The Risk Management Processes

The Practice Standard for Risk Management actually covers the same set of processes that you could find in the PMBoK but there is a subtle difference. The PMBoK is all about Inputs, tools & techniques and outputs. Whereas, the Practice Standard adds more than just that, it adds a lot of details that you wouldn’t find in the PMBoK guide.

Ok, the six risk management processes that are part of the PMBoK Guide and the Practice Standard have been covered in great detail in our blog in the preceding sections. But, let us quickly summarize what the Practice Standard has to say about those processes.

1. Plan Risk Management – Define the Scope and Objective of Project Risk Management knowledge area and ensure that risk processes are fully integrated into wider project management.
2. Identify Risks – Identify as many known risks as practically possible
3. Perform Qualitative Analysis – Evaluate the key characteristics of individual risks so that they can be prioritized for further action
4. Perform Quantitative Analysis – Evaluate the combined risk on the overall project
5. Plan Risk Responses – Determine response strategies and actions for individual & overall project risks and integrate them into a plan
6. Monitor and Control Risks – Implement the approved response strategies, review changes, identify additional risk management actions required and assess the effectiveness of overall risk processes

Lastly, the Practice Standard mentions something that we have gone over multiple times. It says that the risk management processes are iterative and dynamic in nature. They must be tailored to suit the needs of your respective projects.

This wraps up all the articles in the series on PMI-RMP Exam Preparation. All the very best for your Exam. You can view the whole series in the Index Page by clicking here.

Prev: Risk Management Foundation

Introduction – Outputs of the Plan Risk Responses Process

In the previous section we took a detailed look at the Plan Risk Responses process. We covered the inputs used by the process, the risk response strategies for negative risks and positive risks as well as other techniques used in the process like Contingency Reserves. Once all this is complete, just like any other process, a bunch of outputs are created by this process. Actually speaking this process creates nothing new but, it makes updates to a lot of documents related to our project.

The following are the outputs/updates generate by this process:

a. Updates to the Project Management Plan
b. Updates to the Risk Register
c. Updates to Project Documents and
d. Updates to Risk Related Contract Decisions

We are going to be covering each of these updates in details in the following chapters. For now, let us just take a high level look at the updates that this process causes in the Risk Register. They include:

a. Agreed upon response strategies
b. Risk owners and assigned responsibilities
c. Risk symptoms and warning signs
d. Required budget and scheduled activities to implement the risk responses
e. Contingency plans and triggers
f. Time and cost contingency reserves
g. Fallback plans
h. Residual risks
i. Secondary risks

So, at the end of this process, the risk register now contains:

1. List of Identified Risks including the risk owner, people responsible to implement the response, the response etc
2. A prioritized list of risks
3. Outputs of the qualitative and quantitative analysis

Prev: Important Terms - Plan Risk Responses

Next: Updates to Risk Register

Introduction - Plan Risk Responses

In the previous sections, we learnt how to analyze all the risks that we have identified in our project so far. So, what is the next logical step now?

You know what the risk is, its probability, and its impact including the monetary impact and hence are in a great position to decide how to handle the risk appropriately, isn’t it? So, the next logic step would be to decide – what to do in response to each of those risks. That is what we are going to do in this section which is titled “Plan Risk Responses”

Purpose of Plan Risk Responses:

The purpose of this process is to develop options and actions that will reduce the threat of negative risks and/or increase the opportunity of the positive risks.

Simply put, you just decide what you are going to do for each of the risk. Plus, an owner is assigned for each risk so that he/she can track the risk appropriately.

Trivia:

Assigning a risk owner is better than a single person keeping track of an unmanageable quantum of risks. In real life, if you perform Risk Identification for a large Project the list will run into numerous risks. So, if you ask a single person to track all of them, it is quite possible that some of the risks maybe missed. So, its better we assign a manageable number of risks to different people and let them stay on top of those risks.

Once the possible responses for each of the risks are formulated, we typically must ask ourselves the following questions before finalizing the response for each risk:

1. Is the response appropriate in comparison to the significance of the risk?
2. Is the response cost effective in meeting all the challenges posed by the risk?
3. Is the response realistic?
4. Have all parties (stakeholders) agreed to the response?
5. Has an owner responsible for the risk been assigned?
6. Is the response planned for execution at the right time?
7. Has the best response been selected from the available options?

