project risk management - pmbok5

Connoisseur Solutions

Project Risk Management

Pankaj Sharma - Mobile No -919810996356


What is Risk?

Project risk is an uncertain event that can have a positive or a negative impact on the result

If a project risk materializes and has a negative impact on the project, it is called “Threat” to the project e.g.

Unproven technology impacting project schedule

Loosing critical resource from project

If an uncertain event has a positive impact on the project, it is called “opportunities”. E.g.

Emergence of new tool to increase productivity

New resource replacing the lost resource is a better one!

Not all risks are bad, however most of them are perceived as “Threat” to success

Pankaj Sharma, 9810996356



Risk Vs Issue

Risk

Risk is an uncertain event or event that might happen in future

Once risk is identified, its impact should be analyzed and the response plan should be prepared

Examples:

Lack of Business/Application knowledge which may impact the quality of work products

Issue

Issue is an event that has already occurred

Once the impact of Issue is analyzed, the same should be resolved or escalated

Examples:

Client contact is not providing review comments on deliverables in spite of repeated reminders




Project Risks – Key characteristics

Some of the risks are known risks e.g.

Working in a project with competitor (multi-vendor scenario)

Doing a project in a new geography (cultural differences)

Project attracting environmentalists attention

Accident during Travel

To manage “known risks”, risk response plan is prepared

Known risks are predicted / identified based on the past experience of similar projects




Project Risks – Key characteristics

All the risks can not be predicted and such risks are known as “unknown risks”. e.g.

Natural disaster

Unknown risks cannot be managed proactively

Most of the organizations address such risks through “Business continuity” and “Disaster Recovery” plan

What is the difference between “Risk” and “Issue”?




Project Risk Management

Project Risk Management includes the processes of conducting risk management planning, identification, analysis, response planning and monitoring and control on a project. The objectives of Project Risk Management are to increase the probability and impact of positive events, and decrease the probability and impact of negative events in the project.




Project Risk Management Processes

Process Process Group

Plan Risks Management, Identify Risks, Perform Qualitative Risk Analysis, Perform Quantitative Risk Analysis , Plan Risk Responses

Planning

Control Risks

Monitoring and Controlling




Plan Risk Management

Plan Risk Management is the process of defining how to conduct risk management activities for a project. The Plan Risk Management process should begin as a project is conceived and should be completed early during project planning.




Plan Risk Management

Inputs Tools and Techniques Outputs

Project management plan

Project charter

Stakeholder register

Enterprise Environmental Factors

Organizational Process Assets

Analytical techniques

Expert Judgment

Meetings

Risk management plan




Plan Risk Management - Inputs

Project Management Plan . All approved subsidiary plans and baselines should be taken into consideration in order to make the risk management plan consistent with them. The project management plan provides baseline or current state of risk- affected areas including scope, schedule and cost.

Project Charter can provide various inputs such as high level risks, high – level project descriptions and high – level requirements.

Stakeholder Register , which contains all details related to the project’s stakeholder , provide an overview of their role.




Plan Risk Management - Inputs

Enterprise Environmental Factors include the company culture and existing systems that are dealt with and used by the project manager to run the project. The other factors that can influence this process are risk attitudes and tolerances that describe the degree of risk that an organization will withstand

Organizational Process Assets that can influence this process include risk categories, common definitions of concepts and terms, risk statement formats, standard templates, roles and responsibilities, authority levels for decision making, lessons learned and stakeholder register




Plan Risk Management -Tools and Techniques

Analytical Techniques

Analytical techniques are used to understand and define the overall risk management

context of the project. Risk management context is a combination of stakeholder risk

attitudes and the strategic risk exposure of a given project based on the overall project

Context. Some of the examples of these techniques are , use of strategic risk scoring

Sheets, a stakeholder risk profile analysis may be performed to grade and qualify the

project stakeholder appetite and tolerance.

Expert Judgment

To ensure that a comprehensive risk management plan is developed expert advice

should be taken from groups or individuals with specialized knowledge on the subject

area.




