Project Management Stack Exchange is a question and answer site for project managers. It only takes a minute to sign up.
Sign up to join this community
I have analysed the possible risks of my project, and I do intend to get back to them from time to time and make sure that the project is safe.
I am trying to figure out how often I should check them, trying to avoid risks as much as possible, while spending not more then the necessary time.
How often should risk management be analysed and tracked?
Risk management is an ongoing process. Both Ashes and David have pointed that out clearly. Some of my own practices are:
Your total risk exposure should decline over the course of the project. That means it has to be actively planned and managed that way.
It depends on your project. At a minimum, I would recommend reviewing them once a week. Your goal in a review is to:
If your project can tolerate it, and will benefit from it, track risk more frequently. In Agile software development projects with two-week release cycles (small, frequent releases) we used to track risks daily. The best risk updates were "nothing new here."
Also, it's something of a best-practice to have the whole team help in identifying and monitoring risks, not just the PMs.
The identification and its subsequent risk analysis and COA decisions are ongoing. Your risk capability should have a vehicle in which each and every project team member and other stakeholders can escalate a potential threat on a daily basis. This part of the process should not be "scheduled", but rather simply a fluid trigger.
Each discrete risk captured on your risk database has its own schedule for progress updates, briefings, and oversight. Some will require daily updates sequel to the threat and overall exposure while others may only need monitoring on a monthly, quarterly, or other basis. The team assigned to mitigate can recommend the schedule and PM can put a requirement out there, too. The points here is to let the threat dictate reporting and update requirements.
Formal update briefings to leadership and client can be scheduled on a set frequency. No right answer here; it will depend on many factors and, of course, overall agreement to all the parties involved.
The other answers are correct; I don't disagree with them. I would like to add a couple of supplementary notes.
First, the frequency of updates depends on the size, complexity and velocity of the project, and on the priority your stakeholders give to risk management. Yes, risk management should be continuous, but if the project is not staffed for a full time risk manager, you're going to have to fit the updates in as time permits. Remember that the critical thing you want to do is to warn your stakeholders in time to productively intervene. If your work packages average a week long and you've got a dozen or more in progress at any time, then monthly updates will not permit timely intervention. If your work packages extend over multiple quarters and you've got only a few in progress, monthly may work.
Second, although I update my risk registry monthly, that's somewhat deceptive. The driver is that each risk has an urgency; I mark each risk with the date of next review. Some high level risks (high probability, high impact) don't vary by much. Some risks are dependent on political events that have very fixed deadlines and won't change till then. If you capture the urgency of the risk as the next date on which it could potentially change, then you can review the risk registry very quickly/economically.
