Developing a project risk management plan

A guide and template

August 2023

Introduction

The purpose of a Project Risk Management Plan is to ensure risks are identified and then managed
in a structured way to minimise their impact on a project.

This document includes a guide and a template to assist delivery partners in developing a Project Risk Register for projects they are delivering for Hort Innovation. The information within the guide has been informed by AS/NZS ISO 31000:2009, Risk Management Guidelines, which defines risk as the effect of uncertainty on objectives. In the case of a Hort Innovation project, this refers to any factor that may adversely affect the success of a project in terms of realising the agreed project outcomes, delivery of project outputs, achievement of timeframes or meeting budgetary constraints.

How to develop the Project Risk Register

A Project Risk Register template is provided that delivery partners may use or adjust as required. Delivery partners may also choose to develop a risk register that is tailored specifically to a particular project. For further information on how to use the risk register, please contact the relevant Hort Innovation process owner for the project.

All Hort Innovation projects require a Project Risk Register be completed by delivery partners and submitted at Milestone 102. All risk registers must be kept up to date as the project progresses.

How to submit the Project Risk Register

The Project Risk Register should be submitted via the Hort Innovation Delivery Partner Portal (DPP).
As risks are identified during the life cycle of a project, it is necessary that they are added to the project’s risk register and that the updated Project Risk Register is submitted via the DPP.

Risk assessment process

The risk assessment process has the following nine steps.

1. Risk identification – what could happen that may have a consequence
for the project?

Identify potential risks that could impact the delivery of project outputs, achievement of intended outputs and outcomes, and project progress in terms of budget, agreed timeframes and changes to key personnel. To assist in identifying potential risks, it is useful to consider project risk categories. Possible risk categories are included in Table 1. Possible risk categories (these are not mutually exclusive).

Table 1. Possible risk categories

Human resource	Financial resource	Work health and safety	Equipment
Organisational	Environmental	Commercial	Technological
Reputational	Economic	Informational	Facilities
Target audience	Relationship	Dependency	Political

2. Cause/source identification – when, where, why and how could the risk event happen?

Identify the situation that would lead to the identified risk event occurring. How could it happen? What would cause it? There may be multiple causes/sources for a specific risk. They should be listed separately as they may require different controls. This step is critical to identifying possible risk treatment options.

3. Risk impact identification – how would the risk impact on project delivery
and what is the consequence level?

Provide a brief description of how the identified risk would impact on the project. For example:

Prevent (delivery of/conduct of/some aspect of the project)

Delay (increased time to completion or realisation of outcomes)

Degrade/decrease (some process, output and/or outcomes of the project or image of the organisation(s) involved).

4. Risk treatment options – what controls are in place, or will be in place,
to manage the risk?

If the level of an identified risk is above an acceptable threshold, risk mitigation/management actions must be identified. The actions will reduce the negative consequences or likelihood associated with the identified risk (or both). If the level of risk is below an acceptable threshold, no actions may be required (risk acceptance).

5. Risk likelihood identification – what is the frequency or probability of the
risk occurring?

The scale of frequency or probability of the identified risk occurring will depend on the nature of the risk causes relative to the project. The scale used must be appropriate for the specific project and activities. Refer to Table 2. Risk likelihood scale for details.

Table 2. Risk likelihood scale

Descriptor	Definition
Remote	May occur only in exceptional circumstances during the project; < 10% probability
Unlikely	Could occur in some circumstances during the project; 11-20% probability
Possible	Should occur at some time during the project; 21- 50% probability
Likely	Will probably occur in most circumstances during the project; 51-80% probability
Almost certain	Expected to occur in most circumstances during the project; > 80% probability

6. Risk consequence – Identify the scale of the consequence of the risk event occurring

Consequence and likelihood tables (Table 3. Risk consequence scale) are used to provide definitions for rating scales so there is a common understanding of their meaning; tables should be consistent with the context of the risk management activity. An identified risk may have more than one impact and these should be listed separately.

Table 3. Risk consequence scale

Descriptor	Definition
Insignificant	All project outputs delivered, and outcomes achieved; No loss of reputation of organisation/s; No loss of work time (e.g. due to availability of staff or weather interruptions); Minimal loss/damage to assets; Loss or impairment of a small amount of non-critical information
Minor	Outputs delivered but some quality reduction; Some reputational damage to organisation/s; Temporary loss of work time; Temporary corruption/loss of services/resources or non-critical information; Some loss of opportunity
Moderate	Failure to deliver some non-key outputs and/or some quality reduction in some non-key outputs; Moderate reputational damage to organisation/s; Medium-term loss of work time; Corruption/loss of non-critical information; Moderate loss of opportunity
Major	Failure to deliver most outputs or most key outputs; Significant reputational damage to organisation/s; Long-term loss of work time; Loss/irrecoverable corruption of critical information resources; Major loss of opportunity
Catastrophic	Outcomes unable to be achieved and failure of delivery of all outputs; Irreparable damage to reputation of organisation/s; Loss of irreplaceable key staff or work time completely disrupted; Total loss/corruption of all information services/resources; Total loss of opportunity

7. Uncontrolled risk level – what is the risk assessment?

The level of an identified risk is based on a combination of the determined consequence and likelihood of the risk event occurring. These are mapped by using a risk assessment matrix (Table 4).

