Project Risk Management Literature Review

This assignment requires a comprehensive literature review of recent publications on project risk management. It involves analyzing various aspects of risk identification, assessment, mitigation, and control within project contexts. The review should synthesize key findings, identify emerging trends, and highlight the importance of effective risk management for project success.

TOPIC: RISK MANAGEMENT ANALYSIS
NAME
STUDENT ID
SUBJECT
DATE
1

Table of Contents
INTRODUCTION.....................................................................................................................................1
RISK MANAGEMENT PROCESS.........................................................................................................2
Risk Context Establishment..................................................................................................................2
Risk Identification.................................................................................................................................2
Risk Estimation......................................................................................................................................3
Risk Assessment and Evaluation..........................................................................................................4
Risk Control or Mitigation...................................................................................................................4
Risk Monitoring and Review................................................................................................................5
Risk Matrix..........................................................................................................................................6
RISK MANAGEMENT PLAN.................................................................................................................6
Risk Avoidance......................................................................................................................................7
Sharing Risks.........................................................................................................................................7
Risk Acceptance.....................................................................................................................................7
Risk Control...........................................................................................................................................8
Risk Reduction.......................................................................................................................................8
Risk Transfer.........................................................................................................................................8
CONCLUSION..........................................................................................................................................8
REFERENCES..........................................................................................................................................9
2

INTRODUCTION
A risk can be defined as the potential or possibility of injury or loss occurrence. Business risks
are the aspects of a business organization with the potential capability of causing loss of value
for the business. Risk management is the identification, estimation, analysis, assessment and
acceptance or mitigation of business risks or threats (Ziemba and Kolasa, 2015). Business risks
can originate from different business operations like financial operations, human operations,
technical operations, production operations, advertising and marketing operations and legal
operations among others (Aven, 2016). Nowadays, risks management has become a very crucial
activity for most business organizations in the current modern business world. In the case of
digitalized companies, the IT security threats and data security risks have become a priority,
whereby the businesses have always devised various technique of managing the identified risks,
e.g. by effectively ide3ntifying and controlling data and IT appliance and device threats
especially in the organizational data assets (De Bakker et al, 2011). However, a business
enterprise can mitigate these risks by avoiding, accepting, controlling, risk assumption method,
risk retention methods and risk transfer method (Berg, 2010). In other words, it is important that
every business organizations builds and implements an effective and efficient risk management
plan so that it be in a better position to perform and achieve its objectives (Brustbauer, 2016).
Every business management team should ensure that there is timely and adequate risk
identification plan which will be able to achieve the risk management goal and objective (Cole et
al, 2017). This means that, there should be an effective risk management methodology as well,
even in a business project. Additionally, a business enterprise should ensure that its plans,
policies and procedures that relate to business risks are also effective and efficient especially
when it comes to achieving the risk management standards. Risk management is a process that is
actually undertaken by risk experts and professional (Chance and Brooks, 2015). These
professionals basically analyze and assess different business departments and operations and
roles including the insurance sector, business continuity status, human or employee welfare,
health and safety, business’s corporate governance and business financial sector to name just but
a few. This means that this process should be able to attain the main principles of risk
management set up by the International Organization for Standardization which include aspects
like: business value creation, inclusion in the decision making process, be systematically
3

structure process, be flexible and iterative especially to change, have the capability of being
improved and advanced when need be among others.
RISK MANAGEMENT PROCESS
A risk management process should be preceded by a risk management plan which indicates
various ways and methods of managing the risks (Cagno et al, 2008). Every risk management
process should be certain of achieving and attaining the required standards and guidelines
provided by the International Organization for Standardization (ISO). The project that I will be
referring to is the development and advancement of information technology appliances in an
Izteck Company. A risk management process involves the following steps:
Risk Context Establishment
This step involves the assessment of the circumstances under which a risk may occur. The risk
management team should evaluate and analyze the relationship between the organization and the
environment in which the risk is likely to occur. For instance, the team can assess the status of a
specific organizational department, e.g. information technology department and the overall
environment surrounding the business. By doing this, the team will have established and
identified the boundaries where the risk is bound to occur. Therefore, in this first step, the team
should consider evaluating both the external and internal environment of the organization, i.e.
employees, business goals and objectives, business stakeholders among other things (Didraga,
2013).
Risk Identification
This step basically involves the identification of potential risks in specifics. This involves
analyzing and evaluating their origin or causes. Generally, this step involves identifying the
business aspects that have the capability of causing risks. Just as mentioned earlier, most risks
that occur in most businesses originate from the sources like, human resource sector, financial
sector, information and technology sector, operations sector, technical sector and political sector
of a business to name just but a few. The risk management team of specialists should therefore
focus on evaluating and analyzing every step and activity involves in most of these sectors to be
able to identify the risks that can occur there (Ennouri, 2013). There are different approaches that
can be used to identify these risks:
4

