Beginner’s Guide to Project Risk Identification Complete with Workshop Toolkit

Risk identification is important because it increases the chances of project success. Many projects fail because managers do not identify important risks. Early risk identification helps the project team respond to risks quickly and effectively.

“By definition, risk management is the process of identifying, tracking, and managing potential risks that can impact your scope,” sharesAmy Black, Director of Security, Privacy, and Risk at RSM US LLP. “Risk identification is no different. Without proper tracking, the risk can delay or be a significant failure point for the success of your end deliverables. This will impact cost, schedule, and performance.”

The benefits of early project risk identification include the following:

• Fewer Delays:Stay on schedule by identifying risks that could cause delays.
• Better Adaptability:减少负面影响的风险,和maximize the impact of the negative risks by identifying them early on.
• Fewer Surprise Expenses:By helping you avoid delays and resource shortages, project risk identification decreases the number of surprise expenses or penalties.
• 在creased Chance of Success:Decrease the chances of project failure caused by unforeseen risks.

“It is not an ‘if’ but ‘when’ something goes wrong in your project,” saysAlexis Nicole White, a Project Management Professional (PMP)®, Scrum master, and project delivery consultant with North Highland. “It is important to identify all those things that can go wrong within your project or program as early as possible and associate an impact to each item. Failure to identify risks will result in costly delays. Subsequently, it can impact other project areas such as your budget, resources, and key success metrics.”

Six phases comprise the project risk identification lifecycle. These include creating a statement template, conducting a SWOT analysis, researching risks, reviewing internal and external risks, cross-checking risks, and creating a final risk statement.

在the Guide to the Project Management Book of Knowledge (PMBOK® Guide), the risk identification lifecycle indicates that the risk management planshould provide a statement for “a fully specified risk statement.”This includes the cause, event, time window, impact, and effect on the project’s objective for each risk.

These are the six phases of the project risk identification lifecycle:

1. Create a Statement Template:A statement template allows you to capture the same key pieces of information for each risk. A risk statement template might look like this: Because of , could occur during , which could lead to with an .
2. Conduct a SWOT Analysis:Basic identification begins with analyzing the strengths, weaknesses, opportunities, and threats (SWOT) associated with the project. For example, a threat may be that market competitors have more brand recognition than you do.
3. Research Risks:Project managers can identify risks while conducting interviews, reviewing assumptions, brainstorming with their teams, and researching similar projects.
4. Review External Risks:Many risks will come from within the project team or company. However, everyone should be on the lookout for external risks that can impact the outcome of a project. It’s essential to gather knowledge from as many outside sources as possible. For example, you might interview a market specialist familiar with competitors to evaluate the actual market share of your company or project and that of your competitors.
5. Cross-Check Risks:It’s important that all risks are relevant to the project scope andwork breakdown structure (WBS). The project manager will ensure each risk corresponds to an element in the WBS.
6. Create a Final Risk Statement:The project manager will create a risk statement for each risk in the list. A final risk statement might look like this: Because competitors have more brand recognition, the customer may choose another product before evaluating our product, which could lead to fewer opportunities and have a profound effect on expected product sales and revenue.

Once you complete these steps, you can begin your project risk mitigation efforts.

The steps of identifying project risks align with the phases of the risk lifecycle. The first step is to build the risk statement template. After the internal team and stakeholders identify relevant risks, finalize each risk statement using the template.

Project risks can come from anywhere. Review all inputs to better understand potential risks. Common inputs include your project management plan, project documents, enterprise environmental factors (EEFs), and organizational process assets (OPAs).

For each input, review every element to ensure that you identify every major risk to your project.

Here are the main risk identification inputs:

• Project Management Plan:A project management plan includes cost management, scheduling, quality control, human resources, scope, schedule, and budget. For example, it is not uncommon to identify risk within the budget, especially if it is too low to cover all project expenses.
• Project Documents:Project documents include the project charter, stakeholder register, costs, duration, performance reports, resource requirements, and procurement documents. For example, insufficient resources to complete the project pose an enormous risk.
• Enterprise Environmental Factors (EEFs):EEFs include industry information, important benchmarks, research and studies, and attitudes toward risk. For example, industry competitors can pose a risk to a project.
• Organizational Process Assets (OPAs):OPAs include risk registers from previous projects and lessons from the project manager, experts, and the project team. For example, if a subject matter expert reviews your project, they will likely find additional risks.

Each project manager will have their preferred tools and techniques for identifying risks. Gathering data through brainstorming sessions, consulting experts, and conducting a SWOT analysis are all common methods for identifying risks.

These are some helpful risk identification tools and techniques to try:

• Expert Judgment:Experience and subject matter expertise might be enough to identify some project risks. Consult experts to ensure that you haven’t missed key risks.
• Data Gathering:Project managers might host brainstorming sessions with the project team and external stakeholders to dive into potential risks. Checklists, questionnaires, and interviews can help you discover important risks.
• Root Cause Analysis:Root cause analysis means identifying the actual risk as opposed to the symptoms of the risk. Conducting a SWOT analysis and critically reviewing project requirements and assumptions will likely bring hidden risks to the forefront.
• Collaboration:Group or individual meetings, workshops, and brainstorming sessions are all great ways to unearth new risks and eliminate risks that are outside the project's scope.
• Hybrid Approach:Most project managers combine two or more techniques to uncover risks throughout the project.

The project risk identification framework is a tool that standardizes risk identification. Knowing the current and potential risks helps improve the likelihood of project success. Keep everyone on the same page about risks by establishing a common framework.

Each business will create or adopt its own unique framework. In the The Journal of International Technology and Information Management, Jack T. Marchewkaputs forth this frameworkfor identifying project risks. Marchewka’s framework is a helpful example of how to standardize risk identification.

在Marchewka’s model, project value is at the core of the risk identification framework. Just outside the center are project elements, such as quality and budget, that significantly impact project success. The next tier includes internal and external risks, which may be outside a project manager’s control. The next layer contains known, unknown-known, and unknown-unknown risks.

已知的风险是完全确定的。Unknown-known国际扶轮sks are certain, but some details might be unclear. For example, you might know that you have to hire an engineer for your project, but you don’t know the exact negotiated salary. Unknown-unknown risks are those that the project manager cannot predict. For example, a recession or sudden bankruptcy are unknown-unknowns. The outermost layer of Marchewka’s framework contains the project lifecycle phases because risk identification may occur at any point during the project.

This project risk identification workshop toolkit will help you conduct a successful risk identification workshop. The toolkit includes all the information you will need to run your own workshop, from brainstorming questions to communication guidelines.

The guide includes questions that will help the team think about, discuss, and prioritize potential risks. Following the risk identification workshop, you will document and track all risks in the risk register.

Download a Project Risk Identification Workshop Toolkit for
Microsoft Word|Google Docs

For more useful templates and resources, see our comprehensive list ofproject risk management templates.