Risk Breakdown Structure (RBS) in Project Management Explained

J.R. Johnivan Avatar

Written By

Reviewed by

Published

Share this Article:

Our content and product recommendations are editorially independent. We may make money when you click links to our partners. Learn more in our Editorial & Advertising Policy.

Key takeaways
  • Risk breakdown structure in project management outlines the risks a project may face throughout its life cycle, ranking them by priority so they can be properly managed and their impact mitigated.
  • The risk breakdown structure helps project managers detect, identify, and categorize risks, as well as determine a project’s total risk exposure.
  • Most common project risks include performance risk, operational risk, scheduling risk, cost and budgeting risk, legal risk, and external hazards.

Featured Partners

According to recent project management statistics compiled by monday.com, 46% of organizations consider project planning as a top priority. However, even the most meticulously planned and well-executed projects are still prone to risk. But with a risk breakdown structure in place, these risks can be managed, preventing them from derailing the project. 

But what is the risk breakdown structure? How does it affect the risk management process in project management, and more importantly, how can you integrate it into your next project?

What is Risk Breakdown Structure in Project Management?

In project management, the risk breakdown structure or RBS is a graph or flowchart that identifies and describes the various risks in any given project. It provides a hierarchical representation of risks, beginning with the ones that are the most serious and most likely to occur, moving to the least serious and least likely to happen. The result is an easy-to-read map of potential project risks.

Some of the most common project risks include the following:

  • Performance risk
  • Scheduling risk
  • Communication risk
  • Technological risk
  • Cost and budgeting risk
  • Operational risk
  • Market risk
  • Governance risk
  • Legal risk
  • External hazards
  • Scope creek

While not all-inclusive, this list serves as a great starting point for identifying risks.

Risk Identification Strategies

In order to create an accurate risk breakdown structure in project management, it’s crucial that the project manager is able to properly identify and assess all types of project risks. Here are some techniques to ensure accuracy and efficiency when identifying project risks. 

Brainstorming

Brainstorming is a great way to involve your entire team in the risk identification process. Allowing everyone to participate could uncover risks that are difficult to detect on your own. Moreover, brainstorming could lead to new strategies in addressing and mitigating risks.

Documentation

Make sure to evaluate any project documentation you’ve created, including the initial project plan or scope. Analyzing these documents can help you pinpoint new areas of risk that might have otherwise been missed.

SWOT Analysis

Performing a SWOT analysis during the risk identification phase not only helps you identify potential threats, but it is also a good way to highlight your team’s strengths.

  • Strengths: These are the internal factors that will help your team succeed. In many cases, strengths relate directly to technology or business resources, but they can stem from other elements too.
  • Weaknesses: Similar to risks, weaknesses are the internal factors that are likely to be detrimental to your team’s success. Potential weaknesses include lack of resources and untrained (or unskilled) team members.
  • Opportunities: These are external factors that have the potential to support project success. For example, receiving a steep discount on the necessary project materials could lead to unexpected savings and, as a result, increased space within your allocated budget.
  • Threats: Threats are external factors that have the potential to harm or delay your project. A storm that knocks out the power in your entire building is an example of an external project threat.

After you’ve identified potential risks, start prioritizing them in a way that makes sense to everyone involved.

Risk Prioritization Methods

Not only do PMs need to consider the likelihood of risks occurring, but they need to consider the impact each of them will have on the project as a whole.

Using a risk matrix

The risk matrix, also known as the risk register, is one of the most effective means of prioritizing project risks. Most risk matrices use a five-by-five chart, consisting of five columns and five rows, but you can create bigger (or smaller) risk matrices if necessary.

