Project Risk Management

We often execute the risk identification process many times within an iteration's life cycle or project life cycle. I prefer to execute it at regular intervals, during the monitoring and control phase, down till the closure phase. Many would do it even during the planning phase.

Planning is a optimistic exercise, Risk Management is pessimistic. When planning, we are optimistic about what should get done, by whom, in what sequence and when it should get done. After its planned, if we run through the plan with a pessimistic mind asking many 'what if' questions, particularly with those tasks for which we are not completely confident, I think many risks will be unearthed.

That means, even before the plan is put to execution, we should execute the same in our mind -pessimistically.

Another activity which can generate value is in the way the mitigation for the risks are managed.  Mitigations are action items. These action items (i.e., the risk mitigation), most could be within the direct authority and control of the Project Manager. Those which are not should be highlighted in the reviews as items for management attention and their ownership should be assigned and tracked.

To summarize ...

1. Execute the Plan even before executing it
2. Execute Risk Management processes (identification, prioritization, mitigation etc.) periodically
3. Maintain a centralized Action Items log and add the mitigation to this log
4. Highlight risk mitigation items that need management attention during Project Reviews
5. Assign ownership to each Action Item and track them to closure