We’ve identified the risk, the potential cause of the risk and what we can do to mitigate the risk occurring and the fall out from the risk.
My risk management plans typical consist of the following as a minimum for each risk:
- Roles and responsibilities – Include both team members and any outside resources that may be used as part of the risk management plan.
- Risk category – from the risk register
- Probability – how likely is this risk to be realized
- Impact – if it is realized what will it mean to the project
- Mitigation plan – what we are going to do to reduce the probability and/or if it does happen reduce the influence o the project
- Timeline – the time line of he risk overlaid with the project plan milestones. It shows where the risk may affect the project (WBS) and where we will apply the steps of the mitigation plan
- Tracking and report outs – how the risks and plans will be documented and reported to the stakeholders
Risk Category – this can be from a standard list to look for complementary risks or put together by the team.
The output here is the Risk Assessment, one for each identified issue. Additionally the risks can be ranked in some kind of order at this point, likelihood or potential impact are two sorts I’ve used in the past.
Remember a risk may, or may not happen and it’s very possible for a risk to have a positive effect on a project (an opportunity).
The next stage is to quantify the potential impact using the data from the probability and impact sections of the risk analysis. This is designed to produce a quantified potential cost and probability of the risk (80% chance of a 4 week slide/$20K one time cost).
The corresponding mitigation plan should include any opportunity (with the cost) that has been identified that would reduce or eliminate that risk (again quantify the risk reduction, show where the PM adds value whenever possible). Also note risks that can be worked together using a single complementary strategy.
Responses to risks can take a number of forms:
- Avoid – Eliminate the risk before it happens (with any corresponding cost)
- Mitigate – Reduce the probability or/and the impact
- Transfer – deflect the risk and make another party responsible for it
If it is positive risk (opportunity) note in the plan what you need to do to enhance and exploit it, along with the opportunity cost.
Strategies for dealing with the risks need to be timely, and appropriate to the level of risk. More than one response may be appropriate and always involve the team and stakeholders in the plan.
And always, always celebrate the wins.