Start by using the columns to indicate the severity of each risk, with each risk level corresponding to a number. In a five-by-five risk matrix, your risk severity levels will look something like this:

  • (1) Negligible risk
  • (2) Minor risk
  • (3) Moderate risk
  • (4) Major risk
  • (5) Catastrophic risk

You will also need to determine the likelihood of each risk happening. These go into the rows of your risk matrix. A five-by-five risk matrix will look something like this:

  • (1) Very unlikely to occur
  • (2) Not likely to occur
  • (3) Possible to occur
  • (4) Probable to occur
  • (5) Very likely to occur

An example of a risk matrix showing the likelihood severity of risks. Source: Asana.

To calculate the overall risk impact, simply multiply the severity by the likelihood. If you have a negligible risk that is not likely to occur, the overall risk impact would be 2 (1 x 2). If you have a catastrophic risk that is very likely to occur, the overall risk impact would be 25 (5 x 5).

Once you’ve calculated the overall risk impact, list that specific risk on your risk matrix. Risks with the least amount of impact will appear in the lower-left corner of your risk matrix, while those with the most amount of impact will appear in the upper-right corner. After you’ve sorted out prioritization, it’s much easier to fill them into your RBS.

How to Use a Risk Breakdown Structure

While the risk matrix gives you a visual chart of risk priorities, the RBS provides a means of organizing and categorizing these risks. Start by listing general risk categories, such as time, people, cost, or deliverables. Next, break down these general categories into more specific risks.

Time risks, for example, include potential schedule delays and project changes. People risks include labor shortages, strikes, and skill deficiencies, while cost risks include project escalations, inaccurate estimates, and unexpected changes in foreign exchange rates. Remember to list all of the specific risks that apply to the project at hand.

What are the Benefits of a Risk Breakdown Structure?

Although it might be time-consuming, especially for larger projects, the risk breakdown structure can help your team in a lot of ways. Some of the primary benefits of utilizing an RBS include:

  • Helps detect and identify risks: The most obvious and immediate benefit of the RBS is that it helps you identify project risks while detecting new ones as — or before — they appear.
  • Aids in risk categorization: The RBS makes categorizing risks simpler, which then makes it easier to prioritize them and delegate risk mitigation–related tasks to the right team member.
  • Drives communications: The RBS is another method of communicating risks to your team and key project stakeholders.
  • Strengthens resource allocation: Highlighting risks early on in the project life cycle makes resource allocation less challenging yet more efficient.
  • Improves risk monitoring and reporting: The RBS helps project managers monitor risks, especially when working with long-term projects, while making it easier to report on the success — or failure — of risk mitigation strategies.
  • Highlights recurring risk themes: A comprehensive RBS can help you identify trends and highlight recurring risks across projects.
  • Helps determine total risk exposure: Finally, the RBS helps you determine a project’s total risk exposure, which could mean the difference between moving forward with a project and cutting your losses before it even begins.

How to Create a Risk Breakdown Structure Template

Since it takes time to create a new RBS for every project, many skilled PMs opt to utilize a risk breakdown structure template. Not only does this reduce the amount of time it takes to create the chart, but it also provides a standardized approach to risk management that your entire team can understand.

Consider the following risk breakdown structure example for more information.

A risk breakdown structure template to help project managers get started

A simple risk breakdown structure template can be created in a matter of minutes. Adopting a standard flowchart style, start at the top of the chart and add a series of empty boxes that span the length or width of the document. These boxes will eventually be filled in with risk categories.

Now create a second series of empty boxes, either next to or underneath the previous boxes. These boxes should be populated with specific risks and then connected to their generic category. Once complete, you should have a risk breakdown structure that begins with a list of generic risks before branching off into granular, specific risks.

Integration with Modern Project Management Tools

The risk breakdown structure has become a staple in modern project management software. Platforms like monday.com are capable of generating risk breakdown structures based on the data you provide. Others, like Asana, offer a plethora of free templates that can help you get started on creating your own. 

The RBS has also become an essential element of several project management tools, concepts, and methodologies. Using an RBS in tandem with a Gantt chart, for example, is a great way to delegate and prioritize activities that are directly related to risk management.

Kanban boards, which are used to visualize project activities and limit the number of activities that are currently in progress, can also be used with an RBS. Kanban boards used together with a risk breakdown structure help teams manage their risk backlog and when planning sprints to address specific risks. 

