Unit
- Risk as uncertainty: Project risk is an uncertain event or condition that, if it occurs, has a positive or negative effect on one or more project objectives. This definition from the PMBOK Guide emphasizes the duality of risk: it can create threats or opportunities.
- Risk vs. uncertainty: Uncertainty is a lack of knowledge about future outcomes, while risk is uncertainty that can be quantified or assessed. In projects, uncertainty that cannot be measured remains a source of ambiguity rather than a managed risk.
- Known unknowns vs. unknown unknowns: Known unknowns are risks that can be anticipated and analyzed using historical data. Unknown unknowns are unpredictable events that cannot be foreseen, often requiring contingency buffers or adaptive management.
- Positive risk (opportunity): Not all risks are harmful. Opportunities can accelerate schedules, reduce costs, or improve quality if proactively identified and exploited. Risk management must address both sides of the risk spectrum.
- Project objectives at risk: Risks can affect scope, schedule, cost, quality, resources, and stakeholder satisfaction. Each objective requires specific risk thresholds and tolerance levels determined by the project sponsor.
- Risk event vs. risk cause: A risk cause is the condition that gives rise to the risk, while the risk event is the actual occurrence. For example, lack of skilled personnel (cause) leads to delayed deliverables (event), which impacts schedule (effect).
- Residual and secondary risks: After implementing a response, residual risks remain. Secondary risks arise directly from the response itself, such as increased costs from a mitigation action. Both require ongoing monitoring.
- Risk thresholds and triggers: Triggers are early warning signs that a risk is about to occur. Thresholds define the acceptable level of deviation from the plan. Together they enable proactive response activation.
- Risk appetite vs. risk tolerance: Risk appetite is the degree of uncertainty an organization is willing to accept in pursuit of value, while risk tolerance represents the acceptable deviation from that appetite on specific objectives. These concepts determine how aggressively opportunities are pursued and how much contingency reserve is allocated across the project portfolio.
- Risk register as a living document: The risk register captures each identified risk along with its cause, probability and impact ratings, proposed response strategies, and assigned owner. It is continuously updated throughout the project lifecycle to reflect new risks, closed risks, and changes in status, serving as the central repository for all risk tracking and reporting.
- Risk owners and accountability: Every identified risk must be assigned a specific risk owner responsible for monitoring trigger conditions, implementing the agreed-upon response strategy, and reporting changes in risk status to the project manager. Without clear ownership, risks often go unmanaged until they become active issues that damage project objectives.
- Probability and impact matrix: This matrix plots risks by their likelihood of occurrence and potential effect on project objectives, producing a priority score that guides response planning. High-priority risks demand proactive mitigation or contingency plans, while low-priority risks are often accepted or placed on a watch list for periodic review.
Strategic Framework
Framework: Risk Breakdown Structure (RBS)
Purpose: Categorizes potential project risks into hierarchical levels to ensure comprehensive identification and analysis.
- Technical risks: Include design changes, technology obsolescence, requirements volatility, and performance shortfalls. These often originate from the project’s complexity or new technology adoption.
- External risks: Cover regulatory changes, market fluctuations, natural disasters, supplier failures, and geopolitical shifts. These are outside the project team’s control but can be monitored and mitigated.
- Organizational risks: Arise from resource constraints, stakeholder conflicts, budget cuts, or priority shifts within the parent organization. Effective communication reduces these risks.
- Project management risks: Relate to estimation errors, planning gaps, communication breakdowns, and poor governance. These are often addressable through better processes and skilled leadership.
Quick Revision
- Risk is uncertain and can be positive or negative; it must be assessed against project objectives.
- Distinguish between uncertainty (unmeasurable) and risk (measurable).
- The Risk Breakdown Structure (RBS) provides a systematic way to categorize risks.
- Triggers and thresholds enable proactive risk response activation.