RMP® Certification Course

Lesson 10—Control Risks

Based on the Project Management Institute, A Guide to the Project Management Body of Knowledge
(PMBOK® Guide) ― Fifth Edition and The Practice Standard for Project Risk Management.
RMP and PMBOK are the registered marks of Project Management Institute, Inc.
© Copyright 2014, Simplilearn, All rights reserved.
© Copyright 2014, Simplilearn, All rights reserved. 1
Objectives

After completing ● Explain the purposes and objectives

this lesson, you will
be able to: ● Identify the critical success factors

● Describe the inputs, tools and techniques, and outputs

● Discuss how to document the results

● Describe risk audits

© Copyright 2014, Simplilearn, All rights reserved. 2

Purposes and Objectives

The primary objectives of Control Risks process are as follows:

Monitoring residual Ensuring risk response

Tracking identified risks Identifying new risks
risks plans are implemented

Monitoring the Reviewing the

Making improvements
effectiveness of risk effectiveness of risk
to the process
response plans management processes

For each risk where a contingent response is identified, the corresponding trigger conditions should
be specified. Risk owners should monitor the implementation in a timely manner.

© Copyright 2014, Simplilearn, All rights reserved. 3

Purposes and Objectives (contd.)

Once the Plan Risk Responses process is complete, all the approved unconditional response actions
should be included and defined in the risk register.

● The first action then is to check if it has been completed and take action as necessary, such as
invoking change management process if required.

● Effective communication needs to be maintained between them and the project manager, so that
the respective stakeholders accept the accountability.

● In addition to the response actions and trigger conditions, a mechanism for measuring the
effectiveness of the response is provided by the Plan Risk Responses process.

● In the event of major organizational changes, risk management planning may need to be revised.

© Copyright 2014, Simplilearn, All rights reserved. 4

Critical Success Factors

Following are the critical success factors for Control Risks process:

Integrate Risk Monitoring and Control with Project Monitoring and Control +
Continuously Monitor Risk Trigger Conditions +
Maintain Risk Awareness +

© Copyright 2014, Simplilearn, All rights reserved. 5

Critical Success Factors

Following are the critical success factors for Control Risks process:

Integrate Risk Monitoring and Control with Project Monitoring and Control -
● Project management plan should address actions used to carry out and control
risks.
● After the risk response plan, monitoring and controlling of risks should be carried
out as a part of the monitoring and controlling of project.

Continuously Monitor Risk Trigger Conditions +

Maintain Risk Awareness +

© Copyright 2014, Simplilearn, All rights reserved. 6

Critical Success Factors

Following are the critical success factors for Control Risks process:

Integrate Risk Monitoring and Control with Project Monitoring and Control +
Continuously Monitor Risk Trigger Conditions +
● Specifically defined risks may trigger conditional responses by the risk action
owner in collaboration with the risk owner.

Maintain Risk Awareness -

© Copyright 2014, Simplilearn, All rights reserved. 7

Critical Success Factors

Following are the critical success factors for Control Risks process:

Integrate Risk Monitoring and Control with Project Monitoring and Control +
Continuously Monitor Risk Trigger Conditions +
Maintain Risk Awareness -
● Risk management report should be a regular item on every status meeting to
create awareness about risk management and its importance.
● Regular reports on risks should be shared with the senior-level sponsor and the
stakeholders.

© Copyright 2014, Simplilearn, All rights reserved. 8

Inputs, Tools and Techniques, and Outputs

Following are the inputs, tools and techniques, and outputs required for Control Risks process:

Inputs Tools and Techniques Outputs

● Risk register ● Risk reassessment ● Work performance
● Project management plan ● Risk audits information
● Work performance data ● Variance and trend analysis ● Organizational process assets
● Work performance reports ● Technical performance updates
measurement ● Change requests
● Reserve analysis ● Project management plan
● Meetings updates
● Project document updates

© Copyright 2014, Simplilearn, All rights reserved. 9

Inputs

Following are the inputs for Control Risks process:

Inputs Description

Identifies risks, risk owners, actions to respond to risks, characteristics of risks, and a watch-list of
Risk register
risks of low priority.

Project management Contains risk management plan which includes risk tolerances, risk owners, protocols, human
plan resources, time, and other resources allocated for project risk management.

Provides items related to project performance results, which may be impacted by risks such as
Work performance data
deliverable status, progress with respect to schedule, and cost incurred to accomplish the work.

