Project Risk Management

Project risk refers to the effect of uncertainty on the project as a whole, arising from all sources of uncertainty including individual risks, representing the exposure of stakeholders to the implications of variations in project outcome, both positive and negative. Project risks are divided into two categories: negative and positive risks. Negative risks are threats, positive risks are called opportunities. Negative risks can harm project objectives while positive risks can benefit the project objectives.

Project risks can be found at any point throughout the life cycle of the project. There are two types of risks: individual risk and overall project risk. Individual risks are specific events or conditions that may affect project objectives. Individual risks can positively or negatively affect one or more of the project objectives, elements, or tasks. Overall project risk demonstrates the impact of uncertainty on the project as a whole.

To reduce uncertainty in projects, you must first identify the likelihood, consequences, impact, and possible causes of the risk that needs to be taken:
• The possibilities may be low, medium, or high. For example, you determine how likely it is that supply delays will stop the
project. You make an estimate based on your experience. When you look at past projects, you will see a 50% chance of delay.
• Risks can affect the scope, cost, time, and/or quality of projects. You need to determine how serious the impact is
(impact on project objectives).
• You can determine the effect by a specific number or percentage. You must determine a measure of the severity of the impact. For example, you can set the delay to be good if it is less than 5 days, moderate between 5-10 days, bad if more than 10 days.
• It is important to standardize the impact of risks in a common language. You can ensure that the project team and stakeholders understand the impact of risk in the same way.

In order for the Project Risk Management Plan to be compatible with other plans, it is necessary to review the sub-plans (time, cost, etc.) included in the Project Management Plan. Project Charter, which includes project deliverables, constraints, and objectives, is another input. Project documents such as assumptions log and stakeholder register may contain information on risks that may prevent the project from achieving its objectives. Finally, environmental organizational factors (stakeholder risk tolerances, etc.) and organizational process assets (policy, procedures, etc.) should be
considered. In order to effectively monitor and control risks in a project, planning is necessary.

Document analysis is used to review all relevant project documents that can help identify risks. These documents are plans, assumptions, constraints, previous project files, contracts, agreements, and technical documentation. Particular attention should be paid to the assumptions and constraints documented for the project in all documents. Identifying associated risks allows them to be addressed early.

Interviews help us engage with team members, stakeholders, customers and suppliers to uncover potential risks. Brainstorming and negotiations on identified risks can be made. In the interviews, additional risks will be identified and the existing risks can be classified. During the interviews, the risk list can be reviewed and the causes and effects of the risks can be evaluated. Risks can be dealt with in detail. The risks identified in the interviews can be grouped according to their source, area affected by the project and the relevant stage. Grouping risks for common reasons may work in terms of generating a common response.

The following questions should be asked for root cause analysis:
• What can cause this risk?
• Under what conditions can this risk turn into a problem or an opportunity?
Even after identifying the possible causes of a risk, one should continue to ask questions and try to find other relevant causes.

SWOT analysis is one of the data analysis methods used to identify and classify risks. SWOT expresses Strengths, Weaknesses, Opportunities, and Threats. SWOT analysis can be done by brainstorming or interviews. SWOT analysis lists factors that have a definite impact on the project. The best way to perform SWOT analysis is to create a simple matrix for each of the four factors: Strength, Weaknesses, Opportunities, and Threats.

Checklists are used to identify important issues to consider and ensure that they are not omitted. In the process of determining risks, checklists compiled from the problems experienced in previous projects, lessons learned or prepared in the sector-specific are used. The checklist should assess whether the risks identified are valid for the current project. By reviewing the risk records of similar projects, you should add potential risks to your checklist for your current project. The risk checklist should be updated as the project progresses. The risk checklist should also be reviewed and updated during project closure.

The Risk Records, Assumption Log, and Stakeholder Register are inputs that contain detailed information on the risks to be analyzed. Records from past completed projects, similar to the project you are working on, help determine how to prioritize specific risks.

