Identifying PRINCE2 Risks
The Identify step can be divided into a number of smaller steps. I will list these and then explain them further:
- Identify the context: which is to understand the project from a risk point of view; whether this is a high- or low-risk tolerance project
- Complete the Risk Management Strategy document
- Identify the risks using a number of techniques
- And describe the risks in terms to cause, event and effect.
Identifying PRINCE2 Risks in context
We need to ask a number of questions about the project. The answers will enable the Project Manager to complete the Risk Management Strategy.
- What type of project is this? Are we building a satellite where Risk Tolerance will be very low or are we creating a prototype product that will only be used for a few months in-house where the Risk Tolerance is very high or something in between?
- What is the customer’s Quality Expectations? Will the product be available to thousands of users who will expect all functionality to work immediately or to a small in-house team of three to four people to evaluate?
- Number of organizations involved and the relationship between them
- What is the complexity and scale of the project?
- What is the Project Board’s attitude to risk?
- What is the organization’s approach to risk?
These questions need to be asked as soon as possible in the project and before the Risk Management Strategy is created.
Note that the Risk Management Strategy document is created during the Initiation Stage with the other 3 strategy documents.
Most of the answers to these above questions can come from 3 documents: the project mandate, the Project Brief and the Project Product Description.
The Risk Management Strategy will include information on:
- The Risk Management procedures to follow
- Tool and techniques (e.g., use workshops to discover risks)
- What information needs to be kept, as well as the structure of the Risk Register?
- Timing of Risk Management activities
- Roles and Responsibilities
- Scales to use for likelihood, impact, proximity (e.g., very low, low, normal, etc.)
- How scales will be categorized
- Risk Tolerances that will be used
- Risk budget information (this is optional)
- Early warning indicators (For example, just imagine the dashboard in your car having a red light for the number of issues raised in a week, e.g., average number of defects captured in a quality inspection, percentage of cost increase, type of customer feedback, project staff turnover, etc. Any of these can have an effect on a number of project objectives.)
PRINCE2 also recommends a number of techniques to help identify risks, such as Review Lessons, Use Risk Checklists, and Brainstorming.
- Review lessons: Review lessons from similar and previous projects to see what were the threats and opportunities
- Risk Checklists: These are in-house checklists that may exist. They help to make sure that risks that were identified on previous projects are not overlooked
- Checklist for a legal project, financial investment, merger, etc. (some of these can be purchased from specialist companies)
- Brainstorming: For example, invite different types of stakeholders to a brainstorming-type meeting or workshop. You may choose to gather risks beforehand and use the workshop to categorize and prioritize them. Use Post-Its or a whiteboard to discover threats and opportunities. This should be led by someone with good facilitation techniques.
Part of Identify Risk is to describe the risk in a specific way, but this will be covered in a separate topic, as I want to give a number of examples because it is important to learn how to describe risks.
How to Express the Risk
Let us learn how to express Risk or in other words how to describe it.
PRINCE2 recommends that risk should be described in a certain way. For example, we cannot say that the risk to an international business conference in London might be a volcano. This does not tell us very much in terms of how the volcano would affect the project. PRINCE2 recommends that we should describe this risk in terms of the cause, event and effect. We need a few examples to get this across.
Let us say that our project is to organize a European conference on solar energy in London and we invite the top 300 persons from around Europe to this event who would mostly travel by air. Now let us look at the volcano example again. I will describe the risk in terms of cause, event and effect.
Due to an active volcano in Iceland that is releasing ash, there is a threat that the winds could bring this ash into UK airspace, thus grounding planes, which would cause many people to miss the event.
Now let us look at the cause, event and effect in the last statement:
- The cause is that there is an active volcano in Iceland that is releasing ash. This cause is already happening
- The event is a threat that the winds might bring the ash into UK airspace so planes could be grounded. The event might happen
- The effect on our project is that it would cause many people to miss the event or not be able to return home after the event.
Here is Example 2, taken from the PRINCE2 Manual:
I will first mix up the sentence so you can think about the cause, the event that is a threat, and the effect.
Farmers’ crops might get damaged due to heavy rain, as fields will get flooded.
- What is original cause?
The cause is heavy rain.
- What is the threat?
The threat is that fields might get flooded
- What is the risk?
The effect if the risk does happen is that the crops will get damaged.
So the correct way to describe this risk would be:
“Due to the heavy rain, there is a threat that the fields might be flooded which would damage the crops.” You could make this easy by starting the sentence with the words “Due to [the cause], then follow it with communicating that “there is a threat” of an event that could happen which would result in (describe the effect)
Here is an example of an opportunity:
Let us say that the project is to organize an outdoor concert that is about 10 kilometers away from Heathrow Airport, but near the flight path. Concert organizers see this as an opportunity, as there would be no overhead noise from the airplanes.
Let us describe this from a cause, event and effect point of view:
The cause is that the volcano is releasing ash, and there is an opportunity that the winds might blow the ash into UK airspace, which would ground airplanes and result in no noise disturbance.
We could write this risk like the following: – Cause, Event & Effect
Due to the fact that the volcano is active and releasing ash, there is an opportunity that the winds might blow the ash into UK airspace and ground airplanes, which would result in a better experience for concert goers and more visitors.
This course is DEPRECATED
The old PRINCE2 6th Edition Foundation and Practitioner syllabus was upgraded in 2024. Check out the brand NEW PRINCE2 7th Edition Masterclass, covering all the current syllabus, training material and online exam benefits HERE
Your Route To PRINCE2 6th Edition Practitioner
Study PRINCE2 6 Foundation and Practitioner Exams with our famous on-line course with streaming HD Video Lessons, study guides and mock exams. In the last fifteen years we have had 6,000+ Academy students successfully transform their careers as PRINCE2 Practitioners.