If you can answer yes for all of at least a majority of these questions, then we can be pretty sure that the response we have selected would be good.

A point to remember here is that, the responses we develop and when we actually implement those responses depends on various factors including the probability and impact of the risk. Also, in some smaller projects, quantitative risk analysis may or may not happen. In such cases, the “Plan Risk Responses” activity happens right after Qualitative Analysis. However, it would be a good idea to do Quantitative Analysis before planning responses.

This whole Plan Risk Responses activity can be summarized using the image below:




We take a bunch of inputs which include your risks, their details, the analysis you have performed so far and any other relevant information, we apply some response strategy for each of those risks and then formulate the Risk Response Plan for the project.

Remember that there are different strategies for different risks. For ex: If a risk could cause losses (A Negative Risk) we may want to find out options to avoid it whereas if a risk could cause profits or benefits (A Positive Risk also known as an Opportunity) then we may want to capitalize on it to ensure that the benefits are achieved.

Don’t worry just yet about the strategies because there will be whole chapters dedicated to them shortly…

Prev: Section Summary - Updates to Risk Register after Quantitative Analysis

Next: Inputs used in the Plan Risk Responses process

Risk Response Planning

The Risk Response Planning domain of the Risk Management Framework is the third largest domain in terms of the no. of questions it contributes to the RMP Certification Exam. As seen in the introductory chapter on the Risk Management Framework, the exam objectives of this domain are:

a. Develop a Risk Response Strategy
b. Develop a Contingency Approach & Plan
c. Present the Recommendations to Key Stakeholders

Let us say you are the project manager for a project and the warning signs have appeared that a risk is about to happen, what will you do? This is exactly what this domain is all about.

The exam objectives are only 3 in number and may be deceptive that this domain is easy. But as with the other domains, these 3 objectives cover a lot of ground. As you may have guessed by now (If you are a PMP or atleast have read the PMBOK guide) that much of this chapter is centered around the “Plan Risk Response” chapter of the PBMBOK Guide. In the series on PMP Exam Preparation, we had covered this topic in great detail. You can click here to access the chapter on Planning Risk Responses

In order to develop a good Risk Response Plan, you first need to understand the types of strategies you can use for Negative & Positive Risks. Do you know what these Negative & Positive Risks are and how to differentiate between the two? This is one of those basic pre-requisites you need to know before you can actually manage risks for any project. You also need to understand the concepts of Secondary and Residual risks.

Trivia:

A Negative Risk is one that affects a project in a negative way (Like causing delays, bugs, monetary losses etc).
A Positive Risk is one that affects a project in a positive way (Improving schedule, monetary benefits etc).

In order to efficiently execute this domain, a project manager needs to know about:

a. Contingency Plans
b. Contingency Reserves
c. Fallback Plans
d. Workarounds
e. Various Risk Response Techniques
f. Interpreting Risk Related Data

As with other domains, we will be taking a detailed look at all the exam objectives of this domain in future…

Prev: Risk Analysis

Next: Risk Governance

Chapter 18: Risk Management

Aim: To understand the following Risk Management Processes
• Plan Risk Management
• Identify Risks
• Perform Qualitative Risk Analysis
• Perform Quantitative Risk Analysis
• Plan Risk Responses

If you have read the PMBOK or my earlier series “PMP Certification - Study Guide” you would by now know that

“A Risk is an Uncertain Event that can affect your Project”

Remember that this risk can be either Negative (An Actual Risk) or Positive (An Opportunity).

PMI’s risk management philosophy is based on a proactive approach to preventing negative risks and enhancing positive risks. Key points that you must remember about risk are:

• Risk can be either positive or negative. Positive risks are opportunities; negative risks are threats.
• A risk breakdown structure (RBS) is used to organize risk in a hierarchical structure.
• Monte Carlo analysis is a technique using simulations and probability in determining quantitative risk analysis.
• Risk categories are important in classifying risk.
• Probability and impact are both needed to assess risks.
• Quantitative analysis is generally reserved for high-probability, high-impact risk.
• Risk management planning and risk response planning are not the same activities.
• Risk identification is an iterative process that is performed throughout the project, not just during planning.
• Decision tree analysis is a technique using probabilities and costs for structured decision making.
• Five of the six risk management processes are conducted during the planning process group.
• The risk register is an important tool for capturing and tracking risks.