There are seven different tools and techniques to perform qualitative risk analysis:
• Expert Judgement - When conducting a qualitative risk analysis, you will rely on the expert judgment of individuals and groups with expertise and knowledge about the project.
• Interviews - Interviews are conducted to collect the data needed to conduct a qualitative risk analysis.
• Interpersonal and team skills - Interpersonal and team skills to increase the effectiveness of qualitative risk analysis as they enable the project team and stakeholders to reach consensus and express their views. 
• Meetings - In the qualitative risk analysis process, the project team can organize risk workshops and meetings to review,
evaluate, categorize, and prioritize project risks.
• Risk categorization includes technical, external, and internal risk groups.
• Risk data quality assessment - If the information collected about the risks is incorrect, biased, or incomplete, the
results of the qualitative analysis will not be reliable. Therefore, risk data quality assessment is performed during the qualitative risk analysis process. 
• Risk probability and impact assessment - As another data analysis technique, risk probability and impact assessment are performed to determine the likelihood of a particular risk occurring in the project.

In order to measure the impact of a risk, time, cost, and scope baselines must be identified as reference. It will be necessary to compare the effects of risks on the scope, time, and cost targets with these baselines. In this context, the project management plan that is formed as a result of the planning processes is an important input of this process. In order to realize this process effectively, it will also be necessary to use assumption log, cost and time estimates, bases of estimates, milestone list, resource requirements, and so on.

Interviews allow us to get the information you need by referring to expert judgments. Experts may be members of the project team, as well as professionals, academicians, consultants, experienced senior executives from outside the project team.

Plan Risk Responses is the process of developing options, selecting strategies, and agreeing on actions to address overall project risk exposure, as well as to treat individual project risks. Through this process, it is aimed to reduce the impact of threats on the project and to increase the impact of opportunities.

Transferring risk includes shifting the risks to the third party. The risk does not disappear. You transfer responsibility to a party outside the project. An example of this strategy is to delegate risky activities or work packages to a specialized supplier. Another example is the insurance method. Both methods may require changes to increase the costs of the project. The difference between the loss you will incur in case of risk and the cost increase caused by the transfer of risk should be evaluated.

The strategies for Positive Risks or Opportunities are as follows:

Exploit - It is aimed to find the best way to take advantage of the opportunity by eliminating the uncertainty in the project. 
Share - This strategy involves merging with a firm to increase the chances of securing gains and agreeing to share rewards. 
Enhance an opportunity - This includes taking steps to increase the likelihood of the opportunity or its positive impact on the project. 
Accept - Accepting the risk, not taking any action and continuing the project as planned can be an action plan. 

The purpose of the implementation of risk responses is to execute agreed risk strategies. In this process, planned strategies are implemented. The individuals or groups that implement these strategies may not be part of the project team. They may be outside the project team or outside the company. Therefore, project managers should ensure that the necessary strategies for risks are implemented by negotiating with stakeholders, guiding them, and raising their awareness.

Monitoring Risks is the process of monitoring the implementation of agreed-upon risk response plans, tracking identified risks, identifying and analyzing new risks, and evaluating risk process effectiveness throughout the project.

Meetings are the most effective means of information exchange. For risk management, the project should be carried out regularly according to the workload. At regular status meetings, discussing risks should always be an agenda item. The benefit of doing so is to make all risks in the project identifiable and traceable. It will also help to keep risk management as a discipline that all stakeholders consider.
Audits are used to assess the effectiveness of risk management in projects. It is realized as the project progresses. During risk audits, risk management team or external auditor assesses and reports on risk responses and effectiveness. After the audit, the project manager should decide how to respond and evaluate the risk response plans when necessary.

Two data analysis techniques are very important in the risk monitoring process: technical performance analysis and reserve analysis.
• Technical performance analysis - Technical performance analysis focuses on product-related risks such as scope, functionality, and quality. It compares actual and planned technical achievements. The success of technical performance analysis depends on the team that determines the performance parameters at the beginning of the project. It includes measurements of the product’s characteristics such as size, speed, or capacity.
• Reserve analysis - Reserve analysis involves comparing the remaining emergency reserves with the remaining risks. Thus,
whether the reserves are sufficient to see the end of the project is decided. During the project, some risks may arise with positive or negative effects on the budget or time. Reserve analysis aims to protect the budget and time by ensuring that its reserves are sufficient to meet these impacts.