Risk Identification Methods in Project Management

According to Project Management Institute (PMI), the risk management life cycle is a structured way to help companies view risks throughout the project. Regardless of the organization or project requirements, the outline of this approach can assist in risk identification and management, and support strategic decision-making. The figure 4-1 below from PMI, shows the lifecycle framework for managing risks. Not all risks are predictable but following the framework will allow for the least amount of exposure to risks and is the framework for preparing responses to risks.

The Risk Management Plan (RMP) serves as a set of guidelines outlining how the team members will organize and execute risk management activities. It encompasses essential elements such as risk strategy, methodology, roles and responsibilities, funding timing, and risk categories. Throughout the project's duration, the RMP acts as a comprehensive tool for identifying and managing risks. To ensure its effectiveness, all team members and key stakeholders must be well-informed about the plan's details and embrace its principles.

Companies have the option to develop a standardized risk management plan structure that applies universally to all projects. While the specific details and products may vary, the underlying framework remains consistent. As a result, over time, the quality and productivity of risk management improve. This standardized approach enables the RMP's integration into the company's culture, fosters cohesion in the risk management process, and facilitates data analysis for future projects.

It is useful to develop a risk breakdown structure (RBS) when breaking down the risk categories. The RBS is a visual tool to show the structural depiction of potential sources of risk. The risks can be broken down into direct source risks and then into levels of associated risks. For example, allowing for shutdowns due to COVID 19 could cause technical, management, commercial, and external risks. Each of these risk levels will have several other levels of risks associated with them. It is helpful to include the RBS in the risk management plan to describe the categories of risk.

The success of a project relies heavily on identifying its risks, and it's essential to involve multiple stakeholders and experts with specialized knowledge in this process. Gathering comprehensive data for the project enables a thorough assessment of its requirements, threats, and opportunities. Brainstorming serves as an effective approach to generate a wide range of risks across various departments. To maximize its effectiveness, brainstorming can be conducted anonymously through emails or in small virtual sessions, providing an open forum for team members to contribute ideas and insights.

Though valuable, brainstorming can be time-consuming, especially for large projects. Therefore, the project manager plays a crucial role in filtering and organizing the identified risks. Additionally, checklists can be employed to present detailed lists of risks, drawing from past project experiences or audits. In cases where the project involves risks related to a pandemic, which might have limited available knowledge, a combination of brainstorming and industry-known risk checklists can be beneficial. This amalgamation can enhance the preparation for the risk identification process and ensure a more comprehensive risk assessment for the project.

The use of data analysis techniques can also assist in uncovering project risks. Root cause analysis can be used to examine causes that may lead to a problem and the associated risks of that issue. For example, if there are increases to supply change costs due to transportation, since the cause is transportation a plan can be put in place to avoid the additional transportation by using local or domestic vendors. This technique can be used to identify threats as well as opportunities. Finding the root cause could help explore alternative options that could save time and/or money.

A list of risks could also be developed by using a SWOT analysis. This type of analysis focuses on the company's strengths, weaknesses, opportunities, and threats (SWOT). By identifying the weaknesses and threats, risks can be identified specific to those areas. This can be applied to each sector of the project to help identify any potential risks. And by identifying the company's strengths and opportunities strategically this may provide ways in which the identified weaknesses and threats could be averted. Knowing the areas in which the company is most successful in, most strengths is a competitive advantage. Developing strengths and opportunities helps maintain a competitive edge in the industry just as much as avoiding and mitigating risks.

Once a list of risks has been accumulated, an easy way to organize and update risks is by using a risk register. The risk register can be as detailed or limited depending on the needs of the project. Along with the risk register, an impact and probability matrix can be added to show how probability percentages can be applied to the risk register to show how significant the impact could be on each risk in the project. As the impacts change, the probability percentages can be updated so there is a constant and accurate impact rating. PMBOK lists the following areas that can be recorded in the risk register and updated throughout the project: Perform Qualitative Risk Analysis, Plan Risk Responses, Implement Risk Responses, and Monitor Risks.

The risk register should, at a minimum, encompass a list of identified risks, the assigned risk owners, and potential risk responses. In addition to these essential elements, the risk register can incorporate any other pertinent data, such as risk categorization, current risk status, and timing details. The greater the specificity of information within the risk register, including the timing of potential risk occurrences or the determination of risks that are no longer relevant, the more advantageous it becomes for the management team to take proactive actions.

Regularly updating the risk register is crucial as risks evolve over time, some becoming more relevant while others may no longer pose a threat. Keeping the risk register up-to-date facilitates the most accurate risk analysis and mitigates the likelihood of a black swan event, characterized by severe consequences resulting from unexpected risks. By maintaining a comprehensive and current risk register, the project team can effectively manage risks and enhance the overall project's success.

Along with the risk register, the project management team may also want to include a risk report. This is more of an overview of all sources of the project's overall risk. It gives an overall summary of the project's exposure to certain risks. The risk report can outline how risks are distributed across risk categories and include information on where this project trends in the industry. This can provide an overview for stakeholders that may not need a complete and comprehensive report of risks and risk mitigations.

After identifying and documenting all potential risks, monitoring their changes can pose significant challenges, even for an experienced project management team. Dealing with the pandemic's constraints adds an extra layer of complexity to various project aspects. Risks may increase due to supply chain limitations, transportation issues, scheduling constraints, and other factors. While having a list of identified risks is a good starting point, continuous monitoring is crucial to prevent bottlenecks or unexpected black swan events that could severely disrupt progress.

In this context, analysis techniques play a vital role in predicting changes and assisting the project management team in better preparing for potential outcomes. By applying such techniques, the team can proactively address emerging risks and enhance their ability to navigate through uncertainties and challenges posed by the pandemic.