mitigating future risks. The stakeholders may have intimate knowledge of business processes, project expectations, communication standards and Key Performance Indicators (KPI’s) that will be used to evaluate the effectiveness of the overall project.

One of the best tools in a Project Manager’s war-chest is a Risk Register, a document used as a repository for all identified risks. The Risk Register will also contain additional information about each risk including the nature of the risk, mitigation measures as well as the reference to and owner of the risk. The Risk Register becomes a living document that is updated as frequently as needed. It is key for both the client and vendor project managers to review and agree on mitigation strategies promptly. The contents of the Risk Register are usually included in the weekly Status Report for the project to ensure transparency and agreement on the mitigation plan. The successful resolution of each risk should be assessed in the project postmortem phase during the Lessons Learned sessions.

Once a risk is identified, the potential impact of the risk must be determined. Typically, there are five categories or types of risks that you will encounter.

1. Risk related to performance, quality, scope, or technology. These include risks that lead to a project failing to meet the business requirements or mission of the project. Additionally, performance risks can lead to schedule and cost related risks if technological based problems cause an increase in the cost or duration of a project.
2. Risk related to environment, safety and health. This applies to the project’s impact on the environment or potential hidden human risks that are discovered during the project execution.
3. A schedule risk. This applies to risks that elongate the project schedule. Often schedule risks will also increase the overall project costs as it will take more time and possibly more resources to complete the project.
4. Risks related to cost. Cost risks tend to overlap with schedule and performance risks. Typically, an increase in costs will likely force a reduction in scope or quality to meet a specific date. This can diminish the overall value of the project.
5. Risk related to critical loss of support of the project’s goals from stakeholders or their constituents. Loss of support could lead to a reduction of budget, scope or quality or affect the ongoing viability of the project. Any of these reductions can devalue a project and the project’s ability to meet its intended mission.

While all the risk types listed above may be encountered in various forms, frequency or intensity, it is probably most productive to view those risks from one of two perspectives – incremental or catastrophic.

• Incremental risks are risks that may be insignificant when viewed individually. However, combined with several other insignificant risks, those risks may pose a large risk when viewed collectively. For example, a cost overrun for one component or sprint of a project may not pose a major risk to the overall project. Yet, if multiple sprints have cost overages, then entire project is now at risk of being over budget.
• Catastrophic risks are typically very rare in occurrence but extremely significant in impact if they do occur. An example of this type of risk is the dependence on critical technology or resources that may not prove to work adequately to meet the requirements of the project.

Collectively, a project team should ask themselves a few questions. Do we fully understand the risk? Is this a risk that has presented itself before on other projects? If so, how was it previously resolved? Project Managers will ask one additional question: how could this risk impact the scope, budget or timeline of the project? The answers to these questions will require every member of the project team to be flexible. Team members may be asked to step outside of their comfort zones to foster a viable solution. While unpopular, there is also the real possibility of increased workloads for one or more team members. The flexibility and adaptability of the project team is key to mitigating the risk and getting the project back on track.

After a risk is identified and a solution is determined there is one final component that is needed to successfully mitigate any risk: an unwavering commitment by all sides – client and providers alike – to resolving the issue. In theory, the execution of a resolution plan is always straightforward. Find a problem, design and implement the solution and your risk will be resolved. The reality is resolving a risk requires the project team to remain steadfast in their commitment to eliminating the risk. Solving the problem could lead to additional work. There is a possibility that the fix may be more complicated than originally anticipated. A new risk or issue could be discovered in the process of resolving the original risk. The time it takes to resolve the risk may exceed the estimated time designated for resolution. Your project may encounter one or more of the challenges mentioned above. Clear and concise communication with both Project Team Members and Project Stakeholders will help manage expectations and provide updated information including projected completion dates for any risk mitigation effort. Additionally, continuously updating the Risk Register will provide audit level details of mitigation strategies as well as the ability to track the progress of the risk mitigation efforts.

In summary, there are several components to risk management. Identification of a risk is equally as important as risk mitigation and project communications. Every project will encounter risks, but the most successful projects are products of a well-defined Risk Mitigation strategy. While every project will have its own variations, having a formal policy for addressing risks in place will help eliminate some of the major issues that could prevent a successful project outcome.