The Risk Management Processes

The Practice Standard for Risk Management actually covers the same set of processes that you could find in the PMBoK but there is a subtle difference. The PMBoK is all about Inputs, tools & techniques and outputs. Whereas, the Practice Standard adds more than just that, it adds a lot of details that you wouldn’t find in the PMBoK guide.

Ok, the six risk management processes that are part of the PMBoK Guide and the Practice Standard have been covered in great detail in our blog in the preceding sections. But, let us quickly summarize what the Practice Standard has to say about those processes.

1. Plan Risk Management – Define the Scope and Objective of Project Risk Management knowledge area and ensure that risk processes are fully integrated into wider project management.
2. Identify Risks – Identify as many known risks as practically possible
3. Perform Qualitative Analysis – Evaluate the key characteristics of individual risks so that they can be prioritized for further action
4. Perform Quantitative Analysis – Evaluate the combined risk on the overall project
5. Plan Risk Responses – Determine response strategies and actions for individual & overall project risks and integrate them into a plan
6. Monitor and Control Risks – Implement the approved response strategies, review changes, identify additional risk management actions required and assess the effectiveness of overall risk processes

Lastly, the Practice Standard mentions something that we have gone over multiple times. It says that the risk management processes are iterative and dynamic in nature. They must be tailored to suit the needs of your respective projects.

This wraps up all the articles in the series on PMI-RMP Exam Preparation. All the very best for your Exam. You can view the whole series in the Index Page by clicking here.

Prev: Risk Management Foundation

Risk Management Foundation

In this chapter, we are going to cover the foundational concepts of Risk Management.

Let us start with the official definition of the term “Risk” - A Risk is an uncertain event or condition that, if it occurs, has a positive or negative effect on a project’s objectives. The term uncertain means we are not sure whether the event will happen. There is a likelihood that the event will happen and if it does, there will be consequences.

The practice standard for risk management says that – Dealing with threats and opportunities together typically leads to a gain of synergies and efficiencies.

While handling project risks we typically use two terms:

Individual Risk – A risk that may have an impact on project objectives
Overall Risk – Reflects the overall uncertainty of the project as a whole

During the course of the chapters on the PMI RMP Exam series, I have said this numerous times and since the concept is so important, I don’t mind saying it again. Risk Management is an iterative activity and must start at the early stages of a Project Lifecycle.

Who is Responsible for Risk Management?

This is a million dollar question which you already know the answer, don’t you?

Everyone

Yes, everyone in the project including all the stakeholders are responsible collectively to manage the risks in the project. But, the key people who drive the risk management effort for the whole project are the Risk Manager and the Project Manager. It would be a god idea to have a Risk Manager for every project but, in most cases there is no dedicated risk manager for a team and the Project Manager doubles over as the risk manager as well.

Common Risk Management Mistakes

As said in the previous section, without a collective effort from everyone in the team, risk management could fail very easily. But, this isn’t the only problem in most projects. Some of the common mistakes that people do in projects are:

• Conducting no risk management activities at all
• Even if risk management activities are conducted, it is done by one or a select few people only
Responsibilities of the Project Manager & Risk Manager with respect to Project Risk Management:
The following are some of the responsibilities of the Project Manager and Risk Manager:
• Getting the senior management’s support and carrying out as well as encouraging strong communication
• Determining risk tolerance levels & tailoring the risk management activities in the project to suit the needs of the project as well as the risk tolerance levels
• Generating an approved Risk Management plan that reflects the project’s risk management processes
• Carrying out and overseeing the Risk Management Plan activities and processes
• Reporting as required
• During project closure – determining what went well and where there are areas for improvement.
• You document lessons learned so that future projects could use them

Remember, just earlier on in this chapter I said that risk management is everyone’s responsibility but according to the practice standard for risk management though risk management is everyone’s responsibility, the project manager will be held accountable for successful completion of risk management activities in the project.

Prev: Introduction to Practice Standard for Risk Management

Next: The Risk Management Processes

Introduction to the Practice Standard for Project Risk Management

The Project Management Institute (PMI) has a dedicated practice standard for Project Risk Management that is available for all PMI Members to download. The Current PMI Standards can be found by Clicking Here. You can click on the link titled “Practice Standard for Project Risk Management” to download your copy as a member benefit. The file is password protected and you cannot print or share it with anyone and is strictly for personal use.
Coming back to our PMI RMI Exam Preparation perspective, going through the practice standard for Project Risk Management would be a good idea before you actually go for the exam. It is only around a 100 pages in size and not as big as the PMBoK.

