10.5. Managing Project Risk
Once you have a risk management process in place, you need to actively monitor the project for those risks. However, the risks you identified and planned for are not the only risks your project will encounter. We discussed the risk and cost of changes in later stages of the project plan and even if those risks and contingency plans were assessed and "planned" for, they may still have secondary effects you were not aware of. This cycle of project risk is shown in Figure 10.5 You can see that even if the risk is identified and "Plan B" is implemented, you may still be creating secondary risks. Sometimes those risks are minor, sometimes they're major but you've accounted for them, and sometimes they're major and completely unexpected.
Figure 10-5. Project Risk Cycle
Risk monitoring and control occur in this phase of the project lifecycle. The methods of managing risk include:
As you move from one phase to the next or one set of deliverables to another, you should review your risk management plan and be aware of the risks your team identified. If a risk was anticipated, it should not come as a surprise simply because you (or your team) forgot to review your risk management plan. It's sometimes helpful to add milestones to your project schedule either to indicate places where risk has been identified, trigger points for identified risks, or simply as a reminder to review your risk management plan periodically. You should also periodically discuss and review project risk in your project team meetings, especially risks to your critical path tasks. This discussion can include risks that are pending, coming up, or just discovered. It can also be used to discuss the potential secondary risks discovered as a result of one or more changes to the project. Another risk management tool is the Earned Value Analysis, which we discuss at length in Chapter 11. This can help assess project progress and identify overall project risk. One final tool for managing project risk is the monitoring or measuring of performance against specification. If the project team does not have the skills and talents necessary to accomplish the project work, your project is at risk. This may not have been an identified risk during your project risk evaluation process, so it might crop up only as work gets underway.
What can you do to manage risk? We've previously discussed developing contingency plans for project risks that have the highest likelihood of occurring and the highest impact to the project. We can manage risk through:
Remember, when assessing changes and risks, it's important to keep your critical path tasks in mind. Risks and changes to tasks on the critical path require careful review of potential ramifications. Risks and changes to tasks that are not on the critical path also require careful assessment, but by definition, changes to these tasks will be less dramatic, at least to the project schedule, than tasks on the critical path. Finally, keep in mind that changes to tasks can place them on the critical path, so evaluate change before implementing them to keep your project on an even keel.