The Risk Management Plan

Question 1: What is the risk management plan?

Answer 1: The risk management plan is the comprehensive document that pulls together all the risks, assessment results, and response plans. It can be a stand-alone document, a series of smaller documents, or incorporated into the overall project plan.

Question 2: What is the format of the risk management plan?

Answer 2: The format that you choose depends upon the level of intensity of your project, the formality that is expected from a project manager, and the volume of risks that you have. The plan may be shared as a presentation, a narrative, or a simple conversation. The format is not critical, but the content is.

Question 3: What content should be included?

Answer 3: The risk management plan should contain the following information:

Risk management approach: This is a description of what “methodology” was used for the identification and assessment of the risks.
Risk listing: This is prioritized by risk score results or by probability or impact.
Risk strategies: These are descriptions of the risk prevention, impact reduction, and response planning actions. The strategies may be organized by strategy, project constraint, or priority.
Communication strategies: These are descriptions of the ways in which the risk management plan will be communicated to the organization.
Question 4: How is the risk management plan used throughout the project?

Answer 4: As the project manager, you use the risk management plan in several capacities, as follows:

During planning: You incorporate the elimination and reduction actions into your project schedules, staffing plans, budgets, vendor arrangements, and so forth.
During project execution: As risks occur during the project, you refer to the plan to execute the response plans. You also update the risk list, probabilities or impacts, and plans as the project changes and new risks present themselves.
At project closure: You review the risks, probabilities, impacts, and responses at the end of the project to determine the learnings and how to conduct better risk management on future projects.
Question 5: What are residual risks and secondary risks?

Answer 5: According to the Project Management Institute’s Project Management Body of Knowledge, secondary risks are risks arising as a direct result of implementing a risk response. Residual risks are all the risks upon which you have determined to not act. They are the risks that are the low probability or low impact as well as the risks that you have decided to accept and for which you have created response plans.

Presentation
A Comprehensive Look at Risk Management: A Case Study
Introduction

You created your risk management plan and identified the risks to the project, determined the ones to which you need to respond, and crafted your action plans. You adjusted the project schedule, changed resource assignments, put into place various agreements with vendors, and trained the team on the new processes that need to be followed.

Judith, a senior engineer, is a new member of the project team. She came to the company from a medical device manufacturing firm. You are briefing her on the project when she shares one of her past experiences with you. During the discussion, you both realize that you have potentially overlooked a significant area of risk on the project.

When Product Risk Impacts the Project

On one of Judith’s last projects, her company was audited by the government agency for adherence to the required processes. The audit identified product risk mitigation (also known as technical risk) as one of her former employer’s areas for improvement. The project team did not fully understand the impact their medical device product could have on a patient, and they were not building in safety features and controls into the product. As a result, the entire project had to be halted for 3 weeks while a technical risk assessment was completed.

During this assessment, the technical risks were identified, risk management plans were developed, and the leaders of the project and quality organizations had to attend mandatory training on the subject. It caused a major disruption to the project that had not been anticipated. Additionally, a significant amount of new product engineering had to be included to address the safety requirements that had been missed. This adversely impacted the project schedule and budget by more than 15%.

Judith strongly advises that you take the project through a technical risk assessment. It will take approximately 2 weeks, requiring full-time involvement from Judith, the lead engineer, the quality manager, the project sponsor, and you. You decide that although this is more of a requirements-gathering activity than a project management activity, you need to address this issue immediately. Also, the project has not yet started detailed requirements gathering, so the results will not incur any rework.

As your next step, you develop a short case for conducting the risk assessment and obtain approval for the activity. As you are preparing for the assessment, you realize that catching the need for the additional assessment and acting upon it will be a very good thing for the overall project. Although this will delay the start of some activities by 2 weeks, this assessment will actually eliminate several risks around scope that you had previously identified.

Click Here To Get More On This Essay!!!