Table 4. Risk assessment matrix

Consequence
Likelihood	Scale	Insignificant	Minor	Moderate	Major	Catastrophic
Remote	Low	Low	Low	Medium	Medium
Unlikely	Low	Low	Medium	Medium	High
Possible	Low	Medium	Medium	High	Extreme
Likely	Low	Medium	High	High	Extreme
Almost Certain	Low	Medium	High	Extreme	Extreme

8. Risk level evaluation – is the level of risk acceptable or unacceptable?

Could you defend that the level of risk is acceptable? To determine acceptability or otherwise, you may compare the level of risk against a risk threshold, criteria or both.

9. Risk responsibility allocation – who is responsible?

Who is responsible for monitoring and managing risks? The person/s responsible for undertaking risk management actions may be distinct from the person/s accountable for the risk management plan. Appoint personnel within a project team to cover both areas.

Using the Project Risk Register template

Delivery partners may choose to use the Project Risk Register template on the following page or develop their own that is specific to a particular project. If the delivery partner uses their own template with different risk likelihood and consequence criteria, it must provide details of the likelihood/consequence criteria and risk assessment matrix used together with its risk register.

The Project Risk Register template provides examples that will need to be deleted and replaced with content that is specific to the project. Rows should be added if required.

For further information, please contact the relevant Hort Innovation process owner for the project.

Share your thoughts We strive to provide the best experience possible for our delivery partners. Please share your feedback on how we can improve this document for you and other delivery partners in the future by emailing us at communications@horticulture.com.au

DISCLAIMER:

Horticulture Innovation Australia Limited (Hort Innovation) makes no representations and expressly disclaims all warranties (to the extent permitted by law) about the accuracy, completeness, or currency of any information published or made available by Hort Innovation in relation to this publication. Your access, use and reliance on any information published or made available by Hort Innovation is entirely at your own risk. The information published or made available by Hort Innovation does not take into account your personal circumstances and you should make your own independent enquiries before making any decision concerning your interests or those of another party or otherwise relying on the information. Hort Innovation is not responsible for, and will not be liable for, any loss (including indirect or consequential loss), damage, claim, expense, cost (including legal costs) or other liability arising in any way, including from any Hort Innovation or other person’s negligence or otherwise from your use or non-use of this publication, or from reliance on information contained in the material or that Hort Innovation makes available to you by any other means.

COPYRIGHT NOTICE:

Copyright © Horticulture Innovation Australia Limited 2023

Copyright subsists in this publication. Horticulture Innovation Australia Limited (Hort Innovation) owns the copyright in the publication, other than as permitted under the Copyright Act 1968 (Cth). Copying in whole or in part of this publication is prohibited without the prior written consent of Hort Innovation.

Any request or enquiry to use this publication should be addressed to:

Communications Manager

Hort Innovation

Level 7, 141 Walker Street

North Sydney NSW 2060

Australia

Email: communications@horticulture.com.au

Phone: 02 8295 2300

Project Risk Register template

Project Risk Register: Delivery Partner Portal – [Project code] – [Project name]

The risk What could happen?	Potential risk causes/sources What could happen? What would cause it?	Potential risk impacts How would the risk impact on delivery of the project?	Risk controls What controls are in place, or will be in place, to manage the risk?	Risk likelihood with controls in place Refer to Table 2. Risk likelihood scale	Risk consequence with controls in place Refer to Table 3. Risk consequence scale	Treated risk assessment Refer to Table 4. Risk assessment matrix	Risk evaluation Could you defend this level of risk is acceptable? Yes/No	Person responsible Who is the person/s responsible for monitoring and managing the risk?
Loss of key project personnel	Resignation or retirement	Loss of key knowledge and experience	Project team trained in multiple skills; Regular project team meetings to share information on progress; Central storage of project data/information	Unlikely	Insignificant	Low	Yes
Unable to find on-farm trial sites	Difficulty finding grower willing to host trial sites and any associated field days	Unable to trial research findings on-farm; Disruptions to work time; Unable to hold adoption activities	Liaise with industry and industry development projects early; Host grower has access to researchers	Unlikely	Minor	Medium	Yes
Unfavourable weather for trials	Wetter than average weather	Delay in delivering project outputs	Ability to undertake trials in a different region or vary project timeframes	Possible	Minor	Medium	Yes
Low grower engagement in adoption activities	Growers unable or unwilling to attend; Adoption activity content not relevant; Inappropriate extension strategies for the target audience	Low uptake of new practices; Underachievement of intended project outcomes	Development of stakeholder engagement plan; Early establishment of industry networks; Close liaison with industry development officer; Team member with knowledge transfer expertise	Possible	Insignificant	Low	Yes
Laboratory equipment failure	Damage to key laboratory equipment	Delays in undertaking trials	Experienced laboratory technicians	Possible	Minor	Medium	Yes

ISO 31000:2018

Tasmanian Government Project Management Guidelines Version 7.0 (July 2011)

Risk Management Guidelines Companion to AS/NZS 4360:2004