Uncertainty is part of every project. Deliveries might be delayed, bad weather could halt outdoor work, or a key machine might breakdown. A big part of project management is about anticipating and being prepared for such events. How you identify and manage risk depends on the nature of the project and what's important to your customer, but here are some techniques that I have found effective.
Begin by understanding the relative importance of cost, time and performance. During the initial planning phase, determine which of these parameters is fixed, where some slippage might be tolerated, and where something extra would be highly appreciated. For instance, some projects are time-constrained. In such a case it's often permissible to go over budget to hit the deadline. Conversely, a customer might be highly delighted if, for just a little extra money, you can give him a raft of additional functions.
It's prudent to get input from your customer on his relative priorities when the project launches. This provides some direction should problems arise and force you into making difficult decisions. An added benefit from having this discussion up-front is that it will be unemotional: once you hit trouble and nerves are frayed, chances are that it will be difficult to have a cool and rational conversation about the choices that have to be made.
Having established priorities, identify the risks in the project. Start with the Work Breakdown Structure and for each task ask "what if?" On a small project the manager can do this himself, though there are advantages in getting other people involved.
Now, a caution on risk identification: it's not sufficient to list what might go wrong. You must drill down to the specifics of what would cause each risk to occur as this provides the basis for planning avoidance and mitigation actions. The fishbone or "Ishakawa" diagram can be a useful tool for this. So for example, you might have a major "bone" identified as "late delivery of circuit board," (this is your risk item,) but then to that bone you attach all the reasons why the circuit boards could be late. You might see causes such as "delayed at customs" or "prototype fails testing".
During your brainstorming session don't worry about the likelihood of things happening. Even though some may seem improbable, get them all listed. Assign probabilities only after you, or the team, feel everything that could happen has been identified. On a small project it may be sufficient to categorize these as Low, Medium and High, and then perhaps disregard all but the High. On a larger project it might be useful to assign a probability number or percentage. Clearly, this isn't going to be precise, but if it's arrived at by a group of people knowledgeable about the project it will be an informed estimate.
Next, assess the consequence and severity of each possible risk event. This, combined with a judgment of the probability, allows you to gauge how important it is to put a contingency plan in place. For many projects Low, Medium and High classifications will be enough, so you'll know that a High probability High impact risk needs to be addressed. Conversely, something Low probability Low impact might be ignored. Put a numeric value on the impact and multiply that by the probability to get a "Risk Priority Number." With this you can rank risks in the order of potential impact and explore how to deal with them.
The best way to deal with a risk is to eliminate it, or failing that, to reduce both its probability and impact. For example, this might mean sourcing key components from two suppliers, purchasing spare machinery or holding additional inventory. Another approach is to find ways to share risk with suppliers and the customer. Financial penalties for late delivery are one tool that might help.
Unfortunately, no matter how hard you try, it's likely that some elements of risk will remain. For these you need to develop contingency plans. That means identifying what you will do if the risk event you anticipated actually transpires.
Finally, while it's vital to plan what you will do if trouble strikes, you also need to be able to recognize the signs of impending disaster. This means putting in place monitoring and control tools that will give you early warning of something going wrong.
So that's managing project risk. It's about anticipating what might happen, judging likelihood and impact, determining what your response will be, and making sure you have a monitoring system that sounds an alarm when disaster strikes.