Risk management cycle; managing risk effectively

Risk management cycle

   +---------------------+
   |    Risk planning    |
   +----------+----------+
              v
   +---------------------+      +---------------------+
   | Risk identification | ---> |    Risk analysis    |
   +---------------------+      |  (qualitative and   |
              ^                 |    quantitative)    |
              |                 +----------+----------+
   +----------+----------+                 v
   |   Monitoring and    | <--- +---------------------+
   |       control       |      |    Risk response    |
   +---------------------+      |      planning       |
                                +---------------------+

The cycle is repeated throughout the project life, because new risks appear and old ones change as the project moves from planning to implementation.

1. Plan: decide the approach, roles, tools and scales.
2. Identify: list the risks by brainstorming, checklists, Delphi and SWOT.
3. Analyse: rank them qualitatively, then find their quantitative effect on cost and time.
4. Respond: avoid, transfer, reduce or accept; prepare contingency plans.
5. Monitor and control: track the risks, review, update and report.

Managing risk effectively

• Start risk management early, in the planning stage, and continue it through all phases.
• Involve all stakeholders and experts in identification.
• Keep a live risk register with the owner, trigger and response for each risk.
• Focus on the top risks by priority (probability x impact, EMV).
• Put the responses into the schedule and budget, with a contingency reserve.
• Use contracts, insurance and guarantees to transfer risk.
• Review regularly, learn from past projects, and communicate the risk status to the client.