Risk Management is NOT an EVENT it is an ONGOING process!

I'd like to say that the mistaken idea that Risk Management is something that happens once, just before a project starts is an outcome of the recent explosion in the use of PM methods to manage work among organizations that never before thought of their work as projects. But I can't. This is an old, bad idea not a new one. :-)

There are lots of experienced project managers out there that do a great job of collecting potential risks from team members and then rank them and develop contingency plans and mitigation plans for the ones that seem the most likely to occur. But then Risk Management for them is done. It is something they do once and then it is time to move on with the Project Management.

This has a fundamental and seemingly obvious problem: new risks can crop up out of unexpected circumstances. A project can take a turn based on a problem or mid-stream scope change. Risks for late stages of a project can seem pretty distant and unlikely at the beginning of the process but after the project is underway and the new phase is coming up there can be a host of these 'late risks' that can start to seem pretty big on the horizon. But that is only if you are looking for them. If risk management and the contingency and mitigation planning that comes with it is done only once then the eyes of the project are closed (or at least not wide open) to these lingering risks.

Risk Management in all it's glory (collection, analysis, ranking, planning, etc) is something that should certainly happen before the project starts. It can be a strong part of the go/no-go decision that starts the project. However, it should also be part of a process that happens just prior to the start of each phase of the project if not a part of the weekly status meetings that occur in most project organizations. It is also something that is not the sole domain of the PM or the PMO. EVERYONE on the team should be in a risk management mode from the very start of the project right up to dreaded 'lessons learned' meeting after the project ends. They should be keeping their eyes open for things that might go wrong. Even if they seem remote: put them on the list!

Risk Management is not an event. It is a continuous process that should involve the whole team.

Obviously this is not new information. "Old School" project managers (those that were PMs before it became sexy a few years ago) have been saying this for years. Hell even the SEI wrote a huge guidebook on the subject called (aptly) Continuous Risk Management Guidebook that goes into great detail about the idea that Risk Management is NOT an event. While this book is focused on software dev the principles it talks about are applicable on any project, in any environment.