Posted: July 11th, 2015

Project Risk Management IP2

Project Risk Management IP2

Assignment:

For this assignment, you will use what you identified as your approach in this week’s Discussion Board to identify and assess all of the risks that are associated with your project. You should identify a minimum of 8 risks then assess them by employing the techniques that you selected in the Discussion Board assignment.

For the compilation of your risk assessment component, you may use a table similar to the following:

Note: This is just a sample, and you may choose to represent it in a different format as long as you have all of the pertinent risk-related information, including the following:

Risk name
Risk description
Likelihood (using a scale)
Impact (use both as a scale and description)
Leave room to append more information later to show your mitigation strategy.

The following is an example of ranking the risks using a 2×2 risk matrix approach:

In this sample 2×2 ranking matrix, the risks that should receive the highest priority are the risks that are in quadrant 1, and the risks that will receive the least attention are in quadrant 4.

Deliverables:

The overall project deliverables are the following:

Update the Key Assignment Document title page with a new date and project name.
Update previously completed sections based on instructor feedback.
Complete the New Content below, and copy it under the sections in Key Assignment Document called “Project Risks Identification” and “Project Risks Assessment”:
New Content
Project Risks Identification
Use the project risk categories that you brainstormed during the previous week to categorize the risks that you have determined for this assignment.
Show a list of stakeholders and project teams that you utilized to identify risks.
Thoroughly describe each project risk (at least 8), which includes the source for identifying the risk.
Identify and show the specific technique that you used to identify the risks, such as cause and effect, a fishbone diagram, a SWOT analysis, interview notes, and an assumption list.
Project Risks Assessment
Create a table similar to the sample above, or use another method to list the risk, the likelihood of occurrence, and the overall severity of impact if it occurs.
Fill in the table with the information from the project identification utilizing the 2 scales that you determined as a part of your Discussion Board assignment. Be sure to consider both the cost and schedule impact as you determine the overall impact.
Rank your risks based on both the likelihood and impact using a technique, such as 2×2 matrix as shown in the assignment description section.
Be sure to update your table of contents before submission.
Name the document “yourname_MPM344_IP2.doc.”
Please submit your assignment.

Click on Student Expectations to view the expectations for this assignment.
Scenario:

Identifying & Analyzing Project Risks

Presentation
Presentation: Risk Assessment Techniques
Methods of Risk Assessment
Different techniques can be used to assess the probability and impact of risks. These techniques are especially useful for assessing and analyzing the medium probability and/or medium impact risks. Qualitative risk analysis, semiquantitative risk analysis, and quantitative risk analysis are three main methods for completing this required assessment.
The methods and techniques you use to assess the probability and impact will vary based on the size and duration of the project, the organization’s tolerance for risk, and the constraints of the project. You need to understand these risk management influencers before you go into more detail in your analysis.
Risk Tolerance Influences the Impact of Risk
The tolerance for risk is a critical influencer. Not only does the organization have its own cultural perspective toward risk, but your team members, customers, stakeholders, and sponsor also have their own tolerance levels. Those tolerance levels will vary based on the situation. For example, if the accounts receivable department needs a new billing system functional within six months because the current system is outdated and difficult to use, they will have a lower tolerance for the risk of schedule overrun than the human resources department, which is comfortable with the current system.
Qualitative Risk Analysis
Qualitative risk analysis is the process of assessing risks using a very simple scale. It is the method that is most intuitive and most commonly used. It is typically completed using personal and organizational experience as opposed to mathematical models. This technique will address the majority of the risks in small to medium projects. This technique will give a very good high-level overview for larger projects, but it will likely need to be followed by more quantitative techniques.
Qualitative risk analysis is done by assigning a value of high, medium, or low to each possible risk that was identified. Next, plot the values on a quadrant graph with probability and impact as the axes. The risks falling into the high impact/high probability quadrant should be considered high priority risk events and addressed aggressively. The risks that fall into the low impact/low probability quadrant can be considered lower priority risks and addressed less aggressively (and in many cases, they can be ignored). The risks can also be plotted in a matrix.
The results of qualitative risk analysis should be tested and confirmed by reviewing the assumptions about the risk, the level of accuracy about the impact, and the experiences used to determine the probability.
Semiquantitative Risk Analysis
Semiquantitative risk analysis is when a numerical value is assigned to the probability and impacts instead of a high, medium, or low ranking. This provides a different perspective into the priority of a risk and is especially effective for analyzing the medium probability and/or medium impact risks. It can be used in conjunction with qualitative risk analysis as another technique for prioritizing risks.
A risk score can be calculated for each risk by multiplying the probability value by the impact value (P*I). The higher the score, the more attention that should be paid to the risk. Another technique is to assign a value to both the probability and the impact in the range of 0.0 to 1.0. Then calculate probability plus impact minus the sum of probability times impact, or P + I – (P*I). Plot and compare the results of either or both of these calculations to find the most critical risks to be managed.
Use a scoring method that is understandable to your project team, stakeholders, and sponsor. Focus on the most critical constraints of the project, and put your attention there.

