What Is Risk Management?
Authorities disagree on the proper way to define risk management. There are disagreements on the scope or extent of want constitutes risk management, and on the manner in which to categorize the components of risk management. For our purposes, we will adopt the following activities as composing risk management, while recognizing that other classifications are in use in the literature: Risk Identification, Risk Assessment, Risk Handling, and Risk Monitoring. Note that these activities form a cycle, and that as programs progress there may be several iterations of identification, assessment, handling, and monitoring.
Risk Identification
Risk identification consists of determining what uncertain future events are possible. In the identification activity, care should be taken to ensure that the items identified are truly risks, as opposed to problems or to future events that are certain; program management must be certain that the list of risks is not too long. Simultaneously, historical problems should be researched and team members’ imaginations exercised to ensure that potential risks are not overlooked; program management must be certain that the list is not too short, as well.
Risk Assessment
Once risks are identified, they must be analyzed to determine the likelihood of occurrence, and the range of possible consequences. This is another area in which historical data can be useful to help assess probabilities and potential costs. Risk assessment is also the activity in which program management establishes the thresholds for risk mitigation and contingency planning: what level of risk is acceptable and what level requires additional investment.
Risk Handling
Risk handling is the activity in which risk mitigation strategies and contingency plans are formulated and put into practice. Put another way, risk handling is the activity in which the cost of insurance occurs.
Risk Monitoring
Risk monitoring comprises a number of tasks. If risk events occur, risk monitoring is the activity that assesses the effectiveness of the risk mitigation strategies and contingency plans. Risk monitoring is the activity that determines when overall risk is reduced because of the implementation of risk management plans or because risk events have not occurred. Risk monitoring is the activity that produces reports and evaluations on the overall riskiness of the program.
Risk Management Is Real Work
Too often, team members view risk management as no more than an item to be checked off on a form: “I did my risk management, now I can get back to doing real work.” To be effective, risk management requires the same level of dedication as every other task in a successful program. Program management must understand and promote the importance of risk management as an essential component of the program, and must actively support risk management activities by team members. One way to communicate this support, for example, is to provide specific charge numbers for risk management activities. With proper backing from program management, risk management activities will then be viewed as “real work”.