Project Risk Assessment Techniques

WEF's Global Risks Report 2026 is out 👉 (https://lnkd.in/eaMrdW67).. I put the findings in a 20-year perspective. I mapped 20 years of risk rankings. Two patterns stand out. Both troubling. The headline findings in this report: 🔵 geoeconomic confrontation is now the #1 risk in the short term, 🔵 economic risks are spiking, 🔵 50% of experts expect a turbulent or stormy outlook over the next two years. But the deeper signal only appears when you track the rankings over time (what I did, see 👇 ). ⚫ 𝐏𝐚𝐭𝐭𝐞𝐫𝐧 𝟏 – 𝐋𝐨𝐧𝐠-𝐭𝐞𝐫𝐦 𝐫𝐢𝐬𝐤𝐬 𝐦𝐢𝐠𝐫𝐚𝐭𝐞 𝐢𝐧𝐭𝐨 𝐭𝐡𝐞 𝐬𝐡𝐨𝐫𝐭 𝐭𝐞𝐫𝐦 Not overnight. Not mechanically. But persistently. In 2007–2010, short-term risks were concrete and immediate: asset bubbles, oil shocks, chronic diseases. Fast forward to today. The long-term top risks for 2026 are: 🌪️ extreme weather 🌍 biodiversity loss 🧠 misinformation 🤖 adverse AI outcomes What changed is not that economic risks disappeared. It’s that structural risks began to act as crisis amplifiers. Extreme weather didn’t replace financial shocks, it reshaped them. Climate risks first entered the short-term top 5 around 2014. By 2020, climate action failure topped the list. “Tomorrow’s risks” became today’s stress multipliers, and increasingly, direct crisis drivers. The future didn’t wait. ⚫𝐏𝐚𝐭𝐭𝐞𝐫𝐧 𝟐: 𝐍𝐚𝐭𝐮𝐫𝐞 𝐢𝐬 𝐛𝐞𝐢𝐧𝐠 𝐟𝐨𝐫𝐠𝐨𝐭𝐭𝐞𝐧, 𝐚𝐠𝐚𝐢𝐧 This year, environmental risks dropped sharply in the short-term rankings. More worrying: their severity scores also declined in absolute terms. Yet over the 10-year horizon, environmental risks dominate the top 10. Twenty years of WEF risk data tell the same story: we consistently recognise long-term environmental threats, then consistently deprioritise them when short-term pressures mount. It's not that we don't know. It's that our attention economy is structurally biased toward the urgent over the important. The most interconnected risk for the second year running? Inequality (👇). It fuels everything else: polarisation, migration, political instability, resistance to climate policy. Perhaps that's where to start: 𝐢𝐟 𝐰𝐞 𝐰𝐚𝐧𝐭 𝐭𝐨 𝐚𝐝𝐝𝐫𝐞𝐬𝐬 𝐥𝐨𝐧𝐠-𝐭𝐞𝐫𝐦 𝐜𝐡𝐚𝐥𝐥𝐞𝐧𝐠𝐞𝐬, 𝐰𝐞 𝐧𝐞𝐞𝐝 𝐭𝐨 𝐫𝐞𝐝𝐮𝐜𝐞 𝐭𝐡𝐞 𝐬𝐡𝐨𝐫𝐭-𝐭𝐞𝐫𝐦 𝐝𝐞𝐬𝐩𝐞𝐫𝐚𝐭𝐢𝐨𝐧 𝐭𝐡𝐚𝐭 𝐤𝐞𝐞𝐩𝐬 𝐮𝐬 𝐭𝐫𝐚𝐩𝐩𝐞𝐝 𝐢𝐧 𝐜𝐫𝐢𝐬𝐢𝐬 𝐦𝐨𝐝𝐞. #GlobalRisks #WEF #ClimateChange #Sustainability #SystemChange

