Risk management
Risk management

Start this free course now. Just create an account and sign in. Enrol and complete the course for a free statement of participation or digital badge if available.

Free course

Risk management

3 Project risk management

Much is made of risk management in projects but in essence good risk management is the same whether performed in projects, operations, compliance or strategy. At its most basic it is all about understanding what risks you face and then doing something about them.

Where projects differ is that projects (and therefore some of their risks) have an end date whereas other business risks do not.

In general there are three types of risk that need to be considered for any project:

  • the risks to delivering the project (on time and in full) and the benefits promised
  • the risks to the business during the project – particularly pertinent for change and transformation projects, where the transformation may cause uncertainty in the business
  • risks that are introduced post project – new systems, products, ways of working and locations can all introduce new risks that were not present at the start of the project.
Download this video clip.Video player: Video 5 Project risk management
Skip transcript: Video 5 Project risk management

Transcript: Video 5 Project risk management

So there's a to-do list when it comes to effective project risk management. The first on that list really is probably the hardest, and it will take the longest for you to actually implement. But it's the thing you have to work the hardest to actually make it work. But it has the biggest rewards. And that's the behaviour towards risk management, the culture within your organisation. It's not an easy thing.
You will always have people who are against it, who think it's a box ticking exercise, who think, actually, I've been doing this job for 20 years, what can you tell me? But actually, you know, the amount of times I've seen stuff where it's incredibly talented people, incredibly smart, bright, articulate, experienced people make mistakes because they can't see the wood from the trees. And that's what risk management kind of brings. It's a second view.
I've saved a very large sum of money on one project in particular just by asking a stupid question. It can be done. And that wasn't because I'm some sort of super genius. It was just because I was the right place at the right time, and I just asked the question. So behaviour is very, very key. And the one thing I would say to that is, you know, get people on board, evangelise. What you actually need to do is you actually need to demonstrate the benefits to people.
So you need a win. You need to get a small win, or preferentially, a huge win. But you need to be able to demonstrate that. And once you can demonstrate that to one person, you can demonstrate it to 10 people. You can demonstrate it to 100 or 1,000 people. And what you have to do is you have to nurture that, and you have to get more people involved in the process. You meet more evangelists, champions, whatever you want to call them, to come to your cause.
But that is the only way, frankly. Without that, without an open view on the benefits of risk management and people coming to it with an open, fresh pair of eyes, it's never going to be truly effective. So that's the hardest thing to do.
The second thing I would say is it's all about getting people involved in the process, it's communicating, it's collaborating. It's not just with yourself, of your own organisation, but with others, with clients, et cetera. Transparency is a great, great thing. Because yet again, it's different people's viewpoints, diversity and inclusion, it's all part of that. But actually, when you create something, when you come with something, don't make it three letters, or three words, shall I say, make it so someone from outside your organisation can understand it. And then you've got a greater chance of communicating that onwards.
The other point, I think, is it's all about checking the process, checking what you've done works. Where are we in this mitigation? Where are we in this process? How far down the line have we come? Not just saying, OK, it's now on a list of things somewhere, so therefore, it's done, that box has been ticked. But actually going back and saying, what do I actively need to do? What's the next step to actively reduce this issue we have? Or increase the chance of making this opportunity work? It's a long, long road, but actually, it's more than worth it in the end.

End transcript: Video 5 Project risk management
Video 5 Project risk management
Interactive feature not available in single page view (see it in standard view).

There are standard assessment models available for assessing the state of risk management in projects, one such being P3M3, which is recommended by the UK government.

This is a project maturity model that defines ‘what good looks like’ for various aspects of a project, from financial planning, to estimating through to risk. A maturity model such as P3M3 can be a useful tool for understanding your current level of maturity and providing a road map for improvement.

Activity 3 Short risk exercise

Timing: Allow approximately 10 minutes

Consider this project and run a short risk exercise.

Consider the following scenario:

A small family owned manufacturing business has been expanding rapidly, selling to new customers in different countries as well as introducing new products.

But this expansion has not been without growing pains. They have received an increasing number of customer complaints because of late deliveries, some of which have been caused by customs-related delays of shipping products to new countries and poor product quality.

In addition they are seeing high levels of staff turnover. At their exit interviews people leaving the company commonly highlight old IT systems and excessive workload as their reason for leaving. Many of the people who helped to build the original IT systems have now left the company.

The owners have decided to invest in a new IT system to handle order taking and production scheduling. The system is relatively new and no one in the company has any experience of using it. The provider of the IT system has said that it can be installed and up and running in less than six months, providing that all of the necessary information is available and of good quality and that the company’s best people are available. They have said that the customs module is not in their current quote. The sales team believe that they will recoup the cost of the IT system if it reduces the late deliveries by 50%.

The company management team have asked you to give them some advice. They would like to know the following:

  1. Which of their existing threat risks the project will reduce and which it will not.

Select all of the risks that will be reduced:


Late delivery to customers


Quality problems


Customs-related problems


Business continuity: Lack of support for existing IT tools


Staff turnover

The correct answers are a, d and e.

  1. What risks you foresee to delivering the project on time (and its benefits).


Availability to release the ‘best’ people to support the project


Quality of data (and time to clean up)


Capacity at manufacturing plant


Quality problems


The amount of the benefits caused by customs issues

The correct answers are a, b and e.

  1. What risks to normal operations you think they should be aware of during the project.


Higher levels of staff turnover (due to higher workload)


Higher levels of customer complaints (due to higher workload)


Higher levels of product quality issues

The correct answers are a and b.

  1. The new risks they should consider once the new IT tool is installed.


Opportunity: lower staff turnover


Opportunity: additional benefits from installing customs module


Higher levels of product quality issues


Business continuity for new IT tool

The correct answers are a, b and d.


Good project managers deliver projects on time, to costs and to the customer specification. They do this, in large part, by effectively managing risks.

Good business managers need to understand not only the risks to delivering a project but also the risks to running their business whilst the project is running and the risks that will be created once the project has finished.


Take your learning further

Making the decision to study can be a big step, which is why you'll want a trusted University. The Open University has 50 years’ experience delivering flexible learning and 170,000 students are studying with us right now. Take a look at all Open University courses.

If you are new to University-level study, we offer two introductory routes to our qualifications. You could either choose to start with an Access module, or a module which allows you to count your previous learning towards an Open University qualification. Read our guide on Where to take your learning next for more information.

Not ready for formal University study? Then browse over 1000 free courses on OpenLearn and sign up to our newsletter to hear about new free courses as they are released.

Every year, thousands of students decide to study with The Open University. With over 120 qualifications, we’ve got the right course for you.

Request an Open University prospectus371