Risk Identification is an iterative process because new risks may become known as the project progresses. The Risk Identification process usually leads to the Qualitative Risk Analysis process. Alternatively, it can lead directly to the Quantitative Risk Analysis process when conducted by an experienced risk manager. On some occasions, simply the identification of a risk may suggest its response, and these should be recorded for further analysis and implementation in the Risk Response Planning process.

Inputs of Risk Identification Process:

1. Enterprise Environmental Factors - Published information, including commercial databases, academic studies, benchmarking, or other industry studies, may also be useful in identifying risks.
2. Organizational Process Assets - Information on prior projects may be available from previous project files, including actual data and lessons learned.
3. Project Scope Statement - Uncertainty in project assumptions should be evaluated as potential causes of project risk.
4. Risk Management Plan
5. Project Management Plan

Tools and Techniques used in Risk Identification:

1. Documentation Reviews
2. Information Gathering Techniques like Brainstorming, Delphi technique, Interviewing, Root cause identification, Strengths, weaknesses, opportunities, and threats (SWOT) analysis
3. Checklist Analysis - Risk identification checklists can be developed based on historical information
4. Assumptions Analysis
5. Diagramming Techniques like Cause-and-effect diagrams, System or process flow charts, Influence diagrams

Output of Risk Identification Process: Risk Register (Risk Tracker) - it should contain the following information: List of identified risks, List of potential responses, Root causes of risk and Updated risk categories.

• Risk categories are important in classifying risk.
• Risk management planning and risk response planning are not the same activities.
• Risk can be either positive or negative. Positive risks are opportunities, negative risks are threats.
• A risk breakdown structure is used to organize risk in a hierarchical structure.
• Probability and impact are both needed to assess risks.
• Quantitative analysis is generally reserved for high-probability, highimpact risk.
• Risk identification is an iterative process that is performed throughout the project, not just during planning.
• Decision tree analysis is a technique using probabilities and costs for structured decision making.
• Monte Carlo analysis is a technique using simulations and probability in determining quantitative risk analysis.