 The risk management team can opt to ask the employees who work in those departments
and sections of the business organization. By asking them, they will be able to get more
information on how to identify he risks that are involved in those sectors (Glendon et al,
2016).
 The team can also ask for information and assistance from other risk management leaders
who may have dealt with identification of risks in such organizations or sectors earlier. If
it is in a business project, the risk management team leaders should take advice from
prior leaders who may have run such projects. In other words, this process involves face-
to-face interaction of the parties to encourage open communication and trust.
 To effectively identify business risks, the team leaders should focus on evaluating and
analyzing all of the business systems, processes and structure that may be used. These are
used in identifying the risks because these are some of the sources of business risks
themselves.
 The risk management team also identify business risks by revisiting prior databases that
contain any useful information that relates to risks that may have already occurred in the
business.
Therefore, the identification stage is used to point out possible risks and define them in the best
way possible by listing and analyzing the possible effects or impacts that may be caused by those
risks. In my project, the risk management team must therefore be in a position to point out the
possible risks and impact of consequences that may affect the technological appliances in Izteck
Company which may include aspects like: data theft, software attack and security breaches,
malicious programs and software attacks among others.
Risk Estimation
In this stage, the business should determine the probability of the occurrence of the identified
risk. Additionally, the risk analysis team must determine the potential consequences or impacts
that may arise or caused by the occurrence of the risk. This basically means estimation of risk
value which can be calculated by multiplying the probability of the risk occurring with the cost
of the risk. In other words, the main goal for risk estimation is simply to understand each risk in
a specific way by understanding its occurrence chances and the impacts that it can cause to a
business operation (Grimaldi et al, 2012).
5

Risk Assessment and Evaluation
After the probability of the risk occurrence is determined together with the impacts or
consequences involves in case it occurs. The risk is evaluated so that the business managers can
be able to identify the sensible measures that can be taken to control and mitigate the risks.
Through risk assessment and evaluation, a business will get the opportunity to know whether the
risk is worth taking or leaving. Therefore, this process of risk assessment is very crucial because
it determines the decision to be made in terms of prioritizing a risk implementation plan. This
means that the risk assessment and evaluation involves analyzing the probability of risk
occurring, its impact, exposure and the other possible risk measures that can change or alter the
priority or plan made about the risk occurrence (Grace et al, 2015). When the risks are listed
according to their order of priority, the risk with more or highest impact of consequences should
be the one to be managed first. Risk prioritizing can be evaluated by use of aspects like their
likelihood or rater probability and impact of consequences.
The likelihood of risks can be based on a 1-5 scale whereby 1 represents rare, 2 represent
unlikelihood, 3 represent possible, 4 represent likelihood and 5 represent almost certain. On the
other hand, the impact of risk consequences can be determined based on a 1-5 scale whereby 1
represents negligible, 2 represents minor, 3 represents moderate, 4 represents major and 5
represents catastrophic. To be clear, it is important to note that the higher or greater the
combination of scales, the more the risk should be prioritized for mitigation. This means that if
the risk management team is almost certain that the risk will occur and that the impact of
consequences once it occurs are catastrophic, then that particular risk should be handles and
mitigated being the first.
Risk Control or Mitigation
When the risk has been evaluated, then the management must have acquired some ideas on how
it can be controlled or mitigated. In this step, the risk management team basically revisits the list
of risks identified according to their priority and develops a plan on how to mitigate them using
specific risk control measures. This process most involves some of the following steps: hazard
elimination, substitution of the hazard, isolation of the hazard, exercising restrictive control over
the hard among other things (Rabechini Junior and Monteiro de Carvalho, 2013). In addition to
that, the following risk control measures and approaches are commonly used: risk acceptance,
6

risk reduction, risk transfer, risk retaining to name a few. All of the latter measures are then kept
into account and documented for future use and reference when need be. As for my project, the
team should be able to list possible measures that can help implement the risk control measures,
e.g. building a security fire wall to protect the technological appliances from malicious attacks,
data theft and breaches.
Risk Monitoring and Review
This step involves revisiting the whole risk management process and evaluating all the steps
deeper with an aim of correcting possible mistakes done. The step is also used to track the
progress of all the identified risks with the inclusion of wanting to identify other related or
upcoming risks. Basically, in this stage, the risk management team’s objective is to be able to
understand the mitigation measures taken, their effects on the risks and possible hazard that the
risk may have developed in the course of time (Rabechini Junior and Carvalho, 2013). If the risk
does not pose any hazard after the control measure is implemented, the risk management process
is deemed as successful but in case the risk still poses more additional risks then the measure and
the risk management process is said to have failed (Harding, 2015). The main goal for this stage
is to ensure that risks mitigation measures actually pose an effect to the risk itself and that it
reduces its impact of consequences.
7