Be careful. Most "products" are, in fact, projects. 9 red flags (and how it should work): 1. Large PRD: You start an initiative by documenting everything. 2. Feature factory: You implement the requirements. "Why" is irrelevant. 3. Waterfall: All the requirements are collected in the "initial phase." 4. Gantt roadmap: A time-based, feature-based roadmap. 5. No discovery: No need to validate ideas before implementing them. 6. No designer: There is no Product Designer on the team. 7. No analytics: You have no idea how people use your product. 8. Customer in charge: Powerful customer(s) make all the decisions. 9. No strategy: You try to maximize sales by satisfying all customers and grasping every opportunity. - Here is a better way: 1. Your cross-functional team is empowered to solve the problems. 2. PM, Product Designer, and Lead Engineer perform Product Discovery together. Continuously. 3. You have an outcome-based roadmap. Preferably Now-Next-Later. 4. If you commit to a date, you do it rarely and only after the discovery. Never commit too early. 5. Manage the value, usability, feasibility, and viability risks by experimenting. 6. Test the riskiest assumptions before the implementation. 7. Choosing, instrumenting, and tracking the right metrics is key. 8. Ship incrementally, measure the outcomes, and learn from it. 9. Tradeoffs are essential. What you do, but also what you don't. Respect your market and the unique value proposition. - And if your product hasn't been launched yet: 1. Discover the market and define a unique value proposition, business model, initial vision, and strategy. 2. Test your idea with minimal effort. Before the implementation. 3. Define the go-to-market strategy and validate key assumptions. 4. You can't rely on product analytics. Talk to the customers and collect data from experiments. 5. The Product Trio performs the Initial Product Discovery, just like in Continuous Product Discovery. You need a Product Designer and Lead Engineer. 6. Once you ship, leverage product analytics and apply Continuous Product Discovery. - Hope that helps. What are your thoughts?

New paper THE "SMALL IS SAFE" MYTH IS RUINING YOUR PORTFOLIO Conventional project management wisdom – and most governance frameworks – relies on a simple, lazy assumption: budget size is a reliable proxy for risk. If a project's budget is small, we assume it is "safe". We exempt it from external risk reviews, intense scrutiny, and deep contingency planning. For example, the Danish government recently raised the budget threshold for excusing IT projects from external risk reviews from $1.5 million to $7.5 million. They are completely wrong. In our new paper, my co-authors (Fioralba Ajazi, Daniel Nickelsen, Jens Schmidt, Maria Christodoulou) and I analyzed a large dataset of 5,094 IT projects. The results are a wake-up call for practitioners: 1. Small is not safe: The smallest 20% of IT projects have the worst cost performance of any group, with a mean cost overrun of no less than 192%, in real terms. 2. Wild risk is real: Tail-risk analysis shows that the smallest projects suffer from the most extreme tail risk (α=0.874, which is the lowest α-value we've ever measured for any project type, implying the highest risk). 3. There's a "double burden" of incompetence: Small projects are typically staffed by junior, inexperienced teams. The Dunning-Kruger effect dictates that a lack of experience simultaneously makes a task more difficult and inflates optimism bias. They literally do not know what they do not know. Stop letting budget size dictate your management attention. A tiny project, left unmonitored and under-resourced, is a ticking time bomb. Free pdf with the paper, here: https://lnkd.in/eTQrB5ct Comments very welcome, kindly help share 🙏

Why we classify Mineral Resources and why is so Important for Investors and Money Decisions Classifying a mineral deposit is not just a technical job for geologists; it's a key factor that influences how much a mining project is worth, how risky it is, and whether investors will put money into it. The way we label a resource, as Inferred, Indicated, or Measured, directly shows the uncertainty of mineralization model. These labels are important because they determine: • If we can realistically turn the resource into a mineable quantities. • If we can use it to create mine plans. • If the project is reliable enough to get loan funding (bankability). From a money (financial) standpoint, the classification directly affects: • How much money the mine is expected to make (cash flow) and its current total value. • The risk percentage (discount rate) used in the value calculations. • The overall risk of the project and how sensitive its value is to changes. • The ability to get loans and investment money. Projects that rely mostly on Inferred Resources are much riskier. There's high uncertainty about the quality of the mineralization model and whether the mine plans are reliable. As the project does more drilling, and sampling, the uncertainty decreases. When a resource moves from Inferred to Indicated or Measured, its value becomes more secure and less risky. In simple terms, mineral resource classification is the clearest link between what the ground holds (geology) and what the project is worth (finance). Using standard reporting rules (like JORC or NI 43-101) helps the market correctly judge the risk, put capital to good use, and build trust among everyone involved. The geology identifies the problem (risk). The classification explains it. The financial model puts a price tag on it. How do you account for the certainty of the geology and the resource classification in your financial or investment models?