Article
Analyzing Project Risk
Question 1: Once the risk priorities have been determined, what are the project manager’s next steps?
Answer 1: The final steps in risk assessment involve creating the action plans/risk response plans and then documenting all the analysis into a risk management plan. Once you begin to define how you are going to deal with risks, you will need to dive into a lower level of detail. This will enable you to attack the risks at the source, not just the symptom.
Question 2: What strategies can be used to address project risks?
Answer 2:
There are three strategies that you can use to address any risk on a project:
•    Risk prevention: Minimize the probability of the project risk occurring.
•    Impact reduction: Minimize the impact of the risk occurs.
•    Response planning: Determine the action(s) to take when the risk occurs.
These strategies are not used in isolation. In many cases, you will use all three of these strategies as you determine how to manage each risk.
Question 3: What are some strategies for risk prevention?
Answer 3:
Risk prevention is the strategy that enables you to identify the source of the project risk and then determine the steps you can take to eliminate that risk. You must build actions or steps into your project plans and monitor these steps as the project progresses. For example, on a given project, you determine that one project risk involves the vendor being late with a software customization delivery. This could negatively impact your project time line and result in the schedule slipping. What steps can you take to prevent this risk from occurring? Well, you may choose any or all of the following actions:
•    Build late delivery penalties into your contract with the vendor.
•    Choose a different vendor.
•    Complete the customization work in-house.
•    Give the vendor an earlier delivery date for the software customization than is necessary (although, this raises some ethical issues because you are essentially lying to the vendor and not working from a position of honesty and trust—not ethical).
Question 4: What is impact reduction?
Answer 4:
Impact reduction is the strategy that a project manager takes to determine ways that he or she can reduce the impact of a project risk once it occurs. The analysis involved is similar to the one applied for risk prevention, but the perspective is a bit different.
Rather than focusing on how to reduce the probability of a risk occurring, the project manager recognizes that a risk will occur and determines how to reduce the impact once the risk occurs.

Consider an example of the software customization vendor. You know that there is a high probability that the software vendor will be late in delivering a customized product to you. You also know that your overall project deadlines will be negatively impacted if this occurs. What are some actions that you can take to minimize the impact of this occurrence on the overall project?
You may decide on the following actions to reduce the impact of a late delivery:
•    Adjust the order of tasks in your project schedule to ensure that the vendor delivery is off the critical path.
•    Plan a 2-week contingency into your project schedule.
•    Schedule resources so they are available the moment the software customization arrives.
Question 5: What is response planning?
Answer 5:
A response planning strategy is used once you determine that there is nothing more that can or should be done to reduce the probability or lessen the impact of a project risk. As the project manager, you must take time to determine what you and your team will do when the risk event occurs.
Response planning provides you with the advantage of developing an organized, well-planned strategy when the risk takes place. It minimizes the amount of time that you will spend in “fire-fighting” mode. A response plan (sometimes referred to as the risk register) may involve creating and executing a procedure or following a checklist to address the risk at hand. The amount of effort exerted in creating the response plan to address a given risk should be in line with the level of impact that the risk will have on the project if it occurs.
For example, you may create several response plans to address the risk of a vendor’s inability to deliver a software customization program in a timely manner, thus negatively impacting your overall project deadlines. You might have one response plan for each week that the delivery is late. The response plan may contain steps that tell your team what tasks to execute, what to communicate to management, and how to adjust the project schedule to avoid further delays.