Plan Risk Management -Tools and Techniques

Meetings helps in development of the risk management plan. The

meeting will consist of the project manager, project team members, selected relevant

Stakeholders, and anyone other than these who will be performing the risk management

Activities

The following decisions can be taken at the meeting

1. Basic plans for conducting the risk management

2. Risk, cost elements and schedule activities are developed for inclusion in the project budget and schedule respectively

3. Risk contingency reserve application approaches may be established or reviewed

4. Risk management responsibilities should be assigned

5. General organizational templates for risk management will be tailored as per the project



Connoisseur Solutions Plan Risk Management - Outputs

Risk management plan describes the various risk management processes that will be implemented, monitored and controlled throughout the project lifecycle. It can include the following

1. Methodology – Defines the approaches, tools and the data sources that may be used to perform risk management on the project

2. Roles and Responsibilities – Defines the lead, support and risk management team membership for each type of activity in the risk management plan, assigns people to these roles and clarifies their responsibilities

3. Budgeting - Assigns resources and estimates costs needed for risk management for inclusion in the project cost baseline

4. Timing – Defines when and how often the risk management process will be performed throughout the project life cycle and establishes risk management activities to be included in the project schedule.



Connoisseur Solutions Plan Risk Management - Outputs

5. Risk Categories provides a structure that ensures a comprehensive process of systematically identifying risks to a consistent level of detail and contributes to the effectiveness and quality of Identify risks process.

An organization can use a previously prepared categorization of typical risk. A risk breakdown structure (RBS) is one approach to providing such a structure, but it can also be addressed by simply listing the various aspects of the project.

The risk categories may be revisited during the Identify risks process. A good practice is to review the risk categories during the Risk Management Planning process prior to their use in Identify risks process. Risk categories based on prior projects may need to be tailored, adjusted or extended to new situations before those categories can be used on the current project.




Plan Risk Management - Outputs

Source : PMI PMBOK® Fourth Edition

Risk Breakdown Structure (RBS)






6. Definition of Risk Probability and Impact





7. Definition of Risk Probability and Impact matrix, A grid mapping of probability of happening of risk and the impact if happens, Based on the probability and impact values the risks are rated as High, Moderate and Low. 8. Revised stakeholder’s tolerance, based on the project may be revised in the risk management process. 9. Reporting formats, define how the outcomes of the risk management process will be documented , analyzed and communicated. It describes the content and format of the risk register as well as any other risk report required. 10. Tracking. Tracking documents how risk activities will be recorded for the benefit of the current project and how risk management processes will be audited.




Sources of Project Risks

Project

Risk

Project Initiation

Com

munic

ation

Hu

man

Reso

urc

e

Procurement

Co

st

Time

Qual

ity

ScopeLifecycle and

Environment Variables

Expectation

Feasibility

Requirement

Standards

Time Objectives

Restraints

Restraints

Cost Objectives

Performance

Services

Materials

Availability

Productivity

Ideas

Directives

Data Accuracy




Identify Risks Process

Risk Identification process determines which risks may affect the project and

documenting their characteristics. It is an iterative process as risk can be identified at

any levels in the project. Irrespective of risks having positive or negative

consequences, all risks events and their consequences should be identified.




Identify Risks



Cost management plan

Schedule management plan

Quality management plan

Human resource management plan

Scope baseline

Activity cost estimates

Activity duration estimates

Stakeholder register

Project documents

Procurement documents

Enterprise environmental factors

Organizational Process Assets

Documentation reviews

Information gathering techniques

Checklist analysis

Assumptions analysis

Diagramming techniques

SWOT analysis

Expert Judgment

Risk Register




Risk Management Plan provides inputs regarding the assignment of roles and responsibilities, provision for risk management activities in the budget and schedule, and categories of risk, which are sometimes expressed in a Risk Breakdown Structure.

Cost Management Plan provides processes and controls that can be used to help identify risks across the project

Schedule Management Plan provides insight to project time / schedule objectives and expectations which may be impacted by risks (Known and Unknown)

Quality management plan contains information related to the quality management plan which is an important input to Identify risk process as the project specific approach may generate or alleviate risk by its nature or structure

Identify Risks - Inputs




Human Resource Management Plan . The human resource management plan provides guidance on how project human resource should be defined , staffed , and eventually released. It can also contain roles and responsibilities, project organization charts, and the staffing management plan, which forms a key input to identify risk process.

