Planning for Risk Management

---

Risk management planning is about making decisions. The project manager, the project team, and other key stakeholders are involved to determine the risk management processes. The risk management process is in relation to the scope of the project, the priority of the project within the performing organization, and the impact of the project deliverables. In other words, a simple, low-impact project won’t have the same level of risk planning as a high-priority, complex project.

Referring to the Project Charter

One of the first inputs to risk management is the project charter. The project charter, as you may recall, formally authorizes the project, and clearly identifies the project manager as the authority who will assign resources to the project. The charter is needed in risk management planning because it identifies the business need of the project and the overall product description.

Risks that can prevent the project from satisfying the business need of the project must be addressed. The product description must also be evaluated to determine what risks may be preventing the project work from obtaining the acceptable product description.

Relying on Risk Management Policies

Organizations often have a pre-defined approach to risk management. The policies can define the activities to initiate, plan, and respond to risk. The project manager must map the project risk management to these policies to conform to the organization’s requirements. Within the confines of the risk management policy, the project manager must identify any component that can hinder the success of the project.

Considering Roles and Responsibilities

In many organizations, there are predefined roles and responsibilities that influence risk management planning, the decisions relevant to the risks, and the involvement of the project participants. These roles and responsibilities—and the policies associated with working with these individuals—should be identified and considered early in the project process to save time and frustration.

In addition, the project manager should have full knowledge of the power and autonomy he has on the project. For example, a project manager may want to create plans and reactions to the risks within a project, but the policies within the performing organization limit the amount of power the project manager has to make decisions regarding risk management. Knowledge of the limit of that power can help him work with management or customers to successfully alleviate risk.

Examining Stakeholder Tolerance

Depending on the project, the conditions, and the potential for loss or reward, stakeholders will have differing tolerances for risk. Stakeholders’ risk tolerance may be known at the launch of the project, through written policy statements, or by their actions during the project.

Consider a project to install new medical equipment in a hospital: there’s little room for acceptance of errors because life and death are on the line. No shortcuts or quick fixes are allowed. Now, consider a project to create a community garden. Not only are life and death not on the line in the garden project, but the acceptance of risk is different as well.

A person’s willingness to accept risk is known as the utility function. The time and money costs required to eliminate the chance of failure is in proportion to the stakeholders’ tolerance of risk on the project. The cost of assuring there are no threats must be balanced with the confidence that the project can be completed without extraordinary costs. Figure 11-1 demonstrates the utility function.

Figure 11-1: The value of the project is relational to the cost of risk avoidance.

Using a Risk Management Plan Template

The performing organization may rely on templates for the risk management plan. The template can guide the project manager and the project team through the planning processes, the risk identification, and the values that may trigger additional planning. Hopefully, the organization allows the template to be modified or appended based on the nature of the project. As most projects, however, resemble other historical projects, the template may need only minor changes to be adapted to the current project.

A risk management plan may grant the project manager decision-making abilities on risks below a certain threshold. Risks above a preset threshold will have to be escalated to management for determination of their cost and impact on the project success.

Revisiting the Work Breakdown Structure

The work breakdown structure (WBS) serves as an input to the risk management planning processes. The WBS is needed to help the project manager, and the project team identifies the components of the project and what risks may be unique to a particular area of the project versus a risk shared across the entire project.

For example, a project to create a new building has different components in the WBS: foundation, framing, interior, finishing, and so on. Within each parent component in the WBS there may be risk unique to only that category of deliverables. However, there may also be risks that should they come to fruition could affect the entire project’s success. For example, a risk in the foundation could affect the entire structure later in the project life cycle. Figure 11-2 demonstrates how the WBS can contribute to risk management.

Figure 11-2: The WBS can help identify risks within the project.

---