About the Practice Standard for Project Risk Management:

• It serves as a guiding role to the use of tools & techniques and processes for Project Risk Management
• Does not explain how a process is to be executed
• Expects your experience to fill-in the gaps

The PMBok Guide gives us information on all Project Management Processes. The Practice Standard gives us principles of specialization in Project Risk Management. In this section we will be covering the Practice Standard for Project Risk Management at a very high level. I repeat, this is a very high level summarization of the RMBoK (As I call it) and I strongly urge you to download and browse through it before you sit for the PMI RMP Examination.

Critical Project Success Factors:
According to the practice standard, there are 6 key/critical success factors that could affect the success of our project and its risk management activities. They are:
1. Recognition of the value of Risk Management – As project managers it is our responsibility to explain the importance of risk management to everyone (in our project) and make them realize that risk management activities are not an overhead but can have great benefits on the overall success of the project.
2. Individual commitment – Unless we explain the importance of risk management to all our stakeholders, we will not get their commitment/support which may hinder the risk management activities. As I have said before, risk management is a collective effort and requires the participation from all involved parties.
3. Communication that is open and honest – every project has multiple stakeholders and each of those people could have a different agenda. So, unless we keep the project communications open & honest they wouldn’t have a clear picture of the projects status and this could result in problems in the future.
4. Organizational commitment – A lot of organizations still do not understand the value of risk management activities and hence making them realize the benefits of implementing risk management processes will help us gain their commitment which could go a long way in successful risk management in our project
5. Risk effort tailored to the project – Every project is different. What would be a good idea for one project could be a disaster for another. So, all our risk management effort must be in accordance to the size, complexity and needs of the project.
6. Integration with project management – Risk Management efforts in our project must be closely integrated with the overall project management effort.
Before we elaborate on these key points, think this way – You could be an amazing risk analyst and could identify all risks that could affect your project within hours. You also have access to the most amazing tools that can aid in risk management. So, does this mean that your risk management effort on the project will be a success?

Did you say “Yes”, if so, you are greatly mistaken. Unfortunately, if you do not communicate effectively with the project stakeholders, then your project risk management effort will not succeed. In fact, if you do not take up any of the above mentioned 6 factors properly, there is a high probability that your effort in project risk management may end up a failure.


Prev: Section Summary - Monitor & Control Risks


Next: Risk Management Foundation

Section Summary – Monitor and Control Risks

In the previous few chapters in this section, we had taken a detailed look at the Monitor and Control Risks process, its inputs and the tools and techniques used in this process. Let us quickly recap what we have learnt so far:

• The purpose of this process is - To implement risk response plans, track identified risks, monitor residual risks, identify new risks, evaluate the effectiveness of risk response plans and of the risk management process.
• An important point to remember here is the fact that, during this process, we could uncover new risks as well. In such cases, we typically go back and analyze those risks and then take those risks through the full risk management process cycle
• As risk responses are implemented and risks are tracked, any corrective actions required are submitted through the monitor and control risks process
• This process uses a total of 4 inputs. They are:

1. Risk Register
2. Project Management Plan
3. Work Performance Information
4. Performance Reports

• There are a total of 6 tools and techniques that we will be using in this process. They are:

1. Risk Reassessment
2. Risk Audits
3. Variance and Trend Analysis
4. Technical Performance Measurement
5. Reserve Analysis
6. Status Meetings

• There are three aspects of Risk Reassessment that you must remember for the RMP Exam. They are:

1. Identifying New Risks
2. Closing Risks that are no longer applicable
3. Keeping tab on existing risks to figure out if any further action is required

• Risk Audits are concerned with:

1. Measuring the effectiveness of the risk responses
2. Measuring the effectiveness of the risk management processes in the project

