Project risk assessment and management are important project management activities. All project managers should assess risk for every project and manage it appropriately.
Introduction
Risk assessment is often one of the most neglected yet most important areas of project management . This is largely because many project managers have not taken the time at the onset of the project to properly assess and manage risk. Proper identification and mitigation of risk can add to the likelihood of project success by allowing the project manager to make better-informed and calculated decisions about a project’s performance and success with confidence. For most project managers, “risk” has been interpreted as being unsure about the costs, schedules, or resources available for the project. However, uncertainty about all factors of operation, including organizational and cultural aspects can plague the stages of any project.
Risk and Risk Management
“Risk” can be defined as “the possibility of suffering loss” (Webster, 10th edition). In a development project, the loss describes the impact to the project, which could be in the form of diminished quality of the end product, increased costs, delayed completion or outright failure. Any factor involved in the organization can contribute to the possibility of incurring loss (“risk”) on a project, and although most risk assessment and risk management practices address tangible causes, a major cause of project failure can be organizational in nature. Examples of uncertain organizational factors would include mergers and acquisitions, staff downsizing and work realignment, management turnover, corporate focus shifts – all that would cause levels of uncertainty to rise in the project teams and within the project individuals themselves.
Project managers should evaluate the impact of these factors since there is possibility of project delay, failure or cost escalation because of these events – all ways in which a project can incur a loss.
Risk Management is a project management practice with processes, methods, and tools for managing risks in a project. According to the Software Engineering Institute, risk management provides a disciplined environment for proactive decision-making to:
https://www.sei.cmu.edu/organization/programs/sepm/risk/risk.mgmt.overview.html)
Figure 1: Risk Management Steps Overview
Managing project risk in an unstable or uncertain organizational climate can affect, directly, the accurate assessment of other risk elements (costs, schedule, resources) and can contribute to the overall performance and completion of a project.
Risk Assessment
In assessing the organization to determine the probability of loss due to of any type of organizational uncertainty, it is essential to understand and evaluate organizational structure as a whole and as a component of a project. Any project is part of the organization that is sponsoring it, and changes to the organization could affect the delicate balance of project cohesion and performance.
The systems approach to project management requires that project managers (PMs) always view their projects in the context of the larger organization. Organizational issues are often the most difficult part of working on and managing projects, and according to a recent study by the PM Network, many project managers believe that most projects fail for political reasons.
Similarly, according to the same study, PMs frequently do not consider the political context of a project in an organization, thereby consigning many projects to the “failure” column when they could have been successful with some systematic organizational assessment and organizational risk management. The study concluded that it is important for project managers to develop a thorough understanding of people, the organization, and their relationships to ensure a greater chance of success on projects. Using organizational components in a project’s risk assessment and risk management could provide the project manager with a greater awareness of the risk involved in projects that are undertaken in an uncertain organizational climate, according to the results of this study.
As Meredith and Mandel state in their leading textbook on project management, “Project Management, A Managerial Approach”, it is rare for a project manager to have the capability to affect the structure of their organization; most PM’s must work within the provided structure. However, PM’s must be acutely aware of the organizational nature of their firm, and understand the dynamics of the organization and any changes that organization is (or may likely) experience, so they can incorporate these dynamics into the organization of the project team, its schedule, and the assessment of risks on the project.
Organizations can be viewed as having four (4) frames: structural, human resources, political and symbolic (Bollman and Deal, “Reframing Organizations”, Jossey-Bass, 1991). Bollman and Deal maintain that project managers must assess the current state of each frame in the organization at the start of the project, evaluate continuously the potential for risk and the possibility of change within each frame during the project, and determine the interactions of the elements of each frame within the scope of the project.
Variations of this method of project organizational risk assessment and management can be found in cross-departmental projects, such as data warehouse development and enterprise resource planning projects (Demarest, M. “The Politics of Data Warehousing”, 1997).
The structural frame deals with how the organization is structured, as depicted in an organization chart, and focuses on the different groups’ roles and responsibilities. In information technology projects, a key issue is whether information systems staff should be centralized in one department or decentralized across the various business units. Projects can be effective with either structural approach, but a change to this structure during the course of a project could have far-reaching implications as staff members reassess their reporting relationships, duties, interpersonal interactions, etc. The possibility of a major structural change in the organization should be communicated immediately to the project managers and a good project manager should endeavor to forestall this type of change until their project has been completed, if at all possible.