Scope baseline is a component of scope statement which should be evaluated as potential causes of project risk

Activity Cost Estimates provide a quantitative assessment of likely cost to complete schedule activities and ideally are expressed as a range, with the width indicating the degree of risk

Activity duration estimates are useful in identifying risks related to the time allowances for activities or project as a whole, with the width of the ranges of these estimates indicating the relative degree of risk.

Stakeholder register contains information on stakeholders, which will be useful in interviewing the key stakeholders for their inputs to this process





Project Documents that may be useful while identifying risks are assumptions log, work performance reports, network diagrams, baselines and other project information that may be useful in identifying risks.

Procurement Documents , If the project requires external procurement of resources , procurement documents become a key input to the identify Risks process. The complexity and the level of detail of the procurement documents should be consistent with the value of, and risks associated with, planned procurement.

Enterprise Environmental Factors that can influence this process are published information which consists of commercial database, academic studies, published checklists, benchmarking, industry studies and risk attitudes.

Organizational Process Assets that can influence this process are project files, organizational and project process controls, risk statement templates and lessons learned





Identify Risks– Tools and Techniques

Documentation reviews includes structured review of the project documentation, which may include project files, project plans, assumptions, historical information, and other information from the project level as well as individual activity level. It is also essential to identify the quantity of plans and the consistency between the plans

Information gathering techniques – There are five key techniques for information gathering

□ Brainstorming session is conducted by a facilitator and a group of Subject Matter Expert (SMEs), who perform brainstorming and arrive at a comprehensive list of project risks. Identified risks are categorized by the type of risks. A risk breakdown structure (RBS) can be used as a framework for risk identification.

□ Delphi Technique is conducted by a facilitator and a group of experts, who are given a questionnaire to fill. The results are collected and summarized and the results are again circulated to get feedback from the experts.





Interviewing is one of the main sources of risk gathering techniques where experienced project managers, stakeholders and subject matter experts are interviewed for risk identification.

Root Cause identification involves identifying the causes of risks and improves the understanding of the risk. It sharpens the definition of the risk and allows grouping risks by causes. Effective risk response can be developed if the root cause of the risk is addressed

Checklist Analysis can be based on historical information gathered from previous

similar projects. The lowest level of Risk Breakdown Structure (RBS) can also be used

as a checklist. Checklists can be updated at the end of the project completion to add

new risks, if any. Checklists are not a very much efficient method of identifying risks.





Assumption Analysis reviews the validity of assumptions defined in the

project to ensure that risks are not missed due to inaccuracy or

incompleteness of the assumption. Assumptions are tested against their strength. The

consequences that might occur if the assumptions were false are also analyzed. In

such cases the assumptions are considered as risks.

Diagramming Techniques may include Cause and effect diagrams also known

as Ishikawa or fishbone diagrams, System or process flowcharts, and

influence diagrams, which are graphical representation of situations showing

causal influences

SWOT Analysis examines the project from its Strengths, Weaknesses,

Opportunities and Threats to identify the probable risk events.

Expert Judgment involves participation of SMEs based on their previous

experience and area of expertise




Identify Risks– Outputs

Risks Register The identified risks are mentioned in the document called a Risk Register, which becomes a component of the project management plan. Following items can be included in the Risk Register

□ List of identified risks – The list can state the EVENT that may occur , the IMPACT and if CAUSE, EVENT may occur , then listing of EFFECT. Root causes of the risk events can also be listed

□ List of potential responses – If identified during the process of risk identification, responses should be documented and it may be a useful input to the plan Risk Responses process




Perform Qualitative Risk Analysis

Prioritizing risks for further analysis or action by assessing and combining

their probability of occurrence and impact.




Perform Qualitative Risk Analysis


Risk Management Plan

Scope baselines

Risk Register

Enterprise environmental factors

Organizational Process assets

Risk probability and impact assessment

Probability and impact matrix

Risk data quality assessment

Risk categorization

Risk urgency assessment

Expert judgment

Project document updates




Risk Management Plan documents the roles and responsibilities for :

Budgets and schedule activities for risk management

Risk Categories

Definition of probability and impact

The probability and impact matrix

Revised stakeholder’s risk tolerances

These inputs are documented during Perform Qualitative Risk analysis if not defined during the risk management process.

