Step 3: Analyze the Risks

Every project lives with uncertainty. The difference between a project that delivers and one that derails is usually simple: whoever analyzed the risks beforehand had time to act; whoever did not, fought fires. Analyzing risks is not guessing the future — it is not being caught by surprise, and avoiding surprises that could make the project unviable.

Before we go on, it is worth separating two concepts that get mixed up: a risk is a future uncertainty that may or may not happen (recorded in the Risk Register); an issue is something that has already happened and needs handling now (recorded in the Issue Log). On your board the two live together in the Risks [HOW] list, as long as the distinction is clear on each card — handling them in the same place speeds up resolution.

The processes and the three movements

This step brings together the PMBOK processes of planning risk management (how to run the activities), identifying the risks (determining and documenting them), performing the analysis (prioritizing by probability × impact) and planning the responses (options and actions to increase opportunities and reduce threats). In practice, three movements:

1. Identify the risks — review the ones you noted in Step 1 and look for new ones. Common sources: leaving things to the last minute, resistant stakeholders, conflicting interests, an untrained team, equipment failures, absences, scope changes and assumptions that do not hold.
2. Assess the priority (qualitative analysis): rate the probability and the impact from 1 to 5 (1-very low … 5-very high) and multiply one by the other. The priority (probability × impact) runs from 1 to 25 — the higher it is, the sooner the risk needs handling. (Careful not to confuse them: the impact is only the seriousness of the consequence — half of the calculation; the priority is the product, and it is what orders what to treat first.)
3. Define the response for the highest-priority risks, with an owner and a date.

On your board (ProjectAdm)

In the Risks [HOW] list, create one card per risk. Use the card’s priority (low, medium, high, urgent) to reflect the result of probability × impact, and record the response and the owner in the description. Take the opportunity to include assumptions (factors taken to be true, without proof) and constraints (real limitations) as cards in the same list.

When you finish this step, Project Together reads your board and generates the Issue and Risk Register (Excel) for you, with the Priority column (probability × impact) already calculated — risks and issues in one place, ready to share.

Predictive × Agile

In the Predictive approach, you keep a structured Risk Register, with the priority (probability × impact) and the planned responses.

In the Agile approach, you still record the risks, but you handle uncertainty incrementally: risks that need action go into the Product Backlog itself as prioritized items, to be attacked early. When there is a lot of technical uncertainty, the team creates a spike — a short, time-boxed investigation whose only goal is to reduce the uncertainty before committing effort to the story.

🎯 Your turn — Analyze the risks

🎯 Objective: identify what can go wrong (and the opportunities) and decide how to handle them, starting with the most critical.

✅ Before you start: the scope defined in the WBS list (Step 2).

🗃️ On your board: work in the Risks [HOW] list.

📋 Checklist:

1. Create a card for each risk (describe it as cause → event → impact).
2. Assess probability and impact using the card’s priority.
3. Define the response and the owner in the description.
4. Record assumptions and constraints as cards in the same list too.

🎁 Your deliverable: risks, assumptions and constraints recorded and prioritized.  ⏱️ Time: about 1 hour.  🛠️ Tools: ProjectAdm + SWOT analysis + expert judgment.

💡 Accelerate with AI: run Step 3 in the course menu. It reads your scope and your charter and hands you the prompt for this step already filled in — “given this project and this scope, which risks, assumptions and constraints do you recommend?”. Paste it into your AI, paste the answer into the “0. Inbox” card and run Step 3 again: each risk becomes a card with probability, impact, priority, response and owner already in place.

💬 Tip: handle risks (what may happen) and issues (what already happened) in the same place — it speeds up resolution.

🎁 Your artifact — the Issue and Risk Register in Excel, generated from your board

When you finish Step 3, Project Together reads the Risks and Assumptions list and generates the Issue and Risk Register (Excel .xlsx), saved in _saida/documentos/, with the Priority column (probability × impact) calculated automatically.

How to check it:

1. Open _saida/documentos/Registro dos pontos de atenção – (your project’s name).xlsx. Each row carries its Type in the right column: Risk, Issue, Assumption or Constraint.
2. Check that the risks have probability, impact, priority, response and owner — and that assumptions and constraints appear typed as such (they have no probability and no action: they are facts you take to be true, or limits imposed from outside).
3. Change the probability or the impact of a risk in the spreadsheet and watch the Priority recalculate itself. To regenerate from the board, use the D key in the menu.

Risks under control, it is time for the two questions every sponsor asks: when does it ship and how much does it cost. On to Step 4.