Managing Low Priority Project Risks

Managing Low Priority Project Risks
By Gratien Gasaba

Introduction

Risks management is all about the identification and the treatment of risks. The treatment of risks includes qualitative and quantitative analysis, response planning and risk monitoring and controlling. The qualitative analysis of risks is all about “prioritizing risks for further analysis or action by assessing and combining their probability of occurrence and impact” (Project Management Body of Knowledge: PMBOK@Guide fourth edition). The output of this process is the risk register updates. While risks are identified in a jumble, the “perform qualitative risk analysis “categorizes risks into high, moderate and low risks. While the high priority risks move either to the “perform quantitative risks analysis process” or “plan risk response process”, the low priority risks are put on the watchlist for continued monitoring.

In the real world, most of the risks on the watchlist are forgotten, in drawers, as the project manager focuses on high priority risks. This is what the Pareto rule (or the 80/20 principle) advises us. According to this rule, 80 percent of the problems are due to 20 percent of the root causes; or in a positive way, 80 percent of the success is due to only 20 percent of factors, therefore the focus should be on the 20 percent that has 80 percent of impact.

However, in risk management it is advised to always remember that risks are about uncertainty. The uncertainty of risks suggests that what we know about their probability and their impact is limited. In the following sections we will examine what a great project manager should do with low risks on his watchlist.

• Low priority risks are not dead risks: dynamics of the risk register

  Once developed, the risk register should be visited regularly to assess the status of risks. Risks that have been previously evaluated low, may increase in probability of occurrence and impact. For example, during the qualitative risk analysis, a health Project in Norway on the fight against communicable diseases may rate very low, the outbreak of Ebola, because in the history of Norway no Ebola case was found (this is an imagination by the author for illustration). So, the risk of Ebola outbreak is put on watchlist. However, by surprise, a team of Norwegians tourists landing on Oslo Airport from Uganda may learn that they have visited regions where Ebola outbreak is reported. They might at the same time realize that on board of the airplane and at the airport they physically were in contact with several people who have already left the airport. When the Health Project management team becomes aware of this case, then they will need to revisit the risk register and remove the risk of Ebola outbreak from the watchlist and rate it as high priority risk and develop responses.

• Unexpected rise of low priority risk to the higher level will trigger changes

  It is noteworthy to mention that changes in the project are not always immediately accepted by all stakeholders. Some stakeholders will strongly oppose all suggested changes, as they may found their personal interests threatened. When a low priority risk is raised to the top priority level, responses will be developed to deal with it. Given that the plan has been done based on the initial assessment of the risks, low priority risks were put on the watchlist with no response neither resources assigned to them.

  By developing responses to the low priority risks that became of top priority, the project management team may in most of cases revise the budget. The contingency reserve will change to accommodate responses for new top priority risk, hence affecting the cost baseline (i.e. time-phased budget before the management reserve is added). Until now, one may think the change impact is manageable. However, resource limitations such as budget ceiling may lead to the change on the scope and schedule baselines. The situation may become complex and may affect the quality of project deliverables which may be a source of conflict if not handled adequately.

• Monitor all risks: not only the top priority ones

  There is a mistake made by some project management teams that think, only the top priority risks need to be monitored. However, according to the PMBOK Guide, “monitoring and controlling risks involves implementing risk response plan, tracking identified risks (including those on the watchlist), identifying new risks and evaluating risk process effectiveness”. Monitoring risks involves also assessing the validity of assumptions and reassessing the status of identified risks.

  The assessment of assumptions validity and reassessment of identified risks help to find out changes that may come during the project implementation. Indeed, a change in the risk’s position on the priority yardstick will be seen as a trigger to the “perform integrated change control process”. Here, the project integration management comes into the support of the project risk management. Great project manager will soon know that newly identified risks as well as low priority risks that change to high priority risks need to go through the “perform integrated change control” where the change control board reviews the change requests. Responses to low risks that are now ranked high come as change requests to the previous contingency plan, which as stated earlier will impact the cost baseline.

• How to conduct a low risk monitoring and controlling?

  Monitoring low risks uses the same inputs, the same tools, and the same techniques as monitoring high priority risks. What makes a difference for great project managers is their attitude and commitment to the “all inclusive risks reassessment”. Inexperienced project managers tend to limit the risks reassessment on top priority risks.

  When project managers monitor risks they use information in the risk register, the project management plan, and the work performance report. Based on this information they can reassess risks, conduct risks audits, carry out a variance and trends analysis, carry out technical performance measurements, analyze reserves and hold status meetings. For great project manager, risks reassessment is always on the agenda of the status meetings.

  Though communication techniques are not listed by the PMBOK Guide as risk monitoring techniques, the project manager is required to have a clear idea of how to communicate with risks’ owners. Risks’ owners who are responsible of low priority risks tend to overlook the possibility of the raise of the risks’ importance. However, the manager may change this attitude by conducting risk audits during which questions on the risk management are asked. If risk audits are conducted regularly, chances are that low priority risks’ owners become more conscious of the importance of regularly and adequately tracking risks, and hence capture changes as early as possible. Both risks and information are cross-cutting to all project management processes.

• When to conduct a low priority risk monitoring?

  The prime input to the risk monitoring is the risk register. The risk register is the main output of the “identify risks process”. Normally, risks are identified even during the initiation of the project while creating the project charter, but at this stage, only high level risks are identified. At this stage risks are not yet mapped and prioritized, and the risk register is not yet created. Since the project is in the initiation stage, the project manager will not be required to monitor low priority risks because they don’t exist. However, low priority risk monitoring is strongly recommended after the risk register is created and better still during the project implementation.

Conclusion

Low priority risks deserve sufficient attention during the monitoring and controlling process for one reason: a low priority risk may become a top priority risk and if not well managed it may negatively impact the project outcome. Low risks’ owner occupies a central role in the risk monitoring, but since the overall responsibility of risk management comes to the project manager, the latter will need to ensure that low priority risks are not neglected by their owners. Communication skills will help the project manager to influence the risk owner attitude vis-à-vis low priority risk tracking. Great Project managers do not miss the opportunity to carry out risk audits or reassess risks during project review meetings or status meetings. Change of the status of the low priority risks triggers change on other aspects of the projects. These changes are reviewed in the “perform integrated change control process” and approved or rejected by the change control board. The lesson learned here is: “as long as the risk exists, it deserves to be regularly monitored regardless of its level of priority”.

Gratien Gasaba is an experienced project manager with 9 years of experience in project and program management. He has also a consulting experience in business plan development and project evaluation. Mr Gratien Gasaba has a good working experience with both national and international experts in areas of organizational capacity development, governance, health and agriculture.