While it is dangerous to generalize, I think it’s safe to suggest that most project managers are concerned about risk and would, at a minimum, like to be aware of all the potential banana-skins in their paths.

On this page:

• Creating a Risk Breakdown Structure: Identifying Potential Risks
• Internal and External Risk Factors: An SWOT Analysis
• Risk Identification throughout the Project Lifecycle

Creating a Risk Breakdown Structure: Identifying Potential Risks

However, creating a list of potential risks from scratch is extremely difficult. It’s a similar feeling to an author sitting down with a blank sheet of paper on the desk and an equally blank mind. However, the Project Management Body of Knowledge (PMBOK^® Guide) offers us a good starting point: create a Risk Breakdown Structure. In this way, we can identify areas where risks might be lurking.

Internal and External Risk Factors: An SWOT Analysis

So what are the overall risk categories? Well another technique from the PMBOK^® Guide offers a good start: SWOT (Strengths, Weaknesses, Opportunities and Threats) analysis. Strengths and weaknesses are internal factors, while opportunities and threats are external. So at the top level, our risks either come from within the organization and from outside. SWOT also reminds us that a risk is an uncertainty – it might have a better outcome than expected (be an opportunity in other words).

So what are the internal factors we should consider? Again, looking for high-level areas, we should consider the Knowledge Areas of the PMBOK^® Guide. This means looking at staffing issues (availability of key skills, vacation plans, parental leave, etc), budget constraints (funding for this project depends on the success of another project, etc), schedule demands (hard deadlines, etc), scope definition (scope creep, ambiguous requirements, etc), quality concerns (no history of compliance in the organization, etc) and issues with communications and stakeholder management.

Going outside the organization, we can still benefit from considering the Knowledge Areas. The obvious one is procurement (third-party suppliers leaving us down, lack of suitable vendors, etc). Quality can have external influences too, as we might need to satisfy the regulatory authorities. Budgets can depend on external funding; schedules can be influenced by customer timelines and the dates of various trade fairs. Staff shortages can arise due to increased competition for certain skills or the lack of relevant training courses in the country’s education system.

Risk Identification throughout the Project Lifecycle

Given that the Risk Breakdown Structure is so influenced by the Knowledge Areas suggests that risk can be found in any part of our work at any time. For instance, a very effective way to identify risks is during the estimation activity. If you use a form of 3-point estimation (such as PERT – Program Evaluation and Review Technique), you will be asking the team to offer optimistic and pessimistic estimates. The difference between the two represents the risk.

So, as an example, an activity in this project could involve painting a component. The best case scenario is: 5 minutes to clean the surfaces, 5 minutes to paint it and 1 hour in the oven to dry. At this rate, our painter can get through 12 components in an hour (assuming we can put things in the oven while other components are drying). However, the pessimistic scenario is: 30 minutes getting more paint from the supply room, 60 minutes cleaning the paint gun, 30 minutes cleaning the surface, 5 minutes painting and 24 hours for drying. This is because we might run out of paint; the paint gun might get clogged up with old paint; the surfaces need to be sanded down smoothly and the oven could break down.

Obviously, these risks are easy to mitigate – get enough paint for the day’s work at the start of the day, clean the gun every evening, ensure the component surfaces are sanded properly at the previous station and get the oven maintained regularly. However, without a risk focus, they would never have been identified in the first place.

While looking for uncertainty around every corner sounds like seriously paranoid behaviour, it is a lot preferable than to finding your project in deep trouble because you had not expected the unexpected.