Risk is usually associated with potential events that have a negative impact on the project. However, there is also a concept of opportunity risk or positive risk. In these instances, the project manager or project team may introduce risk to try to gain much more value later. For instance, a team may decide to utilize a new technology on its project because they think it will result in dramatic effort and cost savings. Of course, there is also a chance the new technology will not work. However, the team introduces the risk because the potential for gain. This is an example of intelligent risk taking or positive risk.
(Note: the TenStep Project Management Process assumes that the risks you are managing are negative risks. These risks need to be addressed so that the underlying potential problem does not occur.)
Make Sure Your Risks Must Have Some Level of Uncertainty
If an event is identified as a risk, there has to be some level of uncertainty involved. In other words, if an event has a zero percent likelihood of occurring, it would not make sense to identify it as a risk. It is not even a low risk. It is not a risk at all. On the other hand, if an event is 100% certain to occur, it is also not a risk. It is not even a high risk. It is a fact. (Sometimes these 100% “risk” events are also called constraints. A constraint is an event or limitation that impacts your project and must be planned around. For instance, you may not be able to get a resource you need until 30 days after the project starts. This is a constraint, not a risk. This constraint may cause a scheduling risk, but the constraint itself is not a risk.)
A risk has some probability between 0% and 100% chance of occurring. If an event has a zero percent chance of occurring, it should be ignored. If it has a 100% chance of occurring, it is a fact (and perhaps a constraint). When you are managing risks, be sure to focus on the risks and not on facts and non-events.
Distinguish Between Risks, Causes and Effects
There is a cause for every risk and an effect if the risk occurs. When the project risks are identified, make sure that the risk itself is noted and not the cause or effect of the risk. The cause is a situation that exists that sets up a potential risk. In general, the cause is a fact or a certainty for the project. On the other hand, the effect is the likely outcome if the risk occurs.
Look at the following example. Let’s say that a project solution needs to be implemented in all of a company’s worldwide locations, including those in developing countries. If the telecommunications lines are not upgraded on time where necessary, the solution will not be viable in those locations.
In the previous example, what is the risk?
Is it a risk that you have to implement the solution in developing countries? No, that is the cause. It is a fact or a requirement.
Is it a risk that the solution will not be available in certain countries? No, that is the potential effect of what might occur in this scenario.
Is it a risk that the necessary telecommunications upgrades are not performed on time? Yes, this is where the uncertainty lies.