Risky Business: Risk Management and Live Events

Whether you work in the events business or not, most are aware that events present a high level of risk. Recent events including the tragic loss of life at the Astroworld Festival and the spread of COVID-19 at large-scale festivals illustrate the consequences of risks actualizing into issues.

It is the Event Project Manager and Project Team’s responsibility to identify, anticipate, and plan for risks before they occur. Doing so ensures that your audience, crew, and partners come away from your show having enjoyed the experience as intended. 

Before diving into the key tool that all event project managers should apply to protectively manage risk, let’s go over a few Risk Management definitions and ground rules. 

• Risk means the chance of something happening that will have an impact on project objectives. Risks have not materialized. If a risk occurs, it becomes classified as an issue.  
• There are both positive and negative risks. A negative risk is a threat that would have an unfavorable impact on the event project, while a positive risk can be seen as an opportunity. 
• Risk management is the responsibility of everyone on the project team
• Risk identification, the process of identifying risk, must happen continuously throughout the project. Not just at the beginning. The more team members involved in this process with diverse experiences and perspectives, the more complete picture of project risk will be built. Risk workshops are used to gather the project team, subject matter experts, and project stakeholders to identify and evaluate risk.

In order to assess the severity of risks identified for the project, the Project Team must create a Risk Register with a corresponding Risk Scoring Matrix. The project team must then identify the probability of a risk occurring through the lifetime of the project as well as the expected degree of impact on the project. These items are assessed using a qualitative method of assessing risk that relies on the teams’ project expertise and knowledge. The probability of a risk occurring is rated by using one of five descriptors: “Very Unlikely”, “Unlikely”, “Possible”, “Likely”, and “Very Likely”. The impact is rated using one of the following five descriptors: “Negligible”, “Minor”, “Moderate”, “Significant”, and “Severe”. Additionally, the Project Team must identify if risks have a positive impact (opportunity) or a negative impact (threat). The combination of a risk’s impact, probability, and negative/positive identification results in an assigned severity range score from 1-25. See the probability and impact matrix below:

Identified project risks are detailed in the Risk Register. The Risk Register holds information that pertains to risk probability, impact, priority, assigned risk ID, and response strategy. Additionally, the register documents the accountable and responsible parties, along with the date the risk was identified, the date of response, the current status, and the outcome of the response. The register is established during a risk management initiation meeting run by the Project Manager when the Project Team first identified project risks and risk probability, impact, and priority through a risk workshop. The process by which additional risks will be identified, assessed, and added to the Risk Register must be determined and also communicated at an initiation meeting. The current Risk Register can be shared by the Project Manager with the Project Team on a weekly basis and remain accessible to the Project Team throughout the duration of the project. 

High-impact risks should be reviewed at weekly team meetings or if urgent, the Risk Owner can bring the risk to the Project Manager’s immediate attention through established communication channels. Risk Owners should provide risk status updates bi-weekly at team meetings. During recurring risk identification and assessment meetings, any new risks must be added to the Risk Register and will follow the established risk management process. 

The Risk Manager will assign identified risks to Risk Owners who will be responsible for carrying out responses based on the agreed-upon Risk Responses presented in the Risk Register. It is the responsibility of the Project Manager, Project Team, Risk Manager, and Risk Owners to track identified risks and document newly identified and secondary risks as soon as possible. Lastly, the status of identified risks that fall in the current and upcoming project timeframes will be updated during each risk identification and assessment meeting.

The Risk Register must include the following for each identified risk:

•  Risk ID - The risk identification number
•  Risk Description - Description of the risk
• Risk Probability - Likelihood of the risk happening
• Risk Impact - How the risk could affect the project (Low, Moderate, High)
• Risk Priority - Ranking of risk comparatively (Low, Medium, High)
• Response Plan - Will negative risk be accepted, avoided, transferred, mitigated, or escalated? Will positive risk be exploited, enhanced, accepted, or shared?
• Risk Assignment - Person accountable for the risk (Risk Owner)
•  Date of Risk - Date the risk was identified
• Proposed Response Date - Date at which the risk will be resolved by
• Risk Status - Status of the risk when identified (Closed, In-Progress, New)
• Risk Decision - Final decision made to manage risk

It is the responsibility of a Project Manager to anticipate problems and opportunities before they occur. A great PM is proactive rather than reactive. They leverage their team’s experience and insights in order to deliver successful events. An ounce of prevention is worth a pound of cure. As fundamental as securing a venue for an event project is Risk Management - which includes risk identification, the creation of a risk register, and continued accountability among the project team in monitoring risk and implementing risk responses so that the show can go on.