Risk Identification and Comprehensive Risk Planning, Explained

UPI Study › Courses › Project Management › Free lessons › Lesson 3.7 Free with a free account

Risk Identification and Comprehensive Risk Planning

Project Management · Chapter 3: Building a Comprehensive Project PlanSection 3.7 · lesson 21 of 7314 min · free with a free account

← Quality Planning Standards and ImplementationNext lesson: Acceptance Criteria and Procurement Planning Strategies →

Earn 3 college credits for Project ManagementRecommended for credit by NCCRS · Business 230 · self-paced · one payment, lifetime access
Enroll in Project Management · $250 →Download the syllabus (PDF)

In this lesson

Turning vague worries into scored, owned, and planned project risks.

  • Write risk statements that link a current cause, an uncertain event, and an effect on an objective
  • Use brainstorming, Delphi, checklists, SWOT, and assumptions analysis to identify risks
  • Score and rank risks by probability times impact using scales set in the risk management plan
  • Select response strategies for threats and opportunities and rescore residual and secondary risks

Free study notes

Get this lesson's notes by email

The key points and 4 practice questions with answers, in your inbox. One email, free.

One email. Unsubscribe in one click.

Transcript

Everything said in the video, section by section (1,915 words). Read along, or search it.

Opening Question

A Worry About the Windows

Marrowfield's old library is being refurbished, and Dana Reyes is the project manager. Outside the building, Sam Kowalski, the site supervisor, says what's on his mind: I'm worried about the windows. Dana takes it seriously. But a worry names no event and no effect. You can't score it, nobody can own it, and nothing tells you when it's coming true. So how does a worry become a risk the team can rank, assign, and act on before it happens?

Key Terms

Risk, Threat, Opportunity, and Issue

Start with the words. A risk is an uncertain event or condition that, if it occurs, affects at least one project objective: scope, schedule, cost, or quality. A public holiday on the calendar is certain, so it's a planning fact. A storm on that holiday is uncertain, so it can be a risk. A threat is a risk that would harm an objective, like a supplier delivering late. An opportunity would help one, like a supplier offering a bulk discount. Teams that think only about threats leave benefits unclaimed. One process handles both. And an issue is a risk that has occurred. The day a delivery fails to arrive, probability no longer applies. Issues call for action now; risks call for preparation.

Known and Unknown

Why Identification Is Never Finished

A known risk has been identified and assessed: it has a statement, a score and a planned response. An unknown risk is one nobody has identified yet. Those labels are relative to the team. What's unknown to first-timers may be familiar to a team that's done this before. So identification is never finished. The register is a snapshot of what the team knew on one date, and reviews, including phase gates, turn unknowns into knowns. Planning can't remove the unknown. It prepares for it in general, usually through a reserve held for events nobody has named. And a short register isn't evidence of a low-risk project. It's evidence of what the team has thought of.

Risk Management Plan

Roles, Categories, Scales, and Thresholds First

Before anyone lists risks, Dana writes the risk management plan. It lists no individual risks; it sets the rules for listing and judging them. Roles: who identifies, scores and decides. Dana runs the process, and the sponsor decides on risks beyond the team's authority. Categories for sorting, like technical, external, organizational and project management. Scales: a written definition of every level of probability and impact. And thresholds: score levels that force action, like a named owner and trigger for every high-zone risk. Why first? Without agreed scales, two people who both say likely may picture thirty percent and eighty percent.

Identification Techniques

Brainstorming, Delphi, and Checklists

Then the team finds risks. Risk identification uses several techniques, because none finds them all. Brainstorming: the group lists as many risks as it can, holding criticism until the end. It's fast and broad, and the person laying the floor knows risks the designer doesn't. Its limits: senior voices dominate, and groups settle early to avoid disagreement, which is groupthink. Having people write ideas privately first helps. The Delphi technique gathers expert judgment in rounds of anonymous questionnaires. A facilitator summarizes, the experts revise, and views settle. Anonymity weakens seniority, but Delphi is slow, needs engaged experts, and can produce agreement without accuracy. A checklist lists risks from earlier similar projects. It's quick and passes on experience, but holds only what happened before. Use it as a floor, not a ceiling.

