MS Project: Assessing and Managing Risks

Archived content. No warranty is made as to technical accuracy. Content may contain URLs that were valid when originally published, but now link to sites or pages that no longer exist.

You've used Microsoft Project to create a detailed plan for your project and you believe you've accounted for everything. What could possibly go wrong? Plenty! The question is, "Where will the project go awry and what can you do to avert disaster?" Assessing and managing risks is the best weapon you have against project catastrophes. By evaluating your plan for potential problems and developing strategies to address them, you'll improve your chances of a successful, if not perfect, project.

The basics

There are four steps to assessing and managing risks, and effective risk management requires all four of them:

  • Identify risks.

  • Quantify risks.

  • Plan for risks.

  • Monitor and manage risks.

To adequately analyze risk, you'll need a detailed plan. So the best time to perform an initial risk analysis is just before saving your baseline and starting the project. But don't make the mistake of thinking that risk analysis is a one-time task. You'll want to reevaluate the plan and your risk analysis from time to time throughout the project and whenever major deviations from the plan occur.

Identify risks

There are numerous ways to identify risks. If you have a limited amount of time, the best ways to identify risks are to:

  • Review the task list and schedule.

  • Brainstorm and talk with the experts.

Review the task list and schedule

In your Microsoft Project plan, look first at the critical path tasks, then at tasks that are almost on the critical path, and finally at noncritical path tasks. Look for:

  • Tasks for which your team has no expertise. The duration and cost estimates for these tasks are more likely to be inaccurate.

  • Duration and cost estimates that are aggressive. Ask the estimators how confident they are in their estimates, especially for critical path tasks.

  • Situations where you have a limited number of resources that can do particular tasks and where those resources are fully allocated, overallocated, or my become unavailable. A human resource can become unavailable when he or she leaves your organization or because of commitments within the organization.

  • Tasks with several predecessors. The more dependencies a task has, the greater the likelihood of a delay.

  • Tasks with long durations or a lot of resources. The estimates for these tasks are more likely to be inaccurate.

Brainstorm and talk with the experts

All of your project risks may not be apparent from analyzing the project plan. It's worth your time to call a brainstorming meeting with key resources on your project. Ask these people where they see the most risk to the project. You may be surprised at what you uncover.

If you have some experienced project managers available, have them review your plan. Also, talk with people who have expertise in particular areas of the project. For example, if you're planning to use an outside contractor, talk to people who have used that contractor or other contractors.

Quantify risks

Quantifying risks is a discipline unto itself. Your options range from sophisticated probability analysis to the simpler techniques outlined below. Obviously, the accuracy of your results is commensurate with the techniques you use. This article outlines some basic, but effective techniques.

To quantify risks:

  • Determine your tolerance levels.

  • Assign a probability to each risk.

  • Assign a cost to each risk.

  • Assign a priority to each risk.

Determine your tolerance levels

If you work for a small company, and additional project cost of $250,000 or a delay of two months may put your entire company at risk. If you work for a large organization, these overruns may be acceptable for a project. Write down some hard numbers. How much cost and delay is acceptable? Remember that this isn't your preference, it's just the bottom-line numbers you can tolerate.

Assign a probability

For each risk, determine how likely it is to occur. Unless you're using statistical methods, you'll assign a probability based on your team's knowledge of the risk. Use these tips to identify more likely risks:

  • Use the Microsoft Project PERT analysis tools to see how likely you are to hit your dates. If the task durations in your plan differ significantly from those in the PERT analysis, then the tasks are at higher risk.

  • Review archived projects to see if similar tasks from the past have taken longer than your estimates or have cost more.

  • Find out your team's confidence level. If the resources that will do the work aren't comfortable with your cost or duration estimates, then the risk is more likely to occur.

Assign a cost

The cost of a risk can be measured in dollars, lost time, lost quality, or all three. Try to quantify the cost of a risk, even as a range such as $25,000 to $50,000. One way to evaluate costs is to save a copy of your Microsoft Project plan, and then modify the copy to perform a what-if analysis and see the impact if a risk does occur.

Assign a priority

Based on your tolerance level, the potential cost of the risk, and the probability of it occurring, assign a priority to the risk. For example, if the cost of a risk is beyond your tolerance level and it is very likely to occur, assign a high priority to the risk. Use these priorities to determine which risks to focus your efforts on first.

