Capturing and Managing Risks: The Situation-Trigger-Impact Framework

Creating a useful risk register isn’t just about listing potential problems. It’s about answering the “so what?” questions and determining what to do to avoid the risk, limit its impact or reduce the probability of it occurring at all. Here are three steps to apply when managing risk.

The first step in this process is to properly describe the potential risk situation. There’s nothing worse than opening a risk register and seeing a sparse risk description like “Lack of resources.” What resources? Is the lack in some areas or all? More information is needed to adequately address the risk. The key is capturing context around each risk. Here is a description framework that breaks the risk definition into three portions: “Because of [situation], there is a risk that [something will happen], resulting in [impact].” This structure forces you to think through the situation(s) under which the risk might become an issue.

The second step is to identify “triggers” or early indications that a risk may be coming to fruition. In other words, this is “smoke” that might indicate there is – or will soon be – a fire to extinguish. When determining risk triggers, it is helpful to think about the source of the trigger. Most triggers, often called internal triggers, occur within the project or your sponsoring organisation. If a high-priority project is launched that could affect the availability of the current project’s team members, that would represent a trigger for an internal staffing shortage risk. Negotiation for those staff members would be an appropriate risk response strategy, and could be arranged in the short term, relatively easily.

External risk triggers are harder to manage because they require long-term response strategies. For example, an election result could impact regulatory requirements or funding. This happened on a healthcare project I was managing. When new regulators started their jobs, it was rumored that funding for a new hospital facility could be cut. This “triggered” action on our part to begin lobbying for the funding, along with seeking alternate sources of financing and ways to provide the needed patient care in a less expensive facility.

What we did after the change of government risk trigger is step three: focus on the impact. Rather than focusing solely on finances, we looked at the overall impact. Ultimately, the most significant impact was in delivering needed patient care. So, we looked for alternatives to address that impact. Resolving the financial risk was considered, along with ways to provide patient care with reduced funding. Thus, the activity included determining if a less expensive facility could be constructed. (There was also an examination of alternatives to deliver expanded care within current facilities.)

Next, you continually repeat the steps. Risk discussions should be part of every status meeting, whether weekly or fortnightly. The business environment and world circumstances can change rapidly, and your risk framework needs to respond to those changes.