Project Risk Management for SME’s Handout
Understanding Project Risk
In an ideal world, we could make project plans, instruct the project team to follow them through,
and end up with all the required deliverables on time, to budget, and to specification. In the real
world, anything that can go wrong will go wrong, unless we actively manage it. If the essence of
project management is “making it happen”, then the project manager must be actively and
continually applying energy to this end.
Any venture involving change (i.e. a project) will be subject to risks. There is a growing consensus
that the most important thing for the Project Manager to do is to identify the risks to the success
of the project, and continually work to reduce, and (if possible) eliminate them.
Risk assessment is now a recognised task in the planning of significant projects. However, it is
pointless to assess risks, unless we follow up this task with active risk management. It is not
enough to simply identify what can go wrong (the risk). We must decide what we will do about it
if it happens (the contingency plan), and how we will know when it happens (the trigger).
To manage risk, we must first identify potential risks, then assess them, and then determine how
to act, if they manifest themselves:
Risk Identification
Questions to ask
The risk identification questions are, basically:

What can go wrong?

What is the probability of it going wrong?

What is the impact if it does go wrong?

What shall I do to minimise the impact, if it does go wrong?
To answer these questions comprehensively, it is necessary to involve knowledgeable project
participants, typically as part of the Project Definition Workshop. Common risk categories include:
1. schedule - may be late
2. cost - may go over budget
3. function - what you build may not be what was needed
4. quality - too many defects, poor performance, etc.
5. external - a third party fails to deliver
6. political - project perceived as failure, even thought it met its objectives
Project risks may arise from a number of sources, including:
 Project Team
 Client Relationships
 Business Environment
 Technological Environment
© Parris King Developing Potential 2012 – all rights reserved
Page 1
Project Risk Management for SME’s Handout
Impact Assessment
Having identified the project risks, it is necessary to assess how much damage would be done to
the project if each risk happened. If the impact on the project would be:
High
score 3
i.e. potentially critical – this will probably destroy the project
Medium
score 2
Neither critical nor trivial – somewhere in between
Low
score 1
i.e. a minor irritation – we can live with it
Now score the probability of the event occurring - chance of this risk occurring in this project is:
High
score 3
Almost certain to happen
Medium
score 2
Neither certain nor very unlikely – somewhere in between
Low
score 1
Very unlikely to happen
Note: This method is deliberately simple, to allow risks to be quickly and decisively assessed,
without lengthy debate and complex scoring systems. Effort can then be concentrated on countermeasures and contingency planning.
Assessing the Score
Multiply the impact score and the probability score for each risk on the checklist, then consider
what action to take. (Table 1 provides a scoring table showing the possible values for risk
assessment).
Risk Score
9
4-6
3
1-2
On the basis of the definitions above, this project is very likely to fail. You
must think again about the attainability of your objective and/or about the
environment in which you are trying to achieve it. It is essential to reduce
this Risk before proceeding.
You must maintain a number of alternative planned means to attain the
project objective (contingency plans). This may incur extra costs, to be
justified against the value of the project deliverables.
If the risk is potentially high impact (even though the probability is minimal),
a contingency plan is desirable.
You can risk the threats materialising, and re-plan when they are identified
as imminent.
Table 1. Risk Scoring Table
Impact
Probability
High (3)
Medium (2)
Low (1)
High (3)
9
6
3
Medium (2)
6
4
2
Low (1)
3
2
1
© Parris King Developing Potential 2012 – all rights reserved
Page 2
Project Risk Management for SME’s Handout
Contingency Planning
Definition
Contingency Planning is part of the wider topic of Project Risk Management. The Concise Oxford
Dictionary provides us with following definitions regarding contingency.
Contingency
a chance occurrence that may happen at a later date
Contingency Plan
a plan to take account of such an occurrence
Contingency plans are required to neutralise the consequences of events, outside our control,
which could damage the project. The risk in the project plan determines how much contingency is
needed to ensure an acceptable probability of success. A contingency plan may also be an
opportunity plan that identifies how to maintain the advantage of unexpected windfalls
Contingency Planning Checklist

Focus on critical path tasks.

Be proactive - define actions when things are calm - before they start to go wrong!

For each task, brainstorm as many unplanned events as possible.

For each event, choose a probability (1, 2 or 3)

For each event, ask what impact the event would have on the task (1, 2 or 3)

Multiply probability by impact to get a Risk Factor.

Focus planning attention on highest risk events

Give special attention to potential opportunities!
Risk Log - content
Risk Number
Risk Type
Author
Date risk identified
Risk description
Probability
Impact
Risk category
Countermeasure(s)
Contingency plans
Responsibility
Simplified Risk Log
Unplanned event
(or Risk)
Prob.
1-3
Impac
t 1-3
Factor
(P x I)
Preventive (counter-measures) or
remedial action (contingency plan)
© Parris King Developing Potential 2012 – all rights reserved
Page 3
Project Risk Management for SME’s Handout
Re-assessment
Risk management must be a continuous activity, throughout the project. Regular scheduled
reviews should:

Review the list of risks

Reassess probabilities and impact

Brainstorm/identify any new risks

Re-calculate the risk score
The overall risk should reduce steadily throughout the project. If the risk score is seen to be
increasing, this is a major “alarm bell”, which must not be ignored.
Triggers
The philosophy is that “The time to take action is when you feel anxious, not when you feel pain”.
We must carefully consider what we must monitor in order to know when to activate the
Contingency Plan.
© Parris King Developing Potential 2012 – all rights reserved
Page 4