Inherent risks are those that exist based on the general characteristics of the project. These are risks that can appear regardless of the specific nature of the project.
None of the inherent risks mean that the project is in trouble. Many of these risk factors will be rated as low or medium-level risks. Even if you identify an inherent risk as high, other project factors will come into play as well. For instance, the checklist below states that a large project is inherently more risky that a smaller project. This is generally true. However, an experienced project manager can mitigate many risks associated with large project size. Also remember, if your project falls into a high-risk category, it does not mean you will not be successful. It only means that you should put plans into place to manage the risks.
This table below identifies characteristics that may imply risk, as well as criteria for knowing if it is high-risk and low-risk. Depending on where your project characteristics fall, you can evaluate whether your risk is high, medium or low. This type of checklist can be especially valuable if your organization customizes the risk characteristics and risk criteria and makes them available to all project managers. For instance, you may find in your organization a project of less than 5,000 hours is considered low risk, while one that is 20,000 hours or more is high risk.
If your projects have an end-of project review meeting, the teams can look back and document the risks the project faced, the risk response plan the team executed and the results. The results can be consolidated and summarized in a Risk Factors Checklist that is based on the key learnings and best practices of your own organization.
In the table below, medium-level risks would fall somewhere in the middle of the high and low risk. For instance if your team size is 15, it would be a medium-level risk. Likewise you could have a medium risk if your project scope / deliverables are better than “poorly-defined” and worse than “well-defined”. This could be the case if some deliverables were poorly-defined and some were well-defined.
The following checklist can be used to determine whether there are inherent risks on your project that you have not considered yet.
| Characteristic | High Risk | Low Risk |
| Total effort hours | Large project > 2500 hours | Small project < 250 hours |
| Duration | Longer than 12 months | Less than 3 months |
| Team size | Over 25 members | Fewer than 5 |
| Number of clients or client organizations | More than three | One |
| Project scope / deliverables | Poorly-defined | Well-defined |
| Business benefit | Not clear (should not start the project) | Well-defined |
| Project team and client business knowledge | Neither the project team nor the client have solid business knowledge | Both the project team and the client have solid business knowledge |
| Requirements | Very complex, hard for client to define | Easy for client to define |
| Dependency on other projects or outside teams | Dependent on three or more outside projects or teams | No more than one dependency on an outside project or team |
| Project sponsorship | Unknown (should not start the project) | Identified and enthusiastic |
| Client commitment | Unknown, passive | Passionate |
| Changes required to existing procedures, processes and policies | Large amount of change | Little change |
| Organization structures | Large amount of change | Little or no change |
| Project manager experience | Little experience on similar projects | Similar experience on multiple projects |
| Physical location of team | Team is dispersed at several sites | Team is located together |
| Use of formal methodology | No formal methods or processes | Standard methods in use |
| Technology | New technology is being used for critical components | No new technology required |
| Response time | Very short response times are critical | Normal response time is acceptable |
| Data quality | Data is of poor quality | Data is of good quality |
| Vendor partnership | Have not worked with the vendor before | Have a good relationship with the vendor |
This table is an example of the types of inherent risks that can exist on projects. There are others as well that form the starting point for identifying risks on your project.
Tenstep