Risk Identification and Stakeholder Engagement
Identifying risk
Identification aims to find, recognise and record risks (threats and opportunities) before they affect objectives. Techniques include brainstorming, workshops, interviews, Delphi, nominal group technique, checklists, prompt lists, SWOT, assumption analysis, cause-and-effect (fishbone), fault tree analysis, scenario analysis, and lessons learned from similar projects. A key principle: identify causes and effects, not just symptoms, and record risks in a structured register with an ID, description, cause, effect, owner and initial assessment.
Stakeholder engagement
Identification quality depends on who is in the room. Engage a diverse group - delivery team, users, suppliers, finance, legal, technical specialists - because each sees different exposures. Communication and consultation should be continuous, not a one-off workshop. Stakeholders can also be a source of risk (behaviour, availability, competing priorities).
Assumptions and dependencies
Assumptions (things believed true) and dependencies (things relied upon) are fertile sources of risk: if an assumption fails, a risk may crystallise. Explicit assumption analysis often reveals hidden threats and opportunities.
Traps
- Confusing a cause with a risk (e.g. "lack of resources" is a cause; "design may be delayed due to insufficient resources" is the risk).
- Treating identification as a one-time event rather than iterative.
- Ignoring opportunities or only looking internally.
Worked example
During a workshop, a supplier states new modular components could shorten build time. Recorded as an opportunity: "If modular components are adopted, build time may reduce by 10%, saving cost." It is then assessed and managed like any threat.
Rule of thumb
Use multiple techniques and multiple stakeholders; a single method or single viewpoint will miss risks.