More Techniques

SWOT, Assumptions, and Risk Breakdown Structure

Lena Park, the procurement lead, runs a SWOT analysis: strengths and weaknesses inside the team, opportunities and threats from outside. It asks for good news as well as bad. Assumptions analysis reviews the assumptions log. How sure are we? What happens if it's wrong? The log says the loading door fits a pallet truck, but nobody has measured it. A risk breakdown structure groups sources of risk, broad at the top: technical, external, organizational, project management, with suppliers, weather and neighbors under external. Walking down it exposes blind spots, like twenty technical risks and none organizational.

Risk Statement

Cause, Event, and Effect

Now Sam's worry. A risk statement has three linked parts: a cause that exists now, an uncertain event, and its effect on an objective. The common form: because of a cause, an event may occur, resulting in an effect. What's true now? The window maker runs a single production line. What might happen? A production delay. What would it do? Push installation back about three weeks. The cause shows where a response can aim. The event is what a trigger watches for. The effect is what the impact scale measures. Vague forms, like supplier problems, fail four ways. They can't be scored, since they span a typo to bankruptcy. Nobody can own them, or monitor them. And they confuse an effect with a risk. The schedule might slip is an effect a hundred different events could produce.

Quick Check

Which Roof Draft Is Complete

Quick check. Three drafts about the roof. Which one is a complete risk statement, with a cause, an event and an effect? Pause, and decide. The first. The busy crane operator is the cause, a slip in lifting is the event, and two weeks of roofing delay is the effect. The second has no cause, so nothing tells you where to aim a response. The third has a cause, but its event and effect are too vague to score.

Qualitative Analysis

Probability Times Impact on Ordinal Scales

Then comes ranking. Qualitative analysis ranks risks by judged probability and impact, on agreed descriptive scales. Priya Nair, the planning analyst, writes the scales. Probability runs from one, very unlikely, up to ten percent, to five, very likely, over seventy percent. Schedule impact runs from one, under a day of delay, to five, more than twenty working days. These are ordinal scales: the numbers show order, not distance. Four is more than three, but not by a set amount. A risk's score is probability times impact. Four times four is sixteen. Two times two is four. On one-to-five scales, only certain scores are possible, so the plan sets zones: low from one to five, medium from six to twelve, high from fifteen to twenty-five.

Risk Register

Ranking Six Library Risks by Score

The risk register is the working record: for each risk, an ID, the statement, category, probability, impact, score, response, owner, trigger and status. Dana's register holds six. R01, the windows, scores four times four: sixteen. R03, an unmapped drain from forty-year-old drawings, three times five: fifteen. R06, an opportunity, a supplier's bulk offer on reclaimed timber, three times four: twelve. R02, vibration cracking a shared wall, two times five: ten. R04, a failed inspection on an unfamiliar roof method, three times three: nine. R05, late signage, two times two: four. Ranked by score, with ties broken by higher impact: R01 and R03 sit in the high zone, need approved responses, and both come from outside the team's control. R03 is high though only possible, because its impact is severe. R02 has the same impact, but lower probability, so it falls a zone lower.

Threat Responses

Avoid, Mitigate, Transfer, and Accept

A risk response is a planned action to change a risk's probability or impact, or the recorded decision to leave it alone. Threats have four classic strategies. Avoid: change the plan so the threat can't occur. R04 is avoided by using the supplier's standard roof mounting, so an unfamiliar method can't fail. Mitigate: reduce probability, impact, or both. Ordering the windows early lowers R01's probability. Scanning the ground before digging lowers R03's impact. Transfer: shift the financial consequence to a third party, through insurance or a fixed-price contract. It doesn't make R02 less likely, and insurance won't return a lost month. Accept: decide not to act in advance. Passively, for low-zone R05. Actively, with a fallback or a reserve. What separates acceptance from neglect is a recorded decision. The PMBOK Guide also lists escalate, for a threat that belongs to someone above the project's authority.

