Chapter 11

Project risk management

As we know, risk can be negative (understanding potential problems that might occur in the project and how they might impede project success) or positive (risks that result in good things happening; sometimes called opportunities). Risk utility or risk tolerance is the amount of satisfaction or pleasure received from a potential payoff. There are six processes involved:
@ Risk management planning
— Risk identification
— Qualitative risk analysis,
— Quantitative risk analysis
— Risk response planning
— Risk monitoring and control

The main output of risk management planning is a risk management plan—a plan that documents the procedures for managing risk throughout a project. A risk breakdown structure is a hierarchy of potential risk categories for a project. Similar to a work breakdown structure but used to identify and categorize risks.


In addition, Risk identification is the process of understanding what potential events might hurt or enhance a particular project. Risk identification tools and techniques include: brainstorming, the Delphi Technique, Interviewing and SWOT analysis. Thus, a risk register is a document that contains the results of various risk management processes and that is often displayed in a table or spreadsheet format and for documenting potential risk events and related information.

Top Ten Risk Item Tracking is a qualitative risk analysis tool that helps to identify risks and maintain an awareness of risks throughout the life of a project. A watch list is a list of risks that are low priority, but are still identified as potential risks.

Quantitative Risk Analysis often follows qualitative risk analysis, but both can be done together. Main techniques include: Decision tree analysis, simulation and sensitivity analysis. After identifying and quantifying risks, you must decide how to respond to them. Four main response strategies for negative risks:
— Risk avoidance
— Risk acceptance
— Risk transference
— Risk mitigation

Workarounds are unplanned responses to risk events that must be done when there are no contingency plans.