Scope Baseline mentions the project deliverables, assumptions and constraints. Depending on the project type, i.e. whether it is a state-of-the-art project or a common recurring project type, the risks and level of uncertainty can be evaluated. A project which is more complex than the ones the team has handled earlier and where the uncertainty level is high requires more diligence during the process.

Perform Qualitative Risk Analysis - Inputs




Risk Register contains all the identified risks, it’s a component of the project management plan

Enterprise Environmental Factors, may provide insight and context to the risk assessment such as :

Industry studies of similar projects by risk specialists and

Risk databases that may be available from industry or proprietary sources

Organizational Process assets that can influence this process are information of similar previous projects, studies of similar projects by risk specialists and risk databases that may be available from industry or proprietary sources.

Perform Qualitative Risk Analysis - Inputs




Perform Qualitative Risk Analysis– Tools and Techniques

Risk probability and impact assessment examines the likelihood that each specific risk will occur and evaluates the potential effect of any of the project objectives such as time, cost, scope or quality. It also evaluates the positive opportunities and negative threats. To assess the probability and impact of each risk, a meeting or interview with subject matter experts either internal or external to the organization is conducted where levels are assigned to each risk and also the potential effects of these risks is evaluated in case the risk occurs

Probability and impact matrix assigns ratings to each risk and classifies them for either perform quantitative risk analysis or plan risk responses. Ratings are assigned to risks based on the combination of probability and impact. The risk may guide in providing risk responses as indicated below

□ Risks that have a negative impact on the project objectives if they occur (threats) and that are in the high – risk (black zone of the matrix), may require priority action and aggressive response strategies.

□ Threats in low – risk (medium gray zone) may not require proactive management action beyond being placed on a watch list or adding a contingency reserve.

□ For opportunities, those in the high-risk (black zone) that can be obtained most easily and offer the greatest benefit should, therefore be targeted first

□ Opportunities in the low-risk (Medium gray zone) should be monitored





Probability Impact Matrix






Risk data quality assessment involves determining the quality or usefulness of the data collected to evaluate the risk as per the risk management plan. It involves examining degree to which the risk is understood, and the accuracy, quality, reliability and integrity of the data about risk. If data quality is unacceptable, it may be necessary to gather higher-quality data.

Risk categorization – Project risks can be categorized by the source of risk (e.g., using the RBS), areas of the project affected (e.g. ,using the WBS) or other useful category (e.g. , project phase, etc.) to determine areas of the project most exposed to the effects of uncertainty. Grouping risks by common root causes can lead to developing effective risk responses.

Risk urgency assessment determines how soon the potential risks may occur, and it also identifies near- term responses for those risks.

Expert judgment is required to assess the probability and impact of each risk to determine its location in the probability impact matrix




Perform Qualitative Risk Analysis – Outputs

Risk Register Updates – Risk register is initiated during identify risk process ,and is updated with information from Perform Qualitative Risk Analysis.

Following are the updates from Perform Quantitative Risk Analysis:

Relative ranking or priority list of the project risks. The probability and impact matrix can be used to classify risks according to their individual significance. The project manager can then use the prioritized list to focus attention on those items of high significance to the project, where responses can lead to better project outcomes. Risk may be listed by priority separately for cost, time, scope and quality as organizations may value one objective over another. A description of the basis for the assessed probability and impact should also be included for the assessed risks.

Risk grouped by categories can reveal common root cause of the risk or project areas requiring particular attention.

Cause of risk or project areas requiring particular attention. Discovering concentrations of risk may improve the effectiveness of risk.

List of risks requiring response in the near-term. Those risks that require an urgent response and those that can be handled at a later date may be put into different groups.




