Risk Management Process
Every organization or business has a mission to accomplish. Their management should provide, that the work to accomplish the mission should go in its expected way by identifying and preventing the risks before those risks arise in a problem; in other words by including risk management in their regular management process.
By this perspective, Risk Management field has come into existence and has gained popularity in challenging environment of the world. Risk management has vital importance to all size of companies, organizations, business units or projects in different markets and sectors.
What is Risk?
Risk is a probable event or situation, with a potential for either positive or negative impact on the project.
Risks in projects can be placed under different categories like Customer, Infrastructure, Communication, Lack of Domain/Technical Knowledge etc
What is Risk Management?
Risk Management is the set of activities directed towards improving the probability for a positive impact or reducing the probability for a negative impact and managing the outcome if the risk event occurs.
What are the steps involved in Risk Management?
Risk management involves several important steps given below:
1. Risk identification
2. Risk classification, analysis and prioritization
3. Define strategies for risk management
4. Tracking and controlling risks
Communication on risks is a process which is relevant to all the 4 steps above.
1. Risk Identification:
· The risk identification process involves identifying the different sources of risk (or risk categories) and applying an appropriate risk identification technique to identify the project risks.
· Project manager along with the team should identify all positive as well as negative risks. Internal as well as external risks should be identified as both can affect the outcome of the project.
· An internal risk happens within the project and can be controlled within the project team. External risks are outside the control of the project team for example, earthquake, terrorism, power outage, changing market trends etc.
2. Risk Classification, Analysis and Prioritization:
· Risk is classified based on the categories or based on the source, after which the analysis is done.
· Risk analysis begins with a detailed study of the key risks that have been identified.
· The objective is to gather enough information about the risks to judge the risk exposure on key project goals (for example, cost, schedule, and performance, etc.) if the risk occurs.
· The total risk exposure could be determined based on probability (or likelihood) of risks and impact (or consequence) level of risks.
· Risk exposure helps a great deal in risk response planning and prioritization. This also helps in relating risks to costs and linking as a factor to cost estimates for the project.
· The risk quantification uses a numeric scale, usually from 0 to 1, to measure the probability of an event occurring, where 0 means an event would not occur and 1 means it will occur. The impact is measured on a scale of 0 to 10, where 0 means no impact and 10 means the maximum impact possible.
A guideline to select a Impact & Probability value for a Severity is given below:
Impact Range
Severity
1 to 3
Low
4 to 5
Medium
6 to 7
High
8 to 10
Very high
Impact value and its severity
Probability Range
Severity
0.1 to 0.2
Low
0.3 to 0.6
Medium
0.7 to 0.9
High
Probability value and its severity
To get the risk exposure, the following formula can be used:
Risk Exposure = Probability * Impact
For risks having direct impact on cost and having a high risk exposure, find out cost impact of risks that exceed a threshold value of probability (0.7) or impact (7). Even while planning out contingencies, one must take care that adequate contingencies are available for top risks.
Risks prioritization is done by ranking them all from highest to lowest.
The following is an example of a risk list:
Risk Description
Probability
Impact
Exposure
Comments
Link connectivity not ready on time during transition of project from onshore to offshore
0.2
9
1.8
Chances of this happening are very less, but its impact is very high. Hence overall exposure is not above threshold value.
Interface implementation not completed well before System Testing Phase
0.5
7
3.5
Though its impact is not very high, the probability is very high and that makes this risk a high priority risk.