Having identified and understood the risks, the central task of managing them is the monitoring and control process. Many project managers and project team members think that once a risk is in the risk register it is managed. Not so: it is merely identified and partly understood. It then has to be watched, like a sleeping leopard, so that at the first signs of stirring the project can take action to manage the risk. The key thing is to do something, and the right thing. Risk monitoring and control is the process by which you can watch the leopard of risk and act in the right way when it stirs. Figure 11.7 shows the inputs, tools and techniques and outputs of the process.
Figure 11.7. The risk monitoring and control process
The point of this process is to ensure that the risks in the risk register do not derail the project. (This process is not concerned with risks not in the register; that is the province of the risk identification process.) A surprising number of projects fall foul of risks in the register that are not properly managed. Adapted from PMBOK Guide (p.265)
A surprising number of projects fall foul of risks in the register which are not properly managed. The outputs listed in Figure 11.7 are all aimed at the single end of ensuring that risks in the register do not derail the project. The outputs are reasonably straightforward and self-explanatory. The processes by which they are obtained need more explanation, which is given below.
Risk assessment (also known as risk review)
All projects should have regular risk reviews, to check the current validity and usefulness of the risk register and risk management plan overall. Things change, and no matter how good the initial risk identification and analysis work, new factors or changed circumstances may require them to be updated. This is what the risk assessment does. It can be a standing agenda item in regular project management meetings. It may be useful on some occasions to have a project risk review meeting as a stand-alone event.
There are two uses of a risk audit. One is to audit the risk, to have a third party or a friendly outsider come and review the risks and especially the responses and management plans for them, and give an opinion. In a large project or one with major health, safety or financial risks, a risk audit may be a regulatory or contractual requirement. The other use of a risk audit is as a wake-up call to shake people in the project out of their comfortable habits by frightening them. This can be a reasonable control function of the risk audit.
Variance and trend analysis
What was planned progress? What are the actuals? And what is the trend? Is it getting worse or better? Often a graph to show trends is a powerful tool for seeing and understanding what is going on in the project, and also for communicating it to others. Earned value is one metric which can be used for variance and trend analysis; others are schedule performance index and cost performance index. These are described in the boxed text.
Technical performance analysis
This means analyzing how the technical performance of the project to date compares to the plan. For example, perhaps a project to upgrade an engine planned to enable it to run at a higher temperature than before, say 800 C, so has this been reached or is performance peaking at only 720 C?
If you have a ten-week project with a contingency, or buffer, of $10,000, then there is a great difference between the situation in which you have spent $9,000 of the buffer by the end of the second week and a situation in which you have spent $9,000 of the buffer by the ninth week. The first situation suggests that the project is in trouble, the latter that there are no real problems. This example shows how buffer monitoring can be used to monitor risks.
To ensure you get maximum value from risk monitoring and control meetings, participate in them in two ways. Make sure that the meetings are properly administered, so that there is an agenda, you have an aim, and so on. That should be normal. Secondly, listen to your emotions and feel the emotions of others. Does it feel like there are problems? Follow up your gut feelings by looking for evidence, but of course be sensitive to how you do this.
Top of Page