Project Risk Management - Plan Risk Response

This process develops options and actions to enhance opportunities and to reduce threats to project objectives. It addresses the risks by their priority, inserting resources and activities into the budget, schedule and project management plan.

This process is the mechanism used to analyze if risk response plan is having a desired effect. It also presents commonly used approaches to planning responses to the risks.

Let's look at the Inputs, Tools and Techniques and Outputs of this process.

1) Risk Management Plan

• Includes roles and responsibilities, risk analysis definitions, timing for reviews, and risk thresholds for low, moderate, and high risks. 

2) Risk Register

• Identifies risks
• root causes of risks
• lists of potential risks responses
• risk owners
• symptoms and warning signs
• Relative rating or priority list of project risks
• risks requiring responses in the near term
• risks for additional analysis and response
• trends in qualitative analysis results
• watch list
• which is a list of low priority risks within the risk register

3) Strategies for Negative Risks or Threats

• Decision tree analysis – used to choose the most appropriate responses
• Specific actions – developed to implement the strategy
•     Primary and backup strategies
• Fall back plan – used when the original plan is not working
• Secondary risks – risks that arise as a direct result of implementing a risk response
• Contingency reserve – used to allocate time or cost for these risks
• Three strategies that deal with threats and risks that may have a negative impact on project objectives and the fourth can be used for negative and positive risks

1.     Avoid – the project team acts to eliminate the threat or protect the project from its impact. Changing the project management plan to avoid it or shutting down the project altogether.

2.     Transfer – the team shifts the impact of the threat to a third party, together with ownership of the response. Insurance, performance bonds, warranties, guarantees, contracts and agreements can be used.

3.     Mitigate – the team acts to reduce the probability of the occurrence or impact of the risk. Develop prototypes, adopting less complex processes, conducting more tests, or choosing a more stable supplier are examples.

4.     Accept – the team decides to acknowledge the risk and not take any action unless the risk occurs.

4) Strategies for Positive Risks or Opportunities

• Three responses deal with positive impacts and the fourth can be used for positive and negative risks.

1.     Exploit – the organization wishes to ensure that the opportunity is realized. Eliminates the uncertainty associated with a particular upside risk by ensuring the opportunity definitely happens. Assigning the talented resources to the project to save on time as they will get the work done faster and better.

2.     Enhance – increase the probability and/or the positive impacts of an opportunity. Adding more resources to an activity to finish earlier.

3.     Share – allocating some or all of the ownership of the opportunity to a third party who is best able to capture the opportunity for the benefit of the project. Examples: Risk-sharing partnerships, teams, special-purpose companies, or joint ventures.

4.     Accept – willing to take advantage of the opportunity if it arises, but not actively pursuing it.

5) Contingent Response Strategies

• For some risks it’s appropriate for the team to make a response plan that will only be executed under certain predefined conditions.
• Also known as contingency plans or fall back plans

6) Expert Judgment

• Input from knowledgeable parties pertaining to the actions to be taken on a specific defined risk.

7) Project Management Plan Update

• May include:

o   Schedule management plan

o   Cost management plan

o   Quality management plan

o   Procurement management plan

o   Human resource management plan

o   Scope baseline

o   Schedule baseline

o   Cost baseline

8) Project Documents Updates

• Risk Register updates may include:

o   Risk owners and assigned responsibilities

o   Agreed-upon response strategies

o   Specific actions to implement the chosen response strategy

o   Trigger conditions, symptoms and warning sings

o   Budget and schedule activities

o   Contingency plans

o   Fallback plans

o   Residual risks that are expected to remain

o   Secondary risks

o   Contingency reserves

• Assumptions log updates
• Technical documentation updates
• Change requests

Source: PMBOK 5^th ed.