Work performance Provides information on project work performance that may affect the processes of risk
reports management or the actual occurrence of risk.

© Copyright 2014, Simplilearn, All rights reserved. 10

Tools and Techniques

Following are the tools and techniques of Control Risks process:

Technical
Variance and trend
Risk reassessment Risk audits performance Reserve analysis
analysis
measurement

Risk reassessment is the identification of new risks, reassessment of current risks, and the closing of risks that are
outdated.

© Copyright 2014, Simplilearn, All rights reserved. 11

Tools and Techniques

Following are the tools and techniques of Control Risks process:

Technical
Variance and trend
Risk reassessment Risk audits performance Reserve analysis
analysis
measurement

Risk audits examine and document the effectiveness of risk responses in dealing with identified risks.

© Copyright 2014, Simplilearn, All rights reserved. 12

Tools and Techniques

Following are the tools and techniques of Control Risks process:

Technical
Variance and trend
Risk reassessment Risk audits performance Reserve analysis
analysis
measurement

Variance analysis is used to compare the planned results to the actual results. Trends in the project’s execution
should be reviewed using performance information.

© Copyright 2014, Simplilearn, All rights reserved. 13

Tools and Techniques

Following are the tools and techniques of Control Risks process:

Technical
Variance and trend
Risk reassessment Risk audits performance Reserve analysis
analysis
measurement

Technical performance measurement compares technical accomplishments during project execution to the
schedule of technical achievement.

© Copyright 2014, Simplilearn, All rights reserved. 14

Tools and Techniques

Following are the tools and techniques of Control Risks process:

Technical
Variance and trend
Risk reassessment Risk audits performance Reserve analysis
analysis
measurement

Reserve analysis compares the amount of the contingency reserves remaining to the amount of risk remaining at
any time in the project.

© Copyright 2014, Simplilearn, All rights reserved. 15

Other Tools and Techniques

A few other tools and techniques of Control Risk process are as follows:

Managing
Tracking trigger Tracking overall Tracking
Meeting contingency
conditions risk compliance
reserve

Management reserve for unplanned changes to time, scope, and cost.

© Copyright 2014, Simplilearn, All rights reserved. 16

Other Tools and Techniques

A few other tools and techniques of Control Risk process are as follows:

Managing
Tracking trigger Tracking overall Tracking
Meeting contingency
conditions risk compliance
reserve

Tools are required to identify trends and forecast future outcomes, and to track the progress and spending.

© Copyright 2014, Simplilearn, All rights reserved. 17

Other Tools and Techniques

A few other tools and techniques of Control Risk process are as follows:

Managing
Tracking trigger Tracking overall Tracking
Meeting contingency
conditions risk compliance
reserve

Tools are required to evaluate and track trigger conditions against the project thresholds based on the actual
status. This provides risk-related information for the project parameters such as time and cost.

© Copyright 2014, Simplilearn, All rights reserved. 18

Other Tools and Techniques

A few other tools and techniques of Control Risk process are as follows:

Managing
Tracking trigger Tracking overall Tracking
Meeting contingency
conditions risk compliance
reserve

Tools are required to determine whether the responses have the expected effect on the project’s overall level of
risk.

© Copyright 2014, Simplilearn, All rights reserved. 19

Other Tools and Techniques

A few other tools and techniques of Control Risk process are as follows:

Managing
Tracking trigger Tracking overall Tracking
Meeting contingency
conditions risk compliance
reserve

Quality of execution of risk related plans and process are monitored against the metrics, to see if there is any
variation.

© Copyright 2014, Simplilearn, All rights reserved. 20

Outputs

Following are the outputs of Control Risk process:

Outputs Description

Work performance
Provides a mechanism to communicate and support project decision-making.
information

Organizational process Project risk management processes should be documented in the organizational process
assets updates assets as references for future projects.

Anything that deviates from the project baseline results in changes to the project management
Change requests
plan.

Project management The project management plan needs to be revised and reissued, if there is any approved
plan updates change which has an effect on risk management processes.

Project document Various project documents that require updates include the assumptions log, the technical
updates documentation, the contract terms, and the schedule and cost baselines.

© Copyright 2014, Simplilearn, All rights reserved. 21

Risk Audits

Risk audits help in examining the following:

Team's ability to identify Effectiveness of risk

Performance of risk owners
risks and causes for the risks response plans

Risk audits may be performed by

● a third party,

● a project's risk officer, or

● a qualified personnel.

