COVID-19 and Project Risk Management

With COVID-19 pandemic rapidly spreading throughout the globe and almost bringing everyone's life to a standstill with businesses closing-down and employees forced to stay-at-home because of local or federal guidelines, it is imperative to assess the impact of these unprecedented conditions on the on-going projects, programs, and portfolios.

According to the World Health Organization (WHO), there were 4,347,935 confirmed COVID-19 cases, including 297,241 deaths reported globally as of May 15, 2020. Almost all business sectors were affected by this pandemic and companies had to implement urgent policies such as remote work, limiting employee travel, furlough, or termination.

In these situations, the first thing recommended for every organization — either private or public sector — is to focus on a business continuity plan to mitigate the impact and ensure all critical business functions can operate without any issues.

1. Update Risk Register

First and foremost, identify all risks that could impact the project because of COVID-19:

• Impact on project timeline due to unavailability of internal and/or external resources
• The productivity of the team while working remotely
• Data security risk while the resources are working remotely
• Missing deadline for any regulatory compliance and/or legislative mandates
• Impact to user acceptance testing and training plans
• Availability of virtual meeting tools and video conferencing
• Impact on any on-going contracts and associated deadlines
• Strategic importance and viability of the project to the overall organization
• Availability of project funding
• Impact of local and federal guidelines to the work environment

Risk description should start with IF… the risk happens, THEN… what will be the consequence?

"If the regulatory compliance or legislative mandate deadline of August 31, 2020 is not met, then the organization could face legal issues or loss of funding."

2. Analyze the Risks

After documenting all the possible risks, analyze each risk and assign individual priority, probability and consequence — characterized as Low (1), Medium (2) or High (3).

• Priority: Timing of actions needed. Risks with greater impact and urgency should have higher priority.
• Probability: The likelihood the risk will occur.
• Consequence: The impact or cost to the project should the risk be realized.

Calculate the Overall Risk Factor: (Priority + Probability + Consequence) / 3 × (highest value)

• RF ≤ 2 (Low): Monitor the risk but don't invest significant resources into response planning.
• RF = 3 (Medium): Prepare a risk response plan in case the risk increases.
• RF > 3 (High): Take immediate action to implement the risk response plan.

3. Risk Response Strategy and Planning

The following four strategies can be used for each individual risk:

• Avoidance: Eliminate the threat or protect the project from its impact.
• Transference: Shift some or all of the negative impact to a third party.
• Mitigation: Lessen the probability or impact of the risk.
• Acceptance: Accept the consequences and prepare workarounds.

4. Risk Monitoring and Controlling

Each risk should be assigned a risk owner responsible for monitoring activities throughout the life-cycle of the risk:

• Has the risk owner identified any triggers regarding the risk?
• Is the risk still a possibility and valid for the project?
• Should the risk be closed, or does any component need to be updated?

During the COVID-19 pandemic, it was recommended to monitor risk triggers daily or weekly.

5. Contingency Plan

Some risks with high-risk factor should also have a contingency plan documented in case the risk is realized even after implementation of the risk response strategy. Depending on the type of strategy or contingency plan, a project change request (PCR) might be needed.