Activity
Risk Identification
Scenario
Koch Medical Center, located in the heart of Chicago, Illinois, is adding a new children’s medical wing. The primary benefactor, Lisa Stanfield, has generously donated $7 million to break ground on development of this new facility. However, the Medial Center will need to raise approximately $15 million over the next 3 years to complete the project.
You have been hired by Shawn Hankins, Director of the new children’s hospital wing, as a project risk manager. Your responsibility will be to oversee a Radio-A-Thon that will take place in 9 months. The Radio-A-Thon will be held over a 3-day weekend the first week in December. The committee seeks to raise $1.5 million during this event. December tends to be cold, windy, and sometimes snowy in the Midwest. Most individuals are getting ready for the upcoming holidays.
You have reviewed the project charter and project plan. A budget of $150,000 has been allocated for this event. Funds for the budget include marketing and television advertising fees, set-up of telephone stations to accept phone call donations, and food and supplies for all volunteers during the event.
WBEX, a local, well-recognized, and highly regarded radio station, has sponsored this event for the Medical Center in the past. As a donation to the hospital, all airtime fees, DJ salaries, etc. are complimentary. The radio station will host the hospital’s Radio-A-Thon event this year as well.
The Radio-A-Thon will be held in the lobby of the main medical building.
Before you can begin to identify and analyze any risks, you will need to consider the goals of this project and identify the key stakeholders.
Identify the risks that may potentially impact this project. Review the scenario if necessary.
Question 1
Which of the following risks do you feel may be a threat to your project’s completion and success? (Select all that apply.)
A. insufficient space for the radio station and camera crew
B. insufficient space requirements for phone set-up and volunteer seating
C. insufficient quantity of volunteers recruited to handle phones
D. volunteer no shows
E. individuals do not call to donate funds
F. insufficient budget for phone set-up, advertising, supplies, food, and administrative costs
G. other Outreach or Marketing-sponsored events to impact the Radio-A-Thon
H. Board of Directors does not approve of the radio station for sponsorship
I. insufficient loading area for radio station, camera, and telephone crew
J. insufficient time for Marketing to create a marketing campaign
K. secure personal space for volunteers
L. insufficient funds are raised for the event
M. impact on traffic flow through the lobby during the event
N. security breach on hospital grounds
O. radio station sponsoring event airs advertising or programming that results in rejection of sponsorship
P. inclement weather prevents trucks and volunteers from coming to Radio-A-Thon
The risks that you should have identified to this project include:
A. insufficient space for the radio station and camera crew
B. insufficient space requirements for phone set-up and volunteer seating
C. insufficient quantity of volunteers recruited to handle phones
D. volunteer no shows
F. insufficient budget for phone set-up, advertising, supplies, food, and administrative costs
G. other Outreach or Marketing-sponsored events to impact the Radio-A-Thon
I.. insufficient loading area for radio station, camera, and telephone crew
J. insufficient time for Marketing to create a marketing campaign
K. secure personal space for volunteers
M. impact on traffic flow through the lobby during the event
N. security breach on hospital grounds
O. radio station sponsoring event airs advertising or programming that results in rejection of sponsorship
P. inclement weather prevents trucks and volunteers from coming to Radio-A-Thon
Those risks that are not directly a threat to the project include:
E. individuals do not call to donate funds
H. Board of Directors does not approve of the radio station for sponsorship
L. insufficient funds are raised for the event
Now that you have a clear sense of the risks that might occur with the project, this next task will require you to analyze the probability of occurrence for each risk along with the impact to the project if this risk occurs.
Refer to the scenario if necessary to assess these risks.
Note: The intent of this exercise is to enable you to weigh each of the risks in your analysis. Therefore, there is no hard “correct” or “incorrect” answer. However, one answer may be more optimal than another. The optimal answer will provide you with rationale for why a certain probability or impact rating was given to a particular risk.
Risk 1: insufficient space for the radio station and camera crew
The Probability of this risk to the project:
A. High
B. Medium
C. Low
The Impact of this risk to the project:
A. High
B. Medium
C. Low
The optimal answer is:
The probability of this event occurring is assigned a medium rating. The rationale supporting this rating is that the event took place last year and space for the radio station and camera crew was sufficient.
The impact of this event on the project should the risk occur is given a high rating. The rationale supporting this rating is that insufficient space may cause crowding, unsafe working conditions, higher probability of accidents, and inability of the camera crew to do their job. Station may re-examine their future sponsorship of this project.
Risk 2: insufficient space requirements for phone set-up and volunteer seating
The Probability of this risk to the project:
A. High
B. Medium
C. Low
The Impact of this risk to the project:
A. High
B. Medium
C. Low
The optimal answer is:
The probability of this event occurring is assigned a low rating. The rationale for this rating is that the event took place last year and the space was sufficient.
The impact of this event on the project should the risk occur is given a medium rating. The rationale supporting this rating is that insufficient space may cause crowding or unsafe work conditions, or it may inhibit volunteer productivity.
Risk 3: insufficient quantity of volunteers recruited to handle phones
The Probability of this risk to the project:
A. High
B. Medium
C. Low
The Impact of this risk to the project:
A. High
B. Medium
C. Low
The optimal answer is:
The probability of this event occurring is assigned a medium rating. The rationale for this rating is that fewer individuals may volunteer and this would impact the number of people available to answer phone calls.
The impact of this event on the project should the risk occur is given a high rating. The rationale for this rating is that an insufficient quantity of volunteers may result in higher wait times during high call volume periods. Callers may choose not to wait for a volunteer, thus resulting in lost donations.
Risk 4: volunteer no shows
The Probability of this risk to the project:
A. High
B. Medium
C. Low
The Impact of this risk to the project:
A. High
B. Medium
C. Low
The optimal answer is:
The probability of this event occurring is assigned a medium rating. The rationale for this rating is that a shortage of volunteers as a result of no shows or external conditions can occur given the time of month that the radio-a-thon is taking place.
The impact of this event on the project should the risk occur is given a high rating. The rationale supporting this rating is that volunteer no shows may create higher wait times during high call volume periods. Callers may choose not to wait for a volunteer, thus resulting in lost donations.

