What is a risk in project management?

In this article, I discuss something very simple – describing a risk.

Often project managers overlook this aspect as they are inclined to believe that what really matters is how we analyze and respond to risks and not how we formulate a risk statement.

Would you agree? I have a slight contention with this idea.

Once, in a risk management workshop, when I asked the delegates to cite some examples of risks, I got responses such as:

• The project may be delayed

• Cost overrun

• Attrition

• Raw material prices will hike, amongst other good risk statements.

Are these appropriate definitions of risk?

If not, then what’s wrong with them? Well, we will come to the answer to this question a little later.

Let’s first look at the definition of risk.

The first thing about risk is that these are uncertain events. If something is undoubtedly going to happen, then it’s not entitled to be a risk. For some reason, if you are sure that “raw material prices will hike,” then it’s not a risk; call it an issue.

Simply put, the word “WILL” will not go with risk; it should be replaced by “MAY.” The probability of a risk occurring should be greater than 0% and less than 100%.

The effect of risk could be either beneficial or adverse to the project. Those events that can cause a favorable impact are termed opportunities, and those that would cause an unfavorable impact are termed threats. Project managers are often more engaged with threat management than opportunity management.

A risk statement should comprise three components:

• Cause – is the trigger or the reason for the event to occur.

• Event – represents the uncertainty (there may be an escalation in raw material prices, and weather conditions may not be favorable)

• Effect – this is the consequence should the event occur (beneficial or adverse)

When writing a “risk statement”, you must clearly describe all three.

Examples of some risk statements

Here is an example of risk statement:

• Text in red represents the cause

• Text in Orange represents the event

• Text in purple represents the effect

Due to high levels of stress in the project team,there is a possibility of higher-than-usual attrition, thereby delaying the project. This is a threat.

Due to an extension in project timelines (maybe to deliver added scope), there is a possibility that the service provider releases a newer version of the technology (which is expected) before the end date of the project,which can be adopted instead to reduce operation cost of the application by 10%. This is an opportunity.

Risks are also termed uncertainties: when we say the risk is uncertain, it’s not the cause but the event that is uncertain. There is no uncertainty about the cause; it’s something that’s already happening.

I hope by now you have understood what the issues are with the risks listed at the top of this article. Let’s look at one ‘attrition” risk.

“Attrition” – this definition is not so bad; we can make out what it meant… there is the possibility of attrition being higher in the project team than usual (say 5%), which may affect the project. Do you think this is enough? It doesn’t describe the cause. Why does the project manager believe there would be higher attrition? There could be many reasons for this, like:

1. More job opportunities in the market post-recovery from an economic meltdown

2. High job stress in the project

3. The team doesn’t have the chance to work on the latest skills

Our response to the same risk would vary greatly depending on what the CAUSE is. Like

1. More job opportunities in the market post recovery from an economic meltdown – offer employees better compensation/benefits at par in the industry;

2. High job stress in the project – level resource usage; organize stress relief sessions

3. The team doesn’t have the opportunity to work on the latest skills – promise to offer them a task that they are willing to do in the next assignment;

Without knowing the exact cause, we have no clue which of the above response I should be trying out. Imagine the reason is “Team doesn’t have the opportunity to work on the latest skills,” and I am organizing stress relief sessions and reducing workload.

Now coming to the EFFECT – attrition won’t have the same effect on every project; it depends on the nature of work, the skills required, the criticality of the project, and more. In some cases, resources could be easily replaced.

In contrast, the learning curve could be long and complex in others, requiring long training and orientation to prepare another person to take over. So the effect could vary.

If the effect is assessed to be severe, I would consider some responses like creating a backup or trying to retain the resource by offering some benefits. I will accept the risk if I perceive the effect as insignificant or minor.

I need this knowledge to know how severe it is to warrant appropriate attention and response. Therefore, there is a need to identify and document the effect.

However, I don’t have to analyze the magnitude of the impact at this time; this would be the next step conducted as part of the ANALYSIS.