Risk management is something we all say we should do, but often fail to follow through.  At the beginning of a project we may gather initial risks and may even identify more as we go along.  But I ask you, how many actually follow through with Risk Management?

There are several aspects to risk management including: risk identification, identification of root cause, rating and evaluating the risk, defining mitigation and contingency plans, and monitoring the risk. Many organizations and people are good at identifying issues, but when it comes to risks is where I often see failure.  If they do identify risks, often times they only identify the risks that can be categorized as a threat, however, there are also positive risks that can impact the project.  When managing a project, I immediately added the following risks to the project risk register whether the impact would be viewed as positive or negative.  The mitigation or contingency plans were all based on the project itself along with the probability of occurrence.


Category Risk Description Threat or Opportunity
Resource Holidays, sick days, vacations Threat
Resource Low availability Threat
Resource High availability Opportunity
Funding Budget cuts Threat
Funding Additional Funding Opportunity
Technology Lack of skill-set in-house Threat
Technology Procurement of hardware Threat
Stakeholders Stakeholder changes Threat
Stakeholders Lack of involvement Threat
Stakeholders Increased involvement Opportunity
Communication Lack of transparency Threat
Scope Scope not fully defined Threat


Some of these may seem like they are not risks, until they become an issue so it is important to note these.  The probability may be very low on some of these, but I believe it is better to plan, than to be surprised.  When I lived in Minnesota one of my risks during the winter season included weather that would prohibit people from making it to work.  Back then, working from home was not an option so weather was an aspect that had to be considered.

Another area that many people do not consider is controllability.  When I work in a risk register, I don’t just look at the trigger, probability, and impact as I also factor in controllability.  Some risks can be controlled to some degree which can lower the risk exposure rating.  Communication and the lack of transparency is an example of controllability.  As a project manager one of the key functions that is served is communication.  The project manager has the ability to control this risk from becoming an issue.

So where do we fail? 

Failure Point One:  I cannot tell you how many times I have interviewed someone and asked what comes first a risk or an issue and the response was issue.  That is failure point one when we do not recognize that a risk is something that may happen, and an issue means it happens.  Make sure your resources understand that to identify the risk before it becomes an issue is not only easier to then mitigate but can also save dollars when it comes to the budget. 

Failure Point Two:  Risk identification ends after the charter has been drafted.  Risk identification should be a part of your project meetings.  You should also have multiple avenues for people to report risks as well as keep them updated.

Failure Point Three:  Mitigation plans may be roughed up, but they are never followed.  It seems after it is written that some believe that now it is at a point where we just monitor it.  That is not the focus of the mitigation plan as this gives you the steps to follow to try to avoid it from becoming an issue.

Failure Point Four:  Contingency plans are not determined in the event a risk becomes an issue.  This causes teams to become reactive and only then try to figure out what to do which can impact budget, time and quality.

Failure Point Five:  Often we write them down, we may plan a mitigation or contingency plan, but we don’t monitor or follow-up on the risks.  Then, when it suddenly surprises us with becoming an issue we wonder why.

Failure Point Six:  Too many times risks are not assigned to an owner.  This means that no one is responsible for monitoring the risk or providing updates on whether the probability is increasing. 

Failure Point Seven:  Triggers are not identified.  This is just as important as the risk as the trigger tells you what incidents may occur that would trigger the risk to become an issue.  If this isn’t monitored one day the surprise will happen.

Failure Point Eight:  Often times we do not look at a date, meaning if it doesn’t happen by a certain date then the risk has passed.  This can help you identify risks that may be approaching a critical point.  Ideally if a risk were to become an issue, it is better to identify it early on than later in the game.

Implementing a full risk management practices take time, commitment, and often training.  This is not something that can occur overnight, and sometimes the biggest challenge is convincing leadership on the importance of risk management.  However, I can attest to the fact that it can save budget, time, stress, and help to make a project more successful.  As a project manager you can help with this by making sure that risks are reviewed during every project meeting, and that owners are assigned to keep them updated.  Often by showing how the avoidance of an issue was able to occur, this is what can help others realize the benefits of risk management.

Reading this article qualifies you to submit a request for PDU’s from PMI.

This Article qualifies as follows:



For more information on registering your PDU’s with PMI – CLICK HERE

Alyce Reopelle, the author of this article,  encourages conversation; agree with her or disagree with her, it’s all still knowledge, and she is here to share knowledge. Take a moment to add to the conversation by leaving a comment. It’s an opportunity to engage in the conversation!

If you believe in what she are doing, take a minute to share her articles on your social networks such as LinkedIn and other sites. Use the buttons on the left side of the page.

All articles on this site, this article is protected by copyright.



You may republish this article in whole or in part with attribution to the author and a direct link back to the full article on this site. Attributions MUST include a hyperlink to the original article, as well as a "Canonical Link" reference embedded in the <head> section of the page.
#pmfortoday / #projectmanagement / #pdu / #pmi / #pmo / #pmbok / #pmblog / #pmoblog / #pmp / #pmi-acp / #pgmp


Alyce Reopelle

Alyce Reopelle

Author, Speaker, Project / Program / PMO Thought Leader

Over 20 years project management experience with a passion for helping organizations grow their PMO, their project managers, and their teams.  My passion has taken me to the pursuit of a Doctor of Education, as I enjoy seeing the proverbial light bulb come on.  I am a believer in continuous growth and improvement, and believe that an organizations culture and environment is what drives the growth of PMOs and all areas, and not the other way around.

Alyce is available to speak at conferences, organizational events, organizational training opportunities and more.  Contact Alyce via her website at https://alycereopelle.pmfortoday.com  - CLICK HERE

Share This