Perform Qualitative Risk Analysis – Outputs

List of risks for additional analysis and response. Some risks might warrant more analysis , including perform qualitative risk analysis as well as response action

Watch-lists of low priority risks. Risks that are not assessed as important in the Qualitative Risk Analysis process can be placed on a watch-list for continued monitoring

Trends in qualitative risk analysis results. As the analysis is repeated , a trend for particular risks may become apparent and can make risk response or further analysis more or less urgent/important




Perform Quantitative Risk Analysis Process

Numerically analyzing the effect of identified risks on overall

project objectives.




Perform Quantitative Risk Analysis Process





Risk register

Enterprise environmental Factors

Organizational process assets

Data gathering and representation techniques

Quantitative risk analysis and modeling techniques

Expert Judgment





Perform Quantitative Risk Analysis -Inputs

Risk management plan provides guidelines , methods and tools to be used in quantitative risk analysis.

Cost management plan contains baseline data related to cost, this may help to determine the approach for Quantitative analysis for the project.

Schedule management plan contains baseline data related to schedule, this may help to determine the approach for Quantitative analysis for the project.

Risk register is used as a reference point for performing quantitative risk analysis

Organizational process assets that can influence this process are information of previous projects, studies of similar projects by risk specialists and risk databases that may be available from industry or proprietary sources.




Perform Quantitative Risk Analysis -Inputs

Enterprise Environmental Factors may provide insight and context to the risk analysis, such as :

Industry studies of similar projects by risk specialists, and

Risk databases that may be available from industry or proprietary sources.

Organizational process assets that can influence this process are information of previous projects, studies of similar projects by risk specialists and risk databases that may be available from industry or proprietary sources.




Perform Quantitative Risk Analysis - Tools and Techniques

Data gathering and representation techniques

Interviewing : Experienced project managers , stakeholders and subject matter experts are interviewed to quantify the probability and impact of risks on project objective. During interviewing different kind of probability distribution are used. In case a triangular one is used then the three values for 3 point estimates are taken as input from the SMEs which is used to quantify risk for each element.

Probability distributions : are basically of two types – Asymmetrical distribution or Uniform distributions

Asymmetrical distribution depicts shape which are compatible with the data typically developed during project risk analysis. Asymmetrical distributions are of two types- Continuous probability distributions represent the uncertainty in values, such as durations of schedule activities and costs of project components, whereas Discrete probability distributions can be used to represent uncertain events, such as the outcome of a test or a possible scenario in the decision tree.




Perform Quantitative Risk Analysis -Outputs

Uniform distributions can be used if there is no obvious value that is more likely than any other between specified high and low bounds

Quantitative risk analysis and modeling techniques

Commonly used techniques in Quantitative Risk Analysis and Modeling techniques include:

Sensitivity analysis. This aid in determining which risks have the most potential impact on the project. It examines the extent to which the uncertainty of each project element affects the objective being examined when all other uncertain elements are held at their baseline values. Sensitivity analysis can be done by using the Tornado diagram.

Expected monetary value (EMV) analysis is a statistical concept that calculates the average outcome when the future includes scenarios that may or may not happen (i.e. analysis under uncertainty). The EMV of opportunities will generally be expressed as positive values while those of risks will be negative. EMV is calculated by multiplying the value of each possible outcome by its probability of occurrence and adding them together.




Perform Quantitative Risk Analysis - Tools and Techniques




Perform Quantitative Risk Analysis –Tools and Techniques

Modeling and simulation. A project simulation uses a model that translates the uncertainties or potential risks specified at a detailed level of the project into their potential impact on project objectives.

Simulation techniques compute the project model using the inputs such as cost or schedule to determine the probability distribution. Simulation techniques should be the preferred one for predicting schedule or cost risks as compared to other techniques

Simulations are typically performed using the Monte Carlo technique. In a simulation, the project model is computed many times (iterated) with the input values randomized from a probability distribution function (e.g. cost of project elements or duration of schedule activities) chosen for each iteration from the probability distribution of each variable. A probability distribution is then calculated.