• Workaround is - An unplanned response to a negative risk that has occurred/materialized
• The key difference between workarounds and the contingency/fallback plans is the fact that – Workarounds are unplanned and utilized on the fly whereas we meticulously plan contingency and fallback plans
• Reserve Analysis is an analytical technique to determine the essential features and relationships of components in the pm plan to establish a reserve for the schedule duration, budget, estimated costs or funds for a project
• If the Risk Management team was inefficient in calculating the reserves or if the numbers they calculated were insufficient, the reserve analysis can identify such gaps and help salvage the project
• The purpose of Variance & Trend analysis is to forecast any potential cost and/or schedule deviations in the project at completion
• We will be using Earned Value Calculations during Variance & Trend Analysis
• Though Estimation Techniques and Cost Benefit Analysis are not explicitly listed down as tools and techniques for this process, we need to be aware of them to apply the other actual tools and techniques for the process
• There are three types of Estimation – Analogous, Parametric and Bottom up
• Cost benefit analysis compares the cost of producing a service, product or result to the benefits that the organization (doing/creating it) receives as a result of it.
• The purpose of Technical Performance Measurement is to uncover any deviations that may exist, such as differing functionalities, than what was planned for the Project.
• Any team meeting that addresses risk management in the project as an Agenda Item for discussion would be considered a Status Meeting from Risk Management perspective
• The more often risks are addressed, the easier we can identify and deal with them
• The amount of time we spend discussing risks in our status meetings, depends on the number of risks, their complexity, their probability and impact etc.

Prev: Technical Performance Measurement & Status Meetings

Next: Introduction to Practice Standard for Risk Management

Technical Performance Measurement and Status Meetings

In the previous chapters, we have covered many of the tools and techniques used in the Monitor and Control Risks process. In this chapter we are going to take a look at last two items in the series namely “Technical Performance Measurement” and “Status Meetings”

Technical Performance Measurement

Purpose: To uncover any deviations that may exist, such as differing functionalities, than what was planned for the Project.

This technique compares the actual technical accomplishments in the project to the planned technical achievements. It helps us to identify and forecast the degree of success in achieving the scope of work taken up as part of the Project. Practically speaking, every project is taken up to accomplish some scope of work and in this process, we are just checking to see if the risk of any deviations from the planned accomplishments exists.

In order to use this technique, we must have quantifiable objectives that can be measured on a technical level. This can be done only when project work (Execution) is underway and we are in the Monitor and Control phase of the Project. In real life, you may see this activity taken up during significant project milestones.

As we complete this activity and as deviations are identified, they are documented with all supporting information. Once this information is available the Risk Management team could suggest corrective actions to keep the project on track with the original plan.

A project where the risk management team fails to identify deviations from plan early and fails to implement corrective actions on time, will almost always fail.

Trivia:

I have used the term almost always because – Miracles too happen in real life but I believe in hard work more rather than miracles.

Status Meetings

Before we begin, a Status Meeting is technically not a tool or a technique but is something that can greatly help address project risks. So, logically, as it is used in monitoring and controlling risks, it has been given a kind of honorary technique status for this process.

Any team meeting that addresses risk management in the project as an Agenda Item for discussion would come under this category. In real life, getting everyone in the team to gather in a meeting is not so easy esp. if the people who are to attend the meeting are senior in the org hierarchy. So, once we assemble the key participants, we must utilize the time available effectively.

Benefits:

The more often risks are addressed, the easier we can identify and deal with them.

Risk management is an ongoing activity and is not something that happens say once in a quarter. But, unfortunately this is how risk management happens in real life. People feel that risk management is yet another process/activity that has to be done just because the people higher up say so. So, the effectiveness of this whole activity is greatly depleted.

How we educate our team and stakeholders about risk management and make them understand its benefits will greatly help set the agenda and objectives of the meeting. At the end of the day the key stakeholders and senior management want us (Project Managers) to execute a successful project which finishes on time and within budget. Risk Management is not an overhead; instead it can help achieve the project objectives without any last minute surprises. This is something that must be understood by everyone participating in these meetings to make the most of the gathering.

The amount of time we spend discussing risks in our status meetings, depends on the number of risks, their complexity, their probability and impact etc. We typically will examine all the risks in our Risk Register, their response plans and then gather feedback from the meeting attendants about them. An open floor could give way to newer and smarter suggestions which may not come out if everyone does not understand the importance of the activity or if everyone is not given an opportunity to contribute.

As project managers, it is our responsibility to utilize the knowledge and inputs that our team members may have to get the best out of our Project.