Risk 5: insufficient budget for phone set-up, advertising, supplies, food, and administrative costs
The Probability of this risk to the project:
A. High
B. Medium
C. Low
The Impact of this risk to the project:
A. High
B. Medium
C. Low
The optimal answer is:
The probability of this event occurring is assigned a medium rating. The rationale for this rating is that the budget is determined based on last year’s expenses. However, there may be cost increases that have not been considered and the price may change.
The impact of this event on the project should the risk occur is given a high rating. The rationale supporting this rating is that if the budget increases, there may be a need to cut back on certain expenses (e.g., food), and the risk of lower revenues generated from donations increases.
Risk 6: other Outreach or Marketing-sponsored events to impact the Radio-A-Thon
The Probability of this risk to the project:
A. High
B. Medium
C. Low
The Impact of this risk to the project:
A. High
B. Medium
C. Low
The optimal answer is:
The probability of this event occurring is assigned a medium rating. The rationale for this rating is that there may be another event scheduled over the Radio-A-Thon that will detract or interfere with this event.
The impact of this event on the project should the risk occur is given a medium rating. The rationale supporting this rating is that additional activities may cut into the donations generated for the Radio-A-Thon event, or they may create additional traffic in the lobby area depending on the event.
Risk 7: insufficient loading area for radio station, camera, and telephone crew
The Probability of this risk to the project:
A. High
B. Medium
C. Low
The Impact of this risk to the project:
A. High
B. Medium
C. Low
The optimal answer is:
The probability of this event occurring is assigned a medium rating. The rationale for this rating is that there is a possibility of insufficient room depending on the events taking place in the neighborhood or on hospital grounds.
The impact of this event on the project should the risk occur is given a medium rating. The rationale behind this rating is that it can impact the timeliness and security during event setup.
Risk 8: insufficient time for Marketing to create a marketing campaign
The Probability of this risk to the project:
A. High
B. Medium
C. Low
The Impact of this risk to the project:
A. High
B. Medium
C. Low
The optimal answer is:
The probability of this event occurring is assigned a low rating. The rationale is that this can impact the type of promotion materials created for the event. .
The impact of this event on the project should the risk occur is given a medium rating. The rationale behind this rating is that a fewer donations would be generated if the appropriate level of publicity is not generated.
Risk 9: secure personal space for volunteers
The Probability of this risk to the project:
A. High
B. Medium
C. Low
The Impact of this risk to the project:
A. High
B. Medium
C. Low
The optimal answer is:
The probability of this event occurring is assigned a medium rating. The rationale for this rating is that if personal space is tight, people will not have a place to secure their personal belongings.
The impact of this event on the project should the risk occur is given a medium rating. The rationale supporting this rating is an increased security risk if volunteers are unable to store their belongings into a secure area.
Risk 10: impact on traffic flow through the lobby during the event
The Probability of this risk to the project:
A. High
B. Medium
C. Low
The Impact of this risk to the project:
A. High
B. Medium
C. Low
The optimal answer is:
The probability of this event occurring is assigned a medium rating. The rationale for this rating is that it may impede a person with an emergency situation from getting through the lobby. .
The impact of this event on the project should the risk occur is given a medium rating. The rationale supporting this rating is that the level of traffic flow can impact the security and safety of the lobby area for all individuals walking passing through
Risk 11: security breach on hospital grounds
The Probability of this risk to the project:
A. High
B. Medium
C. Low
The Impact of this risk to the project:
A. High
B. Medium
C. Low
The optimal answer is:
The probability of this event occurring is assigned a low rating. The rationale for this rating is that although hospital security is quite tight; some additional precautions may need to be taken.
The impact of this event on the project should the risk occur is given a low rating. The rationale behind this rating is that ultimately it depends on what transpires; however, a security breach can jeopardize the project if funds or donations are stolen.

