Project managers know that risk management is an ongoing
process, and risk identification happens throughout the project
life cycle. Of course, one of the basic requirements in
identifying project risks is describing each risk in such a way
that it is meaningful to management and other stakeholders who
aren’t part of the project team. To that end, a common practice
is to document risks as “If / then” statements, in the following
format: IF [Event], THEN [Consequences]. You may remember the
definition of a risk as “An uncertainty that matters.” In this
case, the Event is the uncertainty, and the Consequences are why
it matters. The risk statement relates the Consequences to the
Event. As an example, let’s say an interface is being built that
will pass “hours worked” for each employee from the timekeeping
system to the payroll system. Obviously, the hours worked is a
critical input in order to calculate payroll for those employees
who are paid by the hour. For this reason, the interface must be
developed, and t