Prev: Estimation Techniques & Cost Benefit Analysis

Next: Section Summary

Estimation Techniques and Cost Benefit Analysis

Though Estimation Techniques and Cost Benefit Analysis are not explicitly listed down as tools and techniques for this process, we need to be aware of them to apply the other actual tools and techniques for the process. That is the reason why we have this chapter here amidst all the tools and techniques for this monitor and control risks process.

Estimation Techniques:

As part of examining project performance information and monitoring & controlling risks, we will be using/evaluating many estimating techniques and we need to know them at least at a high level in order to assess the project performance as well as to assess the status of the risks. The following are some of the major estimation techniques that we may use in our projects:

1. Analogous Estimating – This is a technique where we estimate the cost of the current project by applying our expert judgment on the actual costs from previous projects. This is a fast and cheap estimation technique but is not very accurate because the parameters considered while estimating the old project may or may not be applicable for our current project and so the estimates may not be accurate. This technique is typically used when resources to do the estimation are low and we are only looking for a high-level or ball-park kind of estimate.
2. Bottom-Up Estimating – This is a technique where we estimate the individual work packages (From the Work Breakdown Structure) and then the individual numbers are rolled up to the project level for the overall estimate. This kind of estimation is time consuming is much more accurate when compared to the Analogous technique. This technique is typically used when we have abundant budget and time to take up estimation at a detailed level.
3. Parametric Estimating – This is the third technique where we use historic data along with other information to arrive at the estimates for our project. For ex: If one person can build a wall in 10 days alone, how long would it take for 3 people to do? This technique is typically used for repetitive activity where the parameters affecting the work and estimate are well known.


Cost Benefit Analysis

Cost benefit analysis is a common technique that we apply at various stages in the lifecycle of our project. It compares the cost of producing a service, product or result to the benefits that the organization (doing/creating it) receives as a result of it.

For ex: If I were to own a supermarket. If the cost of buying a product is X and the cost of keeping it in my store, taking care of it etc. is Y then, the price at which I sell it to you must be greater than X+Y otherwise there will be no benefit (profit) in selling that product.

Cost benefit analysis must also consider initial costs, marketing and advertising expenses, maintenance and support of the product/service for cost benefit analysis. If I were to consider only the purchase and selling price to do cost benefit analysis of my items and ignore my store rent, electricity bill, worker wages etc., then even if I sell my products at a price greater than the cost I bought it, I might end up losing money.

Trivia:

In real life cost benefit analysis is used in various places. For ex: if the project is facing an issue and we are to implement a fix, we need to understand the cost of the fix, the benefits we gain out of implementing the fix before we go ahead. If the benefits I gain are more than the cost I incur then the fix is beneficial and it makes sense in going ahead with the fix.

Prev: Variance & Trend Analysis

Next: Technical Performance Measurement & Status Meetings

Variance and Trend Analysis

In the previous chapters we took a look at some of the tools and techniques used in monitor and control risks process like Risk Audit, Risk Reassessment, Reserve analysis etc. The topic for discussion in this chapter is “Variance and Trend Analysis” which is a valuable tool for any Risk Manager.

Purpose: To forecast any potential cost and/or schedule deviations in the project at completion

In the chanter on inputs for the monitor and control risks process, we saw that we will be need performance related data like Work Performance Info and Performance Reports for this process. We will be using those inputs in this process. We take all the performance data related to our project so far and then:

• The risk management team examines trends in the team’s performance
• Identifies variances by comparing planned vs. actual data
• Identifies any potential delays or bottlenecks with respect to the completion of the Project.

So, the next logical question here would be – how will we analyze the data gathered so far?

We will be using Earned Value Analysis to do all that. Though Earned Value isn’t an actual topic as part of the PMI RMP syllabus, it would be a good idea to revisit the following two chapters to refresh your memory:

a. Cost Management during Monitoring & Controlling the Project
b. Measuring Project Performance

I am pretty sure that you did not revisit those chapters because; I would’ve probably done the same. So, let’s quickly cover the basics of Earned Value Analysis so that we know what we need to know for the PMI RMP Exam.

The basic idea of Earned Value Analysis is to integrate project, cost and scope measures to assess the project performance and progress as of date.

