What Is Project Risk?
Project risk is the potential that a circumstance could arise that alters the outcome of a project, for better or for worse. Project risks affect deliverables, timelines, and budgets. They can lead to a project’s failure if not managed properly.
Project risks can be caused by political, environmental, economic, social, technological, or legal factors beyond the scope of the project. More local factors such as internal restructuring or illness can also be the basis for risks. Some basic examples of project risks include poor project management practices, supply chain delays, unexpected staff illness, emergency needs and expenditures, scope creep, and major weather events. Find more examples of the different types of project risks by reading our guide.
The PMBOK® Guide describes risk as “an uncertain event or condition that, if it occurs, has a positive or negative effect on a project's objective. The key element of this definition is that the effect of the uncertainty, if it occurs, may be positive or negative on the objectives of the planned endeavor.” Project managers use risk mitigation practices to identify potential risks as early as possible, take steps to avoid them, and put a plan in place to control risks when they encounter them.
“When you have more complexity you have more risk,” says Robb Pieper, certified Scrum trainer and CEO of Responsive Advisors. “Dealing with new people, products, or anything you have no control over increases your level of risk. When you make your projects smaller and deliver value sooner, it allows you to mitigate risks faster and fix problems at a quicker rate without heavy lifting.”
How Does Project Risk Differ from Other Types of Risks?
Project risks are a specific risk category of events and circumstances that affect the outcome of projects. Many risk categories are involved in running a business and managing projects, including individual risks, business risks, operational risks, and risk events.
| Type of Risk | Relationship to Project Risk |
|---|---|
| Individual Risk | A single risk that might affect a project. |
| Business Risk | Risks that can affect the entire business, not only a single project. |
| Operational Risk | Risks that are part of the day-to-day operations of working on a project. |
| Risk Event | An event that, if it occurs, will alter the outcome of a project. |
We explain how project risk relates to each of these other risk categories in the sections below.
Individual Risk vs. Overall Project Risk
Individual risk is a single possible circumstance that might affect the outcome of a project. Overall project risk refers to the possibility of any one or more circumstances occurring that might alter a project’s outcome.
Individual risk refers to a single possible event; overall project risk refers to all possible events. For example, an individual risk might be a project going over budget. Project risk is the possibility for a project to go over budget, extend beyond their scheduled end time, or require extra resources, as well as every other circumstance that could affect its outcome.
Project Risk vs. Business Risk
Project risks affect the outcomes of individual projects. Business risks can affect all aspects of an organization, including high-level financials, materials, employment, or even the physical buildings that house the business.
Business risks are, simply put, the cost of doing business. A project risk is a circumstance that could derail the project, such as improper scheduling. Examples of business risks include new products not being well received or widespread labor disputes and strikes occurring. Even natural disasters need consideration, as they may affect how a company does business.
Project Risk vs. Operational Risk
Project risks focus on the uncertainty of a project’s outcomes. Operational risks involve uncertainties that are part of the everyday internal operations of a company. These can include changing certification requirements, non-standard procedures, or breakdown of equipment.
A project risk might be the inability to source materials at the same price as on previous projects. Even though you could source the materials, an operational risk might be the machine you use to fabricate deliverables breaking down suddenly. The machine needs repairs, which puts your project behind schedule.
Risk Event vs. Project Risk
A risk event is one that, if it occurs, will alter the outcome of a process. Project risk is a more general term that describes a collection of risk events that could affect the outcome of a project.
A risk event might be the possibility that your lead developer falls seriously ill and needs to take an extended leave. Project risk includes that possibility and every other possibility that might affect the outcome of the project, such as budget overages, supply chain issues, or scope creep.
What Is Project Risk Management?
In project management, risk refers to the possibility of events that may affect the outcome of a project’s outcome. Project managers must anticipate risks and put processes in place to mitigate or manage them when they arise.
Project Risk Event Flowchart
This flowchart demonstrates how a project manager might approach project risk management. When they identify a risk event, the manager determines the likelihood of it occurring. If it is not likely and will produce little impact on the project’s outcome, they will monitor the risk and mitigate it if necessary. If the risk event has a high chance of producing a negative outcome, the project manager will take steps to avoid it entirely.
“Risk management is the process of identifying, assessing, and managing risks,” says Catherine vanVonno, President and CEO, 20Four7VA. “It includes both the proactive identification of risks that could potentially impact the business, as well as the reactive response to risks that have already been realized. Managing risks reduces your chances of drastic failure and allows for a proactive approach to problem-solving.”
Implicit risk management deals with overall project risk and generally is covered by a company’s risk management plan. Implicit risks are generally tied to factors and decisions made at the project management level and pertain to issues of defining scope, proper scheduling, and accurate budgeting. Explicit risk management focuses on the risks to a specific project and unique risks the team on that project may encounter. Explicit risks are tied to the day-to-day operation of processes on a specific project or the way in which outside factors affect them.
