Like it or not, every project has risks, some will be big some will be small, some will have catastrophic results others nobody will really notice.
Without a risk management strategy you will be just winging it. Without being informed you may be concentrating on preventing the wrong risks. But why can’t you prevent all risks I hear you say, unfortunately in the real world there are so many risks that you are unlikely to account for all of them.
So what do you do with them and how do you work out which are bad and which are really bad?
The first step, and this is crucial, is to actually get the risks down in a formal document, just the act of specifically thinking about the risks will greatly improve your chances of discovering the big ones and help you also think about how to prevent them from occurring (mitigating them).
List all of the risks that you can think of related to the project no matter how big or small or how likely they are to occur. Just get them down in any order.
Once you have them all down, against each one make a note of the effect of the risk actually happening.
Now it’s all about numbers, score each of the risks from 1-5 where 1 is an unlikely to happen and 5 is a highly likely to happen. Now, against each risk score the effect of the risk happening where 1 is limited impact and 5 is catastrophic impact. You may wish to use a matrix such as the one below.
Once you have all of the scores it’s a simple task of adding the numbers together.
A risk that is unlikely to happen and has a low impact is the risk with the least overall score. A risk that is likely to happen and has a large impact has the greatest score.
The higher the risk score the more effort or resources need to be used to mitigate those risks. The lower the risk score the less effort or resources are required to be used to mitigate those risks.
Without employing this type of risk discovery and mitigation strategy it would be easy to either ignore potential risks or to use resources or time on mitigating the wrong risks. At best this results in wasted resources and time, worst case a catastrophic risk event could happen having a severe impact on the project.
This type of risk scoring is suitable for a large cross section of projects, it is simplistic but effective. Risk management is a very large subject all of its own, with lots of statistical tools and process, if you do nothing else but the simple risk matrix and have a formal risk register, then you are well on the way to controlling and mitigating the risks of your project.