Summary

After the assessment, Judith and you are reviewing the results. It turns out that the assessment uncovered several significant safety features that were needed. These would have been very costly to time and resources if they were implemented later in the project. Another finding was that the workshop approach to gathering information was highly effective. Everyone agreed to use that approach for the project, further reducing some of the scope and schedule risks. All in all, what at first appeared to be a significant risk event ended up being a significant opportunity.

Article
FAQ: Monitoring and Controlling Risk
Question 1: How do I know that a risk event has occurred?

Answer 1:

You may immediately know that a risk event has occurred if a critical resource leaves or a late vendor delivery occurs. You may also discern a risk based on your assessment of the project’s status.

For example, you may have documented a risk that increases the scope or that changes the project schedule in your risk management plan. As you monitor the project, you do not encounter a single scope change request that modifies your deliverable due dates. However, during status, you notice that all of your dates are being pushed out. You speak with your team members and determine that a series of small change requests that were approved are the cause of your delays. Thus, the cumulative result is a delay in the project. Now you have identified an occurrence of your risk and begin to enact the action plan that you identified to address this risk.

Click Here To Get More On This Essay!!!

Question 2: What do I do when a risk event occurs?

Answer 2: First, accept it. Some project managers do not like risk because it implies that they are not in control. They try to avoid acknowledging the risk hoping it will go away. Once you accept that a risk event has occurred, you leverage your action plan to determine your next steps. You also need to notify or communicate team members, implement actions, and monitor the result.

Question 3: What do I do when a risk event no longer appears to have either a probability or a significant impact?

Answer 3: As the project progresses, some risks will disappear. Their probability of occurrence will diminish or decline or will no longer have a significant impact. When this happens, you should review your project plan and determine whether any preventive measures that were put into place earlier should be removed. If so, remove these measures, and notify the team. Then, asses your project and determine whether any new risks have appeared or whether the impact and/or probability of other currently defined risks has changed.

Question 4: What do I do when the potential for a new risk arises or a risk’s probability/impact changes?

Answer 4: You follow the same thought process and conduct the same analysis that you did in the beginning of your project. You identify the risk, determine its probability, determine its impact, decide whether this is a risk you need to address, and then address it. You identify ways to eliminate the risk completely, reduce its probability, or reduce the impact when the risk occurs. You then share and communicate that information with your project team, sponsor, and key stakeholders.

Question 5: What are some common risk management roadblocks?

Answer 5:

The biggest roadblock is denial by the project manager as well as the project sponsors. Viewing risk management as a beneficial exercise minimizes this risk.

Over planning is another roadblock. Some project managers become overly focused on removing risks. This leads them to create action plans that are more robust than beneficial.

Presentation
Presentation: Risk Response
Determining the Response to Risk Events

Once the list of risks has been analyzed, you are ready to focus on those critical priority risks and determine how best to deal with them.

Reaching the Proper Level of Detail

Once a project manager starts to define how he or she is going to deal with risks, he or she needs to be sure to dive into the lower level of detail. Risk analysis at the high level of “the schedule slips significantly” is not sufficient. Risks must be attacked at the source, not merely the symptom (for example, “The vendor delivers the software late, resulting in a schedule slippage,” or “The vendor delivers flawed software requiring rework, resulting in schedule slippage.”). These samples get to a minimum basic level of cause.

Risk Response Strategies

There are three primary strategies that a project manager can use to address any risk on a project:

Minimize the probability of the risk occurring (risk prevention).
Minimize the impact if the risk occurs (impact reduction).
Determine what actions will be taken when the risk occurs (response planning).
These strategies are not used in isolation. In many cases, you will use all three of these strategies as you determine how to manage each risk.

Risk Prevention

Risk prevention is the strategy by which you identify the source of the risk and then determine what you can do to eliminate the risk. You then build those actions into your project plans and monitor them as the project progresses.

