Risk Management – Recognizing and Prioritizing Project Risks

One of the biggest components in successfully managing your capital program is a strong risk management plan. A project risk assessment is usually performed during project kickoff with all stakeholders contributing to the list of risks because the earlier in the project you plan for certain events, the lower the chances of the associated risks tend to be. In order to successfully mitigate risks, they must be prioritized based on their overall effect on the project. If every item that poses a potential risk to the project is considered high-priority, then the result is that nothing is a high priority because everything is considered equal. The major keys to reducing the impact of any risk to a project are to recognize, prioritize, and control.

Recognizing Risk

Any event, large or small, can be considered a risk to a project if there is a chance it will impact the scope, schedule, or budget. It is important to examine all programs that are running concurrent with your project as well as within the project itself for any effects they may have. Common ways that project management veterans recognize potential future risks is to look into the past, starting with lessons learned. The lessons learned list is usually comprised of items that may not have been considered during the previous project planning but affected the outcome of that project in some way. Remembering the effect these issues had on previous projects and preparing for similar outcomes will keep you from repeating comparable missteps on project after project.

Accepting that despite the best laid plans, unforeseen conditions, design errors and omissions, and owner scope revisions will occur is imperative during the risk recognition process. Experience working with the different stakeholders on various types of project will enable the team to assess the areas where this may happen. Force Majore events, though not occurring on every project, are also occasions that must at least be considered while planning for project risk. Although typically unpredictable and unlikely, adding these risks to the Risk Matrix can help address liability and responsibility ahead of time rather than waiting for a risk to become an actuality.

Prioritizing

Since every project is unique, the priorities of certain risks will be different for every project. Three simple steps can be used to create a project Risk Matrix in order prioritize risk events. It is imperative that all stakeholders are involved in this process so all points of view are taken into account. In order for risks to be properly mitigated, the matrix should be revisited and updated on a regular basis.

1) Identify: Similar to recognizing risk, listing every potential risk to the project is necessary before any assessments can take place. Even events that have only a slight chance of occurring should be considered when creating the beginnings of your Risk Matrix. For example, a lost time accident could occur on any project but, with the proper safety precautions in place, it is rare. On the other hand, change orders due to unforeseen conditions are almost inevitable on any project, but with the proper precautions taking place by all parties the cost of these could be minimized.

2) Measure Likelihood: Each risk identified should be given a ranking based on the likelihood of them occurring. The scale for this ranking is at the discretion of the project team, it could be 1-5 with 1 being unlikely and 5 being likely, or it could be on a likelihood percentage basis. Using the examples discussed above, a lost time accident while using a contractor with a stellar safety record would be ranked as a 1, while encountering unforeseen conditions on a renovation without existing drawings would get a 5. Each risk on the list should be weighed and discussed with the stakeholders.

3) Assess Impact: Using the same guidelines established when calculating likelihood, the project stakeholders should next rank the impact of different risks. Continuing with our examples, a lost time accident could be devastating to a project with little to no float and given a ranking of 5. However, if the project is not a tightly scheduled one and has a lot of float, then this occurrence may only be given a 3. The impact may also change throughout the project duration. A change order from an unforeseen condition may not affect the project if found early when there is float in the schedule or contingencies are high, ranking it at a 1, but as the project draws to a close that same change request may cause schedule disruption or budget problems, making the impact more like a 4.

4) Find the Overall Calculated Risk:  Depending on the scale used to measure likelihood and impact, a formula can be put together to calculate the overall risk associated with a certain event. From there, the risks can be weighed low, medium, and high so that the team can determine which risks are priorities.  After the overall risk for each event is calculated, stakeholders should look at the urgency of each kind of risk.  If the majority of the risks are shown as high, they should be revisited and reranked.  If every risk on the project is labeled high priority, then in essence you have just deprioritized all of them, because you won’t be able to concentrate on every risk all the time- the entire point of the matrix is to demonstrate where to focus mitigation efforts.
Controlling & Mitigation

Many projects begin in an organized manner with a strong Risk Matrix, and as the day to day management of the project carries on, it becomes harder to stay on top of this document.  The failure to update the Risk Matrix is the most common reason that some risks seem to arise out of nowhere at the last minute.  In order to have a successful risk management program, the Risk Matrix must be updated and controlled on a regular basis.  Priorities will shift, impacts will change, and new risks will arise.  If the Risk Matrix is consistently being evaluated, plans to mitigate the high likely high impact risks.

Mitigating the highest calculated risks does not completely deter them from occurring, but establishes a workarounds and contingencies to lessen the overall impact to the project.  Using the examples discussed above, in order to mitigate the risk of a lost-time accident, you would ensure that all parties are properly safety trained and have submitted their respective safety manuals.  You would also build your schedule to have little or no trade stacking in congested areas and continue regular jobsite safety audits.  In order to mitigate the risk of change orders resulting from unforeseen conditions, you would have both the designer and contractor perform site surveys, have coordination and shop drawing reviews, and have regular stakeholder meetings to discuss design issues.  To lessen the project impact should either of the above risk events occur, the project would ideally have float built into the schedule as well as contingencies in the budget.

Every project comes with risks, and risk events will occur no matter the initial plan.  A solid risk management program is the best way to keep these risk factors low, keeping priorities in place for the good of the project. Stakeholders from all parties must be involved in contributing to the Risk Matrix early and regularly, which can be accomplished by following the three simple steps of recognizing, prioritizing, and controlling.