Risk identification techniques

Risk identification determines which risks may affect the project and documents their characteristics. It is iterative and involves the team, stakeholders and experts. The output is the risk register. The common techniques are as follows.

1. Documentation reviews: study project plans, assumptions, contracts, lessons learned from previous projects to find inconsistencies.
2. Information gathering techniques
   • Brainstorming: team generates a list of risks freely, usually by category.
   • Delphi technique: anonymous expert consensus over multiple rounds.
   • Interviews: experienced managers and stakeholders.
   • Root cause analysis: find underlying causes, then identify related risks.
3. Checklist analysis: use a list built from similar past projects and a risk breakdown structure; quick but may not be exhaustive.
4. Assumptions analysis: test the validity of project assumptions; incomplete or inaccurate assumptions give risks.
5. Diagramming techniques
   • Cause-and-effect (Ishikawa/fishbone) diagrams.
   • System or process flow charts.
   • Influence diagrams showing causal influences.
6. SWOT analysis: weaknesses and threats become risks, strengths and opportunities become positive risks.
7. Expert judgment: advice from experienced people.
8. Prompt lists / risk breakdown structure to prompt thinking (technical, external, organisational).
9. Scenario analysis and simulations.

Inputs (plans, history) -> Techniques -> Risk register

Output

Risk register listing risks, potential responses, root causes, categories and updated risk categories.

Example: A team brainstorming risks for a new payment app lists "API downtime", "regulatory change" and "poor adoption", then checks a checklist from earlier fintech projects to add "data breach".