Project Risk Analysis & Management

Project Risk Analysis & Management

Quick Answer: Identify what could threaten project feasibility and success, estimate impact on goals/schedule/resources/costs/stakeholders/continuity, prioritize with tools such as RPN, and manage responses through the life of the DMAIC project—not only at kickoff.

Risk in the Green Belt Context

ASQ CSSGB BoK II.C.7 is at Understand level: know what project risk is, how it is assessed, and how management actions protect delivery. Distinguish two related ideas:

Both matter. FMEA (severity × occurrence × detection → RPN) is a core Six Sigma risk tool; project risk registers use similar severity/likelihood thinking for schedule and delivery threats. Green Belts should not treat “risk” as only OSHA hazards or only DFMEA rows.

Feasibility: Can This Project Succeed?

Feasibility screening asks whether the proposed project is doable under real constraints. It overlaps project selection filters but continues after charter as conditions change.

Feasibility dimensions

Red flags for low feasibility

• Champion cannot free SMEs for Measure
• Critical data locked in a vendor system with no extract path
• Solution space requires capital the organization already rejected
• Goal demands six-sigma perfection in eight weeks on a chaotic process with no MSA

Feasibility risk does not always kill a project—it may force scope reduction, Black Belt support, or a data-access workstream before Analyze fantasies begin.

Impact: What Gets Hurt If the Risk Hits?

Impact analysis estimates consequences if a risk event occurs. CSSGB topics explicitly connect risk effects to:

Score impact (e.g., 1–5 or 1–10) consistently with how your organization scores FMEA severity when possible, so risk language matches quality language.

Worked example — impact notes:

Risk: “ERP freeze blocks new defect-code field for 10 weeks.”

• Goals: Baseline still possible on existing codes; Improve IT solution delayed
• Schedule: Improve → Control may slip one quarter
• Resources: Team idle or diverted to manual coding audit
• Costs: Soft savings delayed; possible overtime for manual audit
• Stakeholders: Finance frustrated; Champion credibility at risk
• BCP: Low direct ops interruption if pilot is non-production

Documenting multi-area impact prevents “it’s just an IT delay” understatement.

Likelihood, Detection, and RPN

For process FMEA, risk priority often uses:

[ RPN = S \times O \times D ]

• S (Severity): How bad is the effect if the failure occurs?
• O (Occurrence): How likely is the cause?
• D (Detection): How likely are we to detect the failure before it escapes? (High score = hard to detect—worse)

Higher RPN → higher priority for action, with judgment: a severity-10 item with modest RPN may still outrank a high-RPN cosmetic issue. Some organizations add SOD thresholds or prioritize by severity first.

Project risk matrix (simpler alternative)

Many project registers use Likelihood × Impact heat maps without detection:

Know both languages for the exam: RPN for FMEA-style items; likelihood × impact for project registers.

Risk Management Process

A practical loop for Green Belts:

1. Identify — Brainstorm with team/Champion; review assumptions, interfaces, suppliers, change windows, skills gaps.
2. Analyze — Feasibility + impact + likelihood (+ detection if FMEA).
3. Prioritize — RPN or heat map; focus on vital few.
4. Respond — Choose strategies and owners.
5. Implement actions — Put mitigations in the WBS and Gantt.
6. Monitor — Review risks at every tollgate; retire closed risks; add new ones.

Response strategies

Opportunity risks (positive uncertainty) also exist—e.g., a new system release that could accelerate Improve. Capture them so the team can exploit or enhance upside, not only defend against downside.

Effects on Goals, Schedule, Resources, BCP, Costs, Stakeholders

Exam and practice scenarios often ask you to connect a risk to multiple effect types:

Business continuity planning (BCP) angle: When Improve changes a live process, ask: What is the rollback? What is the maximum disruption window? Who is on call? A control plan without a rollback is incomplete risk management for operational processes.

Integrating Risk into DMAIC

Put top risks on the storyboard and tollgate pack. A team that never updates its risk log is not managing risk—it is storing a kickoff artifact.

Common Pitfalls

• Confusing process FMEA with project risk register (use both when needed)
• Ranking only by occurrence and ignoring severity-10 safety or compliance items
• Treating RPN as precision science rather than prioritization aid
• Accepting all risks with no contingency because “we’re too busy”
• Ignoring stakeholder and BCP impacts while tracking only schedule
• Closing the project with residual risks and no owner

Risk Checklist for Green Belts

• Risk log exists with owner, due date, and status
• Feasibility rechecked when scope or sponsorship changes
• Impacts scored across goals, time, resources, cost, stakeholders, continuity
• High RPN / high heat-map items have response actions in the WBS
• Pilot includes rollback / BCP thinking
• Tollgates review residual risk, not only metrics

Understanding project risk analysis and management keeps DMAIC honest: the plan is a hypothesis about the future, and risk work is how the team stays ahead of that uncertainty.