Exam Watch:

Risk register is a term introduced by PMI for the document detailing information on risks. The risk register includes all identified risks, the impacts of identified risks, proposed responses, responsible parties, and the current status.
Risk Management Planning and Risk Response Planning

The first step in Risk Management is to plan how we are going to conduct the whole Risk Management exercise in our project.
The risk management plan includes the risk methodology, roles/responsibilities, budget, execution timing, and definitions for risk categories, probabilities, and impacts. It is a summation of how the project team will carry out the remainder of the risk management activities for the project.

Exam Watch:

The risk management plan is not the same as the risk response plan. The Risk Response Plan will contain the possible actions you must take when a risk actually happens whereas the Risk Management Plan is the overall approach to managing Risks in the Project.

The risk management plan is the single output of the plan risk management process. The table below shows the inputs, tools and techniques, and outputs for the plan risk management process.

Plan Risk Management
Inputs	Tools & Techniques	Outputs
Project scope statement Cost management plan Schedule management plan Communications management plan Enterprise environmental factors Organizational process assets	Planning meetings and analysis	Risk management plan

To know more about the Plan Risk Management Process Click Here

Risk Breakdown Structure (RBS)

A risk breakdown structure (RBS) is a tool that can be used to organize risks in a hierarchical fashion. The structure is defined using the risk categories. Even if an RBS is not used, risk categories are still defined in risk management planning. Risk categories can include

• Technical - Risk associated with using new technology.
• External - Risk associated with forces or entities outside the project organization. External risks can include external suppliers, customers, weather, and market conditions.
• Organizational - Risk associated with either the organization running the project or the organization where the project will be implemented.
• Project Management - Risk associated with project management processes.

Note that this is just a high level classification of Risks and you need to tweak this whole process to suit your needs in the Project that is being executed.

Risk Probability and Impact

Probability can be defined as the likelihood that a risk will occur. It can be expressed mathematically or as a relative scale (low, medium, high).

Impact is the effect a risk has if it actually occurs. It can also be defined on a relative scale or mathematically.

The team documents in the project management plan detail how probabilities and impacts are measured. For example, a red/yellow/green scale might be used, where high-probability, high-impact risks are red; low-probability, low-impact risks are green; and so on. Again, I repeat, how the risks are categorized and prioritized will vary based on the Project at hand and there is no Universal Rule as to how you must handle risks.

Exam Watch:

Both probability and impact are mandatory for evaluating risks. Think of it this way, how will you prioritize a risk if you do not know what the chances are of the risk happening and what the impact it would have if it occurs.

Risk Identification, Analysis, Response Planning, and Monitoring/Controlling

In the risk management process, completing the risk management plan is the first step. After the plan is in place, according to PMI the next steps in the risk management process are
• Risk Identification
• Risk Analysis (qualitative and quantitative)
• Risk Response planning
• Monitoring/controlling Risks (This is not in scope as part of this chapter on Planning. We will cover it in the chapter on Monitoring & Controlling)

Identify Risks

The identify risks process determines the risks that might affect the project and characterizes those risks.
Obviously, you need to identify all the possible risks that might affect your project if you are to have any success handling them. Isnt it? Keep in mind that identifying risks is not just the project manager’s responsibility; team members, subject matter experts, customers, stakeholders, and others are involved in this process.

The table below shows the inputs, tools and techniques, and outputs for the identify risks process.