Bad metallurgy leaves mining investors in the red 🚩 Big ore bodies? Nice. High-grade deposits? Great. But if the metallurgy is complicated, expect trouble. Costs rise. Delays pile up. Projects fail. Not all ore bodies are created equal. Some are straightforward to process. Others require expensive and time-consuming methods like pressure oxidation or bio-leaching. Expensive. Energy-hungry. High-risk. High operational costs. Look at the Ajaokuta Steel Complex in Nigeria. It was supposed to be Nigeria’s ticket to industrial growth, but poor management and metallurgical issues turned a $650 million project into an $8 billion money pit. 40 year after, it has yet to produce any steel. The Sino Iron Project in Australia had similar issues. Processing magnetite ore turned out to be more complex and expensive than expected, and costs ballooned from $2.5 billion to $12 billion. It’s a reminder that even promising projects can spiral out of control when metallurgy gets complicated. Red flags to watch for Investors need to be cautious when assessing mining projects. Here are some common metallurgical red flags that often signal trouble ahead: 1️⃣ Unproven tech. New methods like bio-leaching can seem exciting. These methods are often expensive and unpredictable. While they can work, they come with high risks and significant upfront costs. 2️⃣ Selective sampling. Companies test the best ore and ignore the rest. When metallurgical samples are skewed this way — the reality of extraction costs can be much higher than what’s advertised. Company is only testing high-grade ore? They might be hiding the true complexity of the deposit. 3️⃣ Energy drains. Some methods drain energy and profits. Pressure oxidation? Heavy on power. Hard on margins. 4️⃣Optimistic costs. If the numbers sound too good, they are. Complex metallurgy? Always leads to higher CAPEX and OPEX. 5️⃣ Permitting delays. The more complex the metallurgy, the longer the wait. Environmental approvals slow everything down. No one talks about metallurgy, but it’s one of the biggest risks in mining. Complex processes cost more, take longer, and sometimes fail outright. Investors should always ask, “How simple is the extraction?” before getting excited about that high-grade deposit.

🔐 My OWASP-Style Top 10 for MCPs I’ve been working with various MCP (Model-Context Protocol) clients and servers lately — the infrastructure that lets LLMs call external tools and APIs. It’s a powerful idea, but also introduces a ton of new security risks that aren’t well mapped yet. So I wanted to suggest my own list of what an OWASP Top 10 for MCPs might look like — based on the issues I’ve seen firsthand while testing, building, and breaking things. 🧨 Top 10 MCP Security Risks 1️⃣ Prompt Injection via Tool Metadata Tool descriptions or parameter hints can sneak in hidden instructions the model will execute. 2️⃣ Command Injection / Remote Code Execution Unvalidated input passed to shell commands or system calls = instant RCE. 3️⃣ Tool Redefinition (Supply Chain Attack) A tool that changes behavior post-approval, without any warning or versioning. 4️⃣ Tool Spoofing / Shadowing Malicious servers can impersonate tools registered on other servers and hijack execution. 5️⃣ No Tool Integrity or Authenticity Checks No signing or verification means tools can be silently swapped or tampered with. 6️⃣ Sensitive Data Exposure Tools may leak secrets or internal state if output isn’t carefully filtered. 7️⃣ Overprivileged Tools Tools often get way more access than they need — increasing risk dramatically. 8️⃣ No Logging or Monitoring No visibility into what tools are doing, or what the model is asking them to do. 9️⃣ Denial of Service A malicious or buggy tool can flood connected APIs or external services, bringing them down. 🔟 Denial of Wallet Tools can consume excessive tokens or call expensive APIs, racking up major costs without control. What do you think? Did I miss anything obvious? Would love to hear how others are thinking about securing this layer.

