Protecting the Plan
Risk Management Overview

In this article we will look at ways you can protect your project schedule or plan. What can interfere with your plan and prevent you from being successful?
I have found that most threats to projects come from within the organisation. These internal threats can manifest in various forms, such as unclear project scope or objectives, inadequate resource allocation, poor communication among team members or departments, and insufficient stakeholder engagement. Misalignment between the project's goals and the organization's strategic objectives can also pose a substantial threat. These can all be prevented; well mostly.
Additionally, organisational changes, competing priorities, and bureaucratic processes can lead to delays, decreased productivity, and increased costs. You can plan for these so they have less of an impact on your project.
External threats to projects originate from factors outside the organisation. These threats include market changes, economic conditions, regulatory shifts, technological advancements, supplier issues, natural disasters, political instability, environmental factors, public perception, legal issues, security threats, global events, competitor actions, social and cultural factors, and infrastructure limitations.
The purpose of risk management for a project is to understand the potential threats to achieving the project deliverables on time. There are basically two strategies for managing risks: prevention and mitigation. Mitigating the impact of a risk means reducing the effect of the risk on the project.
The first thing that you can do to protect your project is to plan the project properly. Don’t do a hasty job to just get the project going. Ensure you, the team and the governance group know why you are doing the project and what is agreed as being part of the scope of the project. You can read more about the five W’s of starting your project in my blog Starting your project Well.
Early on, start building a trust relationship with the project sponsor. Later on in the project you will need their support to help you solve issues or remove road blocks for the project.
The purpose of risk management for a project is to understand the potential threats to achieving the project deliverables. There are basically two strategies for managing risks: prevention and mitigation. Mitigating the impact of a risks means reducing the effect of the risk on the project.
The first step in risk management is risk identification and assessment. This is best done in a workshop with your team and subject matter experts. Identify all the possible risks. Don’t discuss or challenge each other too much, just list the risks. Next discuss and assess the likelihood and impact (consequence) of each risk happening on a scale of 1 to 5. Capture the risks and descriptions in a risk register. Add the likelihood and level of impact scores for each risk. A final risk assessment score can be calculated by multiplying the Likelihood and Impact scores. This information will help you identify which risks to spend more time on.
The next step is to agree how each risk will be managed. There are two strategies that can be followed: risk prevention or mitigation. Risk prevention means you plan and put in place actions that will prevent the risk from happening. Risk mitigation means you put actions and agreements in place that will reduce the consequences of the risk when it happens. Mitigations often include contingency budget and/or time, or alternative methods of achieving the same outcome.
Contingency planning is a mitigation strategy that involves identifying and agreeing to put contingencies or reserves aside to protect key milestones and manage identified key risks. This can be time, budget or resources. The process starts with identifying the key project milestones and dates. Identify tasks and budgets feeding into that milestone. For these tasks, plan for additional time and budget to be set aside. On the timeline or schedule they are called feeding-buffers. In the budget they are usually called contingencies.
For a large project there can be many buffers and contingencies. An alternative and more optimal method for the timeline is to identify the critical chain. It is the most important sequence of tasks that directly impact the project delivery date. Protect tasks that feed this critical chain with time contingency feeding buffers. This is called Critical Chain Project Management (CCPM). This method also employs one Project Buffer at the end of the project.
In real life, not all risks will eventuate. Planning contingencies for all risks will be wasteful. The law of aggregation or averages can help the project reduce the total cost of mitigations and contingencies. This implies that in real life only a certain percentage of contingencies will actually be used. The governance group needs to approve a level that they are comfortable with, for example 50%. If they have a very low risk appetite, then 85% is more appropriate. This contingency (time and budget) can be added to the end of the project.
References:
1) Goldratt, E. M. (1997). Critical Chain. North River Press.
2) The Goldratt Institute: The official institute founded by Dr. Eliyahu M. Goldratt provides resources, training, and consulting services related to TOC and CCPM. https://www.goldratt.com/