Opportunity Responses

Exploit, Enhance, Share, and Accept

Opportunities have mirror-image strategies. Exploit: make sure it happens, by removing its uncertainty, for example by committing your best people early. Enhance: raise its probability, or the size of the benefit. Lena enhances R06 by asking the supplier early, and agreeing quantities in advance. Share: give part of the benefit to a partner better placed to capture it. Accept: take the benefit if it comes, without pursuing it. The pairs line up. Avoid and exploit remove uncertainty. Mitigate and enhance change the odds or the size. Transfer and share involve another party. Accept is the same both ways.

Owners and Triggers

One Named Owner and an Observable Sign

Every response needs a risk owner: one named person who monitors the risk and starts its response. Not a team, because a risk everyone owns, nobody answers for. And a trigger: an observable sign that the risk is occurring, or about to. For R01, no written production start date from the window maker by week six. Compare: the supplier seems unreliable. The test is whether two people could disagree about whether it has fired. If so, tighten it. Triggers matter because responses need lead time.

Quick Check

Rain on the Ramp Pour

Quick check. Rain could delay pouring the outdoor ramp. The team moves the pour to the driest month, and books a tent as a backup. Which response strategy is that? Pause, and decide. Mitigate. The dry month lowers the chance of rain, and the tent lowers the impact if it rains anyway. It isn't avoidance, because rain can still fall on pour day. And no third party takes on the cost, so it isn't transfer.

Rescoring

Residual Risk and Secondary Risk

After a response, the risk is rescored. Residual risk is what remains after the response is carried out. Ordering early with a deposit lowers R01's probability from four to two. Impact stays four. Residual score: eight, medium, down from sixteen. A secondary risk is a new risk created by the response itself. Paying a deposit creates the chance that the maker fails and the deposit is lost. It gets its own entry: probability one, impact two, score two, low. One question separates them: without the response, would this risk exist? The residual would, as the original in smaller form. The secondary wouldn't. That's why responses are examined before approval. Here, sixteen becomes eight, plus a new two. A better picture, but only all three scores show it.

Debate

How Far to Trust Matrix Scores

How far can matrix scoring be trusted? For it: early on there's little data, so demanding numbers invites invented precision. A one-hour workshop builds shared words, and shortlists risks for deeper analysis. Against it: ordinal numbers carry order, not distance, so their products have no clear size. Risk X is probability three, impact two. Risk Y is two and three. Both score six. At band midpoints, X is a forty percent chance of a two-day delay: point eight days expected. Y is twenty percent of seven days: one point four. The matrix calls them equal. Whether matrix rankings match quantified ones is empirical. Whether a tool should be judged by convenience or by logic is a question of values.

Back to the Library

The Worry Becomes Risk R01

Back outside the library, with Sam's worry about the windows. It's now R01: because the window maker has one production line, a delay may occur, pushing installation back about three weeks. Score sixteen, high zone. The response is mitigate: order early, pay a deposit. The owner is Lena. The trigger is no written start date by week six. Residual score eight, plus a secondary risk of two, both on the register. The worry has become something the team can rank, assign, and act on.

Key Takeaways

Statements, Scores, Responses, and Owners

To recap. Turn worries into statements with a cause, an event, and an effect. Score probability times impact on scales written before anyone scores. Choose among the responses for threats and for opportunities, and record the decision even when you accept. Give every risk one owner and a checkable trigger, then rescore residual and secondary risks.

About Project Management at UPI Study

Project Management (Business 230) is a self-paced online course of 73 video lessons in 12 chapters, from starting and defining a project to planning, budgets, scheduling tools, proposals, contracts, execution, monitoring, closure, teams and certification. It carries a NCCRS credit recommendation for 3 semester credits.

Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Enroll now → Course details Download the syllabus All Business courses Every course with PRO →

Why take it here

Why students take Project Management with UPI Study

How projects are planned, run and closedProject Management teaches how to deliver work on time and on budget: scope, schedules, the critical path, budgets and earned value, risk, contracts, monitoring and closing a project, and leading the team. It is a common course in business, management and engineering degrees.
Credit at a fraction of the priceThe same 3 credits can cost $750 or more at a US college. Here it is one payment, self-paced, with lifetime access.
Finish your degree soonerTransfer credits reduce the courses you still owe, so you can graduate earlier or lighten a heavy semester.
Strengthen an applicationA completed college-level course on an official transcript shows admissions and scholarship committees you can do the work.
Study on your own scheduleNo start dates, no deadlines. Watch the lessons, practice, and take the final when you are ready.
130,000+students helped with college creditsACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Where the credit goes

Universities that work with NCCRS

Project Management carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Thomas Edison State UniversityThomas Edison State UniversitySigned partnerUniversity of the PeopleUniversity of the PeopleSigned partnerCharter Oak State CollegeCharter Oak State CollegeSigned partnerStrayer UniversityStrayer UniversitySigned partnerColumbia Southern UniversityColumbia Southern UniversitySigned partnerIndiana TechIndiana TechSigned partnerPenn StatePenn StateWorks with NCCRSSouthern New Hampshire UniversitySouthern New Hampshire UniversityWorks with NCCRSSUNYSUNYWorks with NCCRS +many more cooperating universitiesFind my college →

Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.

FAQ

Questions students ask us

About Risk Identification and Comprehensive Risk Planning

How do you write a good risk statement in project management?
A good risk statement links a cause that exists now, an uncertain event, and its effect on a project objective. A common form is: because of a cause, an event may occur, resulting in an effect. For example, because the window maker runs one production line, a production delay may occur, pushing installation back about three weeks. Vague phrases like supplier problems cannot be scored, owned, or monitored.
How is a risk score calculated in a probability and impact matrix?
A risk score is usually the probability rating multiplied by the impact rating, each taken from written scales such as one to five. A risk rated four for probability and four for impact scores 16. Because these scales are ordinal, the numbers show order rather than distance, so the plan groups scores into zones, such as low, medium, and high, that trigger different actions.
What are the risk response strategies for threats and opportunities?
Threats can be avoided, mitigated, transferred, or accepted, and opportunities can be exploited, enhanced, shared, or accepted. Avoid and exploit remove uncertainty, mitigate and enhance change the odds or size of the effect, and transfer and share involve another party. The PMBOK Guide also lists escalate for a risk beyond the project's authority. What separates acceptance from neglect is a recorded decision.
What is the difference between residual risk and secondary risk?
Residual risk is what remains of the original risk after its response is carried out, while secondary risk is a new risk the response itself creates. Ordering windows early with a deposit can cut a delay risk from 16 to 8, which is the residual. The chance of losing the deposit if the maker fails is a secondary risk, because it would not exist without the response.

About the Project Management course

How many college credits is Project Management?
Project Management (Business 230) carries a NCCRS credit recommendation for 3 semester credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
How much does Project Management cost and what is included?
$250, paid once, with lifetime access: all 73 video lessons, a practice quiz after each, the graded work and final exam, and an official transcript when you finish. Students who want several courses choose UPI Study PRO instead.
Which universities accept UPI Study credits?
UPI Study has signed partner agreements with universities such as Thomas Edison State University, University of the People and Charter Oak State College, and works with universities such as Penn State, SNHU and SUNY. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities. Use "Find my college" on this page to check yours.
How long does Project Management take?
It is self-paced with no deadlines. The 73 lessons total about 15 hours of video; most students add reading and practice time and finish in a few weeks to a few months, on their own schedule.
How are the exams done?
Quizzes and assignments are online in the course. The final exam is taken online with proctoring; a person on the UPI Study team checks assignments, usually within two days.
How do my credits reach my college?
When the course shows 100% complete, request the official transcript from your dashboard. It is sent to the college you name, and you can send it to more than one. Check your college first with "Find my college" on this page, or ask Athena.

Ready for the full course? Earn 3 credits in Project Management.

73 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.

Enroll in Project Management →Download the syllabusEvery course with PRO →
Project Management
3 credits · NCCRSEnroll →