Expert Judgment – Subject matter experts internal or external to the organization such as Engineering or statistical experts are required to identify potential cost and schedule impacts , to evaluate probability and to define inputs to tools




Perform Quantitative Risk Analysis – Outputs

Risk Register Updates – The register initiated in the Identify Risks process and is updated in

Perform Qualitative Risk Analysis process. The risk register is a component of the

project management plan. Updates include the following components :

Probabilistic analysis of the project. Estimates are made of potential project schedule and cost outcomes, listing the possible completion dates and costs with their associated confidence levels. This output typically expressed as a cumulative distribution is used with stakeholder risk tolerances to permit qualification of the cost and time contingency reserves

Probability of achieving cost and time objectives. With the project facing the risks, the probability of achieving project objectives under the current plan can be estimated using quantitative risk analysis results

Prioritized list of quantified risks. This list of risks includes those that pose the greatest threat or present the greatest opportunity to the project. These include the risks that require the greatest cost contingency and those that are most likely to influence the critical path.

Trends in quantitative risk analysis results. As the analysis is repeated a trend may become apparent that leads to conclusions affecting risk responses




Plan Risk Responses

Developing options and actions to enhance opportunities and

reduce threats to project objectives






Risk register

Strategies for negative risks or threats

Strategies for positive risks or opportunities

Contingent response strategy

Expert Judgment

Project management plan updates


Plan Risk Responses




Plan Risk Responses - Inputs

Risk management plan include roles and responsibilities, risk analysis definitions, risk thresholds for low, moderate and high risks and the time and budget required to conduct the project Risk Management Processes. Some components of the Risk Management Plan that are important inputs to Plan Risk Responses may include risk thresholds for low, moderate and high risks to help understand those risks for which responses are needed, assignment of personnel and scheduling and budgeting for risk response planning.

Risk register provides important inputs related to this process and this include the relative rating or priority list of project risks, a list of risk for additional analysis and response, trends in qualitative risk analysis results, root causes, risk grouped by categories and a watch list of low priority risks.




Plan Risk Responses – Tools and Techniques

Strategies for negative risks or threats

Avoid. Risk avoidance involves changing the project management plan to eliminate the threat posed by an adverse risk, to isolate the project objectives from the risk’s impact or to relax the objective that is in jeopardy, such as extending the schedule or reducing scope. Some risks that arise early in the project can be avoided by clarifying requirements, obtaining information, improving communication or acquiring expertise.

Transfer. Risk transference requires shifting the negative impact of a threat, along with ownership of the response to a third party. Transferring the risk simply gives another party responsibility for its management, it doesn’t eliminate it. Risk transference nearly always involves payment of a risk premium to the party taking on the risk. Transference tools can be quite diverse and can include but are not limited to the use of insurance, performance, bonds, warranties, guarantees etc.

Mitigate. Risk Mitigation implies a reduction in the probability and impact of an adverse risk event to an acceptable threshold. E.g. Conducting more tests, a more stable supplier etc

Accept. This includes passive or active acceptance. Passive acceptance requires no action , the most common active acceptance strategy is to establish a contingency reserves, including amounts of money or resources to handle known or unknown threats/ opportunities





Strategies for positive risks or opportunities

Exploit .This strategy may be selected for risks with positive impacts where the organization wishes to ensure that the opportunity is realized. This strategy seeks to eliminate the uncertainty associated with a particular upside risk by making the opportunity definitely happen. Directly exploiting responses include assigning more talented resources to the project to reduce time to completion or to provide better quality than originally planned.

Share. Sharing a positive risk involves allocating ownership to a third party who is best able to capture the opportunity for the benefit of the project. E.g. forming risk-sharing partnerships, teams, special-purpose companies or joint ventures, which can be established with the express purpose of managing opportunities.

Enhance . This strategy modifies the size of an opportunity by increasing probability and /or positive impacts and by identifying and maximizing key drivers of these positive-impact risks. Seeking to facilitate or strengthen the cause of the opportunity and proactively targeting and reinforcing its trigger conditions, might increase the probability

Accept. Accepting an opportunity is being willing to take advantage of it if it comes along, but not actively pursuing it.





Contingent response strategy. Some responses are designed for use only if certain events occur. For some risks, it is appropriate for the project team to make a response plan that will only be executed under certain predefined conditions, if it is believed that there will be sufficient warning to implement the plan. Events that trigger the contingency response such as missing intermediate milestones or gaining higher priority with a supplier, should be defined and tracked

Expert Judgment. Expertise may be provided by any group or person with specialized education, knowledge, skill, experience or training in establishing risk responses.




