Do You Know These 6 Practical Risk Identification Techniques?

How to perform risk identification? What risk identification techniques to use? Which ones are most efficient?

And in general: How to discover problems that you’re unaware of?

Risk Identification Techniques are established methods of analyzing project information and discovering threats and opportunities. The most popular techniques in Project Risk Management are brainstorming, interviews, document analysis, checklists (risk categories), root cause analysis, and assumptions analysis.

But when you check the topic in the PMBOK® Guide:

😠  It says nothing about the practical application of these risk identification processes!

In this article, I’ll tell you what techniques you can use today. And you won’t need any specialized training.

But here’s the catch:

Your risk management efforts are as good as your plan. That’s why I’m also going to share my Risk Management Plan Template here:

Let’s clarify one thing: Risk Identification Methods vs. Risk Identification Techniques.

Risk Identification Methods

“A Risk Identification Method is a settled workflow or a procedure that you use to discover risks. It includes the list of techniques that you use.”

There’re three Risk Identification Methods you can use on a practical level:

1. Integrated Risk Management

In this method, you try to identify risks as a part of each process.

For example, you Collect Requirements and write specifications. During this process, you and your team should always be on the lookout.

They need to track all the assumptions they make. They need to check if there’s ambiguity in requirements. If there are unclear aspects of functionality?

While you keep the Risk Register always at hand and log all the risks.

Keep in mind that you do need to log them all! You will shortlist them later in the process. Check out the article on Qualitative Risk Analysis to learn more:

How to Perform Qualitative Risk Analysis for the First Time

2. Event Risk Management

In this method, you have risk identification checkpoints.

For example, you created a Work Breakdown Structure or a draft of the project schedule.

At this point, you plan a dedicated event to analyze the project artifact.

You and your team brainstorm all possible risks in this area.

Again you log everything you identified.

Hybrid Risk Identification Method

In real life, you’ll use the best of two Risk Identification Methods.

You’ll try to identify and log risks on the go.

Still, you will have in-depth risk identification sessions. You need to select certain critical points in project planning.

Here are some important spots to consider:

• When clients identified the project goal
• After you collected a major part of requirements
• After you created a WBS
• After you identified the required resources
• After you created a draft of Project Schedule
• After you created a draft of Project Budget
• After you identified key stakeholders

6 Simple and Actionable Risk Identification Techniques

You don’t always use all the risk techniques on everything you have on the project.

You need to think about the inputs (we’ll talk about it below). After that, you apply the correct technique(s).

It’s possible that you’ll apply several techniques to one input. For example:

1. You can review the project schedule with the team and brainstorm possible threats.
2. Then, you’ll take the schedule to a Senior PM and interview her to get her insights.
3. After that, you’ll check common risk sources in the risk categories.

OK, what exactly you can do to identify risks?

1: Analyse Risk Categories to Discover Typical Risks

(Usually, you use this technique once)

Project managers should collect lessons learned after each project.

You do know that, don’t you?

However, it is rarely the case.

That’s why, most likely, you don’t have a list of risk categories available.

“Risk Categories are just a list of common risks in your organization. It’s a part of lessons learned from risk management.”

The idea’s simple:

You need to analyze the list to see risks that may apply to your current project. This approach helps you to identify risks that you may not be aware of.

In general, an organization does projects similar in nature. Processes and policies are the same. Part of stakeholders never changes.

Therefore, a list of common risks is a quick way of risk identification. Here is a starting point for you:

43 Important Risk Categories for Effective Risk Identification

You can approach it in different ways:

You may either review the list alone and shortlist the categories. Then, you discuss the categories with the team.

Or you can brainstorm through the whole list with the team at once.

2: Perform Requirements Review

(You should use this technique in a hybrid mode)

Requirements contain significant risks.

You need to analyze them to find ambiguity and unclear aspects. Nowadays, you clarify requirements throughout the whole project lifetime. Therefore, you need to reevaluate the risks progressively.

Poor requirements are the number one cause of project failure.

Not only the quality and the level of details of requirements matter.