For example, you determine that one risk to the project is the vendor being late with the delivery of software customization, resulting in a schedule slippage. To prevent this situation from happening, you may choose any or all of these actions:

Build late delivery penalties into your contract with the vendor.
Choose a different vendor.
Do the customization work in-house.
Give the vendor an earlier date than you really need it (although this raises some ethical issues).
Impact Reduction

Impact reduction is the strategy of determining ways to reduce the impact of a risk when it occurs. It involves similar thinking to risk prevention, but instead of focusing on how to reduce the probability of a risk happening, the fact that the risk will occur is accepted, and mitigation strategies are determined.

Using the same example, you may decide on these actions to reduce the impact of a late delivery:

Change the order of tasks in your project schedule to make sure the vendor delivery is off the critical path.
Plan a 2-week contingency into your project schedule.
Schedule resources so they are available the moment the software arrives.
Response Planning

Response planning is the strategy to use when you determine that nothing more can or should be done to reduce the risk probability or to lessen the impact. As the project manager, you now take this time to determine what you and your team will do when the risk event happens. Response planning provides the advantage of having an organized, well-planned response as opposed to action from a “fire-fighting” mode. A response plan (sometimes known as the risk register) may be a procedure that is executed or a checklist to be followed. The amount of effort put into the creation of the response plan should be appropriate for the impact to the project.

Using our example, you may create several response plans: one for each week that the delivery is late. A response plan may contain tasks that tell the team what tasks to execute, what to communicate to management, and how to adjust the project schedule to avoid further delays.

Summary

Determining the appropriate strategy requires an understanding of each risk, the sources of the risk, and the various ways in which each may be addressed.

Click Here To Get More On This Essay!!!

Activity
Activity: Analyzing Risks
You have been hired as a project risk manager for a fund-raising Radio-A-Thon. Your major responsibility is to manage the risks for this project. A list of risks has already been identified for the project.

Study the project scenario and additional notes. Review the risks identified for this project.

You will work through the risks that are inherent to this project and determine the optimal strategy for minimizing the impact and potential of occurrence for each risk. Your treatment of risks will determine your overall project success.

Scenario
Koch Medical Center, located in the heart of Chicago, Illinois, is adding a new children’s medical wing. The primary benefactor, Lisa Stanfield, has generously donated $7 million to break ground on development of this new facility. However, the Medial Center will need to raise approximately $15 million over the next 3 years to complete the project.

You have been hired by Shawn Hankins, Director of the new children’s hospital wing, as a project risk manager. Your responsibility will be to oversee a Radio-A-Thon that will take place in 9 months. The Radio-A-Thon will be held over a 3-day weekend the first week in December. The committee seeks to raise $1.5 million during this event. December tends to be cold, windy, and sometimes snowy in the Midwest. Most individuals are getting ready for the upcoming holidays.

You have reviewed the project charter and project plan. A budget of $150,000 has been allocated for this event. Funds for the budget include marketing and television advertising fees, set-up of telephone stations to accept phone call donations, and food and supplies for all volunteers during the event.

WBEX, a local, well-recognized, and highly regarded radio station, has sponsored this event for the Medical Center in the past. As a donation to the hospital, all air time fees, DJ salaries, etc. are complimentary. The radio station will host the hospital’s Radio-A-Thon event this year as well.

The Radio-A-Thon will be held in the lobby of the main medical building.
Before you can begin to identify and analyze any risks, you will need to consider the goals of this project and identify the key stakeholders.

Additional Scenario Notes

Last fundraiser:

Scheduled in September
Event located in main hospital lobby
Used dock located by main hospital lobby
Volunteer food catered by Dog’s N’ More—the owner of this establishment is close friends with the Director of the Hospital
This year’s fundraiser:

Event located in Woman’s Center—next to the new children’s wing that is being constructed
Main loading dock will be used but will not have access to the entire dock because construction is underway.
Dog’s N’ More is under new management
You and your team have already analyzed and documented the following project risks:

insufficient space for the radio station and camera crew
insufficient space requirements for phone set-up and volunteer seating
insufficient quantity of volunteers recruited to handle phones
volunteer no shows
insufficient budget for phone set-up, advertising, supplies, food, and administrative costs
other Outreach or Marketing-sponsored events to impact the Radio-A-Thon
insufficient loading area for radio station, camera, and telephone crew
insufficient time for Marketing to create a marketing campaign
secure personal space for volunteers
impact on traffic flow through the lobby during the event
security breach on hospital grounds
radio station sponsoring event airs advertising or programming that results in rejection of sponsorship
inclement weather prevents trucks and volunteers from coming to Radio-A-Thon
All of the following questions are multiple choice questions. Choose the correct answer from the choices given.

