Importance of identifying risks and ensuring enough noise is made
Scenario
A project managers life is always busy throughout the life of the project. Hence it is easy to say "I do not have time for risk management" OR one can say "we will deal with the risk when it happens. Let's live for today". Many times, senior management also do not support spending time in identifying or mitigating risks. This makes it even more challenging for the project manager.
As a Fresh Project Manager
The easiest and most often repeated mistakes are:
Not to worry about risks. Assume that there are technical leads who will take care of technical risks, senior management takes care of budget risks, customer interface team takes care of mitigating potential delays using their relationship with the customers... and so on. In other words, "assume that this is not my headache".
Make a half-hearted attempt to having a risk management process and give up when not much support is provided from other key stakeholders.
Come up with a very good list of risks, document them, upload to a central repository, assume the job is done and forget about the risks.
With a Salt -N- Pepper Look & Many More Battle Wounds
One of my first project management trainings taught me something that I will never forget. The word "ASSUME" means – making an ASS out of U and ME. One of the most dangerous word in the life of a project manager is ASSUME. Never assume anything and always make sure to explicitly get an alignment on your understanding. This is very much applicable to risks. Do not assume that others will take care of risks.
As you will see in any project management trainings/books, a holistic approach is required for risk management. All steps need to be successfully completed for effective risk management. They are – Plan, identify, analyze, plan response, implement response and monitor.
One of my very experienced friend uses a phrase that has lot of depth - "They don’t know that they don’t know". The purpose of risk management is to minimize the list of issues that come out of these unknowns.
A tool that I used for risk management was FMEA – Failure Mode Effect Analysis. This is a very powerful technical tool for product issues, but the concept is very well applicable for a project. There are many internet articles with in-depth information on FMEA.
When analyzing risks, it is important to look at the risk from two dimensions – Probability and Impact. First focus should be on risks which are HIGH in both. A Risk Matrix is a very good tool to provide an easy visualization of the risks.
For successful risk identification, it is important to get the time of all key stakeholders – Technical, senior leaders, commercial, deployment, customer interfaces and all other teams that have a stake in the success of the project.
Last but not the least, all the effort of risk management will be wasted, if the risks are not periodically monitored. This monitoring includes following:
Re-look at probability and impact.
Identify additional risks.
Delete risks which are no longer applicable. This is typically the case when the phase of the project, where the risk is possible, has already been successfully completed.
Implement any preventive actions to prevent risks from turning into issues.