Chapter 6 Risk Response

Types of reserves

Contingency reserves Management reserves

Contingency reserves

Contingency reserves also called buffers or time reserves in the PMBOK guide; means a portion of time that is added to the schedule to account for risk or uncertainty. Contingency reserves are calculated for known risks that have documented contingency or mitigation response plans to deal with the risk event should it occur, but you don't necessarily know how much time it will take to implement the mitigation plan and potentially perform rework.

Fallback plan

Fallback plans should be developed for risks with high impact or for risks with identified strategies that might not be the most effective at dealing with the risk. Fallback plans are not contingency plans

Strategies for Negative Risks

Four strategies exist to deal with negative risks or threats to the project objectives: avoid, transfer, mitigate, and accept. Accept is a strategy you can use for positive risks or opportunities also. The four strategies for dealing with negative risks or threats are further described as follows: Avoid: To avoid a risk means you will evade it altogether by eliminating the cause of the risk event or by changing the project management plan to protect the project objectives from the risk event. With risk avoidance, you essentially eradicate the risk by eliminating its cause. Risks that occur early in the project might easily be avoided by improving communications, refining requirements, assigning additional resources to project activities, refining the project scope to avoid risk events, and so on. Transfer: The idea behind a risk transfer is to transfer the risk and the consequences of that risk to a third party. The risk has not gone away, but the responsibility for the management of that risk now rests with another party. Transfer of risk can occur in many forms but is most effective when dealing with financial risks. Insurance is one form of risk transfer. Another method of risk transfer is contracting. Contracting transfers specific risks to the vendor, depending on the work required by the contract. The vendor accepts the responsibility for the cost of failure. Mitigate: When you mitigate a risk, you attempt to reduce the probability of a risk event occurring or reduce its impacts to an acceptable level. This strategy is a lot like defensive driving. According to the PMBOK guide, the purpose of mitigation is to reduce the probability that a risk will occur and/or reduce the impact of the risk to a level where you can accept the risk and its outcomes. Some examples of risk mitigation include performing more tests, using less complicated processes, creating prototypes, and choosing more reliable vendors. Accept: The acceptance strategy is used when you are not able to eliminate all the threats on the project. Acceptance of a risk event is a strategy that can be used for risks that pose either threats or opportunities to the project. There are two alternatives to the acceptance strategy. Passive acceptance means you won't make any plans to try to avoid or mitigate the risk. You are willing to accept the consequences of the risk should it occur. This strategy is often used when it's more cost-effective to accept the impacts of the risk than to spend time or resources developing plans to deal with the consequences. Passive acceptance might also be used because the project team was unable to come up with an adequate response strategy and must accept the risk and its consequences. Active acceptance is the second strategy and might include developing contingency plans and reserves to deal with risks should they occur.

Strategies for Positive Risks or Opportunities

Four strategies exist to deal with opportunities or positive risks that might present themselves on the project: exploit, share, enhance, and accept. The following are the strategies for dealing with positive risks or opportunities: Exploit: The exploit strategy may be selected for risks with positive impacts where the organization wishes to ensure that the opportunity is realized. This strategy seeks to eliminate the uncertainty associated with a particular upside risk by ensuring the opportunity definitely happens. Examples of exploiting a risk include reducing the amount of time to complete the project by bringing on more qualified resources or by providing even better quality than originally planned. Enhance: The enhance strategy is used to increase the probability and/or the positive impacts of an opportunity. Identifying and maximizing key drivers of these positive-impact risks may increase the probability of their occurrence. Examples of enhancing opportunities include adding more resources to an activity to finish early. Share: The share strategy is similar to the transfer strategy because you will assign the risk to a third-party owner who is best able to bring about the opportunity the risk event presents. Accept: Accepting an opportunity is being willing to take advantage of the opportunity if it arises, but not actively pursuing it

Management reserves

Management reserves are a type of reserve used for unknown events. Management reserves set aside periods of time for this unknown work but are not included in the schedule baseline. If you do use management reserves during the project, you must change the schedule baseline to reflect the time used

after identify risks, perform qualitative risk analysis, and perform quantitative risk analysis are performed, the following elements should appear in the risk register:

Prioritized list of identified risks, including their descriptions, what WBS element they impact (or area of the project), categories (RBS), root causes, and how the risk impacts the project objectives Risk ranking Risk owners and their responsibility Outputs from perform qualitative analysis Agreed-upon response strategies Actions needed to implement response plans Cost and schedule activities needed to implement the risk responses Contingency plans Fallback plans List of residual and secondary risks Contingency reserves Residual risk Secondary risk

Outputs of planned risk responses

Project management plan updates: The management plans created to document how the schedule, budget, quality, procurement, and human resources will be defined, managed, and controlled on the project become subsidiary plans to the project management plan. Any and all of these management plans may require updates after you perform the risk processes. In addition, the WBS, the scope baseline, the schedule baseline, and cost baseline may require updates as well. Other project documents, such as technical documentation and the assumptions documented in the project scope statement, could need an update after performing these processes as well. Project documents updates: For this output, it is required to update project documents, including the risk register, technical documents, the assumptions log, and change requests. The risk register is updated at the end of this process with the information discovered during this process. The response plans are recorded in the risk register. The risk register lists the risks in order of priority (those with the highest potential for threat or opportunity first), so it makes sense that the response plans you have for these risks will be more detailed than the remaining lists. Some risks might not require response plans at all, but you should put them on a watch list and monitor them throughout the project.

Residual risk and secondary risk

Residual risks are risks that remain after risk responses have been implemented. Secondary risks are risks that come about as a result of implementing a risk response.

Inputs of planned risk responses

Risk register: It contains the results from risk identification, qualitative risk analysis, and quantitative risk analysis. Risk management plan: It is a document that a project manager prepares to foresee risks, estimate impacts, and define responses to issues.

Tools and Techniques of the Plan Risk Responses Process

Strategies for negative risks Strategies for positive risks or opportunities Contingent response strategies Expert judgment

Contingent Response Strategies

The last tool and technique of the plan risk responses process is called the contingent response strategy, better known as contingency planning. Contingency planning involves planning alternatives to deal with certain risks (such as those with accept strategies) should they occur. This is different from mitigation planning in that mitigation looks to reduce the probability of the risk and its impact, whereas contingency planning doesn't necessarily attempt to reduce the probability of a risk event or its impacts. Contingency comes into play when the risk event occurs. This implies you need to plan for your contingencies well in advance of the threat or opportunity occurring. After the risks have been identified and quantified, contingency plans should be developed and kept at the ready. Contingency reserves are a common contingency response. Contingency reserve strategies for risk events are similar to those for cost and activity durations. This may include setting aside funding, resources, or adding contingency time to the project schedule. Fallback plans should be developed for risks with high impact or for risks with identified strategies that might not be the most effective at dealing with the risk. Fallback plans are not contingency plans. When a contingency response plan is executed, but is not effective, a fallback plan may also be planned in advance for use. Fallback plans are developed as part of the risk response plan to deal with risks when the first response does not work.

Planned risk response

aims to reduce the threats to the project objectives and to increase opportunities. It follows the perform qualitative risk analysis process and perform quantitative risk analysis process. The plan risk responses process includes the risk response owner to take the job for each agreed-to and funded risk response. This process addresses the risks by their priorities, schedules the project management plan as required, and inserts resources and activities into the budget. The purpose of the plan risk responses process is to develop the risk responses for those risks with the highest threat to or best opportunity for the project objectives.