Is this your plan for handling risk? If so, then you're already late, over budget, and the thing you're building is probably not going to work right when you're done.
So let's start with a risk statement, how to speak "risk." It goes like this
If A occurs because of B, than C will be the result.
There are some common errors in the risk management conversation:
- Risks are confused with issues.
- Not defining the risk handling work in the Integrated Master Schedule
- Not providing a budget for the risk handing or for the Issues when the Risk turns into a risk
So let's clarify some concepts
- Risk Management is about A risk. The process of estimating the probability and impact for each risk is targeted for A. Assigning attributes to A risk is part of risk management.
- Risk Analysis is about ALL the risks on the project. This analysis starts with combining and assessing the effects of multiple risks and their relationships. This causal connection is often done in a Risk Map or a Risk Breakdown Structure. But the RBS does not have a temporal paradigm, so the Risk Map is a better approach.
- Monte Carlo Simulation of the connectivity, probability of occurrence, and impacts is the best way to assess the risk exposure.
Discovering the needed contingency associated with the level risk requires the use of tools. A simple list of risks and the consequences provides little or no information about the credibility of the schedule. Modeling the risks, starting with the variability of the duration and effort, the impact of these variances in the duration and cost of the project schedule.
While this approach may appear complex, it is the minimum level of programmatic control needed to create a credible schedule. Without this approach the schedule is just a best guess of what the forecast cost and schedule will be for the project.
