Project Risk Management – 5 Common Mistakes That Can Lead to Failure
Unraveling the Complexities of Project Risk Management: Avoiding Common Pitfalls
Project management is a complex web of tasks and responsibilities, a journey with no shortage of hurdles. The promise of project success, whether it’s a cutting-edge tech endeavor or a critical infrastructure development, is often overshadowed by the lurking shadow of potential failure. Effective project risk management often appears straightforward in theory, but when you dive into the turbulent waters of real-world projects, things can get murky. In this article, I will navigate you through five common project risk management mistakes that project managers make, ones that can have dire consequences if left unaddressed. From my experience, I can tell you that the realm of project risk management is full of VUCA – volatility, uncertainty, complexity, ambiguity, and crucial decisions that can make or break a project. It’s not always comfortable to confront these uncertainties head-on, but it’s a necessity if you want to ensure project success. You’ll be asked to explore the gray areas where assumptions meet reality, where intuitive judgments are transformed into actionable strategies, and where ongoing vigilance becomes a project’s lifeline. These uncomfortable feelings are the essence of effective risk management, and this article will guide you through them. So, why should you care about these common mistakes? Because by understanding and avoiding these pitfalls, you not only reduce the risk of project failure but also enhance your own professional growth and reputation. So, dive with me!
Risk is step six of the eight project management steps, and it heads a small group of posts on keeping a project on course: scope creep, VUCA project management and ongoing project monitoring.
Overlooking the Human Element in Risk Management
Effective risk management is crucial in project management, and often, project managers tend to overlook a critical aspect: the human element. It’s not uncommon for them to focus primarily on technical and financial aspects when assessing risks. While these factors are undoubtedly essential, they can overshadow the pivotal role that human behavior and communication play in risk management.
The success of any project depends not only on the technical proficiency and financial stability but also on the collaborative efforts of the individuals involved. Team dynamics, communication breakdowns, and individual motivations are factors that can significantly impact a project’s risk profile. Neglecting to consider these human elements can result in unanticipated challenges and missed opportunities for risk mitigation.
Team Dynamics: A successful project is often a product of how well a team works together. A harmonious, cooperative team can identify and address risks more effectively. On the other hand, a team plagued by conflicts and misunderstandings is more likely to overlook or underestimate potential risks. Project managers need to understand and actively manage team dynamics to enhance the project’s risk management strategy.
Communication Breakdowns: Effective communication is the lifeblood of any project. Misunderstandings, lack of transparency, or poor communication channels can lead to significant risks. Information must flow freely among team members, stakeholders, and leadership. A breakdown in communication can prevent the timely identification and resolution of emerging risks.
Individual Motivations: Every team member brings their unique motivations and priorities to the project. These motivations can influence their approach to risk management. Some team members may be risk-averse, while others may be more open to risk-taking. Understanding individual motivations can help project managers align team members’ objectives with the project’s overall risk strategy.
Recognizing the human element within the risk landscape is paramount. An inclusive approach that acknowledges the importance of team dynamics, effective communication, and individual motivations can prove invaluable in steering the project toward success. When project managers prioritize the human element in risk management, they not only enhance their ability to identify and address risks but also create a more cohesive and productive project environment.
Recording Non-Risks in the Risk Register
Another common mistake that often plagues project managers revolves around a fundamental misunderstanding of what constitutes a risk within the context of a project. According to established project management principles, a risk is defined as an event, a potential occurrence that poses a threat to the project and lies beyond the sphere of control by the project team. The crux of the matter resides in the term ‘event,’ signifying an incident that unfolds in a specific time and space, an occurrence that can be observed and described by an external observer. A risk is not an abstract concept; it is a tangible entity with a discernible beginning, progression, culmination, and outcome.
For example, imagine the prospect of ‘lightning striking the infrastructure’ or ‘water levels rising above level x.’ These qualify as risks because they are events with a clear trajectory of unfolding. Conversely, something as vague as ‘difficult weather conditions’ is not a risk in itself; it is a risk factor, capable of amplifying the likelihood of a negative impact on the project. Recording such risk factors or their effects, such as ‘project delay,’ in the risk register is a blunder that populates the register with entries that are neither concrete nor significant concerning actual project threats. Consequently, these ambiguous entries fail to elicit a proactive response, leaving risk management machinery dormant and unused.