Risk 1: insufficient space for the radio station and camera crew

Contact the radio station to obtain information on camera crew’s space requirements and base your estimates on their needs.
Allocate the largest amount of space possible.
Estimate space needs based on last year’s Radio-A-Thon fundraiser.
Answer: The optimal strategy to implement for this risk would be: A. A good strategy will be to contact the radio station to determine their space needs. Although you can base it on last year’s space requirements, you will need to account for any changes to this year’s event.

Risk 2: insufficient space requirements for phone set-up and volunteer seating

Speak with the VP of fundraising to obtain an estimate of volunteers based on last year and allocate the maximum space possible so the most volunteers are recruited.
Speak with VP of Fundraising to obtain an estimate of volunteers last year and target the same number this year.
Speak with VP of Fundraising to obtain an estimate of volunteers. Based on last year’s event, analyze data and base you requirements on this year’s fundraising parameters.
Answer: The optimal strategy to implement for this risk would be: C. You should take historical data into account, but also be sure to consider any changes to this year’s event and make the appropriate modifications.

Risk 3: volunteer no show

Estimate 10% of volunteers as no shows and build this percentage into your target number of volunteers recruited.
Estimate the number of volunteers as no shows based on last year’s data. Build this percentage into your target number for this year. Develop a secondary plan to recruit hospital administrative staff to help with phones in the event of an emergency.
Estimate the number of volunteers as no shows using last year’s data. Build this percentage into your target number of volunteers recruited.
Answer: The optimal strategy to implement for this risk would be: B. You definitely want to consider the volunteer data from last year, but you need to assess this year’s conditions and account for any differences. Having a secondary emergency plan is also helpful.

Risk 4: insufficient quantity of volunteers recruited to handle phones

Speak with VP of Fundraising to obtain an estimate of volunteers last year. Base this year’s number of volunteers needed on last year’s data.
Speak with VP of Fundraising to obtain an estimate of volunteers attending last year’s event and analyze data and base your requirements on this year’s fundraising parameters.
Gather data from other similar fundraisers in the area and base the number of volunteer needs on your analysis.
Answer: The optimal strategy to implement for this risk would be: B. You definitely want to speak with the VP of Fundraising to get a sense of last year’s volunteer efforts. However, you need to account for this year’s goals in your estimation.

Risk 5: insufficient budget for phone set-up, advertising, supplies, food, and administrative costs

Consult with the VP of Fundraising and base this year’s budget on last year’s fundraiser.
Consult with the VP of Fundraising and use last year’s budget as a starting point. Adjust the budget in accordance with this year’s fundraising goals.
Begin with last year’s budget as a starting point and adjust the budget in accordance with this year’s fundraising goals. Monitor expenses against the budget throughout the project.
Answer: The optimal strategy to implement for this risk would be: C. Leveraging last year’s budget, modifying it to this year’s fundraising needs, and actively monitoring the budget to ensure that overages do not occur is the optimal strategy for managing this part of the project’s risk.

Risk 6: other Outreach or Marketing-sponsored events to impact the Radio-A-Thon

Meet with the head of the Community Outreach program to determine what events will be taking place locally and within the vicinity of the hospital that may potentially impact the fundraiser.
Inform the head of Community Outreach about the fundraising event logistics. Offer to answer any additional questions that this individual may have about the event.
Answer: The optimal strategy to implement for this risk would be: A. It is extremely important to contact the head of the Community Outreach program to get a sense of the events taking place locally or on hospital grounds that may have an impact on the fundraiser. By reaching out to this individual or group, they can keep you apprised of any new events scheduled to take place.

