Identifying risks
The risk management process is meant to:
- systematically find potential problems for the project and the product being created — identify risks;
- assess how likely such problems are and how severe the consequences are if they occur;
- define activities and work out technical solutions that reduce either the likelihood that they occur or the size of the negative consequences.
The main risk characteristics are:
| Characteristic name | Characteristic description |
|---|---|
| Risk category | Risks are of different kinds: project, product, technical, regulatory, and so on. Classifying risks by category lets you assign the work to employees with the matching skills and areas of responsibility. You can configure the risk category list for your work using the link in the caption of this field. |
| Probability | The list lets you set an estimate of how likely this risk is to occur. Risk probability must be reviewed systematically, because the context changes and work is done to reduce the probability. If needed, you can shorten or extend the list of probabilities by configuring the corresponding reference list. |
| Severity of damage | Specify the size (severity) of the damage if this risk occurs. Like probability, the severity of damage must be reviewed periodically. You can configure your own classification in the corresponding reference list. |
| Priority | This is a calculated attribute, formed from the risk probability and the severity of damage. The higher the priority, the more important it is to take action to remove this risk. |
| Status | Separates new risks from those the team is working on now (In progress) and those for which management or technical decisions have already been made (Managed). |
| Risk factor | Records possible sources of risks and groups them by this criterion, for example so that risk factors can be traced to the risks themselves. |
| Consequences | An analytical note on the possible consequences if this risk occurs. It can be prepared by an expert and then reviewed by the project group responsible for the risk management process. |
| Tasks | Links to tasks whose completion will reduce the probability that the risk occurs, or reduce the damage if the risk occurs. These tasks make up the action plan for lowering the risk priority. |
| Source and derived requirements | Links to requirements that formalize this risk or that place constraints (additional requirements) on the functional, non-functional, and other aspects of the software or equipment being produced. Derived requirements form the action plan intended to lower the risk priority. |
| Cost of the risk consequences | You can quantify the cost of the risk if it occurs. This can be an additional criterion for the severity of damage (and therefore for how significant the risk is). |
| Cost of risk reduction | The cost of the actions or decisions that must be taken to lower the risk priority. |