It’s also important to consider the amount of time available to analyze the documentation. You need to have a chance to review and discuss requirements with the team.

Lack of time to do that is a risk.

Moreover, it is essential to have a big picture of the product. It should be in sync for the whole team.

Here’s the trick:

You need to allocate time for requirements analysis.

When you have a small team, you can try the following approach.

1. Specify a piece of requirements.
2. Select a group for analysis (the whole team or just group leaders).
3. Let them read through the specifications, designs, emails.
4. Plan a meeting to analyze requirements.
5. Let one of them explain the requirements to the others.
6. Clarify requirements to the point where everyone has the same understanding.

Try it at least once out of curiosity.

You’ll notice that different people read the same specification differently.

3: Review Project Plan With Team (Documentation Analysis)

(Usually, you use this technique once. Additionally, you apply it when significant changes to the plan happen.)

Once you have a first draft of the project management plan, review it with your team.

The benefits of engaging the project team into the planning activities are vital. The disengaged and unmotivated team is the huge risk by itself. So you need to ensure their buy-in from the start.

On the other hand, your team is the primary source of information.

And risks.

Why?

For example, a team member sees the schedule. His tasks are on the Critical Path.

Suddenly, he remembers that he’s planning an important trip he has not told you about yet.

It’s better to find out such risks early.

There are many aspects that you need to talk about with the team:

Units of measurement and reporting, roles, and responsibilities, major processes, and procedures…

Just never assume that they see your plan the same way as you do.

4: Use Brainstorming Technique to Make Deeper Analysis

(You should use this technique in a hybrid mode)

There are critical points in project planning when I use brainstorming for risk identification. Here is the list:

• During analyzing essential requirements.
• While reviewing Work Breakdown Structure.
• Reviewing schedule and human resources plan.
• While creating a Quality Management Plan.
• Before finalizing the whole Project Management Plan.

So, for example:

Once I have a draft of the work breakdown structure, I plan brainstorming sessions. We analyze major deliverables first. Usually, risk identification is a part of scope definition for us.

In case we don’t have a clear understanding of how to deliver something – it’s a risk.

The critical point is to gather ideas from different perspectives.

5: Apply Root Cause Analysis For Systematic Risks

(You should use this technique for specific cases)

In practice, I use root cause analysis for risk identification in three cases:

1. Analyze severe problems of past projects. It might be my previous project. It might be a similar one in the organization done by another PM. It can also be relevant notes from lessons learned.
2. When I try to solve systematic problems. It usually relates to poor communications, inaccurate estimates, or ambiguity in requirements.
3. To group all identified risks by the root cause. It helps to see the primary sources of problems and identify even more risks.

In real-world projects, you don’t do it during planning.

Usually, it’s a post-mortem analysis. You collect lessons learned. Then, at some point, you need to act upon them.

So, allocate time at the end of the project to have such root cause analysis sessions. Develop a risk response plan for the next project.

Don’t assume that the same risks will not happen in the next project.

They surely will.

Especially those related to your project management approach and a company’s organization.

6: Make Assumptions Analysis to Identify the Most Impactful Risks

(You should use this technique in a hybrid mode)

By nature, assumptions involve risks. If an assumption is wrong – a project’s in trouble.

Review and validate assumptions regularly. We make assumptions all the time. Some of them may have a severe impact on the project.

In most cases, it’s worth to write them down right into the project management plan.

In it’s simplest form, you can create a simple list. Just name all the assumptions that you make. Review the list regularly.

Here’s the truth:

Assumptions that you make due to the problems in the organization are the most severe ones.

An assumption that you’ll get the required resources in time. Why! Recruiters always get people fast.

An assumption that your subject matter expert will be available for your project. But the next day he’s assigned full time to a critical project.

And so on…

Risk Identification Inputs

So, these are the techniques. Now, you need to apply them to the correct Risk Identification Inputs.

Here’s what’s important!

When I was a junior project manager, I focused on apparent risks.

It was the poor accuracy of estimates, unexpected problems with team members, or unclear requirements.

But, real problems always appeared from sources I never expected.

So, to select appropriate risk identification techniques, you need to understand the inputs as well.

