The management of risk by its very nature, is an ongoing process as new risks may arise and existing risks may change in some way throughout the project, so identify risks will be used multiple times. As the project progresses the environment within which it is being run may also change causing the type and nature of risks to also be modified. Therefore the identify risks process will normally be used many times throughout the project.

The main output of this process is the risk register and is used to feed and drive the remaining four risks processes of perform qualitative risk analysis, perform quantitative risk analysis, plan responses etc, and monitor and control risks.

Identify Risks - The risk management plan

This is the sole output from the previous process of plan risk management. It defines the level of risk that is considered tolerable for the project, how all this will be managed, who will be responsible for these risk activities, what time and cost is needed for each risk activity, and how risk will be communicated.

Identify Risks - Activity cost and activity duration estimates.

These inputs described the understanding of the project schedule and budget which are the major areas of project risk, and are therefore considered and carefully reviewed to determine the latent risks that lie within them.

Identify Risks - Scope baseline

Similar to the above, the scope of the project in terms of the products to be created and the activities as laid out within the project management plan will be a main source of risks to the project.

Identify Risks - The project documents

The project documentation will be a rich source of information on potential risks to the project and as you will see documentation reviews are one of the goals that are used within this process.

Identify Risks - Stakeholder register

This lists all of the project stakeholders as well as describing and classifying them. As a result it will provide a rich source of individuals and groups that should be consulted with and involved as part of identifying potential risk areas within the project.

The cost, schedule, and quality management plans

These plans are all strategies that described how cost schedule and quality are to be managed and implemented, and as such, the information contained within them will have a bearing on project risk.

Enterprise environmental factors

These will have a major bearing on the risks to their success of an individual project and will include aspects such as the laws and regulations governing the creation or use of the projects products. Another key aspect here is the environment within which the project is taking place and may include drivers such as the operational environment, the industry, or market place. The characteristics of the project stakeholders in particular their willingness to accept a risk must also be taken into consideration.

Organisational process assets

Such assets may includes guidelines policies or procedures for the management of risk, the use of tools, historical information or databases, and lessons learned from previous similar projects.

The risk register

This is the single output from this process and consists of the list of all identified risks, their root causes, categories and responses. The information contained within the risk register may be used to update the risk breakdown structure.

Because of risk is an ongoing activity, the risk register will be updated continuously throughout the life of the project and it is a key tool to aid in the management of risks within a project.

Documentation reviews

These are reviews of all documentation that is contained within the project up to this point in time. The reason why this helps it identifying risks, is that each document is reviewed for completeness,, and consistency.

Missing, inaccurate or incomplete information made in the end of itself hinder the identification of all risks and also be a source of risk because of the sketchy nature of the document itself.

Strengths, weaknesses, opportunities, and threats (SWOT) analysis

This tool uses four quadrants, one for each strength, weakness, opportunity and threat, and each risk is plotted and shown in the relevant quadrant.

This gives a powerful picture to allow you to identify the most significant project risk factors, and an aid to boost strengths and opportunities and minimize threats and weaknesses in terms of the risk situation.

Information gathering techniques

There are many ways in which information on the project risk situation can be gathered, and these include expert interviews, root cause identification, brainstorming workshops, and the Delphi technique.

Checklist analysis

This technique uses the risk breakdown structure developed either from this project or one from a previous similar project to compare against and ensure that all significant risks or categories have been identified.

Assumptions analysis

Any assumption that is made may turn out not to be true or at least in error, and therefore all assumptions should be seen as a source for risks. The purpose of this tool is to challenge such assumptions and determine what risks may arise from such assumptions.