Risk Containment or Reduction

In many cases during the risk assessment process, the project manager and the team will be able to identify strategies to minimize or eliminate the risk factors. For example, if the team is perceived to be a high risk because of lack of experience in the development platform, the recruiting of experts or hiring expert contractors can control the risk. All high risk factors that cannot be constrained or eliminated during the risk assessment sessions should have a risk memorandum developed for them, documenting the risk, the impact of the risk on the project, what actions the steering committee and project sponsor can take to assist in reducing the risk, and, for high-impact risks, a contingency plan. Figure 12.5 shows a sample form for this purpose.

Figure 12.5. Risk memorandum

False Science

Some approaches to risk assessment use probability and other scientific approaches. For example, you get assessments such as probability of risk occurring (.2) and so on. We believe that this is still a subjective technique and the use of indicators such as .2 gives business people a false sense of science and rigor. It is still all a series of guesses.

By estimating the costs (people, dollars, time lost) of noncontainment of the risk factor, the project manager can often help focus executives on the added value of proactive risk reduction.

Beam Us Up, Scotty

It is really important that you identify the contingency or fallback position for all high risk factors. What you will generally find is that the contingency will be similar for all high risks (e.g., to fall back to a minimum or "quick win" deliverable ; remember the previous chapter). You should never start a project without the ability, when things get too tough, to be "beamed up."

The proactive reduction or elimination of risk in a project is a classic case of win “win. The project's sponsor and clients win as they have a higher chance of success, and you and your team win because you have a higher chance of success and a lower level of pain in the project.

What is significant is that many project managers face risks in their projects that are beyond their capability (organizationally, politically , and financially ) to control and manage. The technique of risk memorandums enables the people within the organization with the right level of power to assist the project manager in managing the risks.

For larger projects, you may need to go even further than risk memorandums and, with the help of your team and stakeholders, you should develop a risk management plan.

Risk Management Plans

A risk management plan is an extension of the concept of risk memorandums. The model that we use is basically a text document that details for each unresolved high risk factor the following points:

• Risk factor

• Risk impact

• Date by when the risk impact should be evident

• Risk containment strategies

• Person responsible for implementing strategy

• Date or timing for implementation

• Cost of containment strategy

• A time line or schedule for risk action (optional)

Risk Tracking and Reporting

The final process of risk management occurs during the project. Having identified the high risk factors and implemented the proactive risk reduction strategies before commencing the project, you, your team, your project sponsor, and the project stakeholders must regularly monitor and report on the following:

• The effectiveness of the implemented risk reduction strategies;

• The emergence of any new risk factors;

• The elimination of existing risk factors; and

• Any change of status of existing risk factors, for example, a medium risk factor becomes high risk.

This monitoring would typically occur during the normal project tracking and review meetings and reviews undertaken throughout the project. However, it is important that you and your team constantly adopt a risk perspective and keep your collective "risk antenna" tuned for any early warning signs of new risks or changes in the level of existing risks. For example, during a team meeting with stakeholders, a new requirement emerges. Although the impact of the new requirement would typically be assessed from an effort and time perspective, the impact of the new requirement on risk should also be carefully evaluated and reported to the sponsor and stakeholders.

Risk Management Committee

In larger projects, it is useful to convene a risk management committee. This committee is usually a subset of the project steering committee and would include the project sponsor, the project manager and a representative from internal and, in some cases, external auditing. We suggest that after each project steering committee meeting, the risk management committee has its meeting. The risk management committee would review the risk management plan and the risk reporting documents.