All projects have risks and the risks have the potential for negatively impacting the project. (I am not referring to opportunity (positive) risk.) You use risk management to determine the risks that are important enough to manage. The following four techniques will help.
Try to Include Budget and Schedule for Unknown Risks
A project manager can request additional budget and schedule to account for known risks at the beginning of a project. Of course, the risk contingency does not include the full impact of risk. Instead you multiply impact by the percentage likelihood for all high risks. Then add the numbers to come up with a risk contingency budget and schedule.
However, risk identification is not something that only happens at the beginning of a project. The project manager assesses risks throughout the project. Therefore, it makes sense to include time and budget for unknown risks as a part of your estimating process. If you do an effective job of periodically reassessing risks, you may find new risks to manage that were not included in the original risk contingency budget. You can include some additional contingency budget and schedule for these as well.
If your organization does not allow a risk contingency budget, you would naturally account for risk uncertainly in your base budget estimates.
Include Team Members in Risk Identification
If team members are familiar with the circumstances of the project, they can take an active role in identifying and evaluating project risks. Joint participation from the team can help identify project risks, lay out effective actions to manage the risk and provide consensus and buy-in for execution.
Weigh the Cost of the Risk Management Plan Against the Level of Risk
The activities associated with managing risks have a cost. The project manager should make sure that the effort and cost associated with managing the risks do not exceed the impact to the project if the risk occurs. For high risks, this is normally not the case. However, for medium risks make sure that the costs of managing the risk is not more than the risk impact to the project.
Understand the Risk Tolerance Level in Your Organization
During the risk identification process, you may encounter many risks that have some likelihood and impact to the project. Which ones do you think are important enough to manage? The answer says something about your risk tolerance.
Risk tolerance is usually cultural in an organization. Some organizations are bigger risk takers and will accept a higher level of risk on projects. They will also tend to have a higher threshold before they chose to manage a risk. On the other hand, some organizations are more risk-averse. They will tend to accept less risky projects and they will also tend to have a lower threshold to manage risks.