Rule #1: Do not confuse risks with issues!

Risks are events that MAY occur that will negatively impact your project’s resources, time, cost or scope. An issue is an event that has or will occur

Very early in your project, you should actively identify the risks to your project. An effective way of doing this is bringing the team & stakeholders together for a brainstorming session. Think of risks identified for similar projects. What is unique about this project that could cause you problems? Are you using new technologies? Are resources spread too thin? Is funding secure? Keep the group talking and write down the risks as you go. I guarantee that you will have many more risks than you originally thought. Risks can and will continue to come up throughout the life of the project. Always be on the lookout for new risks!

Once the identification phase is complete (or everyone is wiped out from thinking about all the bad things that could happen) the risks should then be quantified to determine the probability that a risk will occur and the severity that said risk will have to the project. A common way of doing this is by using a risk matrix. When using a matrix, rate each risk’s probability of occurring and the impact it will have if it does in fact occur. Those with High probability and High impact will need immediate attention.

Now you know your risks, their severity, and their impacts. So, what do you do next? Well, there are basically four options:
- Avoidance
- Transference
- Mitigation
- Acceptance

Let’s take a look at each:
Avoidance – what can we do to prevent this risk from happening? Does our vendor have a history of late delivery? Well, find another vendor. Are you short on software developers? Hire more (yes, I know that’s not always realistic). You get the idea. Find a way to remove the possibility that this risk will occur.

Transference – the concept of making someone else responsible. Think of it as insurance. And, insurance is actually a form of transference. We offset the risk of having an expensive bill for car repairs by hiring an insurance company to accept some of the risk.

Mitigation – What can we do to minimize the chances of a risk occurring or the impact a risk may have.

Acceptance – There’s not much you can do about a meteor striking your office. So…just accept it.

Risk should be continually managed throughout the project. You should always be on the lookout for new risks and tracking probabilities and impacts of known risks.