Risk, sources of risk, risk management steps

Definition

Risk is an uncertain event or condition which, if it occurs, has a positive or negative effect on the project objectives (scope, time, cost, quality). It is measured by the probability of the event and the size of its impact: Risk = Probability x Impact.

Sources of project risk

1. Technical sources: incomplete or wrong design and drawings, inadequate survey and investigation, difficult geology, new technology, quality of materials and workmanship.
2. Estimating and planning sources: unrealistic cost estimate and schedule, missing activities, over-optimistic productivity, poor risk allowance.
3. Management sources: weak project manager, poor coordination between client, consultant and contractor, lack of skilled manpower, poor monitoring and decision making.
4. Financial sources: shortage of funds, delay in release of budget or payment, inflation, interest and exchange rate changes.
5. Contractual and legal sources: vague contract documents, variation orders, claims and disputes, change in laws, land acquisition and compensation problems.
6. Political and social sources: government change and policy change, bandh and strikes, local community demand, corruption, security situation.
7. Natural and environmental sources: flood, landslide, earthquake, heavy rain, climate change, environmental impact and clearance requirements.
8. Resource and market sources: shortage or price rise of material, fuel, labour and equipment; supplier delay; transport problem (especially in remote areas of Nepal).
9. Human and safety sources: accidents, labour dispute, health problems, errors and negligence.

Steps of risk management

1. Risk management planning: decide the approach, team, roles, budget, tools, risk categories, probability-impact scales and reporting. The output is the risk management plan.
2. Risk identification: find the risks which may affect the project and document them in a risk register (brainstorming, checklist, Delphi, SWOT, interviews, experience).
3. Qualitative risk analysis: rank the risks by probability and impact using a probability-impact matrix to find priority risks.
4. Quantitative risk analysis: estimate the numerical effect of the main risks on cost and time (expected monetary value, decision tree, sensitivity analysis, Monte Carlo simulation).
5. Risk response planning: select the strategy for each risk (avoid, transfer, mitigate/reduce, accept) and prepare contingency plans and reserves.
6. Risk monitoring and control: track identified risks, watch for new risks, check the response is working, update the risk register and report.

 Plan -> Identify -> Qualitative -> Quantitative
   ^                                     |
   |                                     v
 Monitor and control  <-----------  Response planning