You can't treat every forecast the same. More uncertainty means more risk, and you want to deal with it correctly. After building forecasting models at P&G, Unilever, and Squarespace, I've learned there are three ways to manage uncertainty: 𝟭) 𝗔𝘃𝗼𝗶𝗱 𝗔𝘀𝘀𝘂𝗺𝗽𝘁𝗶𝗼𝗻 𝗦𝘁𝗮𝗰𝗸𝗶𝗻𝗴 The more uncertainty, the fewer assumptions you should include. Why? Because if you add multiple variables on top of each other, their margin of error multiplies. If you base the forecast on many assumptions, it's nearly impossible to determine which one was accurate and which wasn't. So, keep your models as simple as possible. Isolate the variables. You can always add additional assumptions later once you better understand the correlations. 𝟮) 𝗥𝘂𝗻 𝗪𝗵𝗮𝘁-𝗜𝗳 𝗔𝗻𝗮𝗹𝘆𝘀𝗶𝘀 It's your job as a finance leader to quantify the risk of a forecast. The easiest way to do that is by changing individual inputs and noting how much impact that has on the forecast. For example, if a 5% price change affects the revenue forecast by 25%, that's a major risk you'll need to call out. 𝟯) 𝗦𝗵𝗼𝘄 𝗮 𝗥𝗮𝗻𝗴𝗲 Sometimes analysts make the mistake of assuming ranges make it look like they aren't confident in their forecast. But a well-measured range is critical for two reasons: One, it shows the order of magnitude of risk. Your CFO knows what's a conservative estimate to communicate to investors. Two, it enables scenario planning. Leaders can plan contingency measures if results are at the lower end of the range. 𝗜𝗻 𝘀𝘂𝗺, 𝘁𝗼 𝗺𝗮𝗻𝗮𝗴𝗲 𝘂𝗻𝗰𝗲𝗿𝘁𝗮𝗶𝗻𝘁𝘆 𝗶𝗻 𝗮 𝗺𝗼𝗱𝗲𝗹: 1. Reduce the number of assumptions 2. Estimate the risk by running sensitivity analysis 3. Provide ranges instead of point estimates Which approach do you find most useful? Comment below 👇 -Christian Wattig 📌 Get my 𝗙𝗶𝗻𝗮𝗻𝗰𝗶𝗮𝗹 𝗠𝗼𝗱𝗲𝗹𝗶𝗻𝗴 𝘁𝗲𝗺𝗽𝗹𝗮𝘁𝗲 + 𝟰𝟲 𝗯𝗲𝘀𝘁 𝗽𝗿𝗮𝗰𝘁𝗶𝗰𝗲𝘀 (free) here: https://lnkd.in/eBAmSF_6 

Product development entails inherent risks where hasty decisions can lead to losses, while overly cautious changes may result in missed opportunities. To manage these risks, proposed changes undergo randomized experiments, guiding informed product decisions. This article, written by Data Scientists from Spotify, outlines the team’s decision-making process and discusses how results from multiple metrics in A/B tests can inform cohesive product decisions. A few key insights include:  - Defining key metrics: It is crucial to establish success, guardrail, deterioration, and quality metrics tailored to the product. Each type serves a distinct purpose—whether to enhance, ensure non-deterioration, or validate experiment quality—playing a pivotal role in decision-making.  - Setting explicit rules: Clear guidelines mapping test outcomes to product decisions are essential to mitigate metric conflicts. Given metrics may show desired movements in different directions, establishing rules beforehand prevents subjective interpretations during scientific hypothesis testing.  - Handling technical considerations: Experiments involving multiple metrics raise concerns about false positive corrections. The team advises applying multiple testing corrections for success metrics but emphasizes that this isn't necessary for guardrail metrics. This approach ensures the treatment remains significantly non-inferior to the control across all guardrail metrics. Additionally, the team proposes comprehensive guidelines for decision-making, incorporating advanced statistical concepts. This resource is invaluable for anyone conducting experiments, particularly those dealing with multiple metrics. #datascience #experimentation #analytics #decisionmaking #metrics – – –  Check out the "Snacks Weekly on Data Science" podcast and subscribe, where I explain in more detail the concepts discussed in this and future posts:    -- Spotify: https://lnkd.in/gKgaMvbh   -- Apple Podcast: https://lnkd.in/gj6aPBBY    -- Youtube: https://lnkd.in/gcwPeBmR https://lnkd.in/gewaB9qC