A simple way to enforce this is to force every entry into one sentence: “Because of [cause], [event] may happen, which would [effect on the project].” Here is the difference in a register, using invented examples:
| Weak entry | Why it fails | Proper risk statement |
|---|---|---|
| Difficult weather | A risk factor, nothing to act on | Because the site is exposed, a storm may halt crane work for over 3 days, which would delay the roof by a week |
| Project delay | An effect, not a cause | Because the vendor has one integration engineer, that engineer may leave, which would stop the interface work |
| Lack of resources | A permanent complaint | Because our tester is shared with support, a major incident may take her for 2 weeks in the test phase, which would move go-live |
Note also that standards take a wider view than the definition above. ISO 31000 speaks of the effect of uncertainty on objectives, which covers good surprises too, as we will see later.
Treating Assumptions as Facts
A frequent misstep that many project managers encounter is the mishandling of assumptions. Once a legitimate risk is correctly recorded in the risk register, the question arises: how often does it occur? In many cases, project managers lack precise data to provide an accurate answer to this critical question. In the absence of concrete data, a prevalent error is to label the probability of the risk occurring as low, while projecting the consequences as catastrophic. This skewed perspective leads to the belief that the project is destined for failure, financial ruin looms on the horizon, and careers hang in the balance.
The next pitfall in this scenario is the multiplication of the probability by the projected impact on the project. This multiplication often results in numerical values assigned to qualitative and highly subjective assessments. There is nothing inherently wrong with this approach, as long as it is recognized that these values are based on intuition, often bolstered by years of industry experience. The grievous error, however, is treating these intuitive assumptions as concrete facts and the multiplication outcome as an infallible oracle, indicating the most critical risks.
A risk ranking is formulated based on these calculations, which may sometimes conflict with our initial intuition, despite our intuition being the foundation from the outset. Yet, these rankings are adhered to as though they are sacrosanct, guiding risk handling strategies, the selection of key risks for management reporting, and more. This transformation from a subjective assessment to a seemingly mathematical method creates a life of its own. The crucial realization, however, is that it is, indeed, a subjective evaluation, and if the final results do not align with our judgment, we have the liberty to adjust them.
This is more than a matter of taste. Tony Cox’s 2008 paper in Risk Analysis argues that risk matrices can give a higher rating to a quantitatively smaller risk, and that different people can rate the same risk differently. So use the matrix to start a conversation, not to end one. Ask the person who scored a risk why they scored it so, and write the reason beside the number. The reason will age better than the score. And be wary of letting an AI assistant fill in those columns for you.
Neglecting Continuous Risk Assessment
The landscape of risks in any project can shift swiftly and unexpectedly. New risks may suddenly emerge, and the scope or impact of existing ones may undergo significant changes. Failing to periodically assess and update the risk register is akin to leaving a project exposed and unguarded against unforeseen threats. In the realm of effective risk management, constant vigilance and adaptation are paramount.
At the inception of a project, project managers often take great care in identifying potential risks, assessing their likelihood and impact, and crafting risk mitigation strategies. These risk management plans are invaluable tools to ensure that the project stays on course and that potential disruptions are minimized. However, they are only as effective as the attention and effort dedicated to keeping them up to date.
The importance of continuous risk assessment cannot be overstated. As a project unfolds, circumstances change, and the factors influencing risk evolve. New competitors might enter the market, regulations could be modified, or external economic conditions may shift. These external factors can introduce new risks or alter the dynamics of existing ones.
Moreover, internal factors within the project, such as resource allocation, team dynamics, and project scope, can also fluctuate. Team members may leave or join the project, deadlines may be adjusted, or unforeseen technical challenges may arise. These internal changes can give rise to new project risks or exacerbate existing ones.
Neglecting continuous risk assessment not only leaves a project vulnerable but can also lead to missed opportunities. A dynamic risk management approach not only guards against threats but also enables project managers to seize opportunities that may arise. Identifying and acting upon positive risks (opportunities) can be just as critical to a project’s success as mitigating negative risks (threats).
