7.4 Risk assessment and impact analysis
Risk assessment involves measuring the probability that a risk will become a reality; impact analysis involves measuring the sensitivity of the project to each identified risk. The key questions are:
What is the risk – how will I recognise it if it becomes a reality?
What is the probability of it happening – high, medium or low?
How serious a threat does it pose to the project – high, medium or low?
What are the signals or triggers that we should be looking out for?
A risk assessed as highly likely to happen and as having a high impact on the project will obviously need closer attention than a risk that is low in terms of both probability and impact. Each risk can be allocated to one of the cells in Table 1 – risk probability and impact.
Table 1 Risk probability and impact
|Low impact||Medium impact||High impact|
The top right-hand box is the most dangerous area. If you place a risk statement in this box, you think it is very likely to happen, or you are very uncertain about it, and the consequences for your project would be very severe. Risks that fall into the bottom right-hand box may seem unlikely to happen but you are judging that the effect if they do makes them a danger area for the project.
Strategies for dealing with risks in project management include:
risk avoidance – for example, where costs outweigh benefits, you may decide to refuse a contract;
risk reduction – for example, regular reviews can reduce the likelihood of an end-product being unacceptable;
risk protection – for example, taking out insurance against particular eventualities;
risk management – for example, making use of written agreements in areas of potential disagreement;
risk transfer – passing the responsibility for a difficult task within a project to another organisation with more experience in that field.
A risk log should be started for the project at an early stage. This is a list of all the identified risks, together with an assessment of their probability and impact, and contingency plans for dealing with them should they become a reality. A risk log – or risk register – will look something like Table 2 – format for a risk register. It provides a framework for necessary actions to be taken and decisions to be made, and should be amended and added to on a regular basis as the project proceeds.
Table 2 Format for a risk register
|Funding||High||Low||Secure funding base prior to start of project|
For each of the scenarios below, identify which categories of risk are likely to be most significant and suggest appropriate strategies for dealing with them.
A voluntary organisation providing accommodation and resettlement services for homeless people is proposing to extend its activities into another town where there is an established need. Local authority financial support has been offered verbally but no firm offer of funding has made in writing. Moreover, previous attempts by another organisation to do similar work met with resistance from a residents’ association. Staff in the organisation are keen to support the proposal, but the manager who would be responsible for the project is on long-term sick leave.
In Case 1 the main risks relate to staffing (labour) and to political and social factors. These issues could be addressed by:
meeting with community leaders to explain the importance and value of the new service (risk management)
dealing with the staff sickness problem by allocating responsibility for the new house to a different team in the interim (risk reduction)
making sure that the contract included a clause allowing the organisation to withdraw if adequate funding was not made available (risk avoidance).
A personnel manager set up a pilot project to test the practicalities of an anticipated change in the law involving the employment of people with disabilities. There were questions about whether the manager was wasting money and time by running the pilot because it seemed possible that the legislation would not proceed through Parliament without substantial changes being made that might change requirements placed on employers.
In Case 2 the risks fall into the political and social category with technical aspects. The project could be refocused slightly to enable the organisation to review its current employment practices for disabled people and to make recommendations about how improvements could be made that would benefit the organisation. This would provide information that would enable them to take action very quickly once the legislation details were confirmed. The organisation would then be in a position to conform with the legislative requirements whilst ensuring that changes that were made were of benefit to it in a number of ways.
A contracts manager for cleaning services in an office block set up a project to develop a quality monitoring system based on performance indicators developed from the office users. She was concerned about the timing of the change: contracts were about to be retendered, so new contractors would not know the performance indicators when they applied to deliver the service. There was also concern about whether there would be sufficient staff to monitor contractors’ performance and how long it would take to train them to do the job.
In Case 3 the principal risks are in the labour, liability and technical categories. These risks could be reduced by close consultation with all concerned, particularly new contractors. If it is decided that the potential benefits outweigh the risks, the project could go ahead, allowing six months to develop a first draft of the performance indicators. Support for the appointment of an additional member of staff to carry out the monitoring could be agreed.