The purpose of this template is to identify and log all the risks related to the project and include additional information about each risk.

This check list serves for the support at the identification of risks for a concrete project. Risks have to be individually identified for every project. Different areas can cause project risks - essential areas including exemplary questions are listed in the check list below. The list is not claimed to be complete.

Project Environment

Organization and Management

Does the project have the necessary support from the customer's/service provider's senior management?
Is management interested in success stories rather than honest project reports thereby undermining the ability to discover/resolve problems?
Is the project work dependent on other projects or suppliers?
Has the senior management made decisions that have led/will lead to a discouraging of the team?
Are contact persons and communication channels properly defined by all parties?

Target Group of the Project Result

Are the users of the project result sufficiently and sensibly included into the project?
Do the users know they have to contribute to the project?
Do the users support the project sufficiently enough?
How experienced are the users as regards their estimated contribution to the project?
Are the users' expectations known, clear and unambiguous?
Do the users accept the project and the aspired solution?
Are the users/will the users be trained adequately?
Are there requirements important to users? Are these requirements being considered?

Customer

Does a legally valid contract exist?
Does the customer pay reliably and punctually (payment record)?
Is the project adequately embedded into the customer's organization?
Does the customer adequately prioritize the project?
Does the customer sufficiently support the project?
Does the customer make necessary decisions?
Are decisions made efficiently and in time?
Do decisions - once made - persist?
Is the customer to be expected to withdraw decisions if encountering opposition (e.g. from the customer's own organization)?
Is the customer consequential in overall?
Are the customer's contact persons defined? Do they coordinate with one another? Is it likely that they don't?
Is it probable that the customer's decision, review and planning cycles are slower than necessary?
If the customer's participation in planning/review of requirements engineering and specification is not possible (for whatever reason), there is a risk of instable requirements and time-consuming (requirements) changes.
Does the customer insist on requirements that are possibly not realizable or cannot be accounted for?
May the customer be expected to absolutely want to include more requirements after having finished requirements engineering?
Are the customer's expectations known, clear and unambiguous?
Does the customer insist on technical features whose realization would go beyond the existing time schedule?
Is it probable that the customer is going to interfere with the project manager's sphere of competence (e.g. direct control of project members while ignoring the project manager)?
Are the components/parts provided by the customer hard to integrate or do not match the product in development and thereby create additional effort in design and integration?
Are objects provided by the customer of such bad quality that additional efforts are necessary?
Are the tools to be used for the customer's requirements rather a restraint for the project's productivity (document management, error tracking, development environments, test environments, dial-up connections, general tools)?

Suppliers

Are there dependencies on suppliers?
Are there dependencies on suppliers?
Is there a risk of delayed deliveries?
Is there a risk of delayed deliveries?
Can the quality of the supplies be insufficient?
Can the quality of the supplies be insufficient?
Are there ambiguities about the communication with the supplier? Who is responsible for the supplier?
Are there ambiguities about the communication with the supplier? Who is responsible for the supplier?
Is communication with the supplier open and honest or is there a danger that any delays will only become known when the deadline is exceeded?
Is communication with the supplier open and honest or is there a danger that any delays will only become known when the deadline is exceeded?
Is it recognizable that the supplier has problems with the client?
Is it recognizable that the supplier has problems with the client?
Are the requirements for the supply of the supplier known?## Are the requirements for the supply of the supplier known?
Is it possible to work iteratively with the supplier?
Is it possible to work iteratively with the supplier?

Product

Requirements

Do all requirements exist?
Does an acceptance of the requirements exist, e.g. in a list?
Is change management compatible?
Have all essential and known information sources been used for requirements engineering?
Are the information sources that have been used documented?
Are the requirements comprehensible and well-defined?
Are the requirements testable?
Are the requirements free of discrepancies? If not, can the discrepancies be resolved?
Are the requirements constant?
Are changes in requirements being documented comprehensibly?
Does an acceptance of changed requirements take place?
Are there any efforts going beyond the time schedule due to not clearly specified parts in the requirements?
Are business processes well-defined and clear or rather vague and complex?
Large number of interfaces?

Product Characteristics

Are modules error-prone (due to technology or complexity) so that more time than expected has to be used for design, implementation and testing?
Is a refactoring of adopted modules necessary because the quality of their realization is not good enough?
Is the product's scope larger than expected?
Does more effort than expected result from non-functional requirements? Has this effort ever been estimated?
Do the product's characteristics require more iterations in design, testing, implementation and integration?
Do essential requirements on compatibility with other systems require more effort on testing, design, implementation and integration than has been budgeted in the offer?
Are there other risks or more effort resulting from having to integrate the product with other systems developed outside the project?
The project ranges in unusual hardware or software environments. There is a risk of unexpected problems.
Is it necessary to develop from scratch components for new functions of an existing system?
Is the technology used fully developed or is it subject to constant development?
Is it important for the project to use the latest version of the latest technology (the "beta-testing" risk)?
Is the product in its core functions dependent on regulations that (can) change (e.g. laws, by-laws, procedures, corporate guidelines, etc)?
Possibility of unexpected change of the technological standards the product is based on?
Is data quality (in production) "bad" and inconsistent? Has this been considered in estimates, specification, design, and testing?
Does a standard product have to be used whose customizing the staff members are not familiar with, or one that is known to be uncomfortable in customizing?