Plan for risks

Once you've identified and quantified risks, you need to plan for them. Because risk planning can take a lot of time and energy, you may want to plan for only the high-priority risks or the medium- to high-priority risks. Planning entails:

  • Identifying triggers for each risk.

  • Identifying proactive, contingency, or mitigation plans for each risk.

Identifying triggers

Triggers are indicators that a risk has occurred or is about to occur. The best triggers tell you well in advance that a problem is occurring.

To identify triggers, talk with the people who are most likely to cause the risk to occur and those who are most likely to feel its impact. Ask them how they would know that the problem is occurring. Start with how they would know that the problem has already occurred, and then work backward to determine how they would know before the problem actually occurred.

As the project manager, consider how the risk would be reflected in the plan. Would the plan show overtime for a specific resource on earlier tasks? Would the plan show delays in specific tasks?

For each risk you're addressing, create a watch list that shows the possible triggers, when they are likely to occur, and who should watch for the trigger.

Identifying plans

Once you've identified triggers, you need to create action plans. You can plan for risks in one of three basic ways:

  • Allay the risk by taking actions ahead of time, thereby decreasing the likelihood of the problem occurring. For example, if you're dependent on a single resource with specific expertise, consider training another resource in that expertise.

  • Mitigate the risk by lowering the consequences if the problem does occur, thereby reducing the risk's impact. For example, if you're dependent on an outside vendor making its delivery dates, your contract with the vendor might include penalties for late delivery, in order to offset your potential losses.

  • Respond to the risk with a contingency plan, if the problem does occur. For example, if a task is at risk of being delayed, your plan may be to add additional resources to the task. Your contingency plan should include any work that must be done ahead of time to make the contingency successful. For example, you'll want to make sure that the additional resources are available in case you need them.

Keep in mind that risk management plans can have unexpected ramifications. Model each plan in Microsoft Project to see the plan's impact on the project. Look for new risks that occur as a result of the plan and address them in it.

Monitor and manage risks

Your risk management plan is in place. Now your job is to make sure you and others on the project team act on it. Take any actions necessary according to your proactive, mitigation, and contingency plans. Monitor your watch list to see if triggers are occurring, and implement contingency plans as needed. Be sure to reassess your risks regularly. You might find the following ideas useful for monitoring your risks:

  • Include a Risks section in status reports and request that resources identify any assumptions they are making, as well as any new risks they see.

  • Set up regular meetings with team members to reevaluate the risk management plan and to identify new risks to the project.

  • Each time your project's actual progress varies significantly from the plan, reassess the risks and reevaluate your risk management plan.

With a little preplanning and thought, you can significantly decrease the risks to your project. Use the tips in this article to implement risk assessment and management to your advantage. We hope your project will be a successful one!

For more detailed information about risk assessment and management, visit review - A Guide to the Project Management Body of Knowledge.

Helpful views for seeing durations and costs

Viewing costs

View the costs for each task by applying the Cost table to the Gantt Chart view.

View the costs for resources and their costs on various tasks by applying the Cost table to the Resource Sheet view.

View the costs of tasks across time in the Resource Usage view.

Viewing durations

View durations in the Gantt Chart view, which is the default view in Microsoft Project. You can sort the chart by duration to review the durations in order from shortest to longest. You can also sort by priority to review durations in order of task priority. You can use the Gantt Chart Wizard to view the critical path and review the durations of critical path tasks.

Helpful views for seeing resource allocation

View resource allocation in the Resource Usage view.

Helpful features for watch lists

You can create your risk management plan and watch list in any application. For example, you might want to create the plan in Microsoft Word. You can then incorporate the watch list information, such as triggers, into your Microsoft Project plan by attaching the information to tasks as notes.

If your watch list is on an intranet or the Internet, you can insert a hyperlink to the Web page.

If you're familiar with Microsoft Visual BasicĀ® for Applications, you can use it to create macros in Microsoft Project to alert you when trigger events occur.

Using the PERT analysis tools

To perform a PERT analysis, you'll need to enter an optimistic, pessimistic, and expected duration for each task you want to analyze.