Fillable Printable Risk Assessment Worksheet and Management Plan

Risk Assessment Worksheet and Management Plan

Page 1 of 12

Customer/Project Name:

The Basics

There are four steps to assessing and managing risks, and effective risk management requires all four of them.

Identify the risks

Qualify the risks

Assess each risk for impact to the project if it does occur

Assess the likelihood of the risk occurrence

Plan for risks by creating a watchlist of risk triggers and how to handle the risk if it does occur

Monitor and manage risks

To adequately analyze risk, you'll need a detailed plan. So, the best time to perform an initial risk analysis is just prior to

starting the project. Don't make the mistake of thinking that risk analysis is a one-time task. You'll want to reevaluate the

risk management plan and your risk analysis from time to time throughout the project and whenever major deviations from

the plan occur.

Identify Risks

There are numerous ways to identify risks. If you have a limited amount of time, the best ways to identify risks are to:

•

Review the following project risk assessment

•

Review the project schedule task list looking for:

•

Tasks for which your team has no expertise. The duration and cost estimates for these tasks are more likely to

be inaccurate.

•

Duration and cost estimates that are aggressive. Ask the estimators how confident they are in their estimates,

especially for critical path tasks.

•

Situations where you have a limited number of resources that can do particular tasks and where those

resources are fully allocated, over allocated, or may become unavailable. A resource can become unavailable

when it leaves your organization or because of other commitments within the organization.

•

Tasks with several predecessors. The more dependencies a task has, the greater the likelihood of a delay.

•

Tasks with long durations or a lot of resources. The estimates for these larger tasks are more likely to be

inaccurate

•

Brainstorm and talk with the experts

•

All of your project risks may not be apparent from analyzing the project schedule. It's worth your time to call

a brainstorming meeting with key project resources and ask where they see the most risk to the project. You

may be surprised at what you uncover.

•

If you have some experienced project managers available, have them review your schedule. Also, talk with

people who have expertise in particular areas of the project. For example, if you're planning to use an outside

contractor, talk to people who have used that contractor or other contractors.

Qualify Risks

As you go through the following risk analysis, you will be asked to qualify the risk probability and impact in terms of Low,

Medium, and High. Qualifying risks is a discipline unto itself and the accuracy of your results is commensurate with the

techniques you use and your historical experience with risk analysis.

Before you begin any qualification analysis, you will want to determine your organization’s tolerance to risk. Can the

organization operate in a high-risk environment or are they conservative and want only low-risk projects? If you work for

a small company, an additional project cost of $250,000 or a delay of two 2 months may put your entire company at risk. If

you work for a large organization, these overruns may be acceptable for a project. How much cost and delay is acceptable?

Remember that this isn't your preference; it's just the bottom-line numbers you can tolerate. Determine and write down the

company’s risk tolerance.

Next, you will want to qualify each risk item by asking:

•

What is the impact to the project if the risk item occurs (Low, Medium, High)?

•

What is the probability or likelihood of the risk item occurring (Low, Medium, High)?

Review archived projects to see if similar tasks from the past have taken longer than your estimates or

Risk Assessment Worksheet and Management Plan

Page 2 of 12

have cost more.

Find out your team's confidence level. If the resources that will do the work aren't comfortable with your

cost or duration estimates, then the risk is more likely to occur.

Once the impact and probability has been determined, you will want to prioritize which risks are going to be actively

managed focusing on the following order in priority (you might want to modify this priority table according to your

organization’s sensitivities):

IMPACT

High Medium Low

High 1 1 2

Medium 2 3 4

Low 4 5 6

Managing Risks

Once you've identified and qualified the risks, you need to plan to manage them. Because risk planning can take a lot of

time and energy, you may want to plan for only the high-priority risks (priority 1) or the medium to high-priority risks

(priorities 1 to 3). Planning entails:

•

Identifying triggers for each risk

•

Identifying the plan for each risk

Identify Triggers

Triggers are indicators that a risk has occurred or is about to occur. The best triggers tell you well in advance that a

problem will occur.

To identify triggers, talk with the people who are most likely to cause the risk to occur and those who are most likely

to feel its impact. Ask them how they would know that the problem is occurring. Start with how they would know

that the problem has already occurred, and then work backward to determine how they would know before the

problem actually occurred. As the project manager, consider how the risk would be reflected in the project schedule.

Would the project schedule show overtime for a specific resource on earlier tasks? Would the project schedule show

delays in specific tasks?

For each risk you're addressing, create a watchlist that shows the possible triggers, when they are likely to occur, and

who should watch for the trigger.

