Risk identification is the first step in a complete risk analysis, given that the objectives of the decision maker have been well defined. There are a number of techniques used to help formalize the identification of risks. This part of a risk analysis will often prove to be the most informative and constructive element of the whole process and should be executed with care. The organizations participating in a formal risk analysis should take pains to create an open and blameless environment in which expressions of concern and doubt can be freely given.
Prompt lists are used to help ensure that all aspects are covered when attempting to identify risks. A prompt list categorizes risks into types or areas and is usually specific to a project type and an organization's function. It is prudent to consider more than one type of prompt list in order to maximize the chance of identifying each possible risk. For example, in analyzing the risks to some project, one prompt list might look at various aspects of the project (e.g. legal, commercial, technical, etc.) or types of tasks involved in the project (design, construction, testing). A project plan and a work breakdown structure, with all of the major tasks defined, are natural prompt lists. In analyzing the reliability of some manufacturing plant, a list of different types of failure (mechanical, electrical, electronic, human, etc.) or a list of the machines or processes involved could be used. One could also cross-check with a plan of the site or a flow diagram of the manufacturing process.
A prompt list should not be considered exhaustive but simply as a focus of attention in the identification of risks. Whether a risk falls into one category or another should not be of great concern, only that the risk is identified. The following list provides an example of a fairly general project prompt list. There will often be a number of sub-sections for each category:
Knowledge and information
Brainstorming is a general technique that can be used for identifying a project's risks, pooling the available information on each risk, and identifying possible risk management options. It involves gathering together a group of project stakeholders under the direction of a neutral and reasonably strong-willed chairperson. It is prudent to have instructed these people well before the meeting what one is hoping to achieve, together perhaps with some explanation of the meaning of a "risk' and an "opportunity'. They may also have been given prompt lists to think about, project GANTT charts or any other means for helping them focus on the task. Suggesting that one should also consider opportunities adds a certain optimism that balances the rather pessimistic search for risks, although admittedly the ratio of risks to opportunities may well end up in the region of 10:1. The chairperson's role is to structure the meeting so that all relevant aspects of the project are considered. A prompt list is often useful in this regard. The participants are encouraged to identify risks that they feel could impact on the project. The chairperson tries to ensure that a blameless and honest environment is maintained and that each person is allowed to express his or her opinion regardless of status or personality. The chairperson may also have to question the group when he or she feels that certain areas are being ignored (this is sometimes not very popular). The group is encouraged to discuss each risk as it is identified and what may be done to reduce its probability and impacts. This aspect of a brainstorming session can be particularly valuable as newly identified risks can often be reduced, eliminated or discounted by agreed actions or extra information supplied from the parties sitting around the table.
Brainstorming sessions are sometimes difficult to organize since they require key (usually very busy) people involved in a project to be in the one place at the same time. They are also expensive in terms of personnel. Minutes from a brainstorming session should be circulated to the participants, so the chairperson can keep the group focused. The chairperson (risk analyst) then arranges meetings with each of the individuals to discuss the relevant risks and to collect their estimates of each risk's probability and impacts. We have found that a rather more frank list of risks often appears as a result of these one-to-one meetings, especially if, as chairperson, one collates the identified risks without recording the originator. Eliciting individual estimates of risks is also a very good check on whether there is a consensus.