Assess and manage risks

Enablers

• Determine risk management approach. (ECO 2.3.1)
• Iteratively identify, assess and prioritize risks and risk responses. (ECO 2.3.2)
• Determine risk response.
• Implement risk response.

Deliverables, and Tools

Risk

A risk * is an uncertain event or condition that, if it occurs, has a positive or negative effect on one or more project objectives.

A trigger condition * is an event or situation that indicates that a risk is about to occur.

Primary components include:

• A measure of probability that the risk event will occur.
• The impact of the risk occurring on a project.
• Positive risks: Risks that produce a positive project outcome.
• Also referred to as opportunities.
• Negative risks: Risks that have a negative impact on the project.
• Also referred to as threats.

Risk Management Plan

A risk management plan * is a component of the project, program, or portfolio management plan that describes how risk management activities will be structured and performed.

Risk Management Approach

Project Risk Management*: The project management knowledge area that includes the processes of conducting risk management planning, identification, analysis, response planning, response implementation, and monitoring risk on a project.

Risk Classification

Business Risk Types

Business risk

• Inherent in business.
• All projects have potential for loss or profit.
• Example: Purchasing inventory without guaranteed sales.

Insurable risk

• Only the potential for loss.
• No potential for profit.
• Insurance may be purchased to offset losses.
• Example: Loss of inventory due to fire.

Business Risk Types

Risk Tolerance, Appetite, and Threshold

• Risk tolerance refers to the maximum amount of risk, and the potential impact of that risk occurring, that a project manager or key stakeholder is willing to accept.
• Risk appetite * is the degree of uncertainty an organization or individual is willing to accept in anticipation of a reward.
• Risk threshold * is the level of risk exposure above which risks are addressed and below which risks may be accepted.

Guidelines to Iteratively Identify, Assess, and Prioritize Risks

• Perform a structured review of appropriate documentation from other planning processes with key project stakeholders to ensure an understanding of each.
• Use one or more risk identification techniques to identify risks and their possible triggers.
• Be consistent. Whatever method you adopt, apply it systematically across your project. Before the project begins, identify risks in every project segment and work package.
• Apply your method consistently, but be on the lookout for special circumstances that might arise in any project segment.
• Consult relevant historical information such as risk response plans and final reports from previous, similar projects that may include lessons learned describing problems and their resolutions.
• Once risks have been identified, group them into categories that reflect common sources of risk for your industry or application area.
• Use the results of your analysis to initiate the risk register.

Qualitative Risk Analysis

• Qualitative risk analysis is a technique used to determine the probability of occurrence and the impact of each identified risk.
• Determine the risk exposure to the project of a particular risk, multiply its probability and impact.
• Provides the list of prioritized risks for further actions.

Probability and Impact Matrix

The probability and impact matrix * is a grid for mapping the probability of occurrence of each risk and its impact on project objectives if that risk occurs.

Quantitative Risk Analysis

Quantitative risk analysis is a technique used to assess the risk exposure events to overall project objectives and determine the confidence levels of achieving the project objectives.

• Helps to identify time and cost contingencies of a project
• Refines and enhances the prioritization and scoring of risks

Risk Responses

• Planning risk responses consists of developing options, selecting strategies, and agreeing on actions to address overall project risk exposure, as well as to treat individual project risks.
• Risks are addressed by priority, and resources and activities can be added to the budget, schedule, and project management plan to support the risks.
• Each risk is assigned a risk response, which is an action to address that risk and a person to implement that action.
• There are various risk response strategies to choose from to determine a risk response for each risk.
• A fallback plan can also be developed in case the primary strategy is not effective. Secondary risks should also be reviewed. These are risks that could occur as a result of implementing a risk response.

Negative Risk Strategies

Positive Risk Strategies

Contingency Plans

• A contingency plan is a risk response strategy developed in advance, before risks occur; it is meant to be used if and when identified risks become reality
• Allows a project manager to react quickly and appropriately to the risk event, mitigating its negative impact or increasing its potential benefits.
• A contingency plan may include a fallback plan for risks with high impact.
• The fallback plan is implemented if the initial contingency plan is ineffective in responding to the risk event.

Guidelines to Determine and Implement Risk Responses

• Examine each identified risk to determine its causes and how it may affect project objectives. Brainstorm possible strategies for each risk.
• Choose the response strategy that is most likely to be effective for each identified risk.
• If you are unable to bring a risk's rating below the organization's risk threshold, ask your sponsor for help.
• Identify backup strategies for risks with high risk factor scores.
• Determine the amount of contingency reserves necessary to deal with identified risks.
• Determine how much of a contingency reserve you should set aside for unknown risks.
• Consult the risk management plan for the description of the content and format of the risk response plan.
• Incorporate the risk response plan into the overall project plan so the strategies can be implemented and monitored.