Identify Plans

Once you've identified triggers and created your watchlist, you need to create action plans to manage your risks. You

can choose to manage risks in one of four basic ways:

•

Avoidance – You can change the project plan and project schedule to eliminate the risk or to protect the project

objectives from its impact. More in-depth planning or requirements gathering may be one way to avoid a risk

later in a project. Reducing scope to avoid high-risk activities, adding resources, or adding time may be other

ways to avoid risk. For example, if you're dependent on a single resource with specific expertise, consider training

another resource in that expertise.

•

Transference – Risk transference is seeking to shift the consequence of a risk to a third party together with the

ownership of the response. It does not eliminate the risk. You can buy insurance to cover the cost of a risk item

occurring. Another transference technique is to enter into a fixed price contract, which transfers the risk to the

Risk Assessment Worksheet and Management Plan

Page 3 of 12

performing party.

•

Mitigation – Mitigation seeks to reduce the probably and/or consequences of an adverse risk event to an

acceptable threshold by taking actions ahead of time, thereby decreasing the likelihood of the problem occurring.

Many times, it is much more effective to reduce the probability of a risk even occurring than trying to repair the

consequences after it has occurred. For example, if you're dependent on an outside vendor making its delivery

dates, your contract with the vendor might include penalties for late delivery, in order to offset your potential

losses. Risks that seem large enough to threaten the project should lead to an “early prototype or pilot” effort

being before full implementation.

•

Acceptance – The final technique of dealing with risk is to respond to the risk item with a contingency plan should

the problem occur. For example, if a task is at risk of being delayed, your plan may be to add additional resources

to the task. Your contingency plan should include any work that must be done ahead of time to make the

contingency successful. For example, you'll want to make sure that the additional resources are available in case

you need them.

Keep in mind that risk management plans can have unexpected ramifications. The prudent project manager might want to

model each plan in their project-scheduling tool to see the plan's impact on the project. Look for new risks that occur as a

result of the project schedule and address them.

Monitor and Manage Risks

Your risk management plan is in place. Now your job is to make sure you and others on the project team act on it. Take any

actions necessary according to the risk response you have chosen. Monitor your watchlist to see if triggers are occurring,

and implement contingency plans as needed. Be sure to reassess your risks regularly. You might find the following ideas

useful for monitoring your risks:

•

Move your High Risk items into your Issues Matrix to be visited during each project status meeting

•

Include a Risks section in status reports and request that resources identify any assumptions they are making, as

well as any new risks they see

•

Set up regular meetings with team members to reevaluate the risk management plan and to identify new risks to

the project

•

Each time your project's actual progress varies significantly from the project schedule, reassess the risks and

reevaluate your risk management plan

With a little preplanning and thought, you can significantly decrease the risks to your project.

Risk Analysis Plan

Proceed through the following list and assess each item for risk using previous experience with similar products, expert

opinions on relevant technologies, and brainstorming with a cross-functional group and assess the severity of the risk for

each item.

Risk Factor Impact Description

Impact

Qualification

(L, M, H)

Probability

Qualification

(L, M, H)

Priority

(See

table)

A) Budget

1) Estimated total budget

for project

L) Less than $100,000

M) $100,001 to $700,000

H) More than $700,000

2) What is the level of

confidence in the accuracy

of the budget estimate

L) High

M) Medium

H) Low

3) What is the possibility of

budget overrun?

L) Not likely

M) Moderately possible

H) Highly probable

Risk Assessment Worksheet and Management Plan

Page 4 of 12

Risk Factor Impact Description

Impact

Qualification

(L, M, H)

Probability

Qualification

(L, M, H)

Priority

(See

table)

B) Duration

1) What is the estimated

elapsed time to complete

the project?

L) Less than 2 months

M) 2 months to 6 months

H) More than 6 months

2) What is the level of

confidence in the accuracy

of the project schedule

estimate?

L) High

M) Medium

H) Low

3) What is the degree of

flexibility in the schedule

and completion date?

L) High flexibility

M) Moderate flexibility

H) Limited or no flexibility

4) What is the life

expectancy for the

solution?

L) Less than 2 years

M) 2 to 5 years

H) More than 5 years

Risk Factor Impact Description

Impact

Qualification

(L, M, H)

Probability

Qualification

(L, M, H)

Priority

(See

table)

C) Project Team Staffing

1) What is the expected

maximum size of the

project team?

L) 4 or less

M) 5 to 10 members

H) Over 10 members

2) Is the project staffing

level (or expected level)

adequate for the project?

