Risk assessment

The method identifies the risks in a venture — a project, or an organisation.

It is simple to apply, and the price of that simplicity is that the classification is often not precise enough. It earns its keep on projects of small and medium complexity.

When to use it

  1. At the start of a project that has something unrepeatable or new about it.
  2. On small and medium-sized projects.

When not to use it

  1. On very complex, very large projects.
  2. In sectors running on very thin margins — there this tool may not be enough.

The goal: used well, the tool puts the project's or the organisation's risks in order of priority.

How to use it

The risk matrix arranges risks along two axes: how serious the consequences are and how often it happens.

1. Ground rules — what to keep in mind

  1. That you are trying to understand:
    1. What are the risks in this project?
    2. Which of them are the important ones?
    3. How do you act against them?
  2. That there can be many risks, but you only have the resources to address the important ones.

2. Brainstorm

Write out every risk that comes to mind:

  • Internal
  • External
  • Process
  • Legal
  • Financial
  • Reputational

3. Running the meeting

  1. State which venture's risks you are looking at.
  2. Run a brainstorm to surface the risks (about 20 minutes).
  3. Place the risks on the matrix by how serious they are and how often they happen.
  4. For the most serious and most frequent ones, write down how you will act against them.

Your team should be drawn from as many different roles and departments as you can manage, so that the problem gets looked at from several sides.

4. Putting the risks in order

How often: from a 1-in-100 chance (rare) to a 2-in-3 chance (near certain). Something that will certainly happen is not a risk.

How serious should be scaled to the project — from an extra 5% on its cost, say, to somebody being killed.

5. Working through the key risks

Together, go through the most important risks — the most frequent and the most serious. What is the strategy if one of them happens? What will it cost? Who should handle it, and who should be told?

Work out how to remove each one. Write the strategy down so that you are ready if the risk does materialise — especially where it would call for acting fast.

Use it in TeamKit