Risk Management

Plan Risk Management

Plan Risk Management is the process of defining how to conduct risk management activities for a project. It produces the risk management plan, which guides all subsequent risk processes.

Risk Management Plan

The risk management plan is a component of the project management plan that describes how risk management activities will be structured and performed. It is the output of the Plan Risk Management process.

Identify Risks

Identify Risks is the process of determining which risks may affect the project and documenting their characteristics. It is performed iteratively throughout the project.

Risk Register

The risk register is a project document that records the details of individual project risks, including their identification, analysis results, response plans, and current status.

Risk Report

The risk report is a project document that presents information on overall project risk as well as summary information on individual risks. It is progressively developed throughout the risk management processes.

Perform Qualitative Risk Analysis

Perform Qualitative Risk Analysis is the process of prioritizing individual project risks by assessing their probability of occurrence and impact on project objectives.

Probability and Impact Matrix

The probability and impact matrix is a grid that maps the probability of a risk occurring against its potential impact on project objectives, producing a risk score used to prioritize risks.

Risk Categorization

Risk categorization is the grouping of risks by their source, affected area, or other useful criteria to identify concentrations of risk exposure and common root causes.

Risk Breakdown Structure (RBS)

A risk breakdown structure (RBS) is a hierarchical representation of potential sources of risk, organized by category and subcategory, used to structure and guide the risk identification process.

Perform Quantitative Risk Analysis

Perform Quantitative Risk Analysis is the process of numerically analyzing the combined effect of identified individual risks and other sources of uncertainty on overall project objectives.

Monte Carlo Simulation

Monte Carlo simulation is a quantitative risk analysis technique that uses random sampling of probability distributions for cost and schedule estimates to model possible project outcomes and calculate the probability of achieving targets.

Sensitivity Analysis (Tornado Diagram)

Sensitivity analysis is a quantitative technique that determines which individual risks or uncertainties have the greatest potential impact on project outcomes. The tornado diagram is its primary visual output.

Expected Monetary Value (EMV)

Expected monetary value (EMV) is a quantitative risk analysis technique that calculates the average outcome of a risk event by multiplying the probability of occurrence by the monetary impact. EMV for threats is negative; for opportunities, it is positive.

Decision Tree Analysis

Decision tree analysis is a diagramming and quantitative technique used to evaluate multiple decision alternatives, each with associated costs, probabilities, and outcomes, to select the option with the best expected monetary value.

Plan Risk Responses

Plan Risk Responses is the process of developing options, selecting strategies, and agreeing on actions to address overall project risk exposure and to treat individual project risks.

Risk Response Strategies for Threats

Risk response strategies for threats are the five approaches available to address negative risks: avoid, mitigate, transfer, accept, and escalate. Each strategy aims to reduce the probability, impact, or exposure of a threat.

Avoid (Risk Strategy)

Avoid is a threat response strategy that eliminates the threat by changing the project management plan to remove the risk entirely, protect the project objectives, or relax the objective that is at risk.

Mitigate (Risk Strategy)

Mitigate is a threat response strategy that reduces the probability of occurrence and/or the impact of a threat to within acceptable limits. The risk is not eliminated but brought to a manageable level.

Transfer (Risk Strategy)

Transfer is a threat response strategy that shifts the negative impact and ownership of a threat to a third party. The risk is not eliminated but the responsibility for managing it moves to another entity.

Accept (Risk Strategy)

Accept is a risk response strategy where the project team acknowledges a risk but takes no proactive action to address it. Acceptance can be passive (do nothing) or active (establish a contingency reserve or plan).

Escalate (Risk Strategy)

Escalate is a risk response strategy used when a risk is outside the scope or authority of the project team. The risk is transferred upward to a program, portfolio, or organizational level where it can be effectively managed.

Risk Response Strategies for Opportunities

Risk response strategies for opportunities are the five approaches used to address positive risks: exploit, enhance, share, accept, and escalate. Each strategy aims to increase the probability, impact, or both of a beneficial risk event.

Exploit (Opportunity Strategy)

Exploit is an opportunity response strategy that ensures the positive risk is realized by eliminating the uncertainty associated with the opportunity. It is the most aggressive opportunity strategy.

Enhance (Opportunity Strategy)

Enhance is an opportunity response strategy that increases the probability and/or positive impact of an opportunity. Unlike exploit, it does not guarantee the opportunity will occur.

Share (Opportunity Strategy)

Share is an opportunity response strategy that allocates ownership of an opportunity to a third party who is best able to capture the benefit for the project. It is the opportunity equivalent of the threat strategy "transfer."

Implement Risk Responses

Implement Risk Responses is the process of executing the agreed-upon risk response plans. It ensures that risk responses are carried out as planned, with the goal of minimizing threats and maximizing opportunities.

Monitor Risks

Monitor Risks is the process of monitoring the implementation of agreed-upon risk response plans, tracking identified risks, identifying and analyzing new risks, and evaluating risk process effectiveness throughout the project.

Risk Triggers

Risk triggers (also called risk symptoms or warning signs) are events or conditions that indicate a risk is about to occur or has already occurred. They signal the need to activate a risk response.

Workarounds

Workarounds are unplanned responses to risks that were not previously identified or to risks for which no planned response was adequate. They are developed in the moment when a risk event occurs without a contingency plan.

Secondary Risks and Residual Risks

Secondary risks are new risks that arise as a direct result of implementing a risk response. Residual risks are risks that remain after planned responses have been implemented, including minor risks that were deliberately accepted.