Lack of Concrete Contingency Plans
Consider a soldier on a mission. They must have several meticulously thought-out plans, a variety of contingency measures, and the autonomy to select the most appropriate course of action on the fly, without constant communication with headquarters. It’s essential to act in accordance with previously established agreements and guidelines.
This military analogy translates seamlessly to project management, encompassing risk management. Merely stating that the CEO must communicate with a specific person to mitigate a certain risk is insufficient. The when, with whom, and why of these interactions must be explicit and timely. If the risk register specifies that immediate action is required in response to an event, the project manager should have the authority to take such action. This autonomy must be ensured when formulating the risk handling strategy.
Each action within the strategy should be finely detailed, and these specifics should be integrated into the project schedule. This integration is the key to treating risk management as a pivotal action that brings the project closer to success, rather than solely as a prevention mechanism.
Written down, it takes one line per risk: what triggers it, who acts, what they do, and how much they may spend or stop without asking. An invented example: the vendor misses a second delivery date, so the project manager activates the backup supplier, with authority up to €10,000. The trigger is what makes a contingency plan real. Without it, the plan waits for someone to feel that the moment has come. The authority limit is the soldier’s autonomy, put into writing.
A contingency can also be built into the plan itself. On an ERP migration with near-zero tolerance for downtime, old and new systems ran in parallel for two weeks, so a failure in the new one was an inconvenience and not an outage.
Project Risk Management Mistakes: Why Registers Become Theatre
I should admit the best argument against all of this: in many companies, the risk register is filled in for the audit and never read again. That criticism is fair. In my reading, the cause is rarely the template. It is what happens to the person who raises a risk. When I took over one company’s IT department as Director of IT and board advisor, security and risk management were non-existent, and one of the principles we changed was eliminating punishment for reasonable risk-taking. People who fear blame report nothing, and an empty register looks exactly like a safe project.
Here is a trigger that did its job. On an ERP migration, bad data was the risk that could sink go-live, so we built automated validation scripts before loading anything. They checked for mismatched data types, missing fields and logical inconsistencies, and caught errors before they reached the new database.
What To Do With All That
The journey towards successful project management is a dynamic and ever-evolving process. The insights gained from this article shed light on the critical importance of effective risk management. To ensure you’re on the path to achieving better project outcomes, consider the following actions:
Implement Effective Risk Management: Apply the principles and strategies discussed here to your project management practices. Prioritize the human element, focusing on the dynamics of your team, and emphasizing clear and open communication. Ensure that you are dealing with concrete risks and are mindful of your assumptions. Embrace continuous risk assessment with well-detailed contingency plans to proactively navigate any challenges that may arise.
Evaluate Your Current Projects: Take a closer look at your ongoing projects. Are there areas where common risk management pitfalls might be lurking? This critical self-assessment will empower you to make necessary adjustments and improvements, increasing your project’s likelihood of success.
Educate Your Team: Share the knowledge and insights gained from this article with your project team. Encourage them to adopt a proactive approach to risk management and to contribute to a culture of open communication and continuous improvement. By fostering this environment, you can harness the collective expertise and experience of your team.
Seek Further Learning: Acknowledge that project management is a constantly evolving field. Consider pursuing further education, training, or certifications in risk management to stay at the forefront of industry best practices. Continuous learning and adaptation are the keys to long-term success in the dynamic world of project management.
Effective project risk management is indeed a cornerstone of project success. By avoiding common mistakes, giving due consideration to the human element, and embracing the practice of continuous risk assessment, you will navigate the complex landscape of project management with greater confidence and achieve better outcomes. Remember, your journey towards successful project management is a continuous one, where ongoing learning and adaptation will be your steadfast companions on the road to success.
What project risk management framework should I use? How do I streamline the risk management process? How do I monitor risks in my project? Do you ask yourself such questions?
Let's talk about risk management in your organization!
Tell me how you started and how you ended up where you are with your challenges, and I will tell you how proper risk management can support your organization. I will explain the possibilities, how I work, and what business and technological partners I bring to the project.
I sell results, not dreams, that is why a discovery consultation is free. Don’t wait, contact me today.