by Cheryl A. Wilson PMP, RMP, CCEP
One of the major failings in managing project risk is incorrectly identifying project risk. All projects have uncertainty and all projects have risks. But not all uncertainty is risk. Managing uncertainty (identifying what are project risks and what is just uncertainty) is key for project managers and a key part of proactive risk management. The reduction of uncertainty surrounding decisions that matter to a project’s success is the primary goal of project risk management.
Project managers (PM) need to understand how to perform risk identification correctly so they can identify risks that truly impact the project’s fit-for-use deliverables. Not managing this key element of the project risk environment will lead to a possible reduction in project success rates. Improved decisions are made by reducing the uncertainty surrounding future outcomes through the application of valuable information. PM need to move beyond the current infantile concept that project risks are just about filling up a risk register with events that they consider “out of their control” or “out of their management capabilities.” The true nature of project risk management must mature into taking proactive control of project success by seeking to improve decisions that impact the project’s deliverables. It must no longer be a project “add-on” or “check box.”
The first step in identifying risks is the understanding the definition “project risk.” Project risk is any uncertain future event that if realized will negatively affect the project’s fit-for-use deliverable(s). Breaking down this definition will allow a deeper look at components that make up project risk. Also, we at the PPG do not try to define risks as both positive and negative impacting future events regardless of the continued bodies of knowledge that have failed to make this concept a part of project terminology. PM as with most professionals do not assign positive impacts to the word risk. Let us finally realize this point and call these uncertain future events what they are: opportunities, and move on.
Project risk is in the future: The current bodies of knowledge have taken the word “future” out of their definition of risk. Project risk is a potential event that has not yet happened; and it might not happen. If risk is an event that is in the future, there are associated events that can turn the risk potential into a reality. These events are called risk triggers. Therefore while risks are associated with the project deliverables, risk triggers are associated with the risks themselves. Without triggers, risks remain unrealized while risks that have been triggered are called issues.
Potential Events: In order to fully understand a “potential event” when we talk about risks, it is important to first understand the concept that risks are “potential events” that will negativity affect the project deliverables. One of the reasons PM mismanage their risk programs is they label almost anything that is uncertain as a risk. (See article “What is a Risk?” under the Risk Column) Not all uncertainty is risk that will have a negative impact on our fit-for-use deliverables. As a PM, it is our responsibility to identify which of these uncertain future events are project risk potentials and which are simply project management activities. Too often, PM will fill the risk register (RR) with events that have some degree of uncertainly but are a part of normal PM management activities. Mismanagement of normal project events is not risk, but poor management. Uncertainty about some key characteristics of a planned event or activity or decision is all a part of managing a project. This form of uncertainly is not risk. An experienced PM knows how to manage these events without the labelling of everything in the future as a risk.
It is very important to understand the difference between what the PM is responsible for and what are outside the confines of normal project management acumen. To a new PM it may seem that everything is a risk since they may have never encountered in their experiences, but a more mature and skilled PM having seen these activities and operations before know how to handle them as part of their daily project management routines. Forgetting to do something or making a poor decision is not a risk unless a PM is willing to label themselves as a risk to the project. Hmmm, interesting, but one cannot have it both ways.
Fit-for-use deliverables: Project deliverables as identified by the project sponsor or customer, and defined contractually in the Statement of Work (SOW) or project charter. Implicit in this definition of deliverables are the quality metrics that describe the “fit-for-use” nature of the deliverables for which the project sponsor or customers will agree to accept or sign off on the project’s production.
There are many ways that project team members can misdirect the project risk management environment, but a significant method is by misidentifying risk potentials that may impact their projects. Some of the common errors in risk identification are:
- Identifying normal PM activities, even if they are not managed correctly by the PM, as risks,
- Defining unplanned work as risks,
- Assignment of incompetent project team members including the PM, BA, and Risk Manager,
- Assignment of any and all uncertainty as project risks,
- Assignment of “unknown unknown unknown unknowns…” (you get the idea) as risks
Risks are tied to the project deliverables. One way to know you have identified your risks correctly is to first identify your project deliverable(s). Secondly, determine what potential event could hinder you from achieving a successful outcome of your deliverable(s) as fit-for-use. You will have your risk potentials. The third step (we will discuss in our next issue) is to list the possible causes of the risk potential and the triggers. Remember triggers are not risks themselves, but the event that could turn the risk potential into an issue. Triggers are associated with risks, not project deliverables.
In closing, this article has attempted to redefine how you should be looking at project risk. Project success is all about making good decisions. Identifying what risk potentials could affect our projects will help the PM make better decisions through the reduction of uncertainly by the application of valuable information. PM need to effectively and correctly identify the true risks to the project. By understanding that all project risks are tied to the projects fit-for-use deliverable will help reduce identifying uncertain future events that are not truly risks to our projects.