© Copyright 2014, Simplilearn, All rights reserved. 22

Risk Reassessment

The process of reassessing the risks in a project risk register includes the following:

Identify new risks and Reassess current risks Close outdated risks
determine responses for their probability
and impact

© Copyright 2014, Simplilearn, All rights reserved. 23

Risk Audit—Guidelines

Guidelines for conducting risk audit are as follows:

Understand risk management Review the risk

rules and process management plan

Assess stakeholder tolerance

General risk management
and risk impact definitions

Document the Create reports and

identified results submit for approval

Make recommendations for improvement

© Copyright 2014, Simplilearn, All rights reserved. 24

Risk Audits—Example

During execution late into a project, the Project Manager (PM) feels that he is constantly
reacting to risk events that should have been identified early. Each time a risk event occurs,
he is asked by upper management why this risk was not identified proactively, analyzed,
and a response plan designated.

Concerned with this rising trend of missed risks, he calls for a team meeting to discuss the
issue. During the conversation, one of the team members suggests that a risk audit might
be appropriate under the circumstances, and the PM agrees.
The team then conducts the risk audit by using the steps within the audit format that had
been defined in the risk plan.

© Copyright 2014, Simplilearn, All rights reserved. 25

Risk Audits—Example (contd.)

After the audit is complete it is obvious that the team has been using a flawed risk plan.
The original plan was biased and caused the team to subjectively miss an entire category of
risks, which have now began to occur while in execution.

With this problem identified, the PM immediately updates the risk plan and all the
supporting documentation. He then instructs the team to begin risk reassessment in an
effort to identify risks in a proactive manner. The PM also informs upper management
about the audit conclusions and the new focus on risk.

© Copyright 2014, Simplilearn, All rights reserved. 26

Trend Analysis

Trend analysis involves reviewing the various trends in project performance on a regular basis.

Trend analysis examines project performance over time to determine whether performance is
improving or deteriorating.

This technique helps in reviewing the various trends in project performance on a regular basis, and it
can also be used to predict future performance.

© Copyright 2014, Simplilearn, All rights reserved. 27

Variance Analysis

Variance analysis is the measurement of deviation from expected results, or the analysis of variance
from the planned and the actual risk impacts.

On the basis of variance analysis, corrective action is taken for the progress of the project.

© Copyright 2014, Simplilearn, All rights reserved. 28

Variance and Trend Analysis—Example

During a routine risk reassessment meeting with the team, Sonny is alerted to a potential
problem by a team member. It seems that the same risk is reoccurring in a technical area of
the project. This area is critical to the success of the project and has a predetermined data
throughput speed that is a quality requirement from an internal customer.

Sonny instructs the team members to pull the test data from the previous test and
inspection paperwork so they can compare these technical measurements over a span of
time.

After compiling the data, it is evident that the risk does in fact seem to occur 24 hours after
each finalized test. Perplexed by this strange phenomenon, Sonny and his team members
investigate further by using variance and trend analysis.

© Copyright 2014, Simplilearn, All rights reserved. 29

Variance and Trend Analysis—Example (contd.)

It appears that every server has suffered this same problem over the last month and no one
had noticed the trend. As every server seems to be affected, Sonny and the team are able
to trace them all to a common cause.

They are all pulling power from the same power bay which has begun exceeding the
maximum capacity in the last month. Apparently, no one thought to check to see if there
would be enough available power for the new servers.

After discovering this problem, Sonny determines several courses of action, submits a
change request, which is approved and performs a minor upgrade on the power bay
distribution breakers to handle this increase power requirement.

© Copyright 2014, Simplilearn, All rights reserved. 30

Technical Performance Measurement

The definition of technical performance measurement is as follows:

Technical performance measurement is a comparison of the project's actual technical

accomplishments to the planned technical objectives as outlined in the project management plan.

Technical performance measurement helps to determine if the technical targets can be achieved.

© Copyright 2014, Simplilearn, All rights reserved. 31

Critical Chain Project Management

Critical Chain Project Management (CCPM) is a method that allows the project team to place buffers
on any path to account for limited resources and other types of risk. A buffer is a non-work schedule
activity with a duration based on the risk for that path. A resource constrained critical path is referred
as a critical chain.

