Project Risk Management

Project risk management addresses the planning, identification, analysis, response planning, and monitoring and control of risk on a project.

The following processes and the primary goals of Project risk management are defined as:

• Plan risk management. Goal: risk management plan

• Identify risks. Goal: risk register

• Perform qualitative risk analysis. Goal: project documents updates

• Perform quantitative risk analysis. Goal: project documents updates

• Plan risk responses. Goal: project documents updates

• Monitor & control risks. Goal: project documents updates, change requests

A key objective of performing project risk management is to increase the probability of project success by minimizing or eliminating negative risk events and increasing the probability of positive events.

For the exam, understand the following concepts:

• Risk Management includes the processes of planning risk management, identifying risks, performing qualitative and quantitative analysis of risks, planning responses to risks, and finally monitoring and controlling risks on the project

• Risk is always in the future

• Risk involves uncertainty - it may or may not occur

• Assess your organization's risk attitudes based on three general elements:

• Risk appetite - what degree of uncertainty can the organization accept based on anticipation of a reward?

• Tolerance for risk: are they risk tolerant or risk averse?

• Risk threshold - at what level of the organization refuse to tolerate the risk?

• There will be known risks and unknown risks

• Risks can be negative or positive and are identified as threats or opportunities

• Risk is considered from the moment the project is conceived

Plan Risk Management

Plan risk management process defines how you will conduct risk management activities for a project. It includes the process of defining and providing sufficient resources and time to perform risk management activities.

Planning for risk management begins when the project is originally conceived and should be completed early in the Planning process group.

Understand that if risk is a significant aspect of your project management planning, you may need to enlist the help of risk management professionals within your organization or external to your organization.

Just as with quality, there is a cost in addressing the risk aspects of your project. However, understand that failure to address risks in a project can ultimately be much more costly, not only to the project, but also to the organization as a whole.

Risk Management Plan

The output of the Plan Risk Management process is the creation and completion of the Risk Management Plan. The major categories in a risk management plan include:

• Risk management methodology

• Roles and responsibilities

• Budgeting

• Timing

• Risk Categories

• Definitions of probability and impact

• Probability and impact matrix

• Revised stakeholder’s tolerances

• Reporting Formats

• Tracking 

Project Risk Categories

The risk categories in a project management plan can be graphically represented with a tool that is similar to the work breakdown structure (WBS) called a Risk Breakdown Structure (RBS).

The RBS enables you to see all project risks grouped by basic themes and the specific risk areas occurring in relation to each theme. Tom DeMarco and Tim Lister in their 2003 book, Waltzing with Bears, identified five key risk categories on a software project:

• Scope Creep – from the stakeholders

• Inherent schedule flaws – usually due to unknown and uncertain elements, and also due to a miscalculation on the size of the product to be built

• Employee turnover – this possibility is usually left out of the estimation process, especially the time needed to ramp up replacement resources

• Specification breakdown – this is a show stopper, in which the customer cannot agree on what is being delivered, effectively bringing the project to a standstill. However, in reality, the conflict is usually so deep that it is often covered up and the project goes ahead with a flawed, ambiguous target. This will result in a project that is either canceled or does not meet customer expectation.

• Poor productivity –usually a result of the impact of the previous four risks described