Risk 12: radio station sponsoring event airs advertising or programming that results in rejection of sponsorship
The Probability of this risk to the project:
A. High
B. Medium
C. Low
The Impact of this risk to the project:
A. High
B. Medium
C. Low
The optimal answer is:
The probability of this event occurring is assigned a low rating. The rationale for this rating is that while the project is under development, radio station DJs may say or do something counter to what the hospital supports. Board of Directors may withdraw from having WBEX sponsor the event.
The impact of this event on the project should the risk occur is given a high rating. The rationale supporting this rating is that this could be detrimental to the fundraiser. A decision would need to be made as to whether the hospital could find another sponsor in enough time to meet the other deadlines.

Risk 13: inclement weather prevents trucks and volunteers from coming to Radio-A-Thon
The Probability of this risk to the project:
A. High
B. Medium
C. Low
The Impact of this risk to the project:
A. High
B. Medium
C. Low
The optimal answer is:
The probability of this event occurring is assigned a low rating. The rationale for this rating is that the risk of extreme weather during December is minimal.
The impact of this event on the project should the risk occur is given a high rating. The rationale supporting this rating is that inclement weather could impact the ability of the Radio-A-Thon to begin as scheduled or to take place at all.
All of the risks have been mapped on a probability – impact risk map. The risk map looks like this:
•    3 of 10 risks are medium probability and impact
•    3 of 10 risks are medium probability and high impact
•    2 of 10 risks are low probability and high impact
•    1 of 10 risks is low probability and low impact
•    1 of 10 risks is low probability and medium impact
Knowing this, how would you summarize the overall risk to your project?
A.    There are several risks rated as “medium” and “high.” This increases the overall project risk, and treatments for these risks must be implemented. Additionally, high consequence risks must have appropriate contingency plans in place for all these risks.
B.    There are several risks rated as “medium” and “high.” This increases the overall project risk; however, the project will not be in much jeopardy provided that the project manager develops the appropriate contingency plans focusing on only the high risks.
C.    There are several risks rated as “medium” or “high.” However, the overall risk to the project is relatively low. The project risk manager must account for the high consequence risks and prepare appropriate contingency plans for the high risks.