𝗗𝗶𝗱 𝘆𝗼𝘂 𝗽𝗹𝗮𝗰𝗲 𝗮 "𝗖𝗮𝗻𝗮𝗿𝘆" 𝗶𝗻 𝘆𝗼𝘂𝗿 𝗣𝗿𝗼𝗰𝗲𝘀𝘀 𝗔𝘂𝘁𝗼𝗺𝗮𝘁𝗶𝗼𝗻? The sort of early warning detection system which monitors your automated processes and sings when irregularities occur? Why a 🐤 𝗰𝗮𝗻𝗮𝗿𝘆 you ask? Around 1911, miners started to take canary birds into the coal mines to detect the accumulation of toxic gases. These birds, would even sense the smallest traces and emissions, starting to erratically chirp and with that giving miners early warnings to immediately evacuate the mine. Just as the canaries once did in the mines, 𝗮 𝗱𝗶𝗴𝗶𝘁𝗮𝗹 "𝗰𝗮𝗻𝗮𝗿𝘆" can play a vital role in monitoring the health of your automated workflows signalling potential issues before they escalate and perhaps, cause scaled harm. But how do you implement a digital canary into your workflows in your process automation? 𝗜𝗻𝗰𝗼𝗿𝗽𝗼𝗿𝗮𝘁𝗲 𝗶𝘁 𝗳𝗿𝗼𝗺 𝘀𝘁𝗮𝗿𝘁: into your design by using code, reconciliation reports, and validation rules to establish effective in-process control checks and monitoring mechanisms and visual dashboards to analyse red flags. Find here 5 examples how to get early alerts in your process automation, even if your automation bots don't know how to sing: ▪️𝗣𝗿𝗼𝗰𝗲𝘀𝘀𝗶𝗻𝗴 𝗖𝗵𝗲𝗰𝗸𝘀: Implement automated checks at various stages of the process to ensure accuracy and completeness and volume variations. ▪️𝗜𝗻𝘁𝗲𝗴𝗿𝗮𝘁𝗶𝗼𝗻 𝗘𝗿𝗿𝗼𝗿 𝗩𝗮𝗹𝗶𝗱𝗮𝘁𝗶𝗼𝗻: Monitor integration and break points like API's for errors or failures to maintain seamless data flow across systems. ▪️𝗗𝗮𝘁𝗮 𝗜𝗻𝘁𝗲𝗴𝗿𝗶𝘁𝘆 𝗦𝗰𝗮𝗻𝘀: Validate for duplicate records or inconsistencies to maintain data integrity and remove manual overrides or corrections. ▪️𝗨𝘀𝗮𝗯𝗶𝗹𝗶𝘁𝘆 𝗙𝗲𝗲𝗱𝗯𝗮𝗰𝗸𝘀: Analyse insights from user feedbacks to check on usability issues, frequent issues and detect sentiment drops with NLP / AI. ▪️𝗖𝗼𝗺𝗽𝗹𝗶𝗮𝗻𝗰𝗲 𝗖𝗼𝗰𝗸𝗽𝗶𝘁: Create a centralised dashboard to monitor compliance metrics to detect red flags and and detect deviations from policies. By integrating digital canaries into your process automation strategy, you are not only enhance your ability to detect and respond to issues rapidly but also promote a culture of self-monitoring and continuous improvement. So, did you already place a digital "canary" into your process design and automations? If not, maybe it's time to reconsider adding this early warning system to your automation approach ensuring the health and resilience of your tasks, data & process performance. What early warning systems have worked for you best? #processautomation #intelligentautomation #rpa #processexcellence

Winter has made a grand entrance in the US with an early season significant lake-effect snowfall that extended over the Great Lakes. This made me think about how snow prediction has so much in common with risk forecasting. Forecasting snowfall is very difficult because small atmospheric shifts can lead to wildly different outcomes. For leaders, risk forecasting is no different. It is a strategic challenge shaped by uncertainty, complexity, and risk velocity. Here goes my perspective in using this weather metaphor: ☑️Tiny Changes, Major Consequences Just as a slight temperature change can turn snow into rain, a small shift in market dynamics, regulation, or technology can dramatically alter your risk landscape. Leaders must be looking for these subtle signals. ☑️ Unpredictable Ratios Snow-to-water ratios vary widely similar to the impact of risk events. One disruption might be absorbed easily, while another could cascade across operations. Leaders must use scenario planning and stress testing to prepare for both. ☑️ Storm Tracks and Dark Corners Storms often form over oceans which are data-sparse regions. As with risks, they often emerge from areas we do not monitor closely like third-party dependencies, emerging tech, or culture shifts. Predictive analytics and AI-driven tools can help illuminate these risk blind spots. ☑️ Localized Impact Snow bands can dump inches in one town and leave the next dry. Risks can be just as localized affecting one business unit, region, or product line disproportionately. Leaders must have risk strategies are granular and adaptable. ☑️ Conditions on the Ground Matter Snowfall totals depend on ground temperature and wind. Likewise, the impact of risk depends on your organization’s resilience and preparedness. Embedding risk management into strategic planning is key. Risk forecasting is not about perfection. It is about being proactive. By leveraging advanced analytics, fostering a risk-aware culture, and aligning risk with growth strategies, leaders can turn uncertainty risk forecast into opportunity. #RiskManagement #Strategy #Leaders Inside Edge Risk Advisors LLC