The Risk Management Processes

The Practice Standard for Risk Management actually covers the same set of processes that you could find in the PMBoK but there is a subtle difference. The PMBoK is all about Inputs, tools & techniques and outputs. Whereas, the Practice Standard adds more than just that, it adds a lot of details that you wouldn’t find in the PMBoK guide.

Ok, the six risk management processes that are part of the PMBoK Guide and the Practice Standard have been covered in great detail in our blog in the preceding sections. But, let us quickly summarize what the Practice Standard has to say about those processes.

1. Plan Risk Management – Define the Scope and Objective of Project Risk Management knowledge area and ensure that risk processes are fully integrated into wider project management.
2. Identify Risks – Identify as many known risks as practically possible
3. Perform Qualitative Analysis – Evaluate the key characteristics of individual risks so that they can be prioritized for further action
4. Perform Quantitative Analysis – Evaluate the combined risk on the overall project
5. Plan Risk Responses – Determine response strategies and actions for individual & overall project risks and integrate them into a plan
6. Monitor and Control Risks – Implement the approved response strategies, review changes, identify additional risk management actions required and assess the effectiveness of overall risk processes

Lastly, the Practice Standard mentions something that we have gone over multiple times. It says that the risk management processes are iterative and dynamic in nature. They must be tailored to suit the needs of your respective projects.

This wraps up all the articles in the series on PMI-RMP Exam Preparation. All the very best for your Exam. You can view the whole series in the Index Page by clicking here.

Prev: Risk Management Foundation

Section Summary – Monitor and Control Risks

In the previous few chapters in this section, we had taken a detailed look at the Monitor and Control Risks process, its inputs and the tools and techniques used in this process. Let us quickly recap what we have learnt so far:

• The purpose of this process is - To implement risk response plans, track identified risks, monitor residual risks, identify new risks, evaluate the effectiveness of risk response plans and of the risk management process.
• An important point to remember here is the fact that, during this process, we could uncover new risks as well. In such cases, we typically go back and analyze those risks and then take those risks through the full risk management process cycle
• As risk responses are implemented and risks are tracked, any corrective actions required are submitted through the monitor and control risks process
• This process uses a total of 4 inputs. They are:

1. Risk Register
2. Project Management Plan
3. Work Performance Information
4. Performance Reports

• There are a total of 6 tools and techniques that we will be using in this process. They are:

1. Risk Reassessment
2. Risk Audits
3. Variance and Trend Analysis
4. Technical Performance Measurement
5. Reserve Analysis
6. Status Meetings

• There are three aspects of Risk Reassessment that you must remember for the RMP Exam. They are:

1. Identifying New Risks
2. Closing Risks that are no longer applicable
3. Keeping tab on existing risks to figure out if any further action is required

• Risk Audits are concerned with:

1. Measuring the effectiveness of the risk responses
2. Measuring the effectiveness of the risk management processes in the project

• Workaround is - An unplanned response to a negative risk that has occurred/materialized
• The key difference between workarounds and the contingency/fallback plans is the fact that – Workarounds are unplanned and utilized on the fly whereas we meticulously plan contingency and fallback plans
• Reserve Analysis is an analytical technique to determine the essential features and relationships of components in the pm plan to establish a reserve for the schedule duration, budget, estimated costs or funds for a project
• If the Risk Management team was inefficient in calculating the reserves or if the numbers they calculated were insufficient, the reserve analysis can identify such gaps and help salvage the project
• The purpose of Variance & Trend analysis is to forecast any potential cost and/or schedule deviations in the project at completion
• We will be using Earned Value Calculations during Variance & Trend Analysis
• Though Estimation Techniques and Cost Benefit Analysis are not explicitly listed down as tools and techniques for this process, we need to be aware of them to apply the other actual tools and techniques for the process
• There are three types of Estimation – Analogous, Parametric and Bottom up
• Cost benefit analysis compares the cost of producing a service, product or result to the benefits that the organization (doing/creating it) receives as a result of it.
• The purpose of Technical Performance Measurement is to uncover any deviations that may exist, such as differing functionalities, than what was planned for the Project.
• Any team meeting that addresses risk management in the project as an Agenda Item for discussion would be considered a Status Meeting from Risk Management perspective
• The more often risks are addressed, the easier we can identify and deal with them
• The amount of time we spend discussing risks in our status meetings, depends on the number of risks, their complexity, their probability and impact etc.

Prev: Technical Performance Measurement & Status Meetings

Next: Introduction to Practice Standard for Risk Management

Inputs to the Monitor and Control Risks Process

In the previous chapter, we took a high level look at the monitor and control risks process. By now, you must be accustomed to the fact that, every process has a set of inputs and uses a set of tools and techniques to generate an output. This process – Monitor and Control Risks is no different.

Before we actually take a look at the actual inputs used in this process let us look at the purpose of this process. The idea here is to give you another opportunity to try to guess what inputs you may require for this process. If you read the purpose statement carefully, you can get a fair idea of what artifacts from our Project you may want to use for this activity.

