I offer a few very basic points for getting practical risk management under way.
1. What is a risk?
Risk specialists talk of risk being the uncertainty that may impact upon whatever objectives you may have. Uncertainty may have a positive effect (opportunity) or, as more widely recognised, a negative effect (threat).
Most risk registers I have seen only focus on the negative - they only contain threat risks.
Another important characteristic of risk is that it focuses upon possible FUTURE events.
I have heard so many people describe an 'issue' as something that has happened, is happening, and will happen in the future. In my experience, there is nothing certain in the future other than death (and, in the UK, indirect taxes). We may be very sure that something will occur, but until it does actually happen, it is not CERTAIN that it will occur (a 100% likelihood). Thus, an issue cannot be a future 'something' - this is always a risk, even if our evaluation of its likelihood is a high 99%. It is always possible that something unexpected may happen to affect the future of which we are so sure (just ask those commenting on the last round of The Masters at Augusta in 1996 when Greg Norman collapsed and Nick Faldo won unexpectedly).
2. Describe your risks correctly
So often risks are simply not described adequately. I frequently hear "It is clear what the risk is. It's going to be late." THIS IS NOT A RISK! It is only a statement about the effect that something, not actually stated, may have upon the project.
To know what uncertainty may cause this impact and which I need to control, I need a better understanding of the risk. This is best provided by including three elements of the risk in its description:
Risk cause:
The source of the risk: "As a result of inadequate public funding of South-West Hertfordshire school infrastructure..."
Risk event:
The uncertain event that may or may not occur, with a statement of its likelihood: "...there is a 90% probability that my eldest son will have to travel two hours each way to the nearest non-selective secondary school..."
Risk effect:
The impact should the risk event occur: "...which will result in my son being very tired and crabby at the end of each school day."
I would record all of the above emboldened text in the Risk Description field of my risk register.
There are several advantages to this approach.
It quickly becomes clear that a single risk event may result in several risk effects (my son may also have to pay for several daily bus journeys; my son may also be unable to continue with previously-established after-school activities; and so on).
It may be that we recognise that several risk events stem from a single underlying cause. So, instead of finding response actions for treating each risk effect stemming from a single underlying cause, we may find it more cost-effective to treat the single cause.
3. Focus on the necessary
So often, perhaps because of a corporate expectation of having a beautifully presented risk register, we scrupulously record all project risks. But why? Will we ever use this information and monitor responses to each of the many listed risks? My experience says no.
On The Reach Free School project (click here for more information), we had a risk register that highlighted the risks we REALLY believed were pertinent, and would control. This sub-set of the risks NEVER EVER exceeded a total of 12 risks. We looked at the risk register to understand progress against these key risks at each project meeting, and determined if the response was working or needed to change. As we concentrated on the few critical risks, this was not an onerous task.