Risk management is limited by the fact that it is impossible to anticipate every risk or prepare for every situation that might arise. It is important, however, to organize your people and processes in a way that makes it easy to identify and mitigate risks where possible, thereby minimizing the effects on a project.
How to Identify Project Risks
The best way to identify project risks is to implement risk management into your everyday processes. Encourage project managers and their teams to adopt practices to mitigate risk factors. They should also look ahead to recognize and anticipate new possibilities.
“Always assess and plan ahead,” suggests vanVonno. “By being proactive and taking the time to plan and reassess the strengths, weaknesses, opportunities, and opportunities (SWOT) of a particular decision or project, you can save your company a lot of time, money, and stress in the long run.”
To help identify project risks, ask yourself the following questions before starting a new project:
- What risks have we encountered on similar projects?
- What circumstances could occur that are unique to this project?
- What are the chances of each circumstance occurring?
- How would these circumstances affect the outcome of the project?
- What can we do to reduce the impact of these circumstances?
Simple SWOT Matrix Template
Download Simple SWOT Matrix Template
Microsoft Word
| Smartsheet
Use this SWOT matrix template to perform a basic risk analysis of the conditions and decisions at your company. List the strengths, weaknesses, opportunities, and threats related to the decision you are making to help organize your thoughts and determine what risks might present themselves when moving ahead.
Find other SWOT matrices in this collection of templates.
What Are Positive Risks in Project Management?
Not all risks are negative. Positive risks are the potential for a circumstance to alter the outcome of a project in a positive way. This type of risk can include policy and technology changes, favorable environmental conditions, positive customer response, and more.
Pieper describes a positive outcome from the risks involved in adapting to working remotely. “We had to change our entire business structure,” he explains. “We offered only in-person training and classes and had to pivot essentially overnight. We jumped on the opportunity to host trainings virtually, which in turn eliminated many of the risks involved with meeting in person and boosted our business. It shows how important it is for organizations to be willing to adapt.”
“One of the biggest risks we took is introducing the idea of a construction virtual assistant to our clients,” explains vanVonno. “We knew that this was a new and innovative idea, but we also knew that it had the potential to change the construction industry forever. We took the risk, and it paid off. The construction virtual assistant position is expected to be one of the most popular services in our list and will help our clients save time, money, and stress. As a result of that outcome, we are continually seeking ways to improve our workflow and take risks to innovate the construction industry.”
What Is Residual Risk in Project Management?
Residual risk is the remaining level of risk that is still present after taking steps to reduce the chances of risk events occuring. It is virtually impossible to eliminate all risk from a project. Some residual risk always remains.
An example of residual risk is continuing to use older technology past its support life rather than spending the money to upgrade. The technology may have been implemented to make processes simpler and reduce risks related to them. However, as time passes, the residual risk of the technology rises; parts may be unavailable or more expensive if the machines break down and support is no longer available for troubleshooting or repair.
Pieper describes how risk exists in a business, even when not related directly to a project. “We work with a lot of clients who experience high turnover,” he says. “We are seeing that businesses cannot fill positions as fast as they need to in order to be successful. This all stems from not keeping your people happy. A huge way to future-proof your business is to put strategies in place that keep your people happy. Losing skilled people is the biggest risk a business can face.”
Project Risk to a Project Manager
A project manager’s goal is to ensure that projects are completed successfully. Much of this task comes down to identifying risks, avoiding them when possible, and mitigating their effects when they are unavoidable.
Project managers use project risk identification strategies to pinpoint potential risk triggers and risk analysis to determine their impact. The most effective way to control project risk is to plan for it. Project managers should implement processes early in the project’s lifecycle to anticipate potential risks and lessen their negative effects when they occur.
Project Risk to a Project Sponsor
The project sponsor ultimately assumes responsibility for a project’s success or failure. It behooves them to create competent teams and empower leaders to manage project risks.
Risk management practices are multipronged approaches, but they all begin with putting competent people in leadership positions. They need to identify risks early to ensure that projects stay within acceptable risk thresholds and remain fruitful for their sponsors.
Project sponsors should ensure that their managers are knowledgeable about the risks involved in project management. They should be available to advise their managers and provide feedback when necessary. Sponsors should provide a safe space for project managers to voice concerns about potential issues, and listen and make changes as needed. A project manager is only as good as the support they receive.
Smartsheet Can Help You Manage and Prepare for Project Risks
Empower your people to go above and beyond with a flexible platform designed to match the needs of your team — and adapt as those needs change. The Smartsheet platform makes it easy to plan, capture, manage, and report on work from anywhere, helping your team be more effective and get more done. Report on key metrics and get real-time visibility into work as it happens with roll-up reports, dashboards, and automated workflows built to keep your team connected and informed. When teams have clarity into the work getting done, there’s no telling how much more they can accomplish in the same amount of time. Try Smartsheet for free, today.