Define risk, types, manage with risk cycle

Definition and types

Risk is an uncertain event or condition which, if it occurs, has a positive or negative effect on the project objectives (scope, time, cost, quality). It is measured by the probability of the event and the size of its impact: Risk = Probability x Impact.

• By nature: pure risk (only loss is possible, e.g. fire, accident, flood) and speculative / business risk (gain or loss is possible, e.g. price change, market demand).
• By source: internal risk (within the control of the project team: estimate, design, management, labour, equipment) and external risk (outside its control: government policy, weather, inflation, market, law).
• By effect: negative risk (threat) and positive risk (opportunity).
• By knowledge: known risks (identified, so responses can be planned and covered by a contingency reserve) and unknown risks (cannot be foreseen, so they are covered by a management reserve).

Managing risk effectively: the risk management cycle

   +---------------------+
   |    Risk planning    |
   +----------+----------+
              v
   +---------------------+      +---------------------+
   | Risk identification | ---> |    Risk analysis    |
   +---------------------+      |  (qualitative and   |
              ^                 |    quantitative)    |
              |                 +----------+----------+
   +----------+----------+                 v
   |   Monitoring and    | <--- +---------------------+
   |       control       |      |    Risk response    |
   +---------------------+      |      planning       |
                                +---------------------+

The cycle is repeated throughout the project life, because new risks appear and old ones change as the project moves from planning to implementation.

Steps and how they manage risk

1. Risk management planning: decide the approach, team, roles, budget, tools, risk categories, probability-impact scales and reporting. The output is the risk management plan.
2. Risk identification: find the risks which may affect the project and document them in a risk register (brainstorming, checklists, Delphi, SWOT, interviews, experience).
3. Qualitative risk analysis: rank the risks by probability and impact using a probability-impact matrix to find the priority risks.
4. Quantitative risk analysis: estimate the numerical effect of the main risks on cost and time (expected monetary value, decision tree, sensitivity analysis, Monte Carlo simulation).
5. Risk response planning: select the strategy for each risk (avoid, transfer, mitigate/reduce, accept) and prepare contingency plans and reserves.
6. Risk monitoring and control: track the identified risks, watch for new risks, check that the responses are working, update the risk register and report.

Justification

The cycle is justified because risk management is continuous: planning sets the rules, identification and analysis find and rank the risks, response planning decides the actions, and monitoring checks the results and feeds new information back to identification. Working as a cycle makes sure that no new risk is left unmanaged and that responses stay effective as the project changes.