Is Your Project Worth the Risk?

Absolutely everything in life carries a risk. Whether

you walk or drive, get married or stay single, go to college or go to work, you’re

taking a risk. You can’t even avoid risk by doing nothing! After all, couch potatoes run the risk of

obesity, diabetes, and high blood pressure.

Given the reality that no action or even

inaction is risk free, how do you decide whether a project or change in your

business is worth the risk?

There are really several different parts to

risk analysis. One is a simple analysis of risks, their likelihood, and their

impact should they come to pass. The second is the construction of a risk matrix to help your team visualize the relative significance of various risks. The third is a risk management plan—a review of

what it would take to mitigate the unavoidable risks inherent in your plan.

To make this a little clearer, imagine that

you are planning a corporate social event. You’ve put together a basic plan for

a picnic, outdoor games, and an evening bonfire. It should be a lot of fun, but—as with everything in life—there are risks involved.

A risk analysis will tell you that it might

rain…team members might choose not to

take part in the games…and the evening

bonfire could become an evening wildfire if not properly managed. This type of

analysis will also tell you that rain is very unlikely, as you happen to live

in a desert area, but very dry conditions mean that bonfires are quite

dangerous.

A risk matrix will help you to visualize the significance of these risks, so that you can better determine which are important enough to manage—and which can simply be avoided.

A risk management plan would almost certainly

include the selection of venue alternatives in case of rain, spirit-building

activities to raise the level of interest in games, and fun, evening

alternative activities that don’t require actual flame.

Of course, none of these analyses can be 100%

accurate: no one can judge risk with 100% certainty. Which explains, among

other things, why gambling and insurance continue to be such popular

industries! But the process of

acknowledging, identifying, and planning for risk can help you and your

business to ensure that you are hedging your bets, and planning for the long

term.

Conducting a Risk Analysis

Once you’ve identified your project, its goals,

and a group of team members with the expertise to undertake the work, you’re

ready to move forward with risk analysis. Of course, it’s great to have the

funds and time to hire an outside risk analysis expert—but, like most of us,

you may have to become that expert yourself! If that’s the case, not to worry: the process is not terribly complex.

Step 1: Identify the Risks

No one understands

risk like the people who live with it every day. Your sales force understands

the risks inherent in over or under-bidding; your marketing team understands

the risks of trying out a new and edgy type of messaging. So you’ll need to

turn to your team as you begin making your list of risks. To do this, you can

interview individual team members, run brainstorming meetings, review

evaluations of past, similar projects, or (ideally) do all three.

Step 2: Evaluate the Risks

Evaluating risks

involves coming up with scored answers for two related questions:

• How great is the probability that this problem
  
  will occur?


• If this problem should occur, how great would
  
  the impact be on our project?

You’ll give each risk a score from 1 to 9,

with 1 being the slightest risk or the slightest impact, and 9 being the

greatest. So, for example, going back to the corporate picnic, the risk of Margaret

in Marketing forgetting to bring the potato salad is quite high (perhaps an 8),

but the impact it would have on the event is very slight (perhaps a 2). Conversely,

the risk of a major storm may be quite low, but it would have a devastating

impact.

The process of evaluating risks can be quite

complex, involving mathematical models. At the very least, it will almost

certainly involve some level of research. For your picnic, you might not want to

actually model the probable outcome of having certain events occur—but at the

very least, you’ll want to look at weather trends to see how likely it is that

you’ll experience severe storms during the afternoon.

When you’re done with your analysis, you

should have a list of risks with two numbers next to each one. It’s handy to

assign each risk a letter, so as to make it easier to chart them on the risk analysis

matrix.

Step 3: Build a Risk Analysis Matrix

A risk analysis matrix is a square chart or

graph divided into four boxes, representing severe, high, elevated, and guarded

risk. Along one axis of the graph are the numbers 1 – 9 representing frequency

of likelihood; along the other axis are the number 1 – 9 representing severity

or significance. If you like, you can color code your chart as shown. When you’ve

graphed your threats, it will become visually obvious which are the most

significant and the most likely (and vice versa).