The optimal answer is:
A. Great job! You are correct to be concerned about the group of risks with a probability/consequence rating of “medium.”  As a group, these risks can pose a serious threat to the project.  Additionally, as a project risk manager, you must consider all possible consequences and have the appropriate contingency plans in place for all of these risks
Summary
Great Job! You have successfully analyzed the overall risks to this project. The next focus of project risk management will be to make plans for how you will address these risks to minimize or eliminate their impact.

Activity
Activity: Identifying Project Risks
You as a project manager must be aware of potential hazards that could jeopardize your project and have a plan in place to prevent, minimize, or recover from them. Developing a risk plan is part of the project management process. The first step to build this plan is to identify the project risks, defined as events or conditions that could negatively affect your project.
Every project has risks. They range from the common (a team member goes on vacation during a critical time period) to the extreme (the software vendor goes out of business). It is possible to go to the extreme and identify so many dangers that you cannot foresee the project ever succeeding.
Assessing the Project
A systematic approach to identifying and categorizing risks can be a very powerful tool. Begin by assessing the strategy. Ask:
•    How sound is it?
•    What if it changes?
•    Is there solid sponsorship of this project?
Reviewing the people connected to the plan can reveal risks as well. You should make sure the right people for the project are available and that they have all the skills necessary to complete the project. Missing skills means possible risk. The team’s lack of ability to work together could pose a risk to the project. The organization’s view of using external resources will affect your project.
The project process must be thoroughly examined. Having a thoroughly documented and systematic process to follow that is appropriate to the project will mitigate risk and provide standards for the team.
A lack of necessary tools (hardware, software, templates, procedures, equipment, supplies, office space, and so on) can pose dangers to the project.
The boundaries of the project contribute to risk factors. Ask these questions:
•    How tight is the timeline?
•    Is the budget adequate?
•    Is the scope well-defined?
•    Are the milestone dates realistic?
•    Is there a clear process to manage scope changes?
•    What happens if there is a budget cut?
External events can also create risk. You must examine the culture outside the project. Pending organizational changes can affect the project as well as issues with vendors being used. For some projects, current events or even the weather can have serious consequences.
Creating a Risk Action Plan
You may feel overwhelmed after compiling a comprehensive list of possible risks; however, you are not going to create an action plan for every possible risk. Instead, you will focus on the probability of the risk occurring and the effect of the risk if it occurs.
Rate each risk for its probability; use a simple high, medium, low, and zero scale. Then rate the impact on the project if the risk were to occur using the same scale. You can now remove items from the overall list that have zero to low impact or zero to low probability.
You must understand your organization’s tolerance for risk to help you determine whether you can also eliminate medium-impact and medium-probability risks or high-impact and low-probability risks. What remains is a list of high-impact and high-probability risks. These are the items that you need to address by creating the risk action plan, which describes how you will avoid the risk, mitigate its probability or impact, or accept the risk.

