Complex IT Project Management: 16 Steps to Success

5.2 A Word About Risk

Conceptually this is a pretty straightforward process. The steps are to:

• Identify potential risks

• Determine which are significant enough to merit proactive planning

• Complete plans as appropriate

• Gain sign-offs

As you go through this process, keep in mind that you should inspect for three types of risk:

• Project risk. This class of potential calamities directly relates to the project's success. Emerging conditions or events can damage your deliverables, or wreak havoc with the schedule or budget. This class of risk generally includes missed dates or deliverables, plus dependencies that do not pan out for some reason or other.

• Beneficiary risk. Project activity can disrupt your beneficiaries' worlds. Cutting over to a new system may lead to loss of data or productivity. Technologically disruptive projects can generate costs the beneficiary must absorb without compensation, the risk being their reticence to produce the required funds. For instance, I worked a project where the beneficiary was forced to replace 2000 desktop PCs with laptops despite the fact that a few million dollars worth of depreciation remained on the books for these legacy PCs that had been purchased to satisfy Y2K requirements. Although this problem was eventually solved, until a "white knight" donated the necessary funds, a key attribute of target state was severely challenged.

• Corporate risk. Data integrity, security, and antivirus protection should all be on your watch list on behalf of the organization. Most of us can cite issues with the public, governmental agencies, vendors, and labor unions that created real or potential risk in past projects. I worked on a project where the productivity of a new Web site was critical to corporate well-being to the degree that poor performance would cause significant revenue loss. The nature of the business also dictated the highest degree of protection for data flowing in and out of the corporate intranet. From a project perspective, the beneficiary was the external sales force numbering in the thousands; but from a risk perspective, it was the corporation with the most to lose.