Plan Risk Responses – Outputs

Project Management Plan Updates- Elements of the project management plan that may be updated include



Quality management plan

Procurement management plan

Human resource management plan

Scope baseline

Schedule baseline

Cost baseline.





Project Document Updates. This include components of the Risk register such as

Identified risks their descriptions, areas of the project (e.g. WBS element) affected, their causes (e.g. RBS element) and how they may affect project objectives

Risk owners and their assigned responsibilities

Output from the Perform Qualitative and Perform Quantitative Risk Analysis processes, including prioritized lists of project risks and probabilistic analysis of the project

Agreed – upon response strategies

Specific actions to implement the chosen response strategy

Symptoms and warning signs of risks’ occurrence





Budget and schedule activities required to implement the chosen responses

Contingency reserves of time and cost designed to provide for stakeholders risk tolerance.

Contingency plans and trigger that call for their execution

Fallback plans for use as a reaction to a risk that has occurred and the primary response proves to be inadequate

Residual Risks that are expected to remain after planned response have been taken as well as those that have been deliberately accepted

Secondary risks that arise as a direct outcome of implementing a risk response

Contingency reserves that are calculated based on the quantitative analysis of the project and the organization’s risk thresholds.




Control Risks

Implementing risk response plans, tracking identified risks, monitoring

residual risks, identifying new risks, and evaluating risk process

effectiveness throughout the project.





Project management plan

Risk register

Work performance data

Work performance reports

Risk reassessment

Risks audits

Variance and trend analysis

Technical performance measurement

Reserve analysis

Status meetings

Work Performance Information

Change requests

Project management plan updates


Organizational process assets updates

Control Risks




Control Risks- Inputs

Project management plan consists of the risk management plan which includes the assignment of people, time, and resources to the project risk management process.

Risk register which is a subset of the project management plan, includes a list of identified risks agreed upon risk responses, specific implementation actions, symptoms and warning signs of risk, residual and secondary risks, watch-list of low priority risks and cost contingency reserves.

Work Performance Data includes information such as project deliverables status , schedule progress and incurred costs.

Work Performance reports gather and summarize the information required by the stakeholders. This information is an analysis of the work performed during the execution process vis-à-vis project baseline and is relevant to the risk management process.




Control Risks- Tools and Techniques

Risk reassessment indicates reassessing the identified risks and identification of new risks as defined in the risk management plan. Project risk reassessment should be performed regularly and it can be included as an agenda item at the project status meetings.

Risks audits are scheduled audits that document the effectiveness of risk responses with respect to their dealing with identified risks and their associated root causes. This aids in determining the effectiveness of the risk management process.

Variance and trend analysis Performance data provides the data for variance and trend analysis. Using this data and applying the earned value analysis and similar methods of project variance and trend analysis; it is possible to monitor the overall project performance.

Technical performance measurement. This involves identifying the variance in the technical performance from the planned technical schedule. Any variance from the defined milestone(s) can aid the project team to forecast the degree of success in achieving the project’s scope.

Reserve analysis. During the planning phase, contingency reserves are defines as a part of risk response plan. During execution some of the reserves get exhausted. This tool determines if the remaining reserves are sufficient to tackle the remaining risks.

Meetings. Status review meetings help in monitoring the risks




Control Risks- Outputs

Work Performance Information , as a Control Risks output , provides a mechanism to communicate and support decision making.

Change requests - During this process, there may be requested change due to implementation of the contingency plans or workarounds. These changes are reviewed and approved through the integrated change control process.

Project management plan updates may arise as a result of the approved change requests

Project document updates- Project documents that may be updated as a result of this process are assumptions log updates and technical documentation updates.

Organizational process assets updates- The risk management processes produce information that should be documented for future reference. The organizational process assets may be updated to include templates for the risk management plan, including the probability and impact matrix and risk register, risk breakdown structure and lessons learned from the project risk management activities.




QUIZ !



project risk management - pmbok5

Education