Presentation
Presentation: Analyzing Project Risk
Introduction
Risk assessment is the activity of reviewing the list of possible risks and determining which ones will be the focus of risk management activities. As you identify the list of possible project risks, you may create a list of 50, 100, or even 200 possible risks. This list will rapidly become overwhelming and unmanageable. Risk assessment helps you focus on the risks that could have the largest impact on the project and that have the greatest risk for occurrence.
Prioritizing the Risks
The first step of risk assessment is to review your list of project risks and ensure it is complete. Second, you must understand the project’s overall priorities and constraints. When you began to scope and plan the project, you should have defined the constraints of the project and their relative importance. For example, working with the project sponsor, you may have determined that hitting the project’s target scope is more important than hitting the project’s target date or that meeting a certain quality level is more critical than working within the project’s budget. Starting with your most critical constraint, analyze and evaluate the risks related to it.
The third step is to prioritize the project risks. For each risk, estimate and assign a value or level for the probability of a risk occurring and the impact of the risk on the project when it occurs.
Probability measures the likelihood of a particular risk occurring on the project. Impact is the size and type of disruption your project will encounter if the risk occurs.
Risks that fall into the high-probability and high-impact quadrant are the highest priority risks. Risks that fall into the low-probability and low-impact quadrant will most likely not need any further attention. Risks that have a medium probability and/or a medium impact require additional analysis to determine their priority.
Risk Assessment Techniques
Qualitative risk analysis, semiquantitative risk analysis, and quantitative risk analysis are the three main techniques that are used to prioritize project risks. The techniques you use will vary and will be based on the
•    size and/or duration of the project.
•    organization’s tolerance for risk.
•    constraints of the project.
Therefore, you need to understand these risk management influencers before delving into greater detail in your risk analysis. An organization’s risk tolerance is a critical influencer. Furthermore, not only does the organization have its own cultural perspective toward risk, but your team members, customers, stakeholders, and sponsor also have their own risk tolerance levels.
Qualitative Risk Analysis
Qualitative risk analysis is the process of assessing risks using a very simple scale, such as high, medium, and low. This type of risk analysis is typically completed using personal and organizational experience rather than mathematical models. It is also the method that is the most intuitive and most commonly used.
Qualitative risk analysis is done by assigning a value of high, medium, or low for the probability and impact of each identified project risk. The results are then plotted in a matrix or on a quadrant graph.
For example, suppose that you have employed a vendor to do a software customization for your project. Past experience has indicated that this vendor may not deliver the software customization by the designated delivery date. If this occurs, your project will be jeopardized because you cannot move forward until you have received the software customization component. In your analysis, you may consider this risk to be high probability and high impact. The risk would be charted as shown here:

Keep these general guidelines in mind:
•    Risks that fall into the high-impact/high-probability quadrant are considered high-priority risk events and should be addressed aggressively.
•    Risks that fall into the low-impact/low-probability quadrant are typically lower priority risks and can be addressed less aggressively or ignored.
•    Everything else must be furthered analyzed and most likely will need to be addressed. Sometimes the company, sponsor, et cetera has a tolerance level and will allow the low-high/high-low project risks to be ignored.
In projects of small to medium size, the qualitative analysis technique will address the majority of the risks. However, on larger projects, this technique will give a very good high-level overview, but it will most likely need to be confirmed by semiquantitative techniques.
Summary
Risk assessment is often thought of as a difficult and complex activity. It isn’t, as long as the proper perspective is taken. Keep the following points in mind:
•    Identify the risks that could realistically be encountered.
•    Understand the source of the risk and then determine the probability of it happening.
•    Determine the possible impact the risk would have to the project if it occurred.
•    Use a scoring method that is understandable to your project team, stakeholders, and sponsor.
•    Focus on the most critical constraints of the project and put your attentions there.

Activity
Activity: Analyzing Project Risk
Qualitative Risk Analysis
Qualitative risk analysis is the process of assessing risks using a very simple scale, such as high, medium, and low. This type of risk analysis is typically completed using personal and organizational experience rather than mathematical models. It is also the method that is the most intuitive and most commonly used.
Qualitative risk analysis is done by assigning a value of high, medium, or low for the probability and impact of each identified project risk. The results are then plotted in a matrix or on a quadrant graph.
For example, suppose that you have employed a vendor to do a software customization for your project. Past experience has indicated that this vendor may not deliver the software customization by the designated delivery date. If this occurs, your project will be jeopardized because you cannot move forward until you have received the software customization component. In your analysis, you may consider this risk to be high probability and high impact. The risk would be charted as shown here:

Keep these general guidelines in mind:
•    Risks that fall into the high-impact/high-probability quadrant are considered high-priority risk events and should be addressed aggressively.
•    Risks that fall into the low-impact/low-probability quadrant are typically lower priority risks and can be addressed less aggressively or ignored.
•    Everything else must be furthered analyzed and most likely will need to be addressed. Sometimes the company, sponsor, et cetera has a tolerance level and will allow the low-high/high-low project risks to be ignored.
In projects of small to medium size, the qualitative analysis technique will address the majority of the risks. However, on larger projects, this technique will give a very good high-level overview, but it will most likely need to be confirmed by semiquantitative techniques.
Summary
Risk assessment is often thought of as a difficult and complex activity. It isn’t, as long as the proper perspective is taken. Keep the following points in mind:
•    Identify the risks that could realistically be encountered.
•    Understand the source of the risk and then determine the probability of it happening.
•    Determine the possible impact the risk would have to the project if it occurred.
•    Use a scoring method that is understandable to your project team, stakeholders, and sponsor.
•    Focus on the most critical constraints of the project and put your attentions there.