Identify Risks
Inputs	Tools & Techniques	Outputs
Risk management plan Activity cost estimates Activity duration estimates Scope baseline Stakeholder register Cost management plan Schedule management plan Quality management plan Project documents Enterprise environmental factors Organizational process assets	Documentation reviews Information gathering techniques Checklist analysis Assumptions analysis Diagramming techniques SWOT analysis (Strength, Weakness, Opportunity, Threat) Expert judgment	Risk register

The Risk Register

The risk register is the output of the identify risks process. The risk register contains the following information:
• Risk description
• Date identified
• Category
• Potential responses
• Current status

Exam Watch:

Identify risks is not a one-time event that occurs just during the planning process. It should be conducted throughout the project, including when major milestones are reached and when an actual risk event occurs.

To know more about the Identify Risks Process Click Here

Qualitative and Quantitative Risk Analysis

Qualitative risk analysis provides further definition to the identified risks in order to determine appropriate responses to them. The key terms are probability and impact. Probability is important because it measures how likely a risk is to occur. A high-probability risk deserves more attention than a low-probability risk. Similarly, impact is a measure of how the risk will affect the project should it occur. A risk with low impact has a different response than one with a high impact.

Exam Watch:

Qualitative risk analysis is most concerned with ranking or prioritizing risks. It is used to determine which risks pose more of a potential effect on the project.

Qualitative risk analysis quickly prioritizes risks in order to conduct response planning and quantitative risk analysis, if required. Using the probability of the impact and a probability impact matrix, the project manager develops a prioritized list of risks. The output to this step is captured in the risk register.

The table below shows the inputs, tools and techniques, and outputs for the perform qualitative risk analysis process.

Perform Qualitative Risk Analysis
Inputs	Tools & Techniques	Outputs
Risk register Risk management plan Project scope statement Organizational process assets	Risk probability and impact assessment Probability and impact matrix Risk data quality assessment Risk categorization Risk urgency assessment Expert judgment	Risk register updates

To know more about Qualitative Risk Analysis Click Here

Quantitative risk analysis assigns numerical values to risks and looks at those risks that are high on the list of prioritized risks (The output of qualitative risk analysis). The goal of this process is to quantify possible outcomes for the project, determine probabilities of outcomes, further identify high impacting risks, and develop realistic scope, schedule, and cost targets based on risks.

The table below shows the inputs, tools and techniques, and outputs for the perform quantitative risk analysis process.

Perform Quantitative Risk Analysis
Inputs	Tools & Techniques	Outputs
Risk register Risk management plan Cost management plan Schedule management plan Organizational process assets	Data gathering and representation techniques Quantitative risk analysis and modelling techniques Expert judgment	Risk register updates

Exam Watch:

Quantitative risk analysis is more concerned with assigning each risk a numerical value. This value can then be used to figure out the relative impact that particular risk would have on the project.

To know more about Quantitative Risk Analysis Click Here

Planning Responses to Positive and Negative Risks

After all risks are identified, options to deal with the risks must be identified. Each risk is assigned to one or more owners to carry out the planned response. The responses are documented in the risk register after it has been updated in the plan risk responses process.

The table below shows the inputs, tools and techniques, and outputs for the plan risk responses process.

Plan Risk Responses
Inputs	Tools & Techniques	Outputs
Risk register Risk management plan	Strategies for negative risks or threats Strategies for positive risks or opportunities Contingent response strategies plan Expert judgment	Risk register updates Risk-related contract decisions Project management updates Project document updates

There are four possible responses to negative risks:

• Avoid (Best) – Eliminating the Actual Threat by taking some action
• Transfer – Shifting the Risk to another party
• Mitigate – Take steps to ensure that the chances of the Risk happening are reduced
• Accept – Let the Risk happen. Use Contingency Reserves to handle it

For positive risks the responses include

• Exploit (Best) – Take steps to ensure that the Opportunity happens
• Share – Enlist the help of a Third party to capitalize on the opportunity
• Enhance – Taking steps to increase the probability of the Opportunity happening
• Accept – Take no steps to take advantage of the situation

To know more about the Plan Risk Responses process Click Here

Exam Watch:

Risks should be re-evaluated when the following events occur:

• A risk trigger is identified
• A change request is approved
• Key project milestones are reached
• Project phases end
• Deviations are detected in variance and trend analysis
• Corrective or preventive actions are implemented

Prev: Chapter 17

Next: Chapter 19