Risk 7: insufficient loading area for radio station, camera, and telephone crew

Inform radio station of loading dock space location and availability.
Contact radio station to inquire about loading dock needs, follow up with VP of Fundraising to assess last year’s loading dock situation, and determine this year’s needs.
Contact radio station to inquire about loading dock needs and inform them of the space availability this year.
Answer: The optimal strategy to implement for this risk would be: B. You need to consider the loading dock from all angles. Contacting the radio station will allow you to assess their needs and learn about any issues that the crew experienced last year. Meeting with the VP of Fundraising to discuss any issues with the loading dock last year will round out your analysis. Furthermore, it will provide you with an avenue during which you can express any concerns and brainstorm resolutions.

Click Here To Get More On This Essay!!!

Risk 8: insufficient time for Marketing to create a marketing campaign

E-mail the head of marketing to request an advertising plan similar to last year’s fundraiser.
E-mail the head of marketing to request that they work with the radio station to develop a comprehensive advertising plan.
E-mail the head of marketing to schedule a meeting to discuss last year’s advertising efforts, while also considering ways to leverage the advertising capability available through the radio station.
Answer: The optimal strategy to implement for this risk would be: C. You definitely want to meet with the marketing group to clarify what was done with last year’s marketing effort, consider any changes to this year’s marketing effort, and brainstorm ways to leverage the radio station for advertising.

Risk 9: secure personal space for volunteers

Request that volunteers leave their personal valuables at home.
Inform volunteers to keep their personal belongings by their side at the day of the event.
Meet with the VP of Fundraising and hospital security to determine the area that was secured for volunteers’ personal valuables last year, figure out the impact of this on the fundraiser, and brainstorm ideas for this year’s fundraiser.
The optimal strategy to implement for this risk would be: C. You must consider your options for obtaining secure space for volunteers. Although you may need to inform volunteers to keep their belongings by their side, at the very least, you made the effort to address any security concerns.

Risk 10: impact on traffic flow through the lobby during the event

Meet with VP of Fundraising to analyze the impact of increased traffic flow during last year’s fundraiser and assume the same will be true for this year.
Meet with VP of Fundraising to analyze the impact of last year’s fundraiser on lobby traffic flow. Brainstorm ideas for modifications/improvements this year.
Meet with VP of Fundraising and key stakeholders to analyze the impact of increased traffic flow during last year’s fundraiser. Brainstorm ideas for modifications based on last year’s fundraising efforts and account for any changes planned to this year’s event.
Answer: The optimal strategy to implement for this risk would be: C. Meeting with the VP and critical stakeholders to analyze the impact of last year’s fundraiser on the lobby traffic will provide additional resources from which you can draw upon for experience. Additionally, accounting for any changes to this year’s event will help you generate a holistic assessment of the situation.

Risk 11: security of building on day of event

Follow hospital security codes.
Discuss security needs with head of the security department. During your discussion, bring up last year’s fundraiser and inquire about any issues that occurred last year that should be considered for this year’s event.
Discuss security needs with head of the security department and internal project stakeholders. During your discussion, bring up last year’s fundraiser and inquire about any issues that occurred last year that should be considered for this year’s event.
Answer: the optimal strategy to implement for this risk would be: B. Meet with the head of security to learn about potential security issues and plan for security at this year’s event. Additionally, involving key internal stakeholders will account for any issues that may have come up last year.

Risk 12: radio station sponsoring event airs advertising or programming that results in hospital’s rejection of sponsorship

Develop a list of alternate radio stations to approach for sponsorship of the Radio-A-Thon event. Set an end date for when alternate sponsorship would not be an option because it would jeopardize the project.
Determine an alternate date to hold the fundraiser if it needed to be rescheduled with another radio station sponsor.
Nothing can be done should this happen; the entire fundraiser will need to be rescheduled for next year.
Answer: The optimal strategy to implement for this risk would be: B. Setting an end date will help you determine whether having another radio station sponsor the event would be feasible.