Risk Analysis Matrix (blank chart).

Chart your risks as you would any other

information by placing the letter representing the risk on the chart where it

belongs. A risk with a likelihood of 8 and a significance of 7 would be plotted

in the red zone, meaning it is a major threat, while a risk with a likelihood

of 4 and a significance of 3 would be plotted in the blue zone meaning it is a

minor risk.

Preparing the Ground for a Risk Management Plan

With your matrix in hand, you can now clearly

see and easily share information about risks related to your planned project. This

means you’re ready to start thinking about how to manage those risks based on

their likelihood and severity.

There are really only a few basic ways to

manage risk, no matter what your business or the risks you’re envisioning. You’ll

choose the style of risk management based on the type of risk you’re facing. Here,

according to the Association for Project Management ,

are your options:

• Remove: Any risk that can be easily removed
  
  from your project should be removed from your project. In the case of the
  
  corporate picnic, it makes sense to just say no to a bonfire.


• Reduce: Many risks can be reduced by taking
  
  relative low cost, simple actions before getting started. For example, if one
  
  of your risks involved negative responses from upper management, an easy way to
  
  reduce the risk might be to involve upper management in early brainstorming and
  
  decision-making.


• Avoid: What
  
  will you do if this problem arises? What
  
  is your “Plan B?” In the case of the
  
  picnic, a great option for avoiding a weather-related risk is to have an indoor
  
  venue available.


• Transfer: Can someone else take responsibility for your
  
  risk? For example, if you hired an
  
  outside firm to set up your picnic, you can also ask them to think through and
  
  offer acceptable options given the risk of rain.


• Accept: Some risks are worth taking. Would you
  
  risk being embarrassed if offered the opportunity to make the graduation speech
  
  at your alma mater? Chances are you’d
  
  say “yes,” and accept the possibility that your mind might go blank at the
  
  microphone. Some risks, on the other hand, are so slight that you can easily
  
  adjust to managing them. Having no potato salad is such a risk. Sure, Margaret
  
  might forget to bring it, but—so what?

Understanding your options, you can now—with

or without the help of counsel or your team members—go through your risk

matrix and assign appropriate responses to each item.

Creating Your Risk Management Plan

Your risk management plan is a document

based on all the work you’ve done so far, which includes your matrix and your

assignment of strategies for each risk. Where the strategy involves more than

simple acceptance, you’ll need to work with stakeholders to determine the best

course of action should the risk become a reality.

This document should be read, revised, and

approved by your team members and any other stakeholders, so that you are all

on the same page regarding the best course of action in each situation. With

your risk management plan approved, you’ll be ready to mitigate or avoid many

risks. Perhaps more importantly, you’ll have a “Plan B” in hand in the event

that significant risks become real problems.

A risk management plan becomes, in essence,

insurance against a wide range of possibilities. How useful is it? According to NASA, a well-designed risk

management strategy has been a major tool for ensuring the success of many high

profile missions such as the repair of the Hubble Telescope. According to a

Case Study document describing risk management at NASA ,

the matrix created for space-related projects was more complex than most, as

some projects involve multi-billion dollar budgets and international scrutiny

while others are almost invisible to the public. The outcome, however, was well

worth the work:

The establishment of the risk level early in the program/project

provides the basis for program and project managers to develop and implement

appropriate mission assurance and risk management strategies and requirements

and to effectively communicate the acceptable level of risk. The document sets

the stage for the project execution addressing a myriad of requirements governing

parts, material design –single point failures, analysis, software, verification

testing, quality assurance, reviews, and risk acceptance level.

Of course, unless you’re working for SpaceX,

it’s unlikely that your risks will include the loss of a major satellite or the

failure to rescue a multi-billion dollar space telescope. But the type of risk

you incur is really beside the point. Your business is as important to you and

your co-workers as a rocket to Mars maybe for NASA. The loss of a major product, client, or project could be fatal to

your corporation. A risk management analysis and plan has the power to ensure

that you’re never risking more than you can afford to lose.