3.2Risk management (identification, criticality, plan)
The essentials in 30 seconds
- Managing risks = anticipating them rather than suffering them: addressing a threat coldly costs less than in an emergency.
- A 3-step approach: identify with no self-censorship, assess criticality (probability × impact), define a response plan.
- Four strategies (avoid, reduce, transfer, accept) recorded in a living register with one owner per risk.
Running case — Bilal opens the register before the storm
Bilal's project depends on a single senior developer and a supplier that delivers late one time in two. Until now, Bilal took a "wait and see" stance. After the remaining-work shock (3.1), he gathers the team for 45 minutes: 8 risks identified, criticality scored, 3 plans launched — doubling the key skill, penalties for the supplier, a 5-day reserve. Two weeks later the supplier slips: plan B kicks in instead of panic.
Sequel to case 3.1 — Bilal moves from observation to anticipation.
1. Anticipate rather than suffer
A project is by nature uncertain. Risk management means anticipating threats rather than suffering them: identifying risks (technical, human, external, suppliers, schedule), assessing their criticality (probability × impact), then defining response plans. Bilal learns the key distinction: a risk is future and uncertain, a problem is a realized risk.
Managing risks means refusing to discover problems the day they explode: you prepare coldly what you do not want to manage urgently.
2. Four strategies, one living register
For each major risk, one strategy: avoid it (remove the cause), reduce it (lower probability or impact), transfer it (insurance, subcontracting, clauses) or accept it (with a reserve and a contingency plan, the "plan B").
Everything is recorded in a risk register — risks, criticality, response, owner — living and reviewed regularly. It is a hallmark of a mature project manager: Bilal rereads it at every weekly point.
🔎 Concrete example — Risk versus problem
Address before the explosion.
Risk = FUTURE, uncertain event (it may happen).
Problem = realized risk (it is here, now, urgent).
→ addressing a threat while it is a risk costs far less.Outcome: anticipated threats, not suffered ones.
Reflex: one owner per risk in the register.
Section vocabulary
- Risk
- An uncertain event which, if it occurs, would impact the project (most often negatively).
Simple example: Bilal's supplier that may deliver late.
What it is not: a delay already observed (that is a problem).
Reflex: phrase each risk as "if… then…".
- Criticality
- A risk assessment combining its probability and impact (often probability × impact).
Simple example: fragile supplier + blocking delay = high criticality.
What it is not: the cost alone or the date alone of the risk.
Reflex: prioritize by criticality, not by arrival order.
- Risk register
- A document listing risks, their criticality, response and owner.
Simple example: Bilal's table reread at every weekly point.
What it is not: a list written once then forgotten.
Reflex: review the register at each tracking milestone.
- Response strategies
- Avoid, reduce, transfer or accept a risk depending on criticality and cost.
Simple example: Bilal transfers through penalties and reduces by doubling the skill.
What it is not: definitively ignoring the risk and hoping.
Reflex: each major risk = 1 strategy + 1 action.
- Contingency plan
- An action plan prepared in advance, to trigger IF the risk materializes ("plan B").
Simple example: Bilal's supplier B activated after 3 days of delay.
What it is not: improvising in panic on the day it breaks.
Reflex: write the trigger before you need it.
In practice — Building a risk register
- As a team, identify project risks (technical, human, external, suppliers, schedule) with no self-censorship.
- Assess each: probability (low / medium / high) and impact; cross them to get criticality and prioritize.
- For the most critical risks, choose a strategy (avoid, reduce, transfer, accept) and a concrete action.
- Record everything in a register with one owner per risk, and review it regularly.
Ready-to-say script — launching risk brainstorming (2 min)
"Let us list everything that could make us miss the date, with no filter and no debate. Then we score: probability times impact. The 3 most critical ones leave with an owner and an action this week. We reread the register at each point."
To say at the start of the session, board visible: exhaustiveness first, then priority.
Copy-paste template — express risk register
RISK (if… then…): _______________
PROBABILITY (low / medium / high): _______________
IMPACT (low / medium / high): _______________ → CRITICALITY: _______________
STRATEGY (avoid / reduce / transfer / accept): _______________
ACTION + OWNER: _______________ | DEADLINE: _______________
PLAN B (if it happens): _______________ | REVIEWED ON: _______________Very small business / tight budget
Five major risks are enough: one page, one owner each, a 10-minute review per week.
SME in Algeria
Bilal includes fragile suppliers, administrative delays and seasonal peaks among his external risks.
Software project
Double the unique skill (bus factor) and plan a supplier B for each critical dependency.
Event project
Weather, venue, providers: one written plan B per major risk (fallback, replacement, time reserve).
✓ Best practices
- Identify risks as a team, with no self-censorship.
- Prioritize by criticality (probability × impact).
- Keep the register alive and name one owner per risk.
✗ Common pitfalls
- Discovering problems the day they explode.
- Treating all risks equally (without prioritizing criticality).
- Building a register once then forgetting it.
Key takeaways
- Managing risks = anticipating them rather than suffering them.
- Approach: identify, assess criticality (probability × impact), respond.
- Four strategies: avoid, reduce, transfer, accept.
- The risk register is living: review it regularly.
48h challenge — apply tomorrow
List 5 risks of your project, score their criticality and launch 1 action on the most critical one (template above).
- I can tell risk (future) from problem (realized).
- I can score criticality (probability × impact).
- I opened a register with 1 owner per risk.
Frequently asked questions
What is the difference between a risk and a problem?
A risk is a future, uncertain event (it may happen); a problem is a risk that materialized (it is here, now). Managing risks means addressing threats while they are still risks — far cheaper than in an emergency. Anticipating means preparing a response coldly; managing a problem means reacting urgently with fewer options.
Is a risk always negative?
Most often we speak of threats, but positive risks (opportunities) exist: an uncertain event that would help the project. Strategies then reverse. In practice, most effort goes to threats, but watching opportunities distinguishes mature steering.
Bilal scores each risk before acting. How does he prioritize?