Design and Implementation

Is the design (unnecessarily) complicated?
Are functions and features intended that are not necessary, not required or were not agreed upon?
Large number of technical interfaces?
Are the technical interfaces complex or plain?
Has a sufficient decomposition taken place to reduce the elements' complexity?
Have alternatives adequately been considered?
Is the design complex enough to represent all issues? A design too simple results in re-design and re-implementation.
A design too complex requires unnecessary, unproductive and error-prone overhead during development.
Are well-known and familiar methods being used? Or is it probable that teething troubles and beginner's mistakes will occur (as is common with initial use)?
Use of a code quality management for achieving good code quality as early as possible (maintainability, fixability)?
Are there coding conventions? Are they established in the project? Who's responsible for enforcing them? Are the conventions accepted?
The actual amount of time saved by tools/procedures designed to raise productivity is overestimated.
Are components being developed independently from each other resulting in unnecessary integration and testing efforts?

Documentation

Does the necessary documentation exist?
Is the documentation complete?
Is the documentation standardized?
Is there a document list?
Are there any defined documentation standards?
Are these standards sufficient?
Control and enforcement of compliance with the standards? Who's responsible?
Was the creation of documentation a part of the cost estimate?

Quality

Sufficient quality assurance?
Quality assurance from the start?
How is the QA defined? Is its scope defined sufficiently?
Are there defined handover schedules?
Are there defined handover criteria?
Does integration take place before transition to QA?
Is there an automated software integration?
Are module and component tests called for and scheduled?
Are module and component tests arranged consecutively?
Are there any quality metrics?
What's the error rate?
Were effort and time considered for improvements?

Technology

Are the chosen and used technologies suitable?
Is the technology stable?
Is the technology mature?
Is the technology dominated by the participants?
Is there technology expertise in your own company and in the marketplace?
Have alternatives been sufficiently considered and taken into account?

Project

Project Management

Who assumes strategic leadership for the project?
Is the project planning updated regularly?
Does a process control take place on a regular basis?
Does a control of the available and the spent budget (time and money) take place on a regular basis?
Is there an active, preemptive risk management?
Is there a structured change management?
Is there a consequential error-tracking?
Are there clear billing modalities?
Are all necessary roles in the project defined and competently filled?

Project Goals

Are the project goals documented?
Are the project goals known, clear and unambiguous?
Does a conflict of goals exist? If so, are the goals prioritized?
Are the project goals sufficiently constant?
Are the project goals subject to non-technical (political) influences?
Are the project goals sustainable in the long run?
Is the business benefit of the project clear and unambiguous, or is it likely that discussions and justifications will occur regularly?

Time Schedule

Is there a sufficiently detailed project planning?
How realistic is the project planning? (Golden Rule: in principle, is it possible to finish 20% before schedule if the project proceeds well?)
Were buffers for unexpected events (occurrence of risks) allowed for during planning?
Are any tasks being underestimated?
Are all necessary and critical working packages covered in the schedule?
Is the project's duration adequate and manageable?
Are time, resources, project size/scope, etc being dictated by senior management? Does this planning conflict with the project's own planning?
Does the schedule rely on the availability of experts with specific qualifications and experience who could drop out or not be available any longer?
Was experience from the project history accounted for sufficiently?
Is the project plan too precise? (Excessive over-planning leads to a loss in productivity)
Are the dependencies between the planned working packages taken into account? Do any risks result from these dependencies?
Is the schedule safe and justifiable to an extent that it can resist possible pressure by time cuts by the customer or senior management?

Budget

Are there legally binding budgets?
Is the budget sufficient?
Is there a reliable and up-to-date budget control?
What does the current budget consumption look like?
Are there restrictions? If so, by whom (customer, company, management, controlling)?

Project Organization

Is the project organization structure solid?
Are roles and responsibilities defined?
Are they defined completely, clearly and unambiguously?
Have the roles and responsibilities been communicated inside the project team?
Is the project organization structure appropriate to the size of the project team?
Are communication structures in the project and to the project environment defined and well-known?
Is there a sufficient communication infrastructure?
Does everybody adhere to the agreed rules?
Is there a structured reporting on a regular basis?

Resources

Is the project size appropriate and manageable? (A too small/large team poses a risk for several reasons.)
Is the necessary staff available?
Is the staff motivated?
Do all staff members have the right working morale?
Are the staff members sufficiently qualified and competent?
Do the staff members have sufficient experience relevant to the project's tasks?
Do the staff members know the business? (Is business expertise necessary?)
Are the staff members familiar with the use of the applied tools?
Are the staff members familiar with the technologies and methods to be applied?
Is there experience relevant to the procedure model the project applies?
Are the staff members team players? Are there any dissonances? Are there (personal) conflicts between staff members?
Are necessary training and orientation opportunities provided? Were they accounted for in the planning (time and cost)?
Are the staff members available at the start of the project with planned full capacity? Or is it to expect that trainings, other projects, etc cannot be finished in time?
Was it made sure that the contract durations of staff members are set to run till the actual project end, or that there is a possibility to renew the contracts?
Was it made sure that staff members who finished their training period will stay in the project until its end?
Are the most important experts identified and bound to the project until its end?
Costs for the training periods of new team members have to regarded as a risk.
Does the project manager have enough expertise for the project?

Infrastructure

Are there appropriate premises?
Will the work be distributed over different locations?
Are there environments suitable for development, testing, acceptance and production? Or are they at least planned?
Are the environments sufficiently equipped (hardware, software, licenses)?
Are the environments accessible and operative in time?
Are the environments reliable under technical and administrative aspects?
Are the environments for development, testing, acceptance and production similar/comparable?
Are there at least the absolutely necessary tools?
Is there support through the manufacturer?
Is there a disaster recovery?
Is it intended to backup data?
Is a failure of the infrastructure possible? Where measures taken to protect against a failure?

Search This Blog

Work better Tools and Articles

Risk List Check List