Risk analysis should be considered in almost every project. This for various reasons but the most fundamental one is to ensure that the risk can only be managed if we plan for it. If you do not analyse the risk involved in a project you will find yourself very quickly in the situation defending your plan and your solutions approache. Risk analysis should include everything that can or will have an impact on your project, from time constraints, man power needed, budget and complexity. It should include risks from a business and an IS perspective and needs to quantify the risk as well.

The main questions asked for each risk should include: How likley is the risk to occure? What will the worst case impact be on the project? As well as the question how to mitigate the risk.

I would always present the full list to a client. This is to ensure that all risk is understood and the client, who will at the end pay for all work done, understands any potential risks to his project, as well as the potential additional costs to mitigate or overcome the risk.

Björn