Risk can be managed when properly entrenched into all stages of the project.

by Karina Sanchez

Project managers are well aware that risk can easily destroy a project and damage an organization. But these days, that’s not enough.

Risk must be addressed throughout a project’s life cycle, and project management practitioners continually need to revisit old risks and explore new risks, says Eric Spanitz, PMP, president of training and coaching firm Synergest Inc. and professor at Lake Forest Graduate School of Management, both in Chicago, Ill., USA.

“Most project managers do risk assessment at the beginning of the project and [don’t think about it past that],” he says.

The Sixth Sense
Risk management is typically viewed as part of the planning process, but it’s also a major element of the execution of a project.

While the first five risk management processes identified in A Guide to the Project Management Body of Knowledge (PMBOK^® Guide)—Third Edition—risk management planning, risk identification, qualitative risk analysis, quantitative risk analysis and risk response planning—are completed in the project planning phase, it’s important to remember the sixth, says Janice Preston, PMP, managing director of training firm Vista Performance Group and curriculum coordinator for the University of California Irvine Extension, Mission Viejo, Calif., USA.

“It’s important to focus attention on monitoring and controlling [risk] during [project] execution as well,” she says.

To ensure the sixth process isn’t ignored, she suggests continually referring back to the risk register created at the beginning of the project. “If you don’t refer back, you forego the opportunity to complete a project successfully,” she says. “Risks you originally thought were important may have changed in probability or impact.”

Mr. Spanitz suggests turning activity owners—those responsible for ensuring project tasks are completed—into risk owners, who constantly look for risk symptoms. For example, in a construction project, the risk owner would continually check to see if more time needed to be built into the schedule for bad weather, in addition to the time allotted at the beginning of the project. He would check for wet ground and watch weather forecasts, then report findings to the project manager. “Project managers are overwhelmed with responsibilities many times,” he says. “Risk owners can help share some of that work.”

While large-scale projects, like those in the government sector, may have a team of risk managers, that’s not likely the case with smaller projects, Ms. Preston says. But appointing a risk manager is a simple approach to adopt, Mr. Spanitz adds. “It’s a matter of awareness—communicating to the risk owners what triggers they should look out for,” he says.

Mr. Spanitz also advocates having separate risk meetings once a month or quarter to identify risks, quantify those risks and come up with responses. Gathering stakeholders, CFOs, CEOs, end-users, vendors and suppliers is essential when revisiting risk assessments. Elements of a project can be overlooked as not posing any risk, but with the input of multiple stakeholders and team members, those areas are more likely to be identified.

An Ingrained Decision
Project managers should strive to reach a level where managing risk becomes embedded in an organization or project, says David Hillson, Ph.D., PMP, director of Risk Doctor & Partners, a risk management consultancy in Hampshire, England.

The four-stage conscious competence model popularized in 1982 by communications specialist William Howell can aid them in achieving this level, he says:

• Unconscious Incompetence. A person is unaware he or she does not know what he or she does not know.
• Conscious Incompetence. A person realizes he or she does not know how to do something and realizes there is a weakness.
• Conscious Competence. A person learns how to do something, thinks about it and does it properly.
• Unconscious Competence. A person does something naturally without thinking about it.

Those who reach the unconscious competence level in terms of risk will improve their overall success at managing projects, Dr. Hillson says. And the best way to reach that point is by learning from experience.

“There are no short cuts or quick fixes in embedding risk management. It becomes embedded with consistent behavior over time,” he says. “We need to encourage unconscious competence, where risk management is just what we do.”

Karina Sanchez is managing editor for Security Products magazine and a freelance writer based in Dallas, Texas, USA.

back to top