Types of Risk in Project Management
By Miley W. Merkhofer
The most common project risks are:
- Cost risk, typically escalation of project costs due to poor cost estimating accuracy and scope creep.
- Schedule risk, the risk that activities will take longer than expected. Slippages in schedule typically increase costs and, also, delay the receipt of project benefits, with a possible loss of competitive advantage.
- Performance risk, the risk that the project will fail to produce results consistent with project specifications.
There are many other types of risks of concern to projects. These risks can result in cost, schedule, or performance problems and create other types of adverse consequences for the organization. For example:
- Governance risk relates to board and management performance with regard to ethics, community stewardship, and company reputation.
- Strategic risks result from errors in strategy, such as choosing a technology that can’t be made to work.
- Operational risk includes risks from poor implementation and process problems such as procurement, production, and distribution.
- Market risks include competition, foreign exchange, commodity markets, and interest rate risk, as well as liquidity and credit risks.
- Legal risks arise from legal and regulatory obligations, including contract risks and litigation brought against the organization.
- Risks associated with external hazards, including storms, floods, and earthquakes; vandalism, sabotage, and terrorism; labor strikes; and civil unrest.
As indicated by these examples, project risks include both internal risks associated with successfully completing each stage of the project, plus risks that are beyond the control of the project team. These latter types include external risks that arise from outside the organization but affect the ultimate value to be derived from the project. In all cases, the seriousness of the risk depends on the nature and magnitude of the possible end consequences and their probabilities.
In addition to project risk, project deferral risk can be important. Project deferral risk refers to the risks associated with failing to do a project. Like project risk, project deferral risk can arise from any of the bulleted risk sources listed above (the second list). Project deferral risk can also occur if there is only a limited window of opportunity for conducting a project—if the project is not conducted now, there may be a risk that it might never be possible to effectively do it later.
Oftentimes, external risks contribute more to portfolio risk because they impact multiple projects simultaneously. For example, a pharmaceutical company’s R&D project is affected by the uncertain outcomes surrounding the specific compound involved, however many projects could be impacted by a change in regulations. Similarly, a petroleum firm’s exploration project depends on uncertainty over whether oil is present at the given location, but uncertainties over the market price of oil affect many projects. Likewise, a construction company might have many projects threatened by the external risk of an increase in steel or commodity prices.
Miley W. (Lee) Merkhofer, Ph.D., is an author and practitioner in the field of decision analysis who specializes in assisting organizations in implementing project portfolio management. He has served on advisory panels for several government agencies and has received grants and research awards for work in the area. Lee is an editor of the journal Decision Analysis.
Prior to becoming an independent consultant, Lee was a Partner of PriceWaterhouseCoopers, where he founded that organization’s capital allocation and project prioritization business practice. Lee is a founding partner of Folio Technologies LLC, a provider of web-based, project portfolio management software.
Lee received his Ph.D. in engineering economic systems from Stanford University. He is the author of the book Decision Science and Social Risk Management and co-author of the book Risk Assessment Methods..