5 Ways to Manage Risk and Maximize Rewards
No project runs exactly to plan, but a strong risk management approach will help project teams navigate the challenges — and capitalize on the opportunities. Here are five practices to step up your risk/reward game.
Written by Project Management Institute • 10 June 2024
Everyone manages risk. Looking both ways before crossing the street, strapping on the seatbelt before turning the ignition. On projects, risk gets more complicated. There are unmarked roads, potential trouble lurking around every curve. The consequences of being surprised and unprepared can be very costly. That’s why risk management is fundamental to the success of every project — and project manager.
Risk management is a team sport. It starts with the project manager, but to succeed it requires active participation from team members, stakeholders, sponsors, partners and customers. It must be supported by the organization with clear processes, tools and resources. And it benefits enormously from a culture that encourages honest, ongoing communication about risks. In doing so, "bad" risks can be mitigated sooner — and "good" ones, bringing opportunities, can be maximized for greater rewards.
Here are some field-tested, expert-vetted practices and insights to strengthen your risk management approach.
Start a Conversation, Keep It Going
At its core, risk management is a conversation. It's looking at tradeoffs with your teams and stakeholders and saying, “Here are the things that could happen. Do we need to take action now? Do we need to change our project plan? Do we go for it?” When business pressures, personalities or other factors make that conversation difficult, it’s imperative that project managers still do everything possible to keep the discussion alive on their teams.
Most team members are eager to talk about risk once they believe they can do so openly without being labeled complainers. In fact, most folks in the trenches are downright relieved to talk about risks. What gets them deeply worried is when they see risks that threaten project success, and no one wants to hear about it.
Unfortunately, in many organizations, risks are handled like hot potatoes — juggled and tossed from person to person. In this environment, the bad news often gets worse, and it gets delivered too late to do something about it.
Many executives and customers are averse to risk or at least reluctant to talk about it because they see uncertainties as negatives, nothing more. Therefore, it becomes helpful to frame the discussion of risk differently.
Remember Risks Are Opportunities, Too
Risk doesn’t exist without the pursuit of an opportunity, and the opportunity or end goal must justify whatever residual risk you decide to carry forward. But many risk models ignore the positive part of the equation. Instead, they prioritize risks based on probability and impact, ignoring the benefit of the potential opportunity. You can't make judgments on risk without considering the benefits of the opportunity.
Project managers charged with identifying risks should be equally diligent about presenting solutions and benefits to the stakeholders. Opportunities surface constantly on projects. As you develop solutions to risks, you will see more tactical opportunities, which will bring with them new risks, and you must make informed decisions as to which way to go.
In one sense, risk management at its best is an entrepreneurial endeavor. Data-gathering, analysis and identification are fundamental, but the big payoffs come when new decisions lead to redefined project plans that capitalize on the opportunities the risks are presenting. The huge challenge for most organizations is to build an infrastructure that allows, in fact encourages, creative responses to risk.
To manage uncertainty on innovative projects where unknowns are the rule, not the exception, continuous redefinition is the best approach, and it must be embedded in the project infrastructure. You know you can't plan to the end; you can only plan to reach milestones somewhere in the middle. Rather than monitoring progress to the goal, you need to monitor what you have learned.
Build a Realistic Risk Budget into Your Plan
Most project managers make a list of potential risks and probabilities at the outset and move forward. A crucial step is often missed: building a realistic risk budget. This often leads to insufficient resources or time to properly deal with risks once they occur.
The risk budget can be broken into four major categories:
-
Avoidance – actions taken to prevent a risk from occurring. This requires upfront planning, because many avoidance strategies must be executed just before the start of the project. Budget may be required to identify alternatives, negotiate different contract terms, and choose specific technologies or approaches
-
Mitigation – actions taken to reduce the probability of it occurring or the impact if it does occur. Mitigation involves proactive and preventative actions throughout the project's life.
