Risks are future events or conditions that have some probability of occurring and that will some impact on your project. We usually think of risks as being bad and we try to put a plan in place to make sure the risk goes away.
But are all risks really bad? Let's say your project was going to utilize a new tool or new technology. Would it make sense to you if I said that your project was riskier than a similar project that is using current technology?
On the surface this would seem to be correct. Your team probably understands the current technology better, the current technology is probably more stable and you probably have a lot more support infrastructure. The new technology is not understood as well, has more opportunity for problems and you don't have nearly as solid of a support infrastructure in case something goes wrong. Even without understanding the specific technology in question, it makes sense that projects with new technology would be somewhat riskier that a similar project that uses current technology. (I know there are exceptions, but this is generally true.)
So here's the question: If it's true that all projects are generally more risky when we use new technology, why would you ever undertake a project with new technology? The answer, of course, is that we perceive there to be a benefit to our project. In other words, the potential impact to our project is a positive. This still meets our definition of risk.
- There is an impact to our project. Normally risk events have a negative impact on our project. However, with positive risk there is a potential positive impact.
- There is a probability of the event occurring. This is still the case with positive risks. In our prior example, if the benefits of moving to new technology were guaranteed, we could make the decision to move forward with 100% confidence. However, usually the benefits are not guaranteed. The technology, or our implementation of the technology, could turn out bad, in which case we might be worse off than when we started.
Positive risk is also called "opportunity risk." In these instances, the project manager or project team may introduce risk to try to gain much more value later.
A key aspect of positive risk is that you put yourself in a position to take on the risks; they are risks that we knowingly take upon ourselves because we perceive there to be advantages to doing so.
Different organizations have different tolerances for risk. Remember that all risks have a probability of occurring. They're not guaranteed. If you take an intelligent risk and you fail, what happens? If your organization rewards people who take risks and are successful, and they punish people that take risks and fail, then they are really risk averse.
Generally when we're doing risk management on projects, we're talking about potential negative events. However, you can also identify the risk events that lead to positive outcomes. Your risk plan should include activities designed to give you the best chance that the risk event will come true.