How to Cheat at IT Project Management

10.5. Managing Project Risk

Once you have a risk management process in place, you need to actively monitor the project for those risks. However, the risks you identified and planned for are not the only risks your project will encounter. We discussed the risk and cost of changes in later stages of the project plan and even if those risks and contingency plans were assessed and "planned" for, they may still have secondary effects you were not aware of. This cycle of project risk is shown in Figure 10.5 You can see that even if the risk is identified and "Plan B" is implemented, you may still be creating secondary risks. Sometimes those risks are minor, sometimes they're major but you've accounted for them, and sometimes they're major and completely unexpected.

Risk monitoring and control occur in this phase of the project lifecycle. The methods of managing risk include:

• Having and using a risk management plan

• Communicating project risks

• Actively monitoring for new risks

• Assessing impact of scope change

As you move from one phase to the next or one set of deliverables to another, you should review your risk management plan and be aware of the risks your team identified. If a risk was anticipated, it should not come as a surprise simply because you (or your team) forgot to review your risk management plan. It's sometimes helpful to add milestones to your project schedule either to indicate places where risk has been identified, trigger points for identified risks, or simply as a reminder to review your risk management plan periodically. You should also periodically discuss and review project risk in your project team meetings, especially risks to your critical path tasks. This discussion can include risks that are pending, coming up, or just discovered. It can also be used to discuss the potential secondary risks discovered as a result of one or more changes to the project. Another risk management tool is the Earned Value Analysis, which we discuss at length in Chapter 11. This can help assess project progress and identify overall project risk. One final tool for managing project risk is the monitoring or measuring of performance against specification. If the project team does not have the skills and talents necessary to accomplish the project work, your project is at risk. This may not have been an identified risk during your project risk evaluation process, so it might crop up only as work gets underway.

What can you do to manage risk? We've previously discussed developing contingency plans for project risks that have the highest likelihood of occurring and the highest impact to the project. We can manage risk through:

• Workarounds Workarounds are ad hoc responses to risks that were not planned. Workarounds should be assessed to determine whether secondary risks exist and if those risks are acceptable.

• Corrective actions Corrective actions are actions you take to keep your project on track. Often corrective actions are minor tweaks you make as part of your day-to-day IT project management. Any type of corrective action typically carries secondary risk, which should be identified and assessed.

• Change requests Changes to the project work or project plan due to risk should be brought through the standard change management process. These changes should be reflected in the project plan and accounted for in the scope, schedule, budget, requirements, or quality metrics of the plan.

• Risk response plans/updates As identified risks occur and contingency plans are implemented, these changes should be documented and reflected in the updated project plan. Sometimes during the course of project work, the risks or risk priorities shift. If this occurs, the risk management plan should also be updated to reflect new risks or new priorities for those risks.

Remember, when assessing changes and risks, it's important to keep your critical path tasks in mind. Risks and changes to tasks on the critical path require careful review of potential ramifications. Risks and changes to tasks that are not on the critical path also require careful assessment, but by definition, changes to these tasks will be less dramatic, at least to the project schedule, than tasks on the critical path. Finally, keep in mind that changes to tasks can place them on the critical path, so evaluate change before implementing them to keep your project on an even keel.