Risk Matrix
RISK MANAGEMENT PLAN
Risk management plan is a documentation that is prepared by a managers, e.g. project managers
for the purpose of guiding them towards effective and efficient risk management. The plan is
meant to guide then on identifying the potential risks, estimate their effects on the business and
identifies different methods for managing the risks (Rodrigues-da-Silva and Crispim, 2014). In
most cases, business organizations implement various strategies when it comes to managing
risks. However, these risks management strategies are basically implemented according to the
types, impacts on the organizational operations and the various ways to mitigate those risks
(Grabara et al, 2016). In additionally to that, the risks strategies are provided and implemented
according to their origin or cause. For instance, a risk that is likely to be caused by entire
business image is to be managed by the top management team of a business while a risk that
related to information technology (IT) and other electronic appliances and devices is to be
managed by the business IT department or experts. Therefore, risk management plan is a very
8

fundamental aspect for a risk management analysis plan for every business. The following
strategies are popular and commonly used in most businesses to mitigate or manage their risks:
Risk Avoidance
When a business implements such a strategy, then its aim is to completely avoid the risk,
basically not to be involved with the risk at all. In this case, the business’s objective is to assume
that the risk will not happen or that it does not exists. For instance, if the business is planning on
engaging in a certain project or business venture, then it can avoid the risks that relate to such
project or venture by: not venturing into the venture at all or passing on or skipping the project
itself. Many business that implement such a management strategy are those that have the
realization that no matter the case (whether they take the risk or fail to take the risk), the project
or venture will not beneficial to its operations at all (Sanchez et al, 2009). Additionally, a risk
can be avoided if the costs involved in taking the risk are actually not worth it, there is a
probability of loss occurrence than profit realization for the business.
Sharing Risks
Sometime, the consequences caused and involved in a risk can be shared between many parties
or rather other third parties. Besides that, the consequences can also be distributed among many
participants (especially in a project) or various business departments (Schroeder and Hatton,
2012). This means that, the profits or losses caused by any potential business risk is to be shared
equally or according to shares owned. For instance, a business shares a project or business
venture with another organization.
Risk Acceptance
It is also known as risk retention strategy or approach. This is basically the last option for every
organization that is willing to take or be involved in a risk. This type of approach is used when
businesses realize that they have no other option of preventing or mitigating the risks.
Additionally, it is also applicable when the cost of potential loss from the risk is less than the
cost of insuring the business from the specific risk. Also, when the future profit realization or
gain is higher and when the risk is worth accepting. For a business to accept a risk, it should
always conduct an impact analysis to be able to determine the levels of consequences and effects
that may arise in case the risk is accepted (Shimizu et al, 2012). This is simply because even
9

when the risk is accepted and the consequences are extremely negative and bring losses, it is
easier for the business to come up with a contingency plan to cope with the impacts.
Risk Control
This is simply known as risk mitigation approach. It is applicable when business have already
decided to take up the risk. Therefore, the business must improvise preventive or detective
actions that can help it manage the risk. Through this actions, the business managers will be able
to reduce the impact or the likelihood of risk occurrence. Preventive action aims at preventing
the occurrence of a high risk situation. May include practicing and implementing issues to do
with employee health and safety through training, building of security firewalls and protection
programs to reduce data theft or IT security breach and insecurity to name a few things
(Gutteling, 2015). The detective actions can referred to actions that relate to the identification of
weak points in a business operations which can attract the occurrence of a risk or threat.
Additionally, the risk detective actions also involve different ways to correct these areas of
weakness in the effective methods.
Risk Reduction
Sometimes, business enterprises have the capability of reducing the impact caused and involved
in a risk in case it occurs. This means that some organizations can reduce the level and rates of
effects that a risk can cause to its daily operations. For instance, a business that has a plan to
venture into a new business, can reduce the effects of a risk by reducing the scope of the venture.
Risk Transfer
In this strategy, a business entity passes on the risk or rather shifts the risk from itself to another
party, i.e. the third party. In such a scenario, business must have identified the potential risk and
estimated its effects which in most cases the organization finds it difficult to prevent or manage
the potential consequences (Toth and Sebestyen, 2016). Most of the cases where risks are
transferred is when a business insures its assets or employees. In this case, on the occurrence of
the insured risk, the costs or effects of the risks are shifted to the insurance company or insurer.
10

