Risk Categorization

We have covered three of the tools and techniques used in qualitative risk analysis; namely - Risk Probability & Impact Assessment, Probability & Impact Matrix and Risk Data Quality Assessment. The next item in the list is “Risk Categorization” which we are going to learn in this chapter.

Risk Categorization

Imagine how effective our project’s risk management efforts could be if we can pin-point what areas of our project are most affected by risks? What if we know the areas of the Work Breakdown Structure WBS that are sources of multiple risks or what if we know which project phase carries the highest level of risk?

The answer to all these questions will be “Very Good” isn’t it?

The idea of Risk Categorization is to uncover areas of risk concentration so that we can create effective responses to handle them. This is because; dealing with sources of risks is easier and cost effective than dealing with each risk individually. In fact, it can have a greater level of effectiveness as well.

We can categorize risks by source using either of the following:

1. Risk Breakdown Structure – RBS
2. Work Breakdown Structure - WBS and
3. Project Phases

If you are not too sure about what this activity is all about, let’s go back to our F1 track construction example.

Let us say that during risk identification, we have identified several high priority/impact risk items related to the equipment we will be using to lay the race track. So, if we categorize these risks, the company that is supplying these machines could be a potential source of risk. The quality of machines they supply, the availability of those machines, servicing delays in case the machines breakdown during track laying activity etc. could be potential risks that we will be exposing ourselves to when we lease or rent these machines from the company.

What if we do some analysis and find out that buying those machines ourselves could cost us a bit more than what the rental company is charging us but it could eliminate all of the risks above because we know that the machine we are buying is of good quality and will be available for our use anytime we want. Moreover, once this track is constructed, we can even re-use this machine in any subsequent tracks we may take up for construction. All in all, by grouping or categorizing a bunch of risks to its source, we have created a response that can help us handle all of those risks effectively in one shot.

Now, can you understand how useful this Risk Categorization activity is in creating effective risk responses?

Prev: Risk Data Quality Assessment

Next: Risk Urgency Assessment

Risk Categorization

As explained in the previous chapter, the distinction between risk categories and risk types is pretty blurred. The distinction you find in this blog is what the majority of the project management world goes with. However, don’t be surprised if your organization goes by a different yardstick when it comes to classifying or categorizing risks.

There are way too many categories of risks and as I said before, every company uses its own risk categorization standards. As per the PMBOK guide the term Risk Category refers to “A Group of Potential Causes of Risk”.

Why do Risk Categorization?

Did you think of this? Why go through the pain of categorizing these risks when we are anyways going to list them all down in the Risk Register and handle them?

The whole purpose of Risk Categorization is to systematically identify risks in a consistent manner and organize them so that they can be better managed. It also helps to identify the root causes of these risks in a better way. A Risk Breakdown Structure or RBS is a classic example of this Risk Categorization idea. The RBS splits risks into categories and then splits them further into sub-categories thereby making our lives (The life of a Risk Manager) easier.



The above is a sample RBS where we have classified the risks for a project into 3 broad categories:

a. Internal
b. External &
c. Project Management

Each of these categories has been further split into 3 sub-categories. A typical RBS can have as many categories & sub-categories as you want. The 3 above is just an example…

How to Proceed with Risk Categorization? – For New Project Managers:

If you are a new Project Manager or new to the Organization where you are managing your projects and are not too sure of how to proceed with this Risk Categorization exercise, don’t worry. Check out previous projects that were similar to yours from the archives and see how the categorization was done. Or you could check with commercial templates based on which industry you work on. Or even better, check with other PMs in your company and check how they completed this activity for their project. This way you will have enough information to proceed with and perform a good quality categorization…

Practically speaking, there is no master list of categories that you can use for your project. It changes from project to project, from industry to industry and most importantly as I have said numerous times before, from company to company. Nonetheless, to get you started in the right direction, below are some broad categories that can be used in a majority of the projects that you may encounter in your life. A word of caution here is that, the list below is not complete and only the starting point for you to improvise on…

1. Internal
2. External
3. Environmental
4. Economic
5. Political
6. Market
7. Process
8. Third-Party
9. Business
10. Operations
11. Organizational
12. Infrastructure
13. Culture
14. Technology
15. Human Resources
16. Legal
17. Financial
18. Project Management
19. Security
20. Etc.

Prev: Types of Risk

Next: Managing Uncertainty