14 Common Project Risks (+ more)

Risks matter. Stuff happens on projects, and if the worst happens, it’s better to know about it in advance.

That’s the point of risk management: thinking about what might go wrong before it does, so you can put a plan together to deal with it if it does.

There’s a lot of uncertainty and hedging in that sentence: “if…” “might…”

But that’s the whole premise of dealing with the unknown.

However, at the beginning of your project when your risk log is empty, it can be a bit of a challenge to think of all the stuff that might need to go on there. We have the solution! In this article we’ll look at common project risks so you can start filling up your risk log and making the right plans.

What’s a risk again?

The PMI definition of risk is:

“an uncertain event or condition that, if it occurs, has a positive or negative effect on a project’s objectives.”

Yep, risks can be a good thing – with a positive effect. However, most stakeholders are more worried (in my experience) about the stuff that can go wrong, so project managers typically put more emphasis on thinking about the negative.

Or maybe we’re all pessimists, who knows.

The causes of risk vary by project, but the need to identify it is a constant where a project manager adds value. It’s our job to facilitate the discussion and extract those risks so they can be actively managed: that’s the risk management process.

It helps to think of risks in categories. Below, you’ll see several different kinds of risk so that you can identify these in your own projects and begin your risk log. The project type you are working on will affect the kinds of risks you see, so pick and choose and by no means consider the list below a definitive list! Use your professional judgement and add the others you need.

Internal risks

There are multiple categories of risk, with internal and external being two of the most common.

Internal risks occur within the organization. As such, you may have a bit more influence on these if appropriate actions are taken early.

Some examples of internal risk are:

1. Lack of support

Once common risk is lack of support from a key project sponsor. As the excitement of a project fades, you might see sponsors stop attending meetings, not making key decisions, or not showing much interest in the project’s success.

If you start to notice this type of behavior, it is often best to share your concern right away. The sponsor may not realize the potential impact on the project, so be prepared to explain the importance of their support.

Lack of support means missing a project deadline (or more than one) as well as spending your precious time on something that the company doesn’t act like it values.

2. Lack of resources

This could be due to staffing levels or other projects being staffed instead due to higher business priority. As you are planning a project, pay attention to the ebb and flow of the staffing levels from start to finish.

If there are any periods where you think there may be a gap in available staffing, say something early.

3. Poorly understood requirements

To be successful, a project manager and team should understand the desired product’s details and what is required at delivery. If there is confusion or a general lack of clarity on the requirements, that can ultimately lead to quality issues and project failure.

Uncontrolled change can also mess up your requirements, so don’t forget to put that on the log!

Be sure to speak up and then take the time to guide the project team and stakeholders though the decision-making process.

A common mitigating action for internal risk is to make sure you have enough time to bring all stakeholders on board and to garner the support needed. Plus, there should be a business case for the project!

External risks

External risks can occur due to a variety of factors, often caused by influences more outside of our immediate control.

External risk examples:

4. Customer Misalignment

There is always the possibility of customer misalignment when it comes to project scope and deliverables.

Worst case, this could prevent final acceptance for some part(s) or even the entire project. Treat this accordingly by discussing and clarifying even during the proposal phase. The project kickoff meeting is another opportunity to provide clarity around the project and associated deliverables.

5. Local labor availability

Local labor is an easy project risk to overlook. Depending on where work is being performed, the local labor market may lack enough people, enough sufficiently skilled people, or both.

Labor strikes might also be an issue, depending on the type of resources you need.

In cases like this the project typically needs to “create” their own resource pool by providing training so that the entire team can perform their assigned work.

Project team risk

Here is a list of common project team risks.

6. Lack of experience or training

When you have a new team, especially people who are new to the company, they may require some additional training. There is an efficiency/schedule/cost risk and cost of potential training to think about.

Training up people can be hard work when you already have a full-on project schedule to run. Think about who is going to take that responsibility and the extra time and cost needed to get people to perform their roles at full capacity.

7. Inefficiency that increases hours and cost

There are multiple types of inefficiency – one is multiple projects and the other is more due to lack of skills.

For multiple projects, there can be an impact caused by ‘task switching’ between projects. This can cause some tasks to take more time than normal due to starting and stopping multiple times. Be aware that team members working on too many projects can create issues.

