Risks, plan B and crises

Every PM knows the temptation: the list of risks is frightening, so better not write it. In the book Eve puts it like this: her team’s risk plan looked like the Book of Revelation; identifying and assessing every potential problem had been hard, “but not doing it was the biggest risk of all”.

A risk is an event or condition that, if it occurs, has an effect on the project’s objectives. Managing risks doesn’t mean predicting the future: it means deciding in advance, calmly, what to do if it happens.

The process, in five steps

1. Identify the risks, all of them, even the ones that seem unlikely.
2. Assess them: how likely they are to happen, and how much they would hurt. Probability times impact gives severity.
3. Decide the response. There are four options: avoid (change the plan so the risk doesn’t arise), reduce (lower its probability or impact), transfer (to a supplier, an insurer, a contract clause), accept (with a plan B ready and a reserve in the budget).
4. Assign an owner to each risk: someone who keeps an eye on it and triggers the response.
5. Monitor: the register is updated at every progress review. Risks change, new ones appear, some disappear.

The right moment for the first risk plan is after drafting the project plan and before starting. The right moment for the last one is the close.

Light or complete

Not every project needs the same format.

The light version is a RAID log: a list of Risks, Assumptions, Issues (problems already under way) and Dependencies, reviewed at every progress meeting. It is enough for a small project with a small team.

Type	Item	Probability	Impact	Response	Owner
Risk	The client approves the design a week late	Medium	High	Mid-point reviews; approval date in the Gantt chart and the SoW	PM
Assumption	The copy comes from the client, already translated	—	High	Written confirmation by the kick-off	Account
Dependency	The back-office APIs are ready by the 15th	Low	High	Test environment with dummy data	Tech lead

The complete version uses a probability/impact matrix, with a score for each risk and thresholds that trigger escalation. It makes sense in large projects, with many stakeholders and high stakes. It isn’t complexity for its own sake, if it genuinely helps you decide.

A risk plan is built together

The best way to build it is a workshop: the team, the main stakeholders, the sponsor, people who know the subject well. The PM facilitates, gathers the known risks and pushes people to look for the ones nobody has thought of. It is the moment to think the unthinkable.

What to look for, in particular:

• Trivial things. A password, an expired domain, a file in the wrong version. It is always the most trivial things that slip through.
• Single points of failure. One contact on the client side, one supplier, one person who knows that system or holds those credentials.
• External dependencies: everything you don’t control.
• Key people: holidays, illness, departures.
• The consequences of success. What happens if the campaign works too well? If the website gets ten times the expected traffic? If the product is used in a way nobody imagined?

Plan B, before you need it

For the most serious risks the response must be written beforehand: who does what, with what resources, how fast. A plan B thought through calmly is always better than one improvised under pressure. And the plan, A or B, must reach the last step, not just the first: “and if the first part works, then what do we do?”.

When it happens anyway: the crisis

Not everything can be foreseen. When the problem comes, what counts is speed of reaction, and method.

• One person coordinates. In a crisis, decisions by committee slow everything down. You need a clear point of reference who gives the go-ahead.
• One problem at a time. Line them up, start with the most urgent, close it before opening another.
• Clear messages and few channels. Who needs to know what, when, from whom. Better a few messages agreed in advance than many improvised ones.
• The truth, early. Tell the client what happened, what you know and what you don’t, what you are doing and when you will update them. If there is a responsibility, acknowledge it.
• Specialists, when needed. If the crisis touches reputation, communication must be coordinated with the people who do it professionally: press office, PR, lawyers.
• Afterwards, the analysis. Once it is over, look for the cause (not the culprit), update the risk plan and record what you learned, so it serves the next project.