Conduct a project risk assessment in 4 steps

Imagine this...

You're organizing an international virtual conference. Everything is on track until:

• The keynote speaker cancels.

• The livestream platform crashes.

• Registration numbers are lower than expected.

Would your project survive?

This is exactly why project teams conduct risk assessments. A project risk assessment helps teams identify potential problems early and decide what to do before they become expensive surprises.

Get ready to tackle project challenges with a simple four-step risk assessment process.

1. Identify Risks ✅

2. Evaluate Impact and Likelihood ✅

3. Plan Responses ✅

4. Monitor and Update ✅

A project risk is an uncertain event that could affect your project's:

• schedule

• budget

• scope

• quality

• customer satisfaction

Risks can be negative (threats) or positive (opportunities).

Examples of risk types:

• Schedule risk: A supplier delivers materials later than expected.

• Budget risk: Material or labor costs increase unexpectedly.

• Resource risk: Your team lacks the skills needed to complete a key task.

• Technology opportunity (positive risk): A new productivity tool helps the team complete work faster.

Projects rarely fail because of one giant issue. More often, several small risks combine over time.

Image courtesy of ijeab via Magnific

Ask:

• What could go wrong?

• What assumptions are we making?

• What dependencies does this project have?

Gather input from people, past experiences, and project records to uncover risks that might otherwise be overlooked. Useful sources include:

• Team brainstorming

• Experience on previous projects

• Subject matter experts

• Stakeholder feedback

Example:

Let's go back to the example of organizing an international virtual conference. After talking with different stakeholders, you may identify the following risks:

• The keynote speaker cancels.

• The livestream platform crashes.

• Lower registration numbers than expected.

For each risk, estimate:

Likelihood: How likely is it to happen?

• low

• medium

• high

Impact: If it happens, how serious would the consequences be?

• low

• medium

• high

This creates a simple probability × impact matrix, one of the most common tools in project risk assessment.

Image courtesy of Magnific

This matrix helps prioritize risks by considering how likely they are to happen and how much impact they would have on the project. Risks in the top-right corner require the most attention, while those in the bottom-left are lower priority.

Example:

Let's calculate the priority of the risks of your virtual conference:

• Speaker cancels: medium likelihood x high impact = high priority

• Platform crashes: low likelihood x high impact = medium priority

• Low registration: medium likelihood x medium impact = medium priority

Once risks are prioritized, decide what to do about them. Common strategies include:

Avoid: Eliminate the risk.

• Example:Your project depends on software that is still in beta. Instead, you choose a proven software solution to avoid potential bugs.

Mitigate: Reduce the chance or impact.

• Example:You're concerned a team member may become unavailable, so you cross-train another employee as a backup.

Transfer: Let another party handle the consequences.

• Example: You hire a specialized vendor to manage cybersecurity or purchase insurance to cover equipment damage.

Accept: Acknowledge the risk and be prepared if it happens.

• Example: There's a small chance of a shipping delay for raw material you need for your project. You accept the risk but build a buffer into the project schedule.

Example:

There are different ways to respond to the risks of your virtual conference:

• Speaker cancels: Confirm a backup speaker in advance = mitigate

• Platform crashes: Arrange a backup livestream platform beforehand = mitigate

• Low registration: Launch an extra social media campaign and offer early-bird discounts = mitigate/accept depending on severity

Image courtesy of Magnific

Projects change, and risks change with them. That's why risk assessment isn't a one-time activity.

Successful teams revisit risks:

• Weekly

• At project milestones

• During sprint reviews

• After major project changes

Many organizations use the following tools to document risks, assign owners, track response plans, and monitor changes throughout the project.

• Risk Register: A dedicated document for recording, prioritizing, and tracking project risks and response plans.

• RAID Log: A project log that tracks Risks, Assumptions, Issues, and Dependencies in one central place.

Example:

As the conference approaches:

• Has the keynote speaker confirmed?

• Has the backup livestream been tested?

• Are registration numbers improving?

Update your Risk Register or RAID Log regularly and adjust your response plans as new information becomes available.

You're managing a website redesign project. One of your software vendors lets you know there's a chance they will deliver a key component two weeks later than planned. If the delay occurs, it could affect your project schedule.

What should you do first?

A. Ignore it until the delay happens.
B. Identify how likely the delay is and how it would affect the project.
C. Immediately cancel the project.
D. Ask the vendor to work faster or find a new vendor.

Taking just a few minutes to assess risks now can help you avoid bigger problems later.

Image courtesy of Drazen Zigic via Magnific

Ready to put your new knowledge into practice? Think about an ongoing or past project and:

To learn more about project management, check out these resources:

• Alison: Successful Project Management Planning and Team Effectiveness

• 3 uses of AI for project management

• 4 strategies for successful project management