Developing an effective Risk Management Plan can prevent small problems from growing big. Different types of Risk Management Plans can deal with calculating the likelihood of an event, its impact on you, what risks are speculative, and how to mitigate the problems associated with those risks. Planning will help you cope with and prevent difficult situations that have or will arise.
Step
Step 1. Understand how Risk Management works
Risk is the effect (positive or negative) due to an event or series of events occurring in one or several locations. Risk is calculated based on the probability of the event becoming a problem and the resulting impact (Risk = Contingency X Impact). Various factors must be identified to analyze risk, including:
-
Occurrence: What could happen?
Develop a Risk Management Plan Step 1Bullet1 -
Probability: How likely is it that the event will occur?
Develop a Risk Management Plan Step 1Bullet2 - Impact: How severe will the impact be if it occurs?
- Mitigation: How (and by how much) you can reduce the likelihood.
- Contingency: How (and by how much) can you reduce Impact?
- Reduction = Mitigation X Contingency
- Exposure = Risk – Reduction
- Once you identify the above variables, the result is Exposure. This is the amount of risk that cannot be avoided. Exposure may also be called Threat, Liability, or Severity, but they all refer to the same thing. The exposure will be used to help determine whether the planned activities need to be carried out.
- This is often a cost vs benefit formula. You might use these elements to determine whether the risk of implementing a change is higher or lower than the risk of not implementing the change.
- Assumed Risk. If you decide to continue (sometimes, you don't have a choice, for example government regulations) then your Exposure becomes an Assumed Risk. In some environments, the Assumed Risk is translated into rupiah values which are then used to calculate the profitability of the final product.
Step 2. Define your project
In this article, let's consider yourself in charge of a computer system that provides important (but not critical) information to some large population. The main computer that houses this system is old and needs to be replaced. Your task is to develop a Risk Management Plan for this move. This plan will be displayed in a simplified model where Risk and Impact will be categorized as High, Medium, or Low (this method is very common in Project Management).
Step 3. Get input from others
Brainstorm risks. Gather a few people who are very familiar with the project and ask for input on what will happen, how to prevent it, and what needs to be done if it does happen. Take a lot of notes! You will use the output of this important session several times during the following steps. Be open to the ideas given. “Out of the box” thinking is fine, but keep control of your session to keep it focused on the target.
Step 4. Identify the consequences of each risk
From your brainstorming session, various information about what happens if the risk becomes a reality has been collected. Associate each risk with the consequences alluded to during the session as specifically as possible. “Project postponement” should be broken down to e.g. “Project will be delayed in 13 days.” If there is a rupiah value, simply mentioning “Over budget” would be too general.
Step 5. Eliminate irrelevant issues
For example, if you move a car dealership's computer system then nuclear war, plague, or killer asteroids won't interfere with your project. there is nothing you can do to plan for or reduce the impact. However, keep in mind that you do not include these events in your risk planning.
Step 6. List all identified risk elements
You don't need to arrange them in order. Just register them one by one.
Step 7. Include the probabilities
For each risk element on your list, determine whether the likelihood of those risks actually occurring is High, Medium, or Low enough? If you must use numbers, the Likelihood for Low scale is 0.01-0, 33, Medium = 0.34-0, 66, and High = 0.67 – 1.00.
-
It should be noted, if the probability of the event becoming real is zero, it means that the risk is no longer considered. There's no point in considering what won't happen (an angry T-Rex eats his computer).
Step 8. Define impact
In general, Impact is designated as High, Medium, or Low based on defined guidelines. If you have to use numbers, it means Impact scales from 0.01 to 1.00, i.e. 0.01 to 0.33 = Low, 0.34 – 0.66 = Medium, 0.67 – 1.00 = High.
-
Note: if the impact of an event is zero, the risk does not need to be registered. There's no reason to consider irrelevant things, whatever the odds (my dog ate dinner).
Step 9. Determine the element's risk
Tables are often used for this. If you're using High, Medium, and Low values, we recommend using the top table. If you're using numeric values, you'll need to consider a slightly more complicated scoring system similar to the second table here. It's important to note that there is no universal formula for combining Likelihood with Impact, and the formula varies depending on the person and the project. The formula in this article is just an example (although it is adapted from a true story):
-
Be flexible in analysis.
Sometimes, you need to go back and forth between the T-S-R method and the numerical method. You can use a table similar to the table below.
Step 10. Sort all risks
List all elements that have been identified from highest to lowest risk.
Step 11. Calculate the total risk
Here the numbers will help you. in Table 6, you have 7 risks with values T, T, S, S, S, R, and R. These values can be changed to 0, 8, 0, 8, 0, 5, 0, 5, 0, 5, 0, 2 and 0, 2, from table 5. The average total risk is 0.5 or Moderate.
