Project risk, issue and assumption management

project risk management processFor any project it is important for the project manager to capture and manage all of the risk, assumptions, issues and dependencies (known as RAID management) for the project they are running. If they do not then they are not doing their job properly.

At this point it is worth clarifying the difference between an Issue and a Risk (it is surprising how many people do not understand the difference). Very simply a risk is something that may impact the successful delivery of a project, an Issue is something that has impacted a project. A project manager who can successfully manage Risks so as to stop them from becoming Issues is worth their salary.  Managing risks so they do not become issues should result in a higher probability of the project outcome being achieved.

In order to manage RAID’s, the project manager should use a structured approach.  If the organisation has a project methodology, the project management office (PMO) should have guidelines and tools. This will normally take the form of:

  • Template to capture Risk, Assumptions, Issues and Dependencies
  • Guide to what and how RAID’s should be captured

There may also eve be additional tools to cover Risk Mitigation Planning.  This is the predefined approach to how a risk will be dealt with.

The template should include:

  • Unique ID
  • Project Name
  • Sub workstream if applicable
  • Risk, Assumption or Issue Name
  • Description
  • Impact
  • For Risks – probability (1 – 5, High, Medium, Low, etc)
  • For all – impact (1 – 5, High, Medium, Low, etc)
  • Identified by
  • Action owner
  • Mitigation plan
  • Target resolution date
  • Status (Open, Closed)

Others may be added depending on project. However, the above will allow for successful management.

The actual approach to resolving Risks, Assumptions and Issues are slightly different.

Assumption Management

Assumptions are usually captured during the planning phases of the project. They are used where information is required to make an informed decision. For example an IT project may make assumptions about disc storage and work out a price for the number and size of discs based on the assumption.

However, what is important is that there is a plan to prove if an Assumption is true or false. Without this, a project may continue assuming disc usage, go into production only to find disc storage requirements are 10 times bigger than the Assumption so the system is not fit for purpose.

In some cases, it may not be possible to prove an Assumption or it may be prohibitive. In this case this is where Risk management comes into play.

Risk Management

The project manager should aim to capture all Risks that may impact a project at the start of a project. These should be assessed (usually by a group of appropriately skilled people) to gain a view on probability and impact.

The project manager must then make a decision on what Risks to worry about (usually those with High probability and or High impact). For these, the project manager (and / or project team), should capture mitigating actions. This will enable the project manager to recommend to senior management where mitigating action should be taken to insure against the Risk. This needs to be considered carefully as taken mitigating action usually costs more money and the Risk may not happen – a tricky balancing act.

Issue Management

When a Risk does happen, then it becomes an Issue – something that needs to be managed. The Issue should be closed on the Risk register and transferred to the Issue register. It is possible for an Issue appear that was not captured on the Risk register – every project manager’s nightmare “the unknown, unknown”.

A course of action needs to be developed in order to resolve the Issue. If the project manager has completed a Risk Mitigation Plan, this will be the starting point.

For Risks, Issues and Assumptions, this is an ongoing exercise for the project manager, it is not just a point in time exercise. Unfortunately, many project managers create a Risk, Assumption and Issue log and then never look at it again. A good project manager should be ensuring the registers are constantly being updated and then they should review with the project team on a regular basis.

Managing risks, issues and assumptions is a really important activity.  The project manager must make sure the appropriate attention is given to the activity.  Using good tools and templates will help the process and reduce the chance that items will be missed and / or not managed.

RAIDs Presentation