We recommend a modified version of the FMEA approach to assessing the risk. The approach is tailored to the needs of project and program managers. We will model the time line as a control plan with minimal controls other than the typical tollgate reviews and, perhaps, team meetings. We know from personal experience that treating potential failures systematically can often forestall risky events completely.

What does it look like?

Our approach uses a header section much like the automotive FMEA so that the document can be appropriately identified, the team named, and other information added for tracking purposes. 

One of the most significant fields is Risk Description, where we explicitly identify the risk. In general it is wise to include enough information that a casual reader can understand the risk situation; that is, a clear, concise, and complete description of the potential issue. It is important at this stage that we do not include potential solutions, because the table has special fields for this.  We define other fields to be:

• Severity
• Probability
• Controllability
• RPN, where
  • RPN = Risk priority number
  • RPN=severity x probability x control
  • Post Mitigation RPN

Stay tuned for more on the topic!