Good risk management entails identifying as many potential risks as possible, analyzing and assessing those risks, working to minimize the probability of their occurrence, and establishing contingency plans $($and funds$)$ for dealing with any that do occur. Much of this takes place before the start of a project, although it is not unusual for this process to be repeated during the project as experience grows and new information becomes available.

The first step is to identify the risks. Typically, there are numerous sources of risks, although the more experience an organization has with a particular type of work, the fewer and more identifiable the risks. Everyone associated with the project should be responsible for identifying risks. Brainstorming sessions and questionnaires can be useful in this regard.

Once risks have been identified, each risk must be evaluated to determine its probability of occurrence and the potential consequences if it does occur. Both quantitative and qualitative approaches have merit. Managers and workers can contribute to this effort, and experts might be called on$.$ Experience with previous projects can be useful. Many page $766$tools might be applied, including scenario analysis, simulation, and PERT $($described earlier in the chapter$).$

Risk reduction can take a number of forms. Much depends on the nature and scope of a project. $$Redundant$($backup$)$ systems can sometimes be used to reduce the risk of failure. For example, an emergency generator could supply power in the event of an electrical failure. Another approach is frequent monitoring of critical project dimensions with the goal of catching and eliminating problems in their early stages, before they cause extensive damage. Risks can sometimes be transferred, say, by outsourcing a particular component of a project, or by having an insurance policy. Risk$-$sharing is another possibility. This might involve partnering, which can spread risks among partners. This approach may also reduce risk by enlarging the sphere of sources of ideas for reducing the risk.

A project leader may have to contend with multiple risks that have different costs and different probabilities of occurring. A simple matrix such as the one illustrated in Figure $17\mathrm{.}13$ can be used to put the risks into perspective.