Common Challenges in Creating a Risk Breakdown Structure

Risk breakdown structures streamline and simplify risk management processes, but creating them comes with a lot of challenges.

  • Capturing all potential risks: An RBS requires a complete picture of the project risk landscape. If the team fails to consider some of the potential risks involved, they might not be prepared to address them as they arise.
  • Oversimplifying risks: The process of assigning likelihood and severity to individual risks is, for the most part, subjective. While most experienced project managers will likely understand these factors, novice PMs have a tendency to oversimplify the most complicated risks and, in some cases, overcomplicate the simpler ones.
  • Determining overall risk impact: While the RBS provides a quantitative approach to risk management, the exact numbers are still left up to the PM’s best judgment. Just like issues with oversimplifying or overcomplicating risks, failure to accurately determine the risk impact will have detrimental effects on the project as a whole.
  • Ensuring stakeholder support: Simply creating a RBS doesn’t ensure the support of key stakeholders, especially if they’re aware of its subjective nature. If they don’t trust the numbers, or if they don’t trust the PM’s judgment, they might be hesitant to support the project in the first place.
  • Adverse selection: This occurs when two or more parties have conflicting information pertaining to a project. In this case, you’ll have to do some more research in order to determine who is correct — or you might have to forego that information altogether.

With experience, these challenges become easier to overcome. Additionally, with stronger strategies in place, it becomes less complicated to account for all potential risks and assign appropriate likelihood and severity ratings.

Comparison Between the Risk Breakdown Structure and Other Breakdown Structures

The risk breakdown structure is only one of many kinds of breakdown structures in project management. Here’s how it compares to the other types.

Work breakdown structure

Unlike the risk breakdown structure, which focuses on general and specific project risks, the work breakdown structure (WBS) provides a visualization of project tasks and subtasks. As such, the WBS is an efficient means of prioritizing and delegating project tasks and activities.

Organizational breakdown structure

As the name implies, the organizational breakdown structure (OBS) is a means of highlighting the structure of your organization. Sometimes used in the field of project management, the OBS helps clarify individual responsibilities like approving and managing projects.

Functional breakdown structure

Typically reserved for product or software development projects, the functional breakdown structure (FBS) provides a hierarchical view of the different functions of a product, system, or service. It helps prioritize and delegate the necessary actions that need to be carried out to complete the project. 

Cost breakdown structure

A hierarchical map of the different costs associated with a project is known as a cost breakdown structure (CBS). It categorizes every expense, helping with budgeting and cost control.

FAQs

Risk breakdown structure in project management is a hierarchical framework that PMs use to identify, organize, and categorize potential risks in a specific project. Conversely, a risk matrix is a visualization tool that is used to assess and prioritize risks according to their likelihood and their potential impact.

The RBS provides a standardized and straightforward means of risk identification, making it a crucial part of project management. It also helps drive communications amongst teammates, aids risk mitigation strategies, and facilitates the tracking of risks throughout the project life cycle.

One of the most common project risks, scope creep occurs when the project’s original scope evolves beyond that of what was originally agreed upon at the beginning of the project. Scope creep generally happens slowly over the entire course of the project, making it hard to detect for inexperienced or novice PMs.

Conclusion

The risk breakdown structure in project management is a straightforward way of identifying, analyzing, and prioritizing project risks. Although you can’t avoid every single project risk, proper planning ensures that everyone is on the same page when it comes to addressing and overcoming risks. Without the RBS, your team won’t even be aware of any potential risks until they occur — and they’ll have no idea what to do to address them.

Subscribe to Project Management Insider for best practices, reviews and resources.

You must input a valid work email address.
You must agree to our terms.

Featured Partners

J.R. Johnivan Avatar

Get the Free Newsletter!

Subscribe to Project Management Insider for best practices, reviews and resources.

You must input a valid work email address.
You must agree to our terms.