Risk Assessment Meeting Guide

Introduction

The Risk assessment meeting is an important part of any project. Projects are launched to take advantage of opportunities and with these opportunities come uncertainty and risk. The project risk management plan addresses the process behind risk management and the risk assessment meeting allows the project team to identify, categorize, prioritize, and mitigate or avoid these risks ahead of time. The team uses this meeting to determine the probability and impact of each risk, determine if the risk can/should be avoided by making changes to the project, plan an appropriate response, and catalog risks and responses in the Risk Register.

The risk assessment meeting should be a formal meeting conducted during the project’s planning process. It is imperative that the project manager sends a meeting invitation and agenda to all attendees well ahead of time. This allows the meeting participants time to review what will be discussed and note any risks they may have already identified. At a minimum, the following should be invited to the risk assessment meeting:

◉ Project Manager: acts as the chairperson and facilitates the meeting
◉ Project Team: the project manager must assign members of the project team the roles of recorder and timekeeper
◉ Key Stakeholders: those identified that may bring value in the identification of project risks and/or mitigation and avoidance strategies
◉ Subject Matter Experts: those identified that may specialize in a certain project activity but are not formally assigned to the project but may add value
◉ Project Sponsor: may participate depending on the size and scope of the project
Although meeting times may vary, 2 to 3 hours is a good estimate depending on the project size.

Risk Identification

Before the risk assessment meeting the project manager will have compiled a list of risks from previous projects. These will be reviewed at the beginning of the meeting as a way to not only identify some common risks but also as a catalyst to get the participants thinking about risks.

While there are many methods for identifying risks, the Crawford Slip method is very common and effective. For the Crawford Slip method, each participant is handed a set of sticky pads on which to write their risks. The project manager gives the participants 10 minutes to write as many risks as they can on the sticky pads. Once the timekeeper indicates that 10 minutes have expired the project manager directs the participants to stop.

Each risk should be stated in a complete sentence which states the cause of the risk, the risk, and the affect that the risk has on the project (key words such as: “due to” or “because”). For example:

Name:
Cause: Because the implementation team is unfamiliar with the organizations' project management methodologies
Risk: time to implement organizations processes in the Project Management System may take longer than planned
Affect: causing delay to the schedule.

Categorize and Group Duplicates (Affinity Diagram)

Categorization makes it easy to identify duplicate risks and acts as to trigger for determining additional risks. After the 10 minute risk identification exercise the project manager will facilitate the team in the categorization of each risk. One effective method for this is to post the sticky notes on a large section of the wall where the meeting chair has posted categories onto sticky papers. The participants then put their risks on the wall beneath the appropriate category. As they identify duplicate risks they stick the duplicates on top of the other.

The project manager then discusses the risks identified under each category with the participants. As new risks are identified the meeting recorder writes them onto additional sticky papers. Once complete the category it falls under will be noted for each risk.

Qualify Risks (Assign Probability and Impact to Each Risk)

On a large section of wall space, the project manager will create an area to chart the risks according to probability and impact. Using sticky papers numbered from one to ten, the project manager will create a vertical axis for probability and a horizontal axis for impact.

The participants will post the risks onto the wall in an approximate location where the likely probability and impact for that risk intersect (subjective based on the person posting the risk). Once all the risks are posted the team as a group will review the location of the risks on the chart and make any final adjustments. Once the location for all the risks is determined the recorder will write the probability for each risk in the upper left corner of the sticky paper and the impact in the upper right corner. The risks which are located in the high probability and high impact area (upper right-most section of the chart) will be separated from the other risks for closer examination and planning. Only these risks with a high risk score will require additional work.

Determine Risk Response

For the risks which have been identified with a high risk score, the participants will determine the triggers or causes and identify responses. Responses may include: adding the risk to the project plan and scheduling for it; adding funding to the project (as a risk reserve) to mitigate any potential increase in costs, adding resources to the project (as reserve) to mitigate any potential shortage in assigned resources; developing a course of action for avoiding the risk; or accepting the risk.

After the Meeting

After the meeting the Project Manager will enter all the risks, probability-impact scores, and responses into the risk register (note that only the high risk score risks have responses). The high scoring risks will be added to the Project Management Plan. The Risk Register will also be included as an appendix to the Project Management Plan. Additionally, the risks with a high score will be added to the project schedule as a method to track the risk at the correct time. Although these risks are added to the schedule, the schedule itself is not necessarily changed. This step is to provide awareness and visibility to the participants of all high scoring risks throughout the project’s lifecycle.