The human resources frame is designed to produce harmony between the needs of the organization and the needs of the individuals, recognizing any differences in needs and working to resolve any potential problems caused by these differences. Some examples of risks within the human resources frame would be changes to the organization’s normal work schedule to facilitate the project’s completion and the shortage of skills/talents/individuals available to adequately staff a project. Measuring the latter is possible and is one of the primary tasks of a project manager at the start of the project, but assessing the likelihood of the former is less certain and may only be possible at critical project junctures, where balancing individual human needs against organizational and project needs are most important and difficult. This competition between individual needs and project/corporate needs should be assessed at the start of the project and the risks associated with changing expectations should be evaluated and measured at the critical project junctures. The targeted project staff may require training in one or more areas to be effective.
The political frame addresses organizational and personal politics, which consist of competition for power, leadership and resources among groups and individuals. Conflict arising from this competition is a central issue in most organizations, and can be the source of many project management risk problems. Politics can be overt or covert, but regardless of their visibility, all project managers must pay close attention to the nuances and demonstrations of political actions throughout the lifecycles of their projects, as an understanding of the organization’s embodiment of the political frame and the effective use of political techniques are essential to securing resources and influence in the support of projects. Poor management of project-related influence is usually a result of a lack of understanding of the organization’s political realities and a project manager’s inability to secure a place in the political arena, according to a study performed by the Project Management Institute (Riordan, J., “Organizations and Risk Analysis”, PMI). Power shifts, individual realignment, changes to political culture are all areas that a PM must be aware of and the PM must continually assess the risks associated with these elements of the political frame during the life of any project.
The symbolic frame is concerned with symbols and meanings, and can include the unspoken items of organizational culture. In this frame, it is most important for a project manager to focus on what is happening and what that act means to the project, the team’s members (and perhaps to the organization as a whole). Frequently, symbols are clear in meaning if one knows what to look for and how to interpret them, but assessing their impact on a project can be difficult if the PM is not clearly aware of the relationship between the other frames and the symbols.
For example, one symbol can be the style and frequency of project meetings in an organization. Do frequent meetings indicate a project-oriented culture (good) or a micromanaged culture (not good)? Will all projects fail at a company that never starts meetings on time, never has agendas for meetings, and engages in “stream of consciousness” status reports? Interpretation of symbols and the assessment of risk based on these interpretations can be successful only in coordination with risk assessment of the other cultural and organizational frames, and may be used most productively as a guide to assessing the probability of risk from the other areas of concern, according to Bollman and Deal.
Once the risk elements have been identified (risk identification), each risk is evaluated for its impact to the project’s success. According to Riordan in his PMI study, each risk element is discussed and agreement reached on:
Figure 2: Risk Assessment Criteria
An overall risk assessment for each risk element is made based on the probability, consequences, and impact of that risky event. Performing this assessment is critical for organizational or cultural risk, since many organizations do not discuss these intangible elements despite their extensive capabilities to affect a project’s success.
Probability
Since a project manager is analyzing organizational risk subjectively, they cannot assess the probability of the risk event occurring down to a decimal point percentage. Therefore, Riordan categorizes the probability of the organizational risk event occurring as very low, low, medium, high and very high, and assigns these weights to the events for a less-objective but still quite useful analysis.
Consequences
The project manager and team provides a short description of the outcome to the project if the risk event occurred, paying attention to the possible “domino effect” of certain results. However in this type of analysis it is best to avoid too much complication, according to Riordan, since organizational risk assessment is subjective and obsessive attention to effects can lead to “project paranoia” (nothing positive will ever happen, all project are doomed since all projects have some element of organizational uncertainty, etc.).
Impact
Once again, in a subjective analysis the PM categorizes the impact on the project of the risk event happening in broad categories of negligible, marginal, critical and catastrophic, based on the consequences of the event as determined by the project manager and team.
Exposure
The overall project risk exposure for each event is then graded from the following impact/probability matrix, developed by Riordan and adopted by the Project Management Institute for its work in Project Risk Management:
| Impact/Probability | Very High | High | Medium | Low | Very Low |
| Catastrophic | |||||
| Critical | |||||
| Marginal | |||||
| Negligible |
https://www.projectmagazine.com/august00/risk1.html
Table 1: Risk Assessment Matrix
For some risk events Riordan recommends that a project manager determine individually the impact of the organizational risk event on the project costs, project schedule and project quality, along with the subjective assessment. This more detailed analysis should be undertaken when the probability of loss because of the organizational event is deemed high/very high and its impact is evaluated as catastrophic or critical.
Conclusion
In uncertain times, given the instability of organizations and the changing cultures of organizations as a result of this instability, project managers should follow a structured risk management process that includes assessment of the organizational risk aspects. Performing risk identification and assessment of organizational factors as well managing the risks associated with tangible aspects (costs, schedule, and resources) will keep all potential risk events uppermost in the minds of the project team and may serve to minimize the consequences of organizationally-oriented risk events, should they occur.