8. Team transitions and leaving job/company

While we cannot prevent people from leaving their jobs, we can do our best to help plan. One of the best ways I have found is to document – this includes meeting minutes, training materials, project scope and charter, key decisions, project schedule baseline, change logs, etc.

That is especially helpful if you move on and a new project manager will come on board later.

9. Team members with negative impact on team and morale

There may be times when issues come from the team members themselves. Be aware of that and always keep the team’s collective well-being in mind.

Project Budget Risks

Monitoring the project’s finances and cost throughout the project lifecycle is a key responsibility. Project stakeholders are particularly sensitive to cost and potential overruns, especially is the project’s results impact their budget. Here is a list of common project cost risks.

10. Reduced budget

Sometimes a project budget needs to be reduced to help the company at large. When this happens, it is often with little advanced warning, but the impact can be very real. This is another reason why current project documentation is essential – you will know exactly what is done, what is left, and where things stand.

Project costs do naturally change over time, but if you have been on the receiving end of being told your budget has been halved (any hands up?) then you’ll know this is worth documenting.

You document it on the risk log even though you realistically can’t do much about it, because then at least when (if) it happens you can point to the risk and say, “That’s why you can’t have all those shiny features you were wanting.” It also keeps the conversation channels open about how much money the project needs to get done.

You might be able to mitigate this risk with cheaper resources, but allow extra time for them to do their work as lower-cost people tend to not have the same skills (and therefore efficiency) as higher-cost resources.

Save time with the Project Workbook and Budget Tracker, which includes everything you need to start tracking your project today. Includes a RAID log and a guide on how to use it.

11. Higher cost resources

For various reasons, you may be assigned resources with a higher cost than the original project basis, in the business case. While you may not be able to change their respective cost, you can opt to use some project contingency.

One key thing with this if it does happen, is that the impact on the project financials should be quantified right away as part of the discussion and agreement with management. Go through the work breakdown structure (if you are using one) and identify the tasks that are affected by using a more expensive resource.

12. Currency fluctuations for international projects

This can happen. You will typically have a financial counterpart who will mind the details but knowing that it may need to be considered is part of the job.

Take appropriate steps so that their actions and decisions either protect or hopefully improve the project’s financial standing. The use of a project metric such as cost performance index (CPI) can act as a leading indicator of project financial health.

Schedule risks

Project schedule risk is another key area, especially as your project stakeholders will typically remember target completion dates. Plus, your project plan is a high-profile document that you’ll be sharing around often, in various formats.

Monitor schedule progress throughout a project; a metric like schedule performance index (SPI) is often quite helpful for this.

In some cases, there may be contractual incentives for early completion and even penalties for late delivery. Some common potential risks for scheduling include:

13. Changing dates

Dates might change, and that will have an impact on your plan. For example, a supplier may not be able to source materials and a delivery will be late. Or a key meeting will be postponed and that delays being able to make a decision for another week.

Your contingency plan is mitigating these risks by having a schedule buffer in the timescales, just in case you need it.

14. Poor estimating

Sometimes the estimates are just rubbish. This can happen for new and unique work where the team has no prior experience of doing the work. Don’t consider it a reflection of your project management ability. More and more, estimating is getting harder (in my opinion).

It may also happen where you have subject matter experts or knowledge workers on the team who are supporting multiple projects and don’t always have full agency over how they spend their time.

Sometimes the estimates are wrong; other times something else happens to disrupt your estimate. Either way, estimating issues are a risk to your schedule.

Other common risk categories

Still not got enough on your risk log? Here are some different types of risks to consider as you brainstorm what needs to be planned for.

Performance risk

At some point in a project, or likely at several times during a project, product performance will be evaluated and/or tested. Those test results will likely be documented and criteria for performance should be met.

Be aware of any performance testing dates, requirements, etc. in your project. Also be sure to account for any performance testing-related items such as the cost of travel, the cost of any equipment, any new equipment you may need to purchase to perform tests, or even the cost of certifications by a third party, if applicable.

Example risks:

• Performance testing requirements are not met
• Performance testing criteria are not set in time/are not meaningful
• Certification is delayed due to unforeseen circumstances

The amount of risk you may see from this category depends on what you are delivering.