The following are the EVM Terms we will need to know:

Planned Value (PV) – The value that signifies how much work must have been completed so far
Earned Value (EV) – The value that signifies how much work has actually been completed so far
Actual Cost (AC) – The value that signifies how much money/cost we have spent on our project so far

Based on these 3 numbers we can calculate the following:

Schedule Variance (SV) – The deviation between the actual schedule progression and the planned schedule
Cost Variance (CV) – The deviation between the actual cost spent on the project and the planned project budget

Cost Performance Index (CPI) – The Numeric Representation of the Project’s cost performance – A number between 0 and 2.
Schedule Performance Index (SPI) – The Numeric Representation of the Project’s schedule performance – A number between 0 and 2.

In either case we would expect the performance index value to be greater than 1 which means we are ahead of schedule or within cost.

Estimate To Complete (ETC) – The amount of funds required to complete the project from the current status/point

Estimate At Completion (EAC) – The amount of funds the project is expected to utilize as a whole, throughout its life when the completion stage is reached.

If you are already a PMP certified manager, you must remember those confusing formulas EV/PV, EV/AC etc. that we would’ve memorized for the PMP Exam. Thankfully, for the RMP Exam, we need not remember all those formulae. That is why; I haven’t given any of the formulas in our quick recap. For the exam, we need to understand the concept and what each of these Earned Value terms signify which I believe, we do by now, don’t we??


Prev: Workarounds and Reserve Analysis

Next: Estimation Techniques & Cost Benefit Analysis

Workarounds and Reserve Analysis

In the previous chapter, we took a look at two of the tools and techniques used in the monitor and control risks process. In this chapter we are going to cover some more – Workarounds and Reserve Analysis. Though workarounds aren’t listed as a distinct or explicit tool and technique used for this process, we are covering it here because, it is very useful in real life and more importantly it is part of the exam syllabus.

Workarounds

The literal meaning of the word workaround is applicable in project risk parlance as well. In real life, every successful or even failed projects would have tried & implemented multiple workarounds to unexpected risks while the project was being executed.

Definition: An unplanned response to a negative risk that has occurred/materialized

In real life, it is not practically possible to capture or identify all of the risks that may occur in our project. Nor is it possible to identify/spot risk warning signs every time. It is also possible that the status of a risk in the watchlist changed from low to high and you completely missed it. In such cases, the risk can suddenly materialize into reality and affect your project.

The workaround is the project team’s response to these types of risks.

Remember contingency and fallback plans that we covered during the “Plan Risk Responses” process? You may be wondering how different is this workaround from those plans?

The key difference is the fact that – Workarounds are unplanned and utilized on the fly whereas we meticulously plan contingency and fallback plans. Another big difference is that, workarounds are formulated and implemented during the monitor and control phase of the project, while contingency or fallback plans are formulated during the planning phase of the project.

The following are some key characteristics of Workarounds:

• They are unplanned responses to negative risks
• They are the usually used to handle unknown or accepted risks
• Is implemented to deal with the consequence of a risk
• Is similar to the contingency plan, except they are unplanned
• Is used when no other response plan exists for this particular risk
• Typically more costlier than planned responses
• Is part of the monitor and control risks process
• Is part of the monitor and control phase of the project

Trivia:

Are you wondering why a workaround would be costlier than a planned response? The answer is pretty straightforward – when you are implementing a workaround, you are literally in fire-fighting mode. You do not have the liberty of looking for multiple alternatives and choose the best/cheapest. All you are worried about now is to minimize the impact/damage caused by the risk that has suddenly materialized and not so much about cheaper alternatives.

Reserve Analysis

Reserve Analysis is yet another important technique that we use in the monitor and control risks process. As the project execution continues, risks begin to materialize and we start implementing the planned responses. In cases where we haven’t planned a response, we use the contingency reserves. So, as we start using the reserves, it becomes necessary to monitor the usage of the reserves to ensure that we still have enough remaining to handle the other risks that may materialize in future.

Definition of Reserve Analysis: An analytical technique to determine the essential features and relationships of components in the pm plan to establish a reserve for the schedule duration, budget, estimated costs or funds for a project

The main idea here is to compare the amount of reserves remaining with the risks remaining to see if the reserves available will be sufficient to handle the rest of the risks. The reserves we analyze will include schedule, cost and budget reserves.

If the Risk Management team was inefficient in calculating the reserves or if the numbers they calculated were insufficient, the reserve analysis can identify such gaps and help salvage the project.

