PROJECT RISK MANAGEMENT

PROJECT RISK MANAGEMENT

1. Project Risk Management includes the processes of conducting risk management planning, identification, analysis, response planning, and controlling risk on a project.

   • The objectives of project risk management are to increase the likelihood and impact of positive events, and decrease the likelihood and impact of negative events in the project.

2. 1. Plan Risk Management:The process of defining how to conduct risk management activities for a project.

   • Inputs: .1 Project management plan .2 Project charter .3 Stakeholder register .4 Enterprise environmental factors .5 Organizational process assets.
     • The project charter can provide various inputs such as high-level risks, high-level project descriptions, and high-level requirements.
     • The organizational process assets that can influence the Plan Risk Management process include, but are not limited to: Risk categories, Common definitions of concepts and terms, Risk statement formats, Standard templates, Roles and responsibilities, Authority levels for decision making, and Lessons learned.
   • Tools & Techniques: .1 Analytical techniques .2 Expert judgment .3 Meetings.
     • Analytical techniques are used to understand and define the overall risk management context of the project. Risk management context is a combination of stakeholder risk attitudes and the strategic risk exposure of a given project based on the overall project context.
   • Outputs: .1 Risk management plan.
     • The risk management plan is a component of the project management plan and describes how risk management activities will be structured and performed.

3. 2. Identify Risks: The process of determining which risks may affect the project and documenting their characteristics.

   • Inputs: .1 Risk management plan .2 Cost management plan .3 Schedule management plan .4 Quality management plan .5 Human resource management plan .6 Scope baseline .7 Activity cost estimates .8 Activity duration estimates .9 Stakeholder register .10 Project documents .11 Procurement documents .12 Enterprise environmental factors .13 Organizational process assets.
     • The cost management plan provides processes and controls that can be used to help identify risks across the project.
     • The schedule management plan provides insight to project time/schedule objectives and expectations which may be impacted by risks (known and unknown).
   • Tools & Techniques: .1 Documentation reviews .2 Information gathering techniques .3 Checklist analysis .4 Assumptions analysis .5 Diagramming techniques .6 SWOT analysis .7 Expert judgment.
     • A structured review of the project documentation may be performed, including plans, assumptions, previous project files, agreements, and other information. The quality of the plans, as well as consistency between those plans and the project requirements and assumptions, may be indicators of risk in the project.
     • Every project and its plan is conceived and developed based on a set of hypotheses, scenarios, or assumptions. Assumptions analysis explores the validity of assumptions as they apply to the project. It identifies risks to the project from inaccuracy, instability, inconsistency, or incompleteness of assumptions.
   • Outputs: .1 Risk register.
     • The primary output from Identify Risks is the initial entry into the risk register. The risk register is a document in which the results of risk analysis and risk response planning are recorded.

4. 3. Perform Qualitative Risk Analysis: The process of prioritizing risks for further analysis or action by assessing and combining their probability of occurrence and impact.

   • Inputs: .1 Risk management plan .2 Scope baseline .3 Risk register .4 Enterprise environmental factors .5 Organizational process assets.
     • The risk register contains the information that will be used to assess and prioritize risks.
     • The organizational process assets that can influence the Perform Qualitative Risk Analysis process include information on prior, similar completed projects.
   • Tools & Techniques: .1 Risk probability and impact assessment .2 Probability and impact matrix .3 Risk data quality assessment .4 Risk categorization .5 Risk urgency assessment .6 Expert judgment.
     • Risk probability assessment investigates the likelihood that each specific risk will occur. Risk impact assessment investigates the potential effect on a project objective such as schedule, cost, quality, or performance, including both negative effects for threats and positive effects for opportunities.
     • Risk data quality assessment is a technique to evaluate the degree to which the data about risks is useful for risk management. It involves examining the degree to which the risk is understood and the accuracy, quality, reliability, and integrity of the data about the risk.
   • Outputs: .1 Project documents updates.
     • Project documents that may be updated include, but are not limited to: Risk register updates. As new information becomes available through the qualitative risk assessment, the risk register is updated. Assumptions log updates: As new information becomes available through the qualitative risk assessment, assumptions could change. The assumptions log needs to be revisited to accommodate this new information. Assumptions may be incorporated into the project scope statement or in a separate assumptions log.

