Positive risks, or opportunities, are often missed because no one was looking for them. Then after the fact someone will say, “We could been done in half the time if only we had …” Or someone will identify an opportunity part way through the project, but the impact of changing to a new approach offsets any of the gains from the positive project risk. Positive risk management looks to find and incorporate all those opportunity ideas into the project plan in a proactive and controlled manner.
Risk management is an ongoing activity that begins at the time of project initiation and continues throughout the life of the project. There are four simple steps to follow when conducting either positive or negative risk management:
1. Identify the risk. Use whatever tools, techniques, templates, or experts to identify risks. One of my favorite is to ask the project team of subject matter experts, “What would have to happen for us to finish this project in half the normal time?” or half the budget, or some other stunning success. Asking those questions will lead to a list of things – some of which are unmanageable, but some are.
2. Prioritize the risks. Risks are not equal in either their probability or their impact. I often use a risk matrix to prioritize risks. We will talk about Risk Matrices in depth at another time. The risks I am looking for at this point are those positive risks that could have a high impact on project success, but have a low probability. It is those risks that we will act on in the next step.
3. Create a Risk Response Plan. For the high impact but low probability positive risks, we consider what we can do to improve the probability. This may mean we go back to our stakeholders and ask for a modification to the Project Charter and change some of the project’s boundaries or constraints. This may mean that we change the resource assignments to take advantage of a one-time availability of a resource. This may mean making a decision earlier or later than normal so that the positive risk path opens up. Consider what needs to happen to increase the probability that the opportunity will be realized.
4. Implement the Risk Response Plan. This should be obvious. But I often hear in Lessons Learned sessions someone talking about an opportunity that was missed and another project team member speaks up and says, “We talked about that, but we never got around to doing anything about it.” Unless the project plan is modified to incorporate the risk response elements, it won’t happen. If the opportunity risk is a contingent risk, then you must create a triggering mechanism to let you when the opportunity exists, or you will be so focused on the existing project plan that you will never see it.
Here are two hints when doing positive risk management.
- Make sure you do your positive, opportunity risk identification early in the project planning process. If you wait until the project is underway, the impact and cost of changing the project to take advantage of the opportunity will be much higher and may out-weigh the benefits. Also, some positive risks may have a very short window of opportunity. If you aren’t looking early in the project, by the time you identify the opportunity, it may already be too late.
- If your project is a phased project, repeat the process of looking for positive risks at the beginning of each phase. Business conditions may change or the results of activities in earlier phases may open up opportunities that didn’t exist at the beginning of the project.