Purpose of the Process:

To implement risk response plans, track identified risks, monitor residual risks, identify new risks, evaluate the effectiveness of risk response plans and of the risk management process.

This process uses a total of 4 inputs. They are:

1. Risk Register
2. Project Management Plan
3. Work Performance Information
4. Performance Reports

Trivia:

People easily confuse work performance information and performance reports. So, be cautious and understand them properly before you move on to the next chapter.

Let’s take a detailed look at each of these inputs…

Risk Register

This one is a no brainer, isn’t it? What process in Risk Management does not use the Risk Register as an input? The answer would be – Plan Risk Management and Identify risks where you actually create this document. Isn’t it?

The monitor and control risks process will make use of all of the Contents of the Risk Registerthat is available till date. However, for easier understanding, the following elements of the Risk Register are used in particular for this process:

1. Agreed Upon Risk Responses - This is a key input because, these responses are what we will be implemented during this process. We created them during the plan risk responses process. During this process, after we implement the responses, we also try to find out the effectiveness of the response and see if the response was sufficient. This is required because, if the risk still exists, we need to take actions to prevent any further impact on our project. Right?
2. Implementation Actions - Implementation Actions refers to - what exactly needs to be done in order to implement a response. For ex: In case our strategy to handle a risk is “Transfer” whereby we entrust the responsibility to handle the risk to a third party, a common implementation action would be – Get a formal contract signed with the 3rd party.
3. Risk Owners – People who own the risk and have been assigned the responsibility of tracking this risk
4. Symptoms and Warning Signs – Indications that can tell us if a risk event is about to occur or has already occurred. This is important because; if you do not know what warning signs suggest if a risk is about to occur, how would you handle it?
5. Residual Risks – These are risks that remain after you implement your response. Typically we will use contingency plans and reserves to handle residual risks.
6. Secondary Risks – These are risks that were created as a direct consequence of us implementing a risk response. Here again, we may utilize contingency reserves to handle them.
7. Watchlist – A list of low priority risks that we have kept aside. You may be wondering why this is an input to this process. Actually, when we place a low priority risk in this watchlist, it means that this risk isn’t relevant now but its status could change in the future. During the monitor and control risks process, we will be actually checking the status of each of those watchlist risks so that we will be prepared to handle them in case any of their probabilities or impacts have changed
8. Contingency Reserves for Time & Cost – as contingency plans are put into action, we need to continuously track them in line with the reserves that were put in place during the planning phase.

Project Management Plan

Actually speaking, the Risk Management Plan is the key input that we will be using for this process. But, since the RM Plan is a subsidiary of the PM Plan and also since we may need to refer to other subsidiary plans inside the PM Plan, the PMBOK chose the use the holistic term “Project Management Plan” instead of “Risk Management Plan”.

The following items from the Risk Management Plan are used in this process:

• Roles and Responsibilities
• Protocols
• Risk Tolerance Levels
• Time and Resources set aside for Risk Management Activities

Work Performance Information

Work Performance Information is generated by the Directing and Managing Project Execution process which is part of the Project Integration Management in Project Execution Phase.

As the project progresses, a lot of information is collected about the project like:

• Status of the deliverables
• Schedule Progress
• Cost incurred
• Etc.

A point to note here is that, all of the above mentioned information is collected as of the current date. Naturally, this information will not be available until we actually start doing project work (In the Project Execution Phase) and may vary as our work progresses.

Performance Reports

Performance Reports are generated as part of Report Project Performance process and is part of Communications Management during Monitoring & Controlling the Project.

Performance reports contain an analysis of the Work Performance Information collected during Project Execution. We will need this information to perform variance analysis, earned value analysis etc.

Performance reports include:

• Analysis of Past Performance
• Status of Risks & Issues
• Work Completed (So Far)
• Work that was to be Completed (So Far)
• Summary of Changes
• Variance Analysis Results
• Forecasted completion information (date & cost)

As suggested earlier, all of these items are generated using the Work Performance Information. To recollect, Work Performance Information is generated by the Directing and Managing Project Execution process which is part of the Project Integration Management in Project Execution Phase.


Trivia:

You may be wondering why PMBOK has used both Performance Reports and Work Performance Information as inputs. If the performance reports are generated using the work performance information, why not use just the performance reports?

The performance reports actually take the status of the project collected (the work performance info) and provides us with reports that give us valuable insight on how the project work is progressing. However, as with any other process, we don’t just use the output. We also store the basis of our findings and hence without work performance information we wouldn’t be in a position to confirm the fact that the report is indeed correct. We are doing risk management here. So, we need to take into account of the fact that, incorrect reports could be a source of risks for the project.

