Risks can have a classification system. This system classifies risks in relation to their locus of action. That is the organisational level at which the risk will have the most impact.
Project Risks: are those risks within the project boundary that could affect the delivery of the business outcome that the project is set up to deliver. In other words, those that could affect the delivery of the project’s objectives.
Business Risks: on the other hand are those risks that affect the operation of the business outcome once it has been delivered by the project.
Environmental Risks: are those risks that are external to the project environment but which nevertheless can affect the project objectives. For example, the Gulf War had a devastating effect upon gas field projects in Kuwait in 1990.
External change risks: are those risks that are beyond the immediate project environment but which could have a major impact. Frequently in contractual terms these may include force majeure events. However, external change risks go beyond force majeure, for example because of a shift in Government policy or in its interpretation of a law.
The main aims of risk management are to:
Identify potential risks;
Assess the probability and impact of each risk;
Identify alternative actions that prevent the risk from happening (avoidance), or if it does happen ameliorate the impact (reduction), or provide a strategy for dealing with the accepted consequences of such a risk occurring (acceptance);
Implement and monitor those actions that are cost effective and necessary to the successful delivery of the project objectives (NB: project objectives not project);
Provide feedback from experiential learning to improve the risk management of future projects and to inform the training and development of project managers.
Risk Management is therefore an integral part of project management - not an additional extra. It should be used to drive, inform