CONCLUSION
Risk management is the identification, assessment and prioritization of risks with the aim of
controlling and mitigating their impact of consequences. Risk management involves the
coordination and implementation of economical measure with the aim of minimizing, monitoring
and controlling the probability of risk occurrence and the impacts of their consequences. Risk
management has become a very essential process and practice for most business organizations
nowadays. This is simply because of the increase in the use of modern technology to conduct and
perform business operations. However, the technological advancement has caused and allowed
the opportunity for high risk occurrence. Therefore, business have decided to invest in this
practice so that they can be able their goals and objectives without any hindrances. Risk
management process and strategies are two main aspects that make up the risk management
analysis process. Therefore, it is important for every organization to identify the most effective
risk management team that will be able to follow the risk management process and implement
the best strategies or approaches to tackle the business risks.
11

REFERENCES
Aven, T., 2016. Risk assessment and risk management: Review of recent advances on their
foundation. European Journal of Operational Research, 253(1), pp.1-13.
Berg, H.P., 2010. Risk management: procedures, methods and experiences. Risk
Management, 1(17), pp.79-95.
Brustbauer, J., 2016. Enterprise risk management in SMEs: Towards a structural
model. International Small Business Journal, 34(1), pp.70-85.
Cagno, E., Caron, F. and Mancini, M., 2008. Dynamic analysis of project risk. International
Journal of Risk Assessment and Management, 10(1-2), pp.70-87.
Cagliano, A.C., Grimaldi, S. and Rafele, C., 2015. Choosing project risk management
techniques. A theoretical framework. Journal of Risk Research, 18(2), pp.232-248.
Chance, D.M. and Brooks, R., 2015. Introduction to derivatives and risk management. Cengage
Learning.
Cole, S., Giné, X. and Vickery, J., 2017. How does risk management influence production
decisions? Evidence from a field experiment. The Review of Financial Studies, 30(6), pp.1935-
1970.
De Bakker, K., Boonstra, A. and Wortmann, H., 2011. Risk management affecting IS/IT project
success through communicative action. Project Management Journal, 42(3), pp.75-90.
Didraga, O., 2013. The role and the effects of risk management in IT projects
success. Informatica Economica, 17(1), p.86.
Ennouri, W., 2013. Risks management: new literature review. Polish Journal of Management
Studies, 8, pp.288-297.
Glendon, A.I., Clarke, S. and McKenna, E., 2016. Human safety and risk management. Crc
Press.
Grabara, J.K., Okwiet, B. and Kot, S., 2016. Managing of Work Risk in Small and Medium-Size
Companies. World Academy of Science, Engineering and Technology, International Journal of
12

Social, Behavioral, Educational, Economic, Business and Industrial Engineering, 10(11),
pp.3524-3529.
Grace, M.F., Leverty, J.T., Phillips, R.D. and Shimpi, P., 2015. The value of investing in
enterprise risk management. Journal of Risk and Insurance, 82(2), pp.289-316.
Grimaldi, S., Rafele, C. and Cagliano, A.C., 2012. A Framework to Select Techniques
Supporting Project Risk Management. In Risk Management-Current Issues and Challenges.
InTech.
Gutteling, J.M., 2015. Risk communication. John Wiley & Sons, Inc..
Harding, J., 2012. Avoiding project failures. Chemical Engineering, 119(13), p.51.
Rabechini Junior, R. and Monteiro de Carvalho, M., 2013. Understanding the impact of project
risk management on project performance: An empirical study. Journal of technology
management & innovation, 8, pp.6-6.
Rabechini Junior, R. and Carvalho, M.M.D., 2013. Relationship between risk management and
project success. Production, 23(3), pp.570-581.
Rodrigues-da-Silva, L.H. and Crispim, J.A., 2014. The project risk management process, a
preliminary study. Procedia technology, 16, pp.943-949.
Sanchez, H., Robert, B., Bourgault, M. and Pellerin, R., 2009. Risk management applied to
projects, programs, and portfolios. International journal of managing projects in Business, 2(1),
pp.14-35.
Schroeder, K. and Hatton, M., 2012. Rethinking risk in development projects: from management
to resilience. Development in Practice, 22(3), pp.409-416.
Shimizu, T., Won Park, Y. and Hong, P., 2012. Project managers for risk management: case for
Japan. Benchmarking: An International Journal, 19(4/5), pp.532-547.
Toth, T. and Sebestyen, Z., 2016. Project Risk Management Process for Professionals: A Value-
Based Approach. In Managing Project Risks for Competitive Advantage in Changing Business
Environments (pp. 128-149). IGI Global.
13

Ziemba, E. and Kolasa, I., 2015, September. Risk factors framework for information systems
projects in public organizations-insight from Poland. In Computer Science and Information
Systems (FedCSIS), 2015 Federated Conference on (pp. 1575-1583). IEEE.
14