Article
Risk Assessment
Question 1: What is risk assessment and why is it important?
Answer 1:
Risk assessment is the activity of reviewing the list of possible risks and determining which ones will be the focus of risk management activities. As you identify the list of possible project risks, you may create a list of 50, 100, or 200 possible risks. That list will rapidly become over-whelming and unmanageable. If you were to try to manage all the risks that could hit your project, you wouldn’t have time to manage anything else! You also would potentially create such a risk-averse project environment that the project team’s ability to meet the project’s objectives would suffer. Risk assessment helps you focus on the risks that could have the largest impact on the project and those risks most likely to occur.
Question 2: What is needed for risk assessment?
Answer 2:
The list of risks is your starting point. This list was created by reviewing the work breakdown structure, project schedule, project budget, organization chart, staffing plans, and other project documents. Use this list, along with any models or methodologies created by the organization over time. Another input is the list of assumptions made during earlier project planning activities.
Question 3: How do I prioritize the risks?
Answer 3:
Review your list of possible risks. For each risk, assign both a probability and an impact. Probability is the likelihood that the risk will occur. Impact is the size and type of disruption your project will encounter if the risk occurs. The risks that are high probability, or high impact, are the highest priority risks. Risks that are low probability, or low impact, will likely not need any further attention. The risks that have a medium probability and/or a medium impact require additional analysis to determine their priority.
Question 4: How do I start the process of risk assessment?
Answer 4:
In building the project charter, you grappled with the constraints of the project and determining their relative priority. For example, is hitting the target scope the most important thing, or is it a target date? Is quality more important than budget? Use this understanding as a starting point in risk assessment. If scope is your most critical constraint, for example, start your risk assessment by analyzing and evaluating the risks that could most adversely affect the scope, such as the following:
•    lack of sponsorship
•    insufficient knowledge of existing business processes and work flows
•    insufficient consensus from key stakeholders on project scope
•    inadequate time allowed for requirements-gathering activities
•    difficulties scheduling meetings/working sessions with key stakeholders and subject-matter experts
•    resistance to change the business work flows required to produce the desired business objectives
Question 5: Who is involved in this step of risk management?
Answer 5:
As the project manager, you have the ultimate responsibility for creating the risk management plan, including identifying the risks, assigning a probability and impact value, and creating the action plans to manage those risks. However, you should not conduct these activities in a vacuum. The project team leaders, subject-matter experts, project sponsor, and key stakeholders will be able to provide their own perspective on the risks, probabilities, and impacts. They will have a different set of experiences from which you can draw, they have a different tolerance for risk, and they have different ideas for managing the risks. Seek out these people and leverage their experiences. Just as importantly, you need these people’s agreement on your risk management plan. Ensure that they understand the approach you are taking to the risk assessment and agree with your conclusions around the risk priorities.

Resource Links
•Free Management Library
(http://www.managementhelp.org/)
This website contains information on a variety of business management topics including risk management.
•MBT Step 7 Risk Management: Developing a Risk Management Plan
(http://www.doi.gov/)
The Department of the Interior website is the source of a summary document about creating a risk management plan. In the search box, type MBT Step 7 Risk Management to find the result of MBT Step 7 Risk Management: Developing a Risk Management Plan.
•Risk Assessment for Digitization Projects
(http://www.jiscdigitalmedia.ac.uk/)
This industry website provides an overview of the risk management process and advice on converting non-digital material to digital form. In the search box, type “Risk Assessment” and find the article of Risk Assessment for Digitization Projects.
•Risk Impact/Probability Chart
(http://www.mindtools.com/index.html)
This website contains training on career enhancing tools. In the search box, type “risk impact” and you will find the result of Risk Impact/Probability Chart.
•Sample Section from a Risk Management Plan
(http://www.lsc.gov/)
This website from Legal Services Corporation contains a sample risk management plan. In the search box, type risk management plan and click on the result of Sample Section from a Risk Management Plan.