HKSM

Risk categorization is a technique that groups identified risks by common characteristics such as source, cause, area, or lifecycle phase to reveal patterns. It supports prioritization, assignment of owners, and consistent responses across similar risks.

Key Points

• Groups risks by source, cause, area, lifecycle phase, or other agreed taxonomy to reveal patterns.
• Often uses a risk breakdown structure (RBS), WBS mapping, or organizational risk taxonomy.
• Applied during risk identification and refined during analysis, planning, and monitoring.
• Enables prioritization, category-level strategies, and targeted reserves.
• Supports visuals such as Pareto charts and heat maps by category.
• Requires clear definitions and consistent tagging in the risk register.

Risk Objective

Expose systemic drivers of risk so the team can focus on the few categories that contribute most to overall exposure and plan coordinated responses.

Method Steps

• Select a taxonomy appropriate for the project (for example, RBS, WBS element, process area, internal vs. external, threat vs. opportunity).
• Define category descriptions and tagging rules; brief the team on how to apply them consistently.
• Tag each identified risk with one or more categories in the risk register.
• Aggregate counts and exposure (for example, probability-impact scores) by category.
• Analyze patterns and perform Pareto or trend analysis to find dominant categories.
• Assign category owners and agree on category-level prevention and response strategies.
• Adjust reserves, plans, and monitoring activities based on category insights.
• Review and refine categories at phase gates or regular risk reviews.

Inputs Needed

• Risk register or log with initial risk statements and attributes.
• Risk breakdown structure or organizational risk taxonomy.
• WBS, schedule, product breakdown, and process maps.
• Stakeholder and SME input, including workshops or interviews.
• Historical data, lessons learned, and checklists.
• Risk appetite and threshold definitions, ideally by category.
• Tools for tagging and reporting (spreadsheets or risk management software).

Outputs Produced

• Updated risk register with category tags and assigned owners.
• Category summaries showing counts and total exposure.
• Pareto charts, heat maps, or dashboards by category.
• Updates to the risk report and communications artifacts.
• Targeted response strategies and adjusted reserves by category.
• Refined RBS or taxonomy to close gaps or remove ambiguity.
• Watchlist of low-priority risks grouped by category.

Thresholds/Triggers

• Initiate categorization once multiple risks are identified or after each risk workshop.
• Revisit categories at phase gates, major changes, or new releases.
• Escalate when a category exceeds a defined exposure or frequency threshold.
• Trigger focused deep dives if a category trend increases over consecutive reviews.
• Update taxonomy when new sources emerge or categories become unclear.

Example

A project team tags risks using an RBS and finds that 40% of exposure comes from supplier-related risks. They assign a category owner, run a supplier risk workshop, implement stronger acceptance criteria, and allocate a small schedule buffer to deliveries. Subsequent reviews show a reduction in supplier risk exposure and fewer late changes.

Pitfalls

• Using categories that are too broad or too narrow, masking real drivers.
• Inconsistent tagging by different team members.
• Assuming categories are mutually exclusive when overlap can be informative.
• Letting labels bias decisions instead of using data from analysis.
• Failing to refresh categories as the project context evolves.
• Focusing only on threats and ignoring opportunities.

PMP Example Question

During a risk review, the team sees many risks related to external suppliers. What should the project manager do next to gain actionable insight?

1. Group the risks using a defined taxonomy and analyze exposure by category.
2. Perform quantitative analysis on every individual risk to get precise numbers.
3. Escalate all supplier-related risks to the sponsor for immediate action.
4. Close low-impact risks to reduce the size of the risk register.

Correct Answer: A — Group the risks using a defined taxonomy and analyze exposure by category.

Explanation: Categorization reveals systemic sources and helps focus responses and reserves. Jumping to full quantitative analysis or escalation may waste effort and closing risks prematurely reduces visibility.