Analyze your risks to determine which ones to manage

by Tom Mochal

Takeaway: Tips for determining project risks and their severity.

No project is without some risk. The best way to identify risks is through a combination of checklists and brainstorming. Checklists allow you to catch the typical risks that might be inherent in projects like yours. A team brainstorming session allows you to find risks that are specific to your particular project. You might end up identifying dozens of risks through a combination of checklists and brainstorming.

After you identify all the risks, you must figure out which ones are important enough for you to address (risk analysis). You want to classify each risk it in terms of high risk, medium risk, or low risk. You do that by looking at the likelihood that the risk will occur and the impact of the risk on the project if it does occur. For example, a risk that is highly likely to occur and has a high impact to the project would definitively be a high category risk. On the other hand, a risk that is not likely to occur and has a small impact to the project if it does occur would definitively be a low-level risk. All other combinations fall somewhere in the middle of this continuum. The following list gives you the various combinations based on the impact to the project (high, medium, low) and the likelihood of the risk occurring (high, medium, low)

Likelihood	Impact	Overall risk level
High	High	High
High	Medium	Medium
High	Low	Low
Medium	High	High
Medium	Medium	Medium
Medium	Low	Medium/Low
Low	High	Medium/Low
Low	Medium	Low
Low	Low	Low

This is one example of how you can categorize risks as being high, medium or low, based on the likelihood of occurrence and the impact. There are many other techniques as well. These high-level risks should be managed. The low level risks can be ignored. The medium-level risks should be evaluated individually. You might need to respond to some while others can be ignored for

Analyzing each risk allows you to determine which ones are important enough to manage. This analysis save you the wasted time associated with managing risks that are better documented, but ignored.