Trivia:

If you are wondering why we need to do this activity – think of the following scenario. Let us say your contingency reserve was 100k USD and you have utilized 90K so far. There is still 3 months’ worth of project work to be completed. Suddenly today you realize that the license for one of the key software components that you use for your project work has expired and it costs around 5K per 3 licenses. Your team has 12 developers and so you will need 20K to acquire 4 fresh licenses. You go and check your contingency reserve to get the shock of your life – you have only 10K and are 10K short.

If you had done reserve analysis last month, you would’ve realized that your project was running low on reserves.

The idea here is simple – if you do not have sufficient reserves, how will you handle risks if they materialize?

Prev: Risk Reassessment & Risk Audits

Next: Variance & Trend Analysis

Risk Reassessment and Risk Audits

In this chapter, we are going to look at two of the tools and techniques in the monitor and control risks process, namely – Risk Reassessment and Risk Audits.

Risk Reassessment

The word reassessment is something that you would’ve heard frequently in real life. The meaning of Risk Reassessment is in the same lines as the literal meaning/purpose of the word and focuses on Risks specifically.

There are three aspects of Risk Reassessment that you must remember for the RMP Exam. They are:

1. Identifying New Risks
2. Closing Risks that are no longer applicable
3. Keeping tab on existing risks to figure out if any further action is required

Points 1 & 2 are pretty self-explanatory. Point 3 is where a bulk of the action is. We will keep checking if the impact and/or the probabilities of risks are the same now (As compared to when they were planned before). The level of impact of a risk or its probability could change when project execution begins. Even some risks that are in the watchlist could have changes to their probability and/or impact. In such cases, we take these risks through the risk management cycle and then formulate a response. The whole idea is to reassess and re-strategize those risks where we feel our existing response strategy may be inadequate.

Trivia:

When a new risk is identified during this process, we take that risk through the full risk management cycle in order to formulate a response strategy for the newly identified risk.

As the project progresses:
• The probability of a risk occurring comes down
• The impact of the risk (if it occurs) goes up

Remember the chapter on Risk & Uncertainty titled Managing Uncertainty? Risks always move with uncertainty. The greater the uncertainty, the greater the risk. So, as the project moves forward and more and more work gets completed, the uncertainty comes down and so does the likelihood of the risk materializing.

Projects vary and not all projects are similar. So, when we do this risk reassessment activity too would vary from case to case. As a general rule of the thumb, risk reassessment should be scheduled regularly, especially where projects have schedule or cost slippages. The whole idea here is to reassess the situation to take remedial actions to bring the project back on track.

Risk Audits

Risk Audits is another tool and technique that we use during the monitor and control risks process. It is also part of the overall process improvement of the project.

Risk Audits are concerned with:
• Measuring the effectiveness of the risk responses
• Measuring the effectiveness of the risk management processes in the project

When we perform Risk Audits, we examine the risk responses (that were implemented) to determine if they were effective in handling the risks and their root causes. The output of this audit is always documented. Similarly, we can also audit and gauge the effectiveness of the risk management processes in the project as a whole too.

The idea behind these kinds of activities is to be more proactive than be reactive. We are constantly trying to refine and improve our processes and efficiency and this risk audit can greatly help the risk management practices in not only the project but also the whole organization as well (If we properly capture the results of our audits and create lessons learned documents)

It is the responsibility of the Project Manager to conduct periodic risk audits. How frequently risk audits happen, who does them, and how the output is captured etc. is specified in the risk management plan. Typically risk audits are scheduled at significant project milestones. For smaller or low-complexity projects, we can even take up risk audit as a onetime activity towards the end of the project.

Steps in Risk Audit:
a. Identify who will participate
b. Follow the risk audit specifications documented in the risk management plan
c. Collect, analyze and document all relevant information
d. Use recommendations to improve the process

As we conduct the audit, the participants may have several questions. All these questions will help us measure the effectiveness of the response that was implemented. In order to achieve maximum benefits out of this activity, all the participants must be in the same page before the meeting and understand the project clearly.

Prev: Overview of Tools & Techniques used in Monitor & Control Risks

Next: Workarounds and Reserve Analysis

Overview of Tools & Techniques used in Monitor & control Risks Process

The monitor and control risks process is instrumental in the success or failure of a project. You may have come up with elaborate and comprehensive plans to handle risks in your project but, if you do not monitor your risks and take controlling actions as required, all your planning effort isn’t worth even one penny. So, every good project manager has to ensure that he/she spends adequate time and effort in this process to reap the best rewards for the project.

