Steps in a Sound Risk Management Process?

As a project manager or team member, you manage risk on a daily basis; it’s one
of the most important things you do. If you learn how to apply a systematic risk
management process, and put into action the core 5 risk management process
steps, then your projects will run more smoothly and be a positive experience for
everyone involved.

A common definition of risk is an uncertain event that if it occurs, can have a positive
or negative effect on a project’s goals. The potential for a risk to have a positive or
negative effect is an important concept. Why? Because it is natural to fall into the
trap of thinking that risks have inherently negative effects. If you are also open to
those risks that create positive opportunities, you can make your project smarter,
streamlined and more profitable. Think of the adage –“Accept the inevitable and
turn it to your advantage.” That is what you do when you mine project risks to create
opportunities.

Uncertainty is at the heart of risk. You may be unsure if an event is likely to occur or
not. Also, you may be uncertain what its consequences would be if it did occur.
Likelihood – the probability of an event occurring, and consequence – the impact or
outcome of an event, are the two components that characterize the magnitude of
the risk.

All risk management processes follow the same basic steps, although sometimes
different jargon is used to describe these steps. Together these 5 risk management
process steps combine to deliver a simple and effective risk management process.

Step 1: Identify the Risk. You and your team uncover, recognize and describe
risks that might affect your project or its outcomes. There are a number of
techniques you can use to find project risks. During this step you start to prepare
your Project Risk Register.

Step 2: Analyze the risk. Once risks are identified you determine the likelihood and
consequence of each risk. You develop an understanding of the nature of the risk
and its potential to affect project goals and objectives. This information is also input
to your Project Risk Register.
Step 3: Evaluate or Rank the Risk. You evaluate or rank the risk by determining the
risk magnitude, which is the combination of likelihood and consequence. You make
decisions about whether the risk is acceptable or whether it is serious enough to
warrant treatment. These risk rankings are also added to your Project Risk Register.

Step 4: Treat the Risk. This is also referred to as Risk Response Planning. During this
step you assess your highest ranked risks and set out a plan to treat or modify these
risks to achieve acceptable risk levels. How can you minimize the probability of the
negative risks as well as enhancing the opportunities? You create risk mitigation
strategies, preventive plans and contingency plans in this step. And you add the risk
treatment measures for the highest ranking or most serious risks to your Project Risk
Register.

Step 5: Monitor and Review the risk. This is the step where you take your Project
Risk Register and use it to monitor, track and review risks.

Risk is about uncertainty. If you put a framework around that uncertainty, then you
effectively de-risk your project. And that means you can move much more
confidently to achieve your project goals. By identifying and managing a
comprehensive list of project risks, unpleasant surprises and barriers can be reduced
and golden opportunities discovered. The risk management process also helps to
resolve problems when they occur, because those problems have been envisaged,
and plans to treat them have already been developed and agreed. You avoid
impulsive reactions and going into “fire-fighting” mode to rectify problems that could
have been anticipated. This makes for happier, less stressed project teams and
stakeholders. The end result is that you minimize the impacts of project threats and
capture the opportunities that occur.
Case Study
Learning a culture

Suppose you get a new job that involves operating a machine of some kind. Your induction training
taught you that you are expected to spend 15 minutes at the beginning of every production session
(morning and afternoon) carrying out routine maintenance on the machine you operate: checking the oil
levels, looking out for wear and tear, making sure all the parts are in alignment and properly sharp, and
so on.

Of course you will diligently do all this on your first few days, but let's suppose you quickly become
aware that the other machine operators around you start productive work long before you do, and are
laughing at you for being so cautious.

By Wednesday lunchtime you have received a visit from your manager who wants to know why your
daily output is so much lower than that of the other members of the team. You are also concerned
about this because along with your basic pay you are paid a small bonus for every job that you finish,
and your colleagues seem to produce far more per day than you do.

You explain that you are just doing what you were taught to do in induction but the manager takes you
aside and explains that the more experienced operators 'know' when their machines need oiling or
adjusting and so on, just from the sound they make and how much they vibrate, and you will soon get to
know too. The manager admits that if machines are not properly maintained there is a risk that they will
be seriously damaged and production will be lost. But the manager also says that if your machine goes
wrong you won't actually be seriously affected anyway. You will get the rest of the day off, on whatever
is your average day's pay, while it is being fixed. So, 'between you and your manager', it is actually in
your interests to produce as much as you possibly can, and ignore your supposed maintenance
responsibilities.

The manager then mentions that a more senior manager has asked the department to fulfil an
unusually large order that week, and your lack of productivity may mean that the more senior manager
is let down.

By Wednesday afternoon, at the latest, you will probably have concluded that your supposed routine
maintenance responsibilities are not actually necessary at all and will get on with productive work
immediately. Perhaps you will be looking around to see if, when, and why your colleagues get the oil can
out, if they ever do, but you will care a lot less about your machine going wrong.

Question: What organizational problems are revealed by the case study above?