Risk 13: inclement weather prevents trucks and volunteers from coming to Radio-A-Thon

Determine an alternate date to hold the fundraiser.
Develop an emergency plan with radio station crew and monitor the weather as the date for the fundraiser nears. If safety of individuals is compromised due to inclement weather, plan on canceling or rescheduling the event.
Nothing can be done if this happens; the entire fundraiser will need to be rescheduled for next year.
Answer: The optimal strategy to implement for this risk would be: B. If you know that the risk for inclement weather exists, although minimal, it is still good to have a game plan in place in the event an emergency such as this does arise.

Conclusion: Great job in working through and analyzing the risks and appropriate contingency plans for addressing each risk!

Activity
Project Risk Management Perspectives
Apply your risk management learning by walking through the process of risk identification, assessment, and response and control for an IS product development project. The project is being carried out in a company that conducts several projects simultaneously.
Activity 1: Asking the Right Questions: Risk Identification

Give one question for each of the following areas to help identify some of the project risks. Good answers will be provided, but there are other possible answers also.
Question 1: Design.

An answer to question 1 is, “Are the design/capability expectations realistic?”
Question 2: Testing.

An answer to question 2 is, “Are staff definitely available for testing in the time we need them?”
Question 3: Schedule.

An answer to question 3 is, “Is our timeline dependent on other projects?”
Question 4: Budget.

An answer to question 4 is, “Can we count on the estimates’ accuracy?”
Question 5: Quality.

An answer to question 5 is, “Do design plans already consider quality issues?”
Question 6: Management.

An answer to question 6 is, “Are accountability and responsibility structures clear?”
Question 7: Human resources.

An answer to question 7 is, “What is the actual skill level of our available staff?”
Question 8: Vendors/contractors.

An answer to question 8 is, “How does the anticipated actual performance of these vendors line up with our expectations?”

Click Here To Get More On This Essay!!!
Activity 2: Risk Assessment
Assess the risks uncovered in the risk identification process by calculating their risk using the P-I scale information given for each. The company’s risk tolerance level is 0.12. (Hint: Multiply probability and cost and compare to the company’s risk tolerance level.) Indicate by responding “no” for any that would be unacceptable (red zone) to the company and must be priority for risk treatment. Indicate “yes” for any that are acceptable.

Question 9: Probability of costs for aspects of programming the new product to be much higher than budget is moderate, and impact to the project is high.

P-I scale indicates that moderate probability is 0.05 and high impact is 0.04.

Is this risk level acceptable?

The answer to question 9 is no, 0.02 exceeds the tolerance level of 0.12.
Question 10: Probability that skill level of some human resources is insufficient is very low, and impact to the project is high.

P-I scale indicates that very low probability is 0.01 and high impact is 0.04.

The answer to question 10 is yes, this is acceptable.
Question 11: Probability of testers not being available when needed is moderate, and impact to the project is moderate.

P-I scale indicates that moderate probability is 0.05 and moderate impact is 0.02.

The answer to question 11 is yes, the risk level is acceptable.

Question 12: Probability of appearance of quality issues requiring rework time is low, and impact is very high.

P-I scale indicates that low probability is 0.03, and very high impact is 0.09.

The answer to question 12 is no, this exceeds the tolerance level.

Activity 3: Multiple choice: Categories in the change control form.

The risks you analyzed for this project included costs for aspects of programming the new product that could be higher than budget. The risk has become a reality, and you are pursuing an alternative to programming. Begin executing your Risk Response Control Plan through the Change Control Form.

Under “description of change” on the change control form, you have written, “Install XP compatible chip to product.” Under justification, you have written, “Eliminating programming costs by chip install saves $18K.”
To what category on the Change Control Form does each of the following belong?

Click Here To Get More On This Essay!!!

Question 13.Organization unit.