The processes are:

1. Plan risk management
2. Identify risks
3. Perform qualitative risk analysis
4. Perform quantitative risk analysis
5. Plan risk responses
6. Monitor and control risks

In this paper, I am concentrating on the second process, identifying risk. I will start this discussion with a project many people are familiar with: buying a home ...

Several years ago, I moved to a new area and was trying to decide whether or not to purchase a home, and if so, where. I also considered if I should buy a preexisting home or hire a builder for a new home. Of course, since I am technical and a project manager, I was very systematic in my research and analysis.

I spoke with different realtors, my coworkers, and my family and scoured the newspaper and Internet searching for open houses. Every option had its own set of potential risks. If I continued to rent, was this really just throwing away money, even though I did find it convenient not to have to mow the lawn or shovel snow. If I purchased a house, could I afford it and was I buying the best house for me and my family?

I approached it like any other project―interviewing people, note collecting, collating, and interpreting the data. After reviewing my expenses and income and examining the tax advantages, I determined that purchasing a house would be a moderate financial risk for me. I narrowed down my search to specific neighborhoods near work that appealed to me and my family then made a spreadsheet to enter data. The main points are illustrated below:

From my research and analysis, I found and purchased my dream home. I reduced risks by first identifying them. All of the items in the spreadsheet held a certain degree of risk: Can I afford this house? Is it convenient to me for work or other necessities?I had to reduce future risk by considering resale value in my equation, so I had to take into account location and features that future potential buyers might find attractive.

Risk Matrix

Okay, so h ow does this story translate to risk management in my projects? It begins the same, with identifying risk and compiling information. Write down information as you proceed with the risk identification process because the output of all of this information will be a risk identification matrix. The matrix is a dynamic document, always evolving because you will be constantly reviewing and making modifications. During the risk identification process, you need not complete the matrix other than the Risk Identification field. The Project Impact, Action, Responsible Party, etc. fields come into play at a later date.

Risk generally falls into three categories: technical elements, project management, or business and external forces. Technological risks are the most crucial because they are the ones that measure project performance. Project managers have to ask if the project can deliver the customer’s goals, objectives and if they can meet the specifications.

Project-management risk deals with the amount of experience of the project managers, project team and how well the project is run, controlled and finalized. Questions to be asked are if the project has enough resources to do the job well, such as personnel and estimates. I have seen projects that were challenged from the very beginning because the project was underestimated in resources, estimates and material needed to complete the project on time.