Project risk management is concemed with identifying, assessing and responding to uncertainties which could impact project outcomes. These impacts might be positive or negative, although the tendency in business has been to focus on the negative - or downside - risks, Le., those risks which could be potentially detrimental to project outcomes.Risk management requires an investment in time, effort and cost. For thisreason, it has to be efficient if it is going to make business-sense. If it can be shown that risk management plays a positive role in supporting successful project delivery, then the case for investing in risk management will be validated.This study focuses on two projects within Old Mutual, to investigate the link between risk management and project success. Both projects had been approved by the company's Strategic Investment Committee (SICOM), which required that they conform to various governance criteria, including that their risks be managed according to a specified process.One of the projects - CRAFT - was deemed by its stakehoiders to have delivered successfully, while the other - SSA - was perceived to have had mixed results. As a precursor to the study, an extensive review of the current literature on project risk management was undertaken. The literature was found to be largely consistent in its definition of project risk management, and to be concerned mainly with developing the processes and techniques for improving risk management in the live project environment. Based on the literature, it was possible to develop an analytical framework for use as a generic tool in evaluating the role which effective risk management practice could have on project success. This tool was used as the basis for studying the CRAFT and SSA projects.A critical part of the study was directed at understanding the policy-underpinnings supporting project delivery, since policy is assumed to be the articulation of management's requirements. The simple logic is that if strong policy guidelines on risk management exist - and are enforced - then one can reasonably infer that risk management is important to the organisation's management. In the case of both CRAFT and SSA, SICOM registration ensured that they were run within strict policy guidelines, so it could easily be concluded that a key prerequisite for project success was met.However, even though policy is a necessary condition for project success, it is not a sufficient condition. Equally important is how well project success criteria are defined. In the case of CRAFT, the success criteria were found to be unambiguously defined, and thus a major contributor to the ultimate outcome. In the case of SSA, however, different stakeholders had different expectations of what the project should have delivered, and were thus divided on their assessment of the final outcome.The analytical framework also provided a means for studying how effectively the two projects implemented risk management 'best practice' in regard to the identification, assessment and responding to of project risk. One of the general conclusions was that checklists could be a useful aid to the identification of project risks, since they act as prompts to management, thereby ensuring that key risks might not be inadvertently overlooked.The overall conclusion drawn was that project risk management practice does support project success - which is not to say that no risk management practice leads to project failure, since risk implies probability, not certainty.
