Risk Management Concepts for Project Management

Project risk is the cumulative effect of the probabilities of uncertain events that can have a negative or positive impact on the objectives of the project. Risks are divided into known and unknown. Known risks are identified and managed - risk response plans and reserves for possible losses are created. Unknown risks cannot be identified, and therefore it is impossible to plan actions to respond to such risk.

A risk event is a potential event that could harm or benefit a project.

Probability of risk - the probability that the risk event will occur. All risks have a probability greater than zero and less than 100%. A risk with probability 0 cannot occur and is not considered a risk. Risk with a probability of 100% is also not a risk,since it is a reliable event that should be provided for by the project plan.

The consequences of risk,if it happens, are expressed through the days of schedule, labor, money and determine the degree of impact on the goals of the project.

The magnitude of the risk is an indicator that combines the probability of risk and its consequences. The magnitude of the risk is calculated by multiplying the probability of occurrence of the risk by the corresponding consequences.

Contingency reserve (or provision to cover uncertainty) - the amount of money or period of time that is necessary in excess of the calculated values to reduce the risk of over expenditure associated with the achievement of project objectives to a level acceptable to the organization; are usually included in the basic cost plan or project schedule.

Management reserve - the amount of money or period of time not included in the basic cost plan or schedule of the project and used by management to prevent the negative consequences of situations that cannot be predicted.

Risk response planning includes the development of a risk management plan - a document developed at the beginning of the project and representing a schedule for working with risks throughout the project. The plan contains the following information.

Methodology - defines and describes the approaches, tools and data sources used to work with risks.

Roles and responsibilities - the section contains a description of who performs what work during the risk management of the project.

Budgeting - defines a budget to manage project risks.

Time frame - sets the frequency of risk management processes.

Tools - the section defines which methods of quantitative and qualitative risk analysis are recommended to be used and in what cases.

Control - a section that defines the format of the risk response plan.

Reporting - identifies ways to document the results of risk management activities and store information in a knowledge base for lessons learned and lessons learned.

An example of a methodology is the msf (Microsoft Solutions Framework) risk management discipline. MSF describes the process of continuously identifying and assessing risks, prioritizing them and implementing preventive risk management strategies throughout the project lifecycle.

Methods of project risk management for small and medium-sized projects are sufficiently developed and allow to effectively reduce the level of risks and labor costs for the project (see Table 5.1)For the management of large projects, the "standard" set of methods is not enough.



It is recommended that the risk assessment begin at the planning stage of the project, as at this point the project team and stakeholders begin to form the vision of the project, its boundaries and framework. With each new constraint or assumption associated with a project, an increasing number of risk sbegin to emerge. The project team should initiate risk detection activities as early as possible. Based on the results of risk analysis and planning steps, the necessary prevention and mitigation plans should be immediately included in the project schedule and its consolidated plan. The implementation of these plans should be monitored as part of a standard project management process.


During the planning phase, in accordance with accepted policies and procedures, the organization should take the following actions in the risk management process:

to adopt a systematic approach to risk identification, assessment and processing.
The systematic approach involves the introduction of risk classification, the definition of events affecting the course of the project and its results, the definition of the method of risk expression. With regard to quality, cost, timing or technical characteristics, determine the manner in which risks are expressed in appropriate terms, including indicators where possible;

identify risks.

This action includes the identification of the initial events associated with each risk in each of the risk categories, as well as the identification of relationships between the sources of risks. Determine the way risks are expressed in appropriate terms and, if possible, in indicators.