PMBOK® Guide lists 13 inputs to the “Identify Risks” process. In fact, you can narrow down the list to six practical questions:

1. Does your project management plan look consistent?

1. Do you have a clear scope of the project?

1. Do you have appropriate resources?
2. Are your estimates accurate?
3. Do you know how to engage key stakeholders?
4. Does your organization’s environment have problems?

On the other hand, it’s not practical to go through all the questions at once. They’re interrelated and impact each other.

Moreover, it’ll take much time to analyze all the documentation at the end of the project planning.

Therefore, I suggest you use a hybrid identification method.

Each milestone in your planning effort should be accompanied by a small session of risk identification effort.

Project Risk Management Overview

If you are not super proficient with Risk Management in general check this video.

It will give you an overview of the Risk Management Framework and the place of Qualitative Risk Analysis.

Conclusion

All risk identification techniques try to answer one question:

What can go wrong?

That is the question you must think about constantly.

You may not need any specific techniques or tools for that.

Just a habit.

Also, I recommend to read:

• Next in the series: 43 Important Risk Categories for Effective Risk Identification
• Previous in the series: Simple Project Risk Management Plan that Works
• Overview of Risk Management: Full Guide to Risk Management Process in Project Management
• PDF: Complete Guide to the Basics of Project Risk Management

Test Yourself in Risk Management

Do you think you know enough about Project Risk Management?

Take this short quiz and identify gaps in your knowledge.

In the end, I provide correct answers and explanations.

A document you use to capture all known risks is called:

• A. Risk Log.
• B. Risk Register.
• C. Risk List.
• D. Risk Diary

Next Question

On a Friday evening John (your best engineer in the team) comes to you and says he quits. You have two weeks to find a substitution. What would reduce the chances of such an event? Why?

• A. Regular one-on-ones with John.
• B. Comprehensive professional development plan.
• C. The highest salary in the team.
• D. More responsibility.

Next Question

A process that involves prioritizing risks for further action or analysis by assessing the impact and the probability of occurrence is called

• A. Qualitative Risk Analysis
• B. Risk Brainstorming
• C. Quantitative Risk Analysis
• D. Risk Retrospective

Next Question

When do you perform Risk Identification?

• A. At the beginning of a project.
• B. During project planning.
• C. During the whole lifetime of a project.
• D. During project execution.

Next Question

As a part of your project, you need to organize a conference. You learn that in the place that you rented there's a 70% chance of a tropical storm on the selected dates. How should you handle such risk?

• A. Change the location of the conference.
• B. Buy insurance to cover possible damage.
• C. Book another place nearby to mitigate the risk of the first location unavailable due to the storm.
• D. Inform all participants of the possible storm.

Next Question

Who should be involved in Risk Management activities?

• A. Only Project Team.
• B. Only Project Manager.
• C. As many stakeholders as practical.
• D. All stakeholder except clients.

Next Question

You acquired an expensive piece of equipment for your project. It is know to be sensitive and fragile in work. Several tasks that require this equipment are on a critical path. What's the BEST action you can do to improve project's chances for success?

• A. Buy insurance to cover the costs of repairs.
• B. Hire a technical support team to quickly fix the equipment if needed.
• C. Find a good expert to operate the equipment.
• D. There's nothing you can do.

Next Question

You are on the call with clients. They say the vendor team they hired to create designs is behind schedule. What should you do?

• A. State that your project is also behind the schedule because of it.
• B. Log the risk into Risk Register to assess impact.
• C. Do nothing. It's not your problem.
• D. Contact the vendor to help them out.

Next Question

After you performed Qualitative Risk Analysis you need to create:

• A. A prioritized list of risks.
• B. List of risk for additional analysis and investigation.
• C. List of urgent risks
• D. Watch list
• E. All the above

Next Question

After reviewing Risk Register you see two critical risks that you anticipate during the next week. What should you do with this knowledge?

• A. Do nothing. Your Risk Register is shared with the team and stakeholders.
• B. Reach out to the stakeholders and the responsible person with a reminder.

Finish Quiz