5. 4. Perform Quantitative Risk Analysis: The process of numerically analyzing the effect of identified risks on overall project objectives.

   • Inputs: .1 Risk management plan .2 Cost management plan .3 Schedule management plan .4 Risk register .5 Enterprise environmental factors .6 Organizational process assets.
     • The risk management plan provides guidelines, methods, and tools to be used in quantitative risk analysis.
   • Tools & Techniques Outputs: .1 Data gathering and representation techniques .2 Quantitative risk analysis and modeling techniques .3 Expert judgment.
     • Expert judgment (ideally using experts with relevant, recent experience) is required to identify potential cost and schedule impacts, to evaluate probability, and to define inputs such as probability distributions into the tools. Expert judgment also comes into play in the interpretation of the data. Experts should be able to identify the weaknesses of the tools as well as their strengths. Experts may determine when a specific tool may or may not be more appropriate given the organization’s capabilities and culture.
   • Outputs: .1 Project documents updates.
     • Project documents are updated with information resulting from quantitative risk analysis. For example, risk register updates could include: Probabilistic analysis of the project, Probability of achieving cost and time objectives, Prioritized list of quantified risks, Trends in quantitative risk analysis results.

6. 5. Plan Risk Responses: The process of developing options and actions to enhance opportunities and to reduce threats to project objectives.

   • Inputs: .1 Risk management plan .2 Risk register.
     • Important components of the risk management plan include roles and responsibilities, risk analysis definitions, timing for reviews (and for eliminating risks from review), and risk thresholds for low, moderate, and high risks. Risk thresholds help identify those risks for which specific responses are needed.
   • Tools & Techniques: .1 Strategies for negative risks or threats .2 Strategies for positive risks or opportunities .3 Contingent response strategies .4 Expert judgment.
     • Three strategies, which typically deal with threats or risks that may have negative impacts on project objectives if they occur, are: avoid, transfer, and mitigate. The fourth strategy, accept, can be used for negative risks or threats as well as positive risks or opportunities.
   • Outputs: .1 Project management plan updates .2 Project documents updates.
     • In the Plan Risk Responses process, several project documents are updated as needed. For example, when appropriate risk responses are chosen and agreed upon, they are included in the risk register. The risk register should be written to a level of detail that corresponds with the priority ranking and the planned response.

7. 6. Control Risks: The process of implementing risk response plans, tracking identified risks, monitoring residual risks, identifying new risks, and evaluating risk process effectiveness throughout the project.

   • Inputs: .1 Project management plan .2 Risk register .3 Work performance data .4 Work performance reports.
     • The risk register has key inputs that include identified risks and risk owners, agreed-upon risk responses, control actions for assessing the effectiveness of response plans, risk responses, specific implementation actions, symptoms and warning signs of risk, residual and secondary risks, a watch list of low-priority risks, and the time and cost contingency reserves.
   • Tools & Techniques: .1 Risk reassessment .2 Risk audits .3 Variance and trend analysis .4 Technical performance measurement .5 Reserve analysis .6 Meetings.
     • Control Risks often results in identification of new risks, reassessment of current risks, and the closing of risks that are outdated. Project risk reassessments should be regularly scheduled. The amount and detail of repetition that are appropriate depends on how the project progresses relative to its objectives.
   • Outputs: .1 Work performance information .2 Change requests .3 Project management plan updates .4 Project documents updates .5 Organizational process assets updates.
     • Work performance information, as a Control Risks output, provides a mechanism to communicate and support project decision making.