L) Adequate level of staffing

M) Slightly understaffed, anticipate minor impact on

project schedule

H) Severely understaffed, will lengthen project schedule

3) What percentage of the

project team can be staffed

from existing personnel?

L) 80-100%

M) 50-79%

H) 0-49%

4) Due to specialized skill

requirements, budget

constraints, etc.; how

difficult will it be to obtain

additional permanent staff

or contractors?

L) Not difficult

M) Somewhat difficult

H) Very difficult

5) Project Manager

availability: full versus

part time

L) Full time basis

M) Full time w/ minor responsibilities elsewhere

H) Equally involved on 1 or more other projects

6) Shared work experience

of team

L) All have worked together before

M) Some have worked together before

H) None have worked together before

7) Number of times team

has implemented this

solution

L) More than once

M) Once

H) None

8) Physical location of

project team

L) Single location (building)

M) Most of team in single location

H) Most of team in multiple sites

9) Contract Help

L) No contract help needed for solution

M) The Company is prime with 1 subcontractor

H) The Company is prime with multiple subcontractors

Risk Assessment Worksheet and Management Plan

Page 5 of 12

Risk Factor Impact Description

Impact

Qualification

(L, M, H)

Probability

Qualification

(L, M, H)

Priority

(See

table)

D) Client-User Staffing

1) What is the expected

maximum size of the client

project team?

L) 4 or less

M) 5 to 10 members

H) Over 10 members

2) Is the client-user staffing

level (or expected level)

adequate for the project?

L) Adequate level of staffing

M) Slightly understaffed, anticipate minor impact on

project schedule

H) Severely understaffed, will lengthen project schedule

3) What percentage of the

client-user team can be

staffed from existing

personnel?

L) 80-100%

M) 50-79%

H) 0-49%

4) Due to specialized skill

requirements, budget

constraints, etc., how

difficult will it be to obtain

additional permanent staff

or contractors?

L) Not difficult

M) Somewhat difficult

H) Very difficult

Risk Factor Impact Description

Impact

Qualification

(L, M, H)

Probability

Qualification

(L, M, H)

Priority

(See

table)

E) User Departments

1) How many departments

or organizations can be

described as primary users

for this project?

L) 1

M) 2

H) 3 or More

2) How many departments

are involved as secondary

users in this project (e.g.,

primary to get information

for secondary reports.)?

L) None to 1

M) 2

H) 3 or more

2) Number of different

physical locations to

implement system

L) 1 site

M) 2 to 3 sites

H) Over 3

Risk Factor Impact Description

Impact

Qualification

(L, M, H)

Probability

Qualification

(L, M, H)

Priority

(See

table)

F) Administration and Control

1) Has a project process

and related standards been

established for this type of

project (i.e. application

development,

infrastructure, etc.)?

L) Yes, project team trained and has applied methodology

in past projects

M) Yes, first time use by project team

H) No, unknown risks & no applied methodology

2) Project Management

change control

management procedures

L) Well defined & accepted

M) Established but unclear

H) Nonexistent

Risk Assessment Worksheet and Management Plan

Page 6 of 12

3) A quality assurance

process has been defined

and is in place?

L) Well defined & accepted

M) Established, but unclear

H) Nonexistent

4) Will the solution be

implemented in well-

defined phases?

L) Yes

H) No

5) Has a version control

system been established for

project?

L) Yes

H) No

6) Has a collaboration

system been established for

documentation and project

information?

L) Yes

H) No

7) Will the development

effort be continuous?

L) Yes

M) No, limited to moderate impact

H) No, considerable impact

8) Has the joint client-

user/project development

team been identified and

established for the project?

L) Yes, with active participation from all departments

involved

M) Yes, with part-time participation

H) No

9) Has a formal review and

approval process been

established for the project?

L) Yes, formal procedures

M) No, informal procedures

H) No procedures

10) Number of clients or

departments involved in

final solution

L) Single department or company requesting solution

M) Two departments in same company requesting solution

H) Multiple departments or more than one company

requesting solution

11) Number of other

projects this project

depends upon

L) 0

M) 1

H) 2 or more

12) Number of other

projects dependent on this

project

L) 0

M) 1

H) 2 or more

Risk Factor Impact Description

Impact

Qualification

(L, M, H)

Probability

Qualification

(L, M, H)

Priority

(See

table)

G) User Support

1) Is there a client analyst

(subject matter expert-

SME) assigned to the

project?

L) Yes, active participation

M) Yes, minimal participation

H) No

2) How knowledgeable is

the SME in the proposed

solution area?

L) Substantial experience in the area

M) Understands concepts, but has no experience

H) Limited

3) Does the client’s top

management support the

project?

