8. Performing Risk and Issue Management Activities

Risk Identification

Determining what risks might affect a project and conducting data gathering exercises to document them

Risk Identification Lifecycle

Starts in the initiation phase, expands in planning, and continues through monitoring and controlling

Known Risks

Risks that have been identified and documented during the project

SWOT Analysis Acronym

Strengths, Weaknesses, Opportunities, Threats

SWOT Analysis Purpose

Used to identify internal and external factors that could impact project success

Strengths (SWOT)

Positive internal factors that benefit the project (e.g., experienced team)

Weaknesses (SWOT)

Negative internal factors that could hinder the project (e.g., overreliance on key staff)

Opportunities (SWOT)

Positive external factors that could benefit the project (e.g., favorable regulation changes)

Threats (SWOT)

Negative external factors that could harm the project (e.g., new compliance requirements)

Sources of Risk

Organizational environment, technology changes, regulatory changes, political or market conditions

Qualitative Risk Analysis

Assesses risks based on parameters like urgency, controllability, and strategic impact to prioritize them

Quantitative Risk Analysis

Assigns numerical or monetary values to risks and uses simulations to predict outcomes

Monte Carlo Analysis

A simulation method used in quantitative risk analysis to model multiple possible outcomes

Impact Analysis

Evaluates probability (0–1) and impact (0–1), multiplying them to produce a risk score

Risk Score

Probability × Impact; higher scores represent higher-priority risks

Scenario Analysis

A “what-if” analysis exploring potential risk outcomes

Situational Analysis

Analyzes internal and external project factors, often using SWOT

Negative Risk Response Strategy

A method to handle threats: avoid, mitigate, transfer, or accept

Avoid Risk Strategy

Take action to eliminate the threat entirely

Mitigate Risk Strategy

Reduce the likelihood or impact of a risk before it occurs

Transfer Risk Strategy

Shift ownership of the risk to a third party (e.g., insurance or outsourcing)

Accept Risk Strategy

Choose not to take proactive action, appropriate for low-priority risks

Positive Risk Response Strategy

A method to handle opportunities: exploit, enhance, share, or accept

Exploit Opportunity

Take full advantage of an opportunity to ensure it occurs

Enhance Opportunity

Increase the probability or positive impact of an opportunity

Share Opportunity

Partner with a third party to share the benefits of an opportunity

Accept Opportunity

Do nothing proactive; used when reward doesn’t justify effort

Issue (Project Management)

An event that has already occurred and is impacting the project

Unidentified Risk

An unknown risk that becomes an issue without a contingency or fallback plan

Issue Management

Process of recording, prioritizing, assigning, and resolving project issues

Issue Log

Document used to record and track project issues, ownership, and resolution status

Workaround

Response created for an issue or unidentified risk after it occurs

Root Cause Analysis

Process used to determine the underlying cause of an issue

Project Change Control

Process followed when an issue resolution results in a project change

Contingency Reserve

Funds allocated in the cost baseline for known risks with active response plans

Management Reserve

Budget held outside the cost baseline for unforeseen or unknown risks

Risk Management Plan

Document that defines how risk management activities are conducted within a project

Risk Register

Document that records identified risks, their owners, impact, probability, and response plans

Contingency Plan

Predefined response to identified risks if they occur

Fallback Plan

Backup plan if the contingency plan fails or is ineffective

Issue Log Components

Includes issue type, raised by, date, description, priority, assignee, target resolution date, status, and resolution

Risk Appetite

The degree of uncertainty an organization or stakeholder is willing to accept

Risk Owner

Person responsible for monitoring and responding to a specific risk

Risk Categories

Grouping of potential risks (technical, organizational, external, etc.) for easier management

Escalation Path

Defined route for reporting and addressing risks or issues beyond a project’s authority