Governance risk

Certain industries have specific governance requirements. One common example are projects in the healthcare industry. There are requirements for how to manage and protect patient data and privacy. Ensuring compliance with rules, regulations, and legal requirements may require additional effort, checks, or input from a compliance expert.

There’s also a risk that new regulation is introduced during the life of the project and you have to comply (been there, done that!).

Common risks:

• New regulation is introduced mid-project
• Team is not experienced enough to incorporate regulatory requirements

Strategic risk

One potential strategic risk is that a project’s relevance and/or priority within the organization changes. That could mean the loss of key resources due to a higher priority or all-hands-on-deck situation.

Example risks:

• Strategy changes mid-way through the project
• Project sponsor changes which has an impact on the strategic direction of the project
• Key resources are moved on to a higher priority project resulting in delays
• Project objectives change unexpectedly to reflect new strategy etc

Legal risk

Ever worked with a supplier on the brink of bankruptcy? Or found yourself on the wrong end of an unfavorable contract clause?

Watch out for risks resulting from your legal and contractual obligations such as incentives and penalties for early or late completion, respectively.

Another type of legal risk is failure to deliver the complete project scope, either through technical challenge(s) that the team was unable to solve or other factors. Always be mindful of your contract, scope of work, and any master service agreement that may be in place.

Example legal risks:

• Contract might not be signed in time and work begins anyway
• Team does not understand the contract
• Contract is unenforceable in certain circumstances
• Complex contracting models are difficult to manage and sub-contractor performance results in delays or additional risk

Legal risks might be the easiest to deal with because an in-house lawyer can typically advise on what steps you could or should take.

Operational risk

If your project is tied to a larger operation, there may be inherent risks associated with that dependency. For example, in a manufacturing environment, things like annual shutdowns, planned and unplanned maintenance outages, labor disputes, and other factors tied to the operation can have an impact.

Think about the specific nuances of your project as it relates to the operation and be sure to involve knowledgeable people who can help plan and offer mitigations to help keep your project on track.

Example risks:

• Project is unable to put changes live in a timely fashion due to operational constraints
• Workforce is unavailable during certain time periods due to operational constraints

Catastrophic events

Depending on where you live, hurricanes and other natural disasters may be common. In 2020 we saw the rise of a global pandemic that fundamentally changed how we work. For external factors like this, think about ways this may impact how you meet, where, when, if you will have access to critical systems, and how you might communicate with your team.

Let’s hope that particular risk event isn’t something we need to plan for again, as hopefully, most of those tech and remote working options are now commonplace.

Example risks:

• Flooding might affect the server room
• Pandemic might make it harder to communicate with remote team members
• Natural disasters may break communication channels/introduce delays to work on the construction site

It’s hard to come up with mitigation strategies for catastrophic events. Consider a phone tree or multiple contact points for each person (phone, email, personal phone, WhatsApp, etc) as getting in touch with your colleagues is likely to be the first thing you’ll want to be able to do.

What if you can’t predict the risk?

You may have heard the term black swan in reference to projects. It is an unpredictable but catastrophic event – something like the housing market crash in 2008. We may not see them coming, but the best defense you can offer is providing honesty and transparency about your project status.

Your next steps

While project risk may be varied, and their nuances equally so, identifying them upfront in a project is very important. As a project manager, you should always be looking ahead and thinking about what MAY happen so that you can insulate your projects from the effects if the risk is realized.

Project risk management is a never-ending job. Dealing with risk is a necessary, and often thankless, part of the role. If risk is managed well, a project may appear ‘easy.’ Of course, when risks are realized that tends to attract much more attention from stakeholders – because now you’ve got an issue to fix!

The good news is that you can take simple actions to get on top of project risk management, whether you are starting a new project or finishing off something already in progress.

Your action steps are:

• Make sure all categories of risk mentioned above are represented in your risk log
• Check that one category isn’t overly represented i.e. that your risks appear to be balanced between the categories. That should help you identify if there are other areas where you need to do more risk identification.
• Complete the risk assessment for each risk
• Prioritize the risks and highlight the most important ones for your project.