Inherent Risk Factors

Inherent risks are those that exist based on the general characteristics of the project. These are risks that can appear regardless of the specific nature of the project.

None of the inherent risks mean that the project is in trouble. Many of these risk factors will be rated as low or medium-level risks. Even if you identify an inherent risk as high, other project factors will come into play as well. For instance, the checklist below states that a large project is inherently more risky that a smaller project. This is generally true. However, an experienced project manager can mitigate many risks associated with large project size. Also remember, if your project falls into a high-risk category, it does not mean you will not be successful. It only means that you should put plans into place to manage the risks.

This table below identifies characteristics that may imply risk, as well as criteria for knowing if it is high-risk and low-risk. Depending on where your project characteristics fall, you can evaluate whether your risk is high, medium or low. This type of checklist can be especially valuable if your organization customizes the risk characteristics and risk criteria and makes them available to all project managers. For instance, you may find in your organization a project of less than 5,000 hours is considered low risk, while one that is 20,000 hours or more is high risk.

If your projects have an end-of project review meeting, the teams can look back and document the risks the project faced, the risk response plan the team executed and the results. The results can be consolidated and summarized in a Risk Factors Checklist that is based on the key learnings and best practices of your own organization.

In the table below, medium-level risks would fall somewhere in the middle of the high and low risk. For instance if your team size is 15, it would be a medium-level risk. Likewise you could have a medium risk if your project scope / deliverables are better than “poorly-defined” and worse than “well-defined”. This could be the case if some deliverables were poorly-defined and some were well-defined.

The following checklist can be used to determine whether there are inherent risks on your project that you have not considered yet.

Characteristic	High Risk	Low Risk
Total effort hours	Large project > 2500 hours	Small project <>
Duration	Longer than 12 months	Less than 3 months
Team size	Over 25 members	Fewer than 5
Number of clients or client organizations	More than three	One
Project scope / deliverables	Poorly-defined	Well-defined
Business benefit	Not clear (should not start the project)	Well-defined
Project team and client business knowledge	Neither the project team nor the client have solid business knowledge	Both the project team and the client have solid business knowledge
Requirements	Very complex, hard for client to define	Easy for client to define
Dependency on other projects or outside teams	Dependent on three or more outside projects or teams	No more than one dependency on an outside project or team
Project sponsorship	Unknown (should not start the project)	Identified and enthusiastic
Client commitment	Unknown, passive	Passionate
Changes required to existing procedures, processes and policies	Large amount of change	Little change
Organization structures	Large amount of change	Little or no change
Project manager experience	Little experience on similar projects	Similar experience on multiple projects
Physical location of team	Team is dispersed at several sites	Team is located together
Use of formal methodology	No formal methods or processes	Standard methods in use
Technology	New technology is being used for critical components	No new technology required
Response time	Very short response times are critical	Normal response time is acceptable
Data quality	Data is of poor quality	Data is of good quality
Vendor partnership	Have not worked with the vendor before	Have a good relationship with the vendor

This table is an example of the types of inherent risks that can exist on projects. There are others as well that form the starting point for identifying risks on your project.