There are a total of 6 tools and techniques that we will be using in this process. They are:

• Risk Reassessment
• Risk Audits
• Variance and Trend Analysis
• Technical Performance Measurement
• Reserve Analysis
• Status Meetings

There will be no need to reassess or audit risks if the actual project execution hasn’t started. So, as of now the project status is the same as what we had at the end of the Planning phase and hence none of the risks or their statuses would’ve changed. In fact, the other processes too may not add much value to the Project’s Risk Management if we haven’t entered the Project Execution Phase. All of these processes analyze the risk related data that is available with us now. So, unless we actually start executing project work, the data is not going to be any different to warrant any analysis.

Variance and Trend Analysis uses Earned Value. Remember Earned Value? Though Earned Value isn’t an actual topic as part of the PMI RMP syllabus, it would be a good idea to revisit the following two chapters to refresh your memory:

a. Cost Management during Monitoring & Controlling the Project
b. Measuring Project Performance


The last and final point we will cover as part of this introductory chapter on the tools and techniques used in Monitoring and Controlling risks process is about “Workarounds”. Almost all junior PM’s and even some senior ones easily confuse workarounds with contingency or fallback plans. Remember that workarounds happen during the monitor and control phase of the project while contingency or fallback plans are created during the planning phase itself.

Armed with all the information above, we are now ready to dive into these tools and techniques in detail. Note here that, in the following chapters we will be covering Workarounds as well as some Estimation techniques and Cost Benefit Analysis. Though these aren’t explicit tools and techniques in this process, they are part of the exam syllabus and will be useful in real life too.

Prev: Inputs to Monitor & Control Risks

Next: Risk Reassessment & Risk Audits

Inputs to the Monitor and Control Risks Process

In the previous chapter, we took a high level look at the monitor and control risks process. By now, you must be accustomed to the fact that, every process has a set of inputs and uses a set of tools and techniques to generate an output. This process – Monitor and Control Risks is no different.

Before we actually take a look at the actual inputs used in this process let us look at the purpose of this process. The idea here is to give you another opportunity to try to guess what inputs you may require for this process. If you read the purpose statement carefully, you can get a fair idea of what artifacts from our Project you may want to use for this activity.

Purpose of the Process:

To implement risk response plans, track identified risks, monitor residual risks, identify new risks, evaluate the effectiveness of risk response plans and of the risk management process.

This process uses a total of 4 inputs. They are:

1. Risk Register
2. Project Management Plan
3. Work Performance Information
4. Performance Reports

Trivia:

People easily confuse work performance information and performance reports. So, be cautious and understand them properly before you move on to the next chapter.

Let’s take a detailed look at each of these inputs…

Risk Register

This one is a no brainer, isn’t it? What process in Risk Management does not use the Risk Register as an input? The answer would be – Plan Risk Management and Identify risks where you actually create this document. Isn’t it?

The monitor and control risks process will make use of all of the Contents of the Risk Registerthat is available till date. However, for easier understanding, the following elements of the Risk Register are used in particular for this process:

1. Agreed Upon Risk Responses - This is a key input because, these responses are what we will be implemented during this process. We created them during the plan risk responses process. During this process, after we implement the responses, we also try to find out the effectiveness of the response and see if the response was sufficient. This is required because, if the risk still exists, we need to take actions to prevent any further impact on our project. Right?
2. Implementation Actions - Implementation Actions refers to - what exactly needs to be done in order to implement a response. For ex: In case our strategy to handle a risk is “Transfer” whereby we entrust the responsibility to handle the risk to a third party, a common implementation action would be – Get a formal contract signed with the 3rd party.
3. Risk Owners – People who own the risk and have been assigned the responsibility of tracking this risk
4. Symptoms and Warning Signs – Indications that can tell us if a risk event is about to occur or has already occurred. This is important because; if you do not know what warning signs suggest if a risk is about to occur, how would you handle it?
5. Residual Risks – These are risks that remain after you implement your response. Typically we will use contingency plans and reserves to handle residual risks.
6. Secondary Risks – These are risks that were created as a direct consequence of us implementing a risk response. Here again, we may utilize contingency reserves to handle them.
7. Watchlist – A list of low priority risks that we have kept aside. You may be wondering why this is an input to this process. Actually, when we place a low priority risk in this watchlist, it means that this risk isn’t relevant now but its status could change in the future. During the monitor and control risks process, we will be actually checking the status of each of those watchlist risks so that we will be prepared to handle them in case any of their probabilities or impacts have changed
8. Contingency Reserves for Time & Cost – as contingency plans are put into action, we need to continuously track them in line with the reserves that were put in place during the planning phase.