Step 12. Develop a mitigation strategy
Mitigation is designed to reduce the likelihood that a risk will become apparent. Usually, you will only need to do this for High and Medium elements. You may reduce the Low element, but put the others first. For example, if an element of risk could delay the delivery of critical parts, you can reduce the risk by ordering them early in the project.
Step 13. Develop a backup plan
Contingencies are usually designed to reduce impact if the risk does not become apparent. Again, usually you will only develop contingencies for High and Medium elements. For example, if an important part you need doesn't arrive on time, you may be forced to use the old parts that are available while waiting for new parts.
Step 14. Strategy effectiveness analysis
How much reduced Probability and Impact? Evaluate your Contingency and Mitigation strategy and reassign Effective Assessment to your risks.
Step 15. Calculate your effective risk
Now, your seven risks are S, S, S, R, R, R, and R, which translates to 0, 5, 0, 5, 0, 5, 0, 2, 0, 2, 0, 2 and 0, 2. Thus, you get an average risk of 0.329. See Table 5 and we find that the overall risk is categorized as Low. Initially your Risk is Moderate (0, 5). After implementation of the management strategy, your Exposure is Low (0.329). This means that you achieve a 34.2% risk reduction through Mitigation and Contingency. Safe!
Step 16. Monitor your risk
Once you know the magnitude of the risk, you need to determine how to know if the risk is real so that you will know when and if you need to create a backup plan. This is done by identifying Risk Signs. Do it at High and Medium elemental risk. Then, as the project progresses, you will be able to determine whether the risk element has become a problem. If you don't know the signs, there's a good chance the risk could become real without anyone noticing and affect the project, even if you have a good backup plan in place.
Tips
- In situations where the Project Manager has too many Risk Management functions, the analysis can be limited to the critical path of the project. In such cases, it is advisable to calculate multiple critical paths with, perhaps, additional lag time to more proactively identify tasks that are likely to be on the critical path. This is particularly appropriate when one Project Manager controls multiple projects, but does not overshadow other planning and control functions (see Warnings).
- Reduction = Risk – Exposure. In this example (and assuming a $1000000 project) Your Risk is 0.5 X $1000000 (500000000 IDR) and your Exposure is 0.329 X 1,000,000,000 IDR (329.000.000 IDR) which is it means the reduction value = IDR 171,000,000. use it as an indication of the amount of reasonable expenditure to manage risk, which should be part of the revised project estimate (such as insurance).
- Plan changes. Risk Management is an uncertain process because risk is always changing. Today, you can assign multiple risks with high likelihood and impact. The next day, the likelihood or impact may change. In addition, some risks may disappear completely while others emerge.
- You can use Exposure to help determine project viability. If the total estimated project is $1000000 and your Exposure is 0.329, the general rule is that the project has the potential to exceed the estimate by $329,000. Can you budget for some extra cash, just in case? Otherwise, maybe reconsider the scope of your project.
- Use working papers to monitor risk planning on an ongoing basis. Risks are always changing, old risks may be lost and new risks come into focus.
- Early warning signals are part of good backup planning. if any test results indicate that a backup plan is necessary, be sure to speed up the test results. If there are no good warning signals, try creating your own.
- Always do an investigation. What have you missed? What could happen that you haven't considered? This is one of the hardest and most important things to do. Make a list and check repeatedly.
- If you are a project manager with minimal experience, or a small project, consider saving time by skipping steps that don't work or have little impact on the project, skip the formal Probability and Impact assessment, do a “mental calculation” and jump right in and look at the project. Exposure. For example, if you need to perform electrical circuit maintenance and this activity will “turn off” the server, the risk of moving the server to a new circuit is greater than waiting for the maintenance to complete to reactivate the server. In both instances, the server will shut down, but you can specify which action is less risky for the project.
Warning
- Do not let politics interfere with your judgment. this happens often. People don't want to believe that what they have control over can be problematic and will argue against your level of risk. Maybe, indeed the risk may not happen, but there is a possibility that the person is following his own ego.
- Don't completely ignore the low-risk elements, but don't waste time on them either. The High, Medium, and Low measures indicate how much effort will be devoted to monitoring each risk.
- Consider what can happen if two or three problems occur together. The probability is very low, but the impact will be huge. Almost all major disasters involve various errors.
- Don't overcomplicate the project. Risk Management is an important part of the project. However, don't let the actual work of your project be hampered. If you're not careful, you may end up chasing irrelevant risks and overloading your plans with useless information.
- Do not assume that all risks have been identified. The nature of risk is unpredictable.
