fact, Project Management Institute
teaches that a project plan can’t be
finalized unless risk planning is complete. A schedule can’t be finalized
unless risk has been accounted for. How can a PM leverage a subjective
scoring model to obtain the necessary time and cost to account for risk?
It is nearly impossible. In addition, many of the seminars, books, and
products available do not help the PM account or plan for risk if no-
body will show up to the risk meeting in the first place! This chapter
provides the framework to lead a risk assessment and management evo-
lution. It shows how to develop a process that will create a risk assess-
ment that ends with a solid result such as, “There should be 10 to 15
days and $20,000 added to this plan based on factors that have oc-
curred in the past.”
The Risk Process
To create a shift in the risk management process, one must begin with
the current risk process. The next few paragraphs offer a very brief
overview of this concept. There are many resources available to learn
more in depth about risk and risk management. This overview is in-
tended to assist in the understanding of the risk assessment’s evolution.
Traditionally, most project management experts teach that the risk
management process steps are:
Risk identification
Qualitative analysis
Quantitative analysis
Risk response planning
Residual risk planning
The first step is to identify the potential risks. The team, either
through a meeting or individually, identifies the potential items that
could have an impact on the project’s cost, schedule, or quality. The fol-
lowing documents are inputs into the risk-identification process:
Scope statement
Work breakdown structure
Resource plan
134 Project Management That Works
A Real Risk Assessment 135
Network diagram
Project schedule
Quality plan
Every document created and every plan made is an input to risk
management. Risk is an important concept. It is designed to assist in
managing the unknowns. The theory is that through proper risk man-
agement, allowances to cost and schedule will be made to ensure a suc-
cessful project. Once a list of risks is identified, it is time to begin to
perform qualitative risk analysis
Qualitative risk analysis is designed to sort and rank the identified
risks so that the PM can prioritize the list appropriately. The team is
supposed to go through each risk factor and identify the probability the
risk will occur and if the risk occurs, what the impact will be on the
project. In true project management practice, based on the qualitative
analysis of risks, a project could be stopped if it is deemed too risky.
Qualitative analysis is a subjective assessment of each risk and usually
uses terms such as high, medium, and low to determine the overall
ranking of the risk. High probability and high impact should be evalu-
ated first, and low probability and low impact should be evaluated last.
It is anyone’s guess of how risky the item is to the project. At the end of
qualitative analysis, a chart would look similar to Table 12-1.
Once the qualitative analysis is complete, quantitative analysis will
begin to put values on the risk.
Quantitative analysis is a numerical analysis of each risk. For every
risk, the team should decide the likelihood (represented as a percentage)
that the risk will occur and the impact on the project’s cost or timeline
should it occur. This step removes the subjectivity of the qualitative
Risk Category Probability Impact
Team members are unavailable Resources Medium High
for the project
Budget is not established Budget High High
Technology has not been Technology Medium Medium
used before

Get Project Management that Works: Real-World Advice on Communicating, Problem Solving, and Everything Else You Need to Know to Get the Job Done now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.