PMP Project Management Professional Study Guide, Third Edition (Certification Press)

Risk response planning is all about options and actions. It focuses on how to decrease the possibility of risks from adversely affecting the project’s objectives, and on how to increase the likelihood of positive risks that can aid the project. Risk response planning assigns responsibilities to people and groups close to the risk event. Risks will increase or decrease based on the effectiveness of risk response planning.

Risk management planning is the process of determining how risk management will be handled. The stakeholder analysis will reveal their willingness to accept risk—which is also known as their utility function. The performing organization may have standard practices for risk management, risk management templates, or guidance from historical information.

There are two types of risk: business risk, which is gains or losses from a financial point of view; and pure risks, which only has a down side. Both types of risks must be assessed and managed.

Risk identification happens early on the project to allot time for risk response planning. Risk identification also happens throughout the project. The project manager, the project team, customers, and other stakeholders are involved in the process. There are several methods to risk identification, though interviews and the Delphi Technique are two of the most common approaches.

Qualitative analysis qualifies the list of risks in a matrix based on impact and probability. This subjective approach uses a common very low, low, moderate, high, and very high ranking. The risks can be prioritized based on their score.

After qualitative analysis, some risks may be sent through quantitative analysis. This approach attempts to quantify the risks with hard numbers, values, and data. Quantification of the risk can lead to time and cost contingencies for the project, priority of the risks, and an overall risk score. Monte Carlo simulations are typically associated with quantitative risk analysis.

There are four risk responses:

• Avoidance The project plan is altered to avoid the identified risk.

• Mitigation Effort is made to reduce the probability, impact, or both of an identified risk in the project before the risk event occurs.

• Transference The risk is assigned to a third party, usually for a fee. The risk still exists, but the responsibility is deflected to the third party.

• Acceptance The risks are seen as nominal so they are accepted. Risks, regardless of size, that have no other recourse may also be accepted.

As the project progresses, risk monitoring and control is implemented. Risks are monitored for signs that they may be coming to fruition. The project team and the project manager execute the risk response plan and document the results. Earned value analysis, which is typically used to measure project performance, can also be used to signal impending project risks.

The responses to identified risks must be in balance with the risk itself. The cost and time invested in a risk must be met with the gains from reducing the risk’s impact and probability. In other words, a million-dollar solution for a hundred-dollar problem is unacceptable. The people or individuals that are assigned to the risk must have the authority to react to the project risk as planned. In most cases, there will be several risk responses that may be viable for the risk—the best choice for the identified risk must be documented, agreed upon, and then followed through should the risk come to fruition.

Preparing for Risk Response

To successfully prepare for risk response, the project manager, project team, and appropriate stakeholders will rely on several inputs—many of which stem from qualitative and quantitative risk analysis—such as:

• The risk management plan

• A list of prioritized risks

• Risk ranking

• A prioritized list of quantified risk

• A probabilistic analysis of the project

• The probability of the project meeting the cost and schedule goals

• The list of potential responses decided upon when risks were first identified

• Any risk owners that have been identified

• A listing of common cause risks to address multiple risks with an achievable solution

• Trends from qualitative and quantitative analysis