Prev: Introduction - Monitor & Control Risks

Next: Overview of Tools & Techniques used in Monitor & Control Risks

An Introduction to Monitor and Control Risks Process

In the previous sections we have successfully completed majority of the Risk Management Processes. By now, we have thoroughly analyzed our risks and even formulated responses for those risks. So, the last step in the Risk Management knowledge area is the “Monitor and Control Risks” process. This is what we are going to learn in this chapter.

Purpose of the Process:

To implement risk response plans, track identified risks, monitor residual risks, identify new risks, evaluate the effectiveness of risk response plans and of the risk management process.

The purpose looks pretty lengthy and is not too clear, isn’t it? This is the official definition as per the PMBOK so I have put it here. Practically speaking this process is responsible for:

• Tracking identified risks
• Monitoring and analyzing residual risks
• Identifying new risks
• Executing risk response plans
• Evaluating the effectiveness of the risk response plans
• Evaluating the effectiveness of the risk management plan
• Checking the validity of project assumptions
• Closing out risks that are no longer valid/applicable
• Monitoring contingency reserves and modifying them as and when required

During the previous process in risk management, we actually created a lot of plans and formulated a lot of actions that were to be implemented as required. This is the process where we actually get to implement those plans and actions.

An important point to remember here is the fact that, during this process, we could uncover new risks as well. In such cases, we typically go back and analyze those risks and then take those risks through the full risk management process cycle. This is done to ensure that we are well planned & prepared to handle risks that may affect our project.

As risk responses are implemented and risks are tracked, any corrective actions required are submitted through the monitor and control risks process. A lot of lessons learned too are picked up in this process. As practitioners of good and proper project management practices, we would document these lessons learned appropriately as well.

Prev: Section Summary - Outputs of the Plan Risk Responses Process

Next: Inputs - Monitor & Control Risks

Chapter 31: Risk Management during Monitoring & Controlling the Project

Aim: To understand the Monitor and Control Risks process

The monitor and control risk process enables the project manager to keep track of how risk responses are performing against the plan, as well as the place where new risks to the project are managed.

There could be cases in which risk might be identified as having a material impact to the enterprise but not to the project. For these risk types, the project must allow for an alternative communication path that forwards alerts to the people in enterprise risk management functions. In addition, the project manager must remember that risks can have negative and positive effects. For example, consider a project for a bridge that interconnects two roads with a max traffic flow of 10,000 cars and 300 tons. A weather event forces a traffic change from other roads, which doubles the capacity requirements for the bridge for at least 18 months after project completion. Although this wrinkle does not directly affect the project’s deliverable, it is important to consider the new information. In this case, the added traffic could affect the lifespan and performance of the deliverable after delivery.

The table below shows the inputs, tools and techniques, and outputs for the monitor and control risks process.

Monitor and Control Risks
Inputs	Tools & Techniques	Outputs
Risk register Project management plan updates Work performance information Performance reports	Risk assessment Risk audits Variance and trend analysis Technical performance measurement Reserve analysis Status meetings	Risk register updates Organizational processes assets Change requests Project management plan updates Project document updates

Remember that to determine how much of an effect a risk will have, multiply its probability by its material impact. As the probability of risk materialization increases, the risk register should make resource (money, equipment, people, and time) allocations ahead of time, thus increasing reserves. It is also important that the risk management plan include the processes that would replenish these reserves before they become depleted.

The purpose of project risk control is to

• Identify the events that can have a direct effect in the project deliverables
• Assign qualitative and quantitative weight—the probability and consequences of these events that might impact the project deliverables
• Produce alternate paths of execution for events that are out of your control or cannot be mitigated
• Implement a continuous process for identifying, qualifying, quantifying, and responding to new risks

The risk register accounts for positive and negative risks. A positive risk is a risk taken by the project because its potential benefits outweigh the traditional approach. A negative risk is one that could negatively influence the cost of the project or its schedule.

One of the techniques to evaluate risk control and monitoring effectiveness is to compare actual risk resolution practices to those that were planned at the time the risk was identified. Any deviations (negative or positive), would be cause to implement a corrective action in the risk management plan.

Exam Trivia:

Risk triggers are those events that cause the threat of a risk to become a reality. For example, you have identified the fact that you only have one water pump station available and the replacement takes six weeks to arrive. In the middle of your irrigation and recycling process tests, you discover that water pressure tends to fluctuate beyond pump tolerance levels. If you do not find a way to solve this problem your risk will become a reality.

Remember that for each identified risk, it is important to provide a response plan. It is not much help if the risk becomes a reality and there is no alternate execution path or an emergency procurement plan.

Exam Trivia:

Business risks and pure risks are different because a pure risk takes into account impacts on loss of financial profits, and business risk concentrates on events that might cause a company to lose position with its investors or to have financial difficulty.

In addition, the risk reserves must be evaluated to determine the best way to replenish them. Some examples of events that could have a negative impact in your risk mitigation and control strategies are

• Resource shortage
• Scope creep
• Contractual issues
• Lack of key resources availability

To know more about the Monitor & Control Risks process Click Here

Prev: Chapter 30

Next: Chapter 32