All projects face risks and risk management is a key process area of all major PM Bodies of Knowledge such as the PMI Body of Knowledge (PMBoK®). If you have never applied risk management to a project before (and even if you have) the following centres around one of the biggest challenges you will likely have - getting people to think and share ideas about risk and capturing them in a productive way. Many projects and project team members are asked to apply risk management to their projects, meaning they have to do a number of things, including doing an assessment of the risks the projects faces. When people have not ever done this before, often they don't find it one of the easiest things they ever do on their project. This is proven out by the output produced time and time again in these circumstances.
So what should you do in these circumstances?
Assuming you have a basic knowledge of risk in relation to projects, the last thing I would do is to leap straight into a risk identification workshop or similar. I may choose to do this at some point, but only after careful planning and preparation. One of the things I would do is I would have all the core team members (or team leaders) review their area of the project, and ask them to consider and most importantly capture what the uncertainties and risks may be. I would also use whatever process collateral is available from company procedures etc, to help them with this task, and offer them coaching in the topic as well.
So what should I expect (back from people)?
At some stage, you will have to consolidate all the inputs (assuming you have some). The first thing to expect is that most people don't find this an easy thing to do and may not produce much or may even produce nothing at all. Even if they do, what they may well offer up are known issues on the project, (which are not risks and should not be included in this process. Clearly we don't want to ignore these, but they don't belong inside the risk management process).
So if I am going to run a workshop, what would I do?
Firstly, I would describe very carefully what we are trying to do and why. I would also make responsibilities within this process as clear as possible. Then, depending on the size of the project I would consider how to run the workshop(s). I may spilt it up into smaller sessions but I would be careful to have cross-functional representation in each session as far as possible. But most important of all, I would not simply ask people to brainstorm the risks - I would bring as much structure to help people as possible. Things like the WBS, if you have one, would be perfect. Lastly, I would be very careful how we capture whatever we get as input from whatever sources they come from. My recommendation would be to do as much of that as you can during the session, not afterwards. If you follow the above, your efforts should be more successful.
Kevin Lonergan is a Principal Consultant for PMIS Consulting, and has conducted and supported risk assessment sessions in multiple projects and in many industries.