Project Management Plan

Actually speaking, the Risk Management Plan is the key input that we will be using for this process. But, since the RM Plan is a subsidiary of the PM Plan and also since we may need to refer to other subsidiary plans inside the PM Plan, the PMBOK chose the use the holistic term “Project Management Plan” instead of “Risk Management Plan”.

The following items from the Risk Management Plan are used in this process:

• Roles and Responsibilities
• Protocols
• Risk Tolerance Levels
• Time and Resources set aside for Risk Management Activities

Work Performance Information

Work Performance Information is generated by the Directing and Managing Project Execution process which is part of the Project Integration Management in Project Execution Phase.

As the project progresses, a lot of information is collected about the project like:

• Status of the deliverables
• Schedule Progress
• Cost incurred
• Etc.

A point to note here is that, all of the above mentioned information is collected as of the current date. Naturally, this information will not be available until we actually start doing project work (In the Project Execution Phase) and may vary as our work progresses.

Performance Reports

Performance Reports are generated as part of Report Project Performance process and is part of Communications Management during Monitoring & Controlling the Project.

Performance reports contain an analysis of the Work Performance Information collected during Project Execution. We will need this information to perform variance analysis, earned value analysis etc.

Performance reports include:

• Analysis of Past Performance
• Status of Risks & Issues
• Work Completed (So Far)
• Work that was to be Completed (So Far)
• Summary of Changes
• Variance Analysis Results
• Forecasted completion information (date & cost)

As suggested earlier, all of these items are generated using the Work Performance Information. To recollect, Work Performance Information is generated by the Directing and Managing Project Execution process which is part of the Project Integration Management in Project Execution Phase.


Trivia:

You may be wondering why PMBOK has used both Performance Reports and Work Performance Information as inputs. If the performance reports are generated using the work performance information, why not use just the performance reports?

The performance reports actually take the status of the project collected (the work performance info) and provides us with reports that give us valuable insight on how the project work is progressing. However, as with any other process, we don’t just use the output. We also store the basis of our findings and hence without work performance information we wouldn’t be in a position to confirm the fact that the report is indeed correct. We are doing risk management here. So, we need to take into account of the fact that, incorrect reports could be a source of risks for the project.

Prev: Introduction - Monitor & Control Risks

Next: Overview of Tools & Techniques used in Monitor & Control Risks

An Introduction to Monitor and Control Risks Process

In the previous sections we have successfully completed majority of the Risk Management Processes. By now, we have thoroughly analyzed our risks and even formulated responses for those risks. So, the last step in the Risk Management knowledge area is the “Monitor and Control Risks” process. This is what we are going to learn in this chapter.

Purpose of the Process:

To implement risk response plans, track identified risks, monitor residual risks, identify new risks, evaluate the effectiveness of risk response plans and of the risk management process.

The purpose looks pretty lengthy and is not too clear, isn’t it? This is the official definition as per the PMBOK so I have put it here. Practically speaking this process is responsible for:

• Tracking identified risks
• Monitoring and analyzing residual risks
• Identifying new risks
• Executing risk response plans
• Evaluating the effectiveness of the risk response plans
• Evaluating the effectiveness of the risk management plan
• Checking the validity of project assumptions
• Closing out risks that are no longer valid/applicable
• Monitoring contingency reserves and modifying them as and when required

During the previous process in risk management, we actually created a lot of plans and formulated a lot of actions that were to be implemented as required. This is the process where we actually get to implement those plans and actions.

An important point to remember here is the fact that, during this process, we could uncover new risks as well. In such cases, we typically go back and analyze those risks and then take those risks through the full risk management process cycle. This is done to ensure that we are well planned & prepared to handle risks that may affect our project.

As risk responses are implemented and risks are tracked, any corrective actions required are submitted through the monitor and control risks process. A lot of lessons learned too are picked up in this process. As practitioners of good and proper project management practices, we would document these lessons learned appropriately as well.

Prev: Section Summary - Outputs of the Plan Risk Responses Process

Next: Inputs - Monitor & Control Risks