L) Well supported

M) Somewhat supported

H) Limited support

Risk Assessment Worksheet and Management Plan

Page 7 of 12

Risk Factor Impact Description

Impact

Qualification

(L, M, H)

Probability

Qualification

(L, M, H)

Priority

(See table)

H) Project/Development Team Qualifications

1) What is the experience of

the project manager with

projects of similar type?

L) Demonstrated performance within this company

with similar solutions

M) Demonstrated performance within this company but

with different type of solutions

H) Prior experience with similar solutions but no

experience at this company or no prior experience

2) What is the experience of

the project manager with

projects of similar size?

L) Demonstrated performance within this company

with similar solutions

M) Demonstrated performance within this company but

with different type of solutions

H) Prior experience with similar solutions but no

experience at this company or no prior experience

3) What is the project

team’s demonstrated

performance in

implementing project of this

type?

L) Excellent

M) Adequate

H) Limited

4) What is the project

team’s demonstrated

performance in

implementing project of this

size?

L) Excellent

M) Adequate

H) Limited

5) What is the project

team’s functional knowledge

of the client’s business in the

solution area?

L) Excellent or Good

M) Fair

H) Poor

6) Project Team expertise

requirements:

L) No subject matter expert required for solution or

subject matter expert on staff already

M) Local subject matter expert required for solution

H) Out of District or location subject matter expert

required for solution

Risk Factor Impact Description

Impact

Qualification

(L, M, H)

Probability

Qualification

(L, M, H)

Priority

(See table)

I) Functional Requirements

1) The new solution may be

described as:

L) Replacement of an existing automated system

M) Replacement of an existing manual system

H) Totally new system

2) What percentage of the

new solution’s functions are

one-for-one replacements of

the existing system’s

functions?

L) 67-100%

M) 34-66%

H) 0-33%

3) To what degree can the

user requirements definition

be based on existing system

documentation?

L) To a large degree

M) To a moderate degree

H) To a minimal degree or no existing documentation

Risk Assessment Worksheet and Management Plan

Page 8 of 12

4) New solution relationship

to client’s business strategy

L) Tightly coupled to business strategic plan

M) Somewhat coupled to business strategic plan

H) Minimally coupled to business strategic plan

5) To what degree has the

project team documented

the client’s requirements?

L) Well understood and documented

M) General understanding but not documented

H) Not well documented

6) To what degree will the

client-user depend on the

technical staff to define

system requirements

(system inputs, outputs,

processing requirements,

data base contents, etc.)?

L) Minimal dependence

M) Moderate dependence

H) High dependence

7) How well defined is the

project scope?

L) Well defined and documented

M) General understanding but not documented

H) Not well defined

8) How likely to change are

the project scope and

requirements?

L) To a large degree

M) To a moderate degree

H) To a minimal degree

9) How diverse are the

requirements of the

different client-user groups?

L) Identical requirements or only one user group

M) Similar requirements

H) Somewhat diverse requirements

10) How well are the project

deliverables or objectives

defined?

L) Well defined and documented

M) Defined in name, but not content

H) Vague

11) How well defined are the

benefits of new solution?

L) Defined, quantified or strategically important

M) Defined in general, not quantified

H) Not defined, unclear

Risk Factor Impact Description

Impact

Qualification

(L, M, H)

Probability

Qualification

(L, M, H)

Priority

(See table)

J) Impact on User Operations

1) To what degree will the

client depend on the new

solution for normal

operations?

L) Not required for normal operations

M) Moderately dependent

H) Extremely dependent

2) Will change in the client

organization be required as

a result of the new solution?

L) Minimal or no change

M) Moderate change

H) Major change

3) To what degree will the

new solution impact client

operations and procedures?

L) Minimal change

M) Moderate change

H) Major change

4) What is the general

attitude of the operational

client to the new solution?

L) Positive

M) Neutral, Somewhat skeptical or unknown

H) Negative

5) How familiar is the client

with the technology being

used?

L) Very familiar

M) Somewhat familiar or unfamiliar, but easy to adapt

H) Unfamiliar, requires extensive user education

Risk Assessment Worksheet and Management Plan

Page 9 of 12

Risk Factor Impact Description

Impact

Qualification

(L, M, H)

Probability

Qualification

(L, M, H)

Priority

(See table)

K) Sponsorship & Commitment

1) Project Sponsor

(Champion) is:

L) Identified, enthusiastic, strong user influence, and

supports the project

M) Identified but passive

H) Unknown

2) What is the experience of

the project sponsor with

projects of similar type?

L) Extensive experience within this company with