Rules for Managing Risk

The effort required to manage project risks must come from the resources made available to the project. Since these are typically scarce resources, the project manager must be careful not to squander resources on risk management activities that aren't made necessary by the project. The project manager must balance this concern against the need to ensure that all significant risks to the project are identified and effectively managed, otherwise the project may fail to deliver on time, or deliver all the features promised, or lack in quality.

A project manager can gauge the needs of the project for risk management effort by assessing it's size and complexity. The more activities the project has, the more dependencies it will have and each and every dependency will entail some degree of risk. To manage the risks inherent in large complex projects the project manager should ensure that risk management activities (activities required to identify,  mitigate, monitor, and control risks) are carried out with sufficient frequency. Checkpoints should be scheduled at suitable points in the project to determine update the risk information and determine if risks are being adequately managed.

"Here are some key considerations for effectively managing risk on a project:

• Early warning systems  Identify some way to flag a risk before it happens.
• Recovery triggers  Identify what happens after a risk occurs.
• Resist assumptions  Avoid relying on unproven ideas whenever possible. If an assumption needs to be made, first try to limit its sphere of influence in the planning activities. Also, build a strategy that triggers a recovery process in case the assumption proves to be incorrect.
• Test risk recovery programs  Ensure that any recovery triggers that are established are tested before they are needed.
• Review risk status regularly  As discussed previously, risk management is ongoing and continuous.
• Communicate risk  Share the risk status and the risk assessment with everyone on the extended team. Keeping this private or secret to avoid worrying anyone usually works against the success of the project. Communicating risk in a simple, understandable format makes it a shared responsibility.
• Don't go it alone  The project manager is the ultimate quarterback, but risk management is a shared responsibility. The more people know about the risks in advance, the better they will contribute to their mitigation or recovery.
• Don't let risk management become its own risk  The process must remain streamlined and workable. Invest your resources in the risks that really matter.