-
Detection/Triggering – actions taken to determine if the risk is likely to occur or if it has already occurred. Detection or triggering is a technique to determine the likelihood of the risk’s occurrence and its potential impact. Often this testing can only be initiated just prior to when the risk most likely would occur.
-
Contingency – actions taken to address the results once a risk event has occurred. Executing a contingency strategy is often more costly than investing in avoidance or mitigation and detection. The more investment made in prevention, the lower the cost of risk.
A key point of this categorization is to avoid just tacking on a percentage of the project budget for risk; instead, properly estimate and budget for avoidance, mitigation, trigger and contingency actions.
Finally, this risk budget should be integrated with your project plan. Too many project managers have a separate file, tool and process for managing risks apart from the rest of the project. As a result, the risk plans are often forgotten, ineffective or used only for administrative purposes, and they fail to be a useful management tool. In addition, it is less likely a risk budget will be cut when it’s connected to the project plan.
Get Risk Management Certified
Become the risk specialist your organization needs with the updated PMI-RMP.
Learn More
Reassess Risk Throughout the Project
Most risks don’t remain stable — they change and evolve with the project and shifting circumstances. And even if the risk itself doesn’t change, as the project moves forward the team can develop a better understanding of it. So, sometimes a risk needs to not only be reprioritized but reassessed to see if the potential impact, or the chance of occurring, or the contingency and management approach is still appropriate.
Project managers should consider several different factors, including:
- Does the original analysis align with what is now known about the risk and project?
- Are the current management activities having any impact?
- Does the planned contingency still seem to be appropriate?
- How do the team members assigned to specific risks feel things are progressing?
- What do other experts in areas impacted by the risk think of the current assessment?
- How do the project manager and team feel about the risk — are they confident or concerned?
Don’t underestimate the importance of that last question. Risks are uncertain, so the experience of team members and the project manager is an important consideration when determining whether a reassessment is necessary.
Conduct a Risk Review, Learn and Share
Many risks are unique to each project, so applying lessons from one project to another might appear difficult. But an end-of-project review can represent a valuable learning opportunity when it comes to managing risk on future projects. Here are some areas and questions to consider:
- Risk identification process
- What risk categories generated the most items?
- Where was it difficult to identify risks?
- What aspects of the project only had risks identified later in the process?
- Who was needed outside the core team to help with the identification process?
- Risk analysis
- Where was it easiest to analyze risks, and where was it most challenging?
- Which categories generated the most significant risks?
- Where was it most difficult to develop contingency plans?
- Where was the management approach most difficult to determine?
- Risk management
- What types and categories of risk responded best to management?
- What approaches worked best and where were the challenges?
- Was there a need to change the approach or reassess risks and, if so, why
- Contingencies
- Where were contingencies needed and were they effective?
- What challenges were experienced?
- Did any contingency plans fail completely?
One of the most frequent criticisms about project reviews is that they become exercises in assigning blame rather than attempts to improve future projects. Throughout risk reviews, the focus should be on understanding:
- Why problems were encountered and how they were overcome
- What best practices were developed or improved
- What approaches didn’t result in successful outcomes
- What recommendations the team has received to improve future risk management
Make sure to consolidate the information in a risk database. We all learn and grow from experience, and risk reviews provide an opportunity for every project manager and team member to grow faster. When it comes to managing risk and maximizing reward, that’s going to provide dividends down the road, even one with unmarked curves.
You Might Also Like…
- The Standard for Risk Management | Download free for members
- Building Resilience Through Strategic Risk Management | Read Now
- Wicked Problem Solving: Online course and toolkit | Learn More
- How Project Teams Are Building Climate-Resilient Infrastructure—Projectified Podcast® | Listen
Have a Story of Your Own? Share it with Us!
Hours of Impact Supports the United Nations 17 Sustainable Development Goals (SDGs) by volunteering project management activities towards efforts that help to better people's lives.
Submit your PMWB volunteer hours and join the movement to improve the world we live in.