An example of CCPM is illustrated below:

Activity Activity Feeding

A D Buffer

Activity Activity Activity Activity Project

Start B E F F Buffer Finish

Activity Feeding
C Buffer

© Copyright 2014, Simplilearn, All rights reserved. 32

Reserve Analysis

Reserve analysis refers to, identifying and adding the following:

Extra time and money

Extra time and money for identified and unidentified risk.

Contingency reserve

Contingency reserve for scheduled risk.

Management reserve

Management reserve for unplanned changes to time, scope, and cost.

© Copyright 2014, Simplilearn, All rights reserved. 33

Status Meetings

Status meetings are conducted to discuss the current status of the project with the project team
members and the stakeholders.

The project manager should include the following for status meetings:

Agenda Items for Status Meetings

Examining the status

Identifying and Identifying risks that Identifying risks that
of risks and risk
managing risks are of high priority need to be closed
responses

Analyzing the
Discussing the
effectiveness of risk
lessons learned
responses

© Copyright 2014, Simplilearn, All rights reserved. 34

Evaluating Project Risks and Risk Status

Evaluating the status of risks include the following:

Monitor Identify Update

Monitor the existing status of each risk event in the risk register.

© Copyright 2014, Simplilearn, All rights reserved. 35

Evaluating Project Risks and Risk Status

Evaluate the status of risks include the following:

Monitor Identify Update

Identify risk events whose status may be changed based on their status at the time of evaluating risks.

© Copyright 2014, Simplilearn, All rights reserved. 36

Evaluating Project Risks and Risk Status

Evaluate the status of risks include the following:

Monitor Identify Update

Update the risk register by modifying the appropriate status of each risk event.

© Copyright 2014, Simplilearn, All rights reserved. 37

Historical Documentation

One invaluable source of information for a project is any available data on

previous projects that were similar to the current one. There are many
risks that will reoccur from one project to the next.
To capitalize on lessons learned, you will need access and it must be well
structured.
Examples of historical documentation includes previous:
● risk plans,
● risk registers,
● contracts,
● project post-mortem documentation,
● change requests,
● cost and time estimates, etc.

© Copyright 2014, Simplilearn, All rights reserved. 38

Documenting the Results

The final control action of risk controlling is to record the actual data for future use.

Some documented risk management information includes the following:

Occurrence of Effectiveness of risk Unexpected or

risk responses undocumented risk

© Copyright 2014, Simplilearn, All rights reserved. 39

 Quiz

© Copyright 2014, Simplilearn, All rights reserved. 40

 QUIZ Which of the following processes involves choosing the alternative strategies, executing
a contingency or fallback plan, taking corrective action, and modifying the project
1 management plan?

a. Control risk

b. Risk response plan

c. Scope control

d. Integrated change control

© Copyright 2014, Simplilearn, All rights reserved. 41

 QUIZ Which of the following processes involves choosing the alternative strategies, executing
a contingency or fallback plan, taking corrective action, and modifying the project
1 management plan?

a. Control risk

b. Risk response plan

c. Scope control

d. Integrated change control

Answer: a.

Explanation: Control Risk process takes care of choosing alternative strategies, executing
fallback plan, taking corrective action, and modifying the project management plan.
© Copyright 2014, Simplilearn, All rights reserved. 42
 QUIZ
Which of the following is not a tool or technique of Control Risks?
2

a. Bringing in an outside party to review your risk response strategies

b. Revisiting your risk register to review and reassess risks

c. Using earned value analysis to find variances that point to

potential project problems

d. Gathering information about how the work is being performed

© Copyright 2014, Simplilearn, All rights reserved. 43

 QUIZ
Which of the following is not a tool or technique of Control Risks?
2

a. Bringing in an outside party to review your risk response strategies

b. Revisiting your risk register to review and reassess risks

c. Using earned value analysis to find variances that point to

potential project problems

d. Gathering information about how the work is being performed

Answer: d.

Explanation: Gathering information about how the work is being performed is not a tool or
technique of Control Risks.
© Copyright 2014, Simplilearn, All rights reserved. 44
 QUIZ
Which one of the following is not an output of Control Risk process?
3

a. Organizational process assets updates

b. Risk register updates

c. Variance and trend analysis

d. Change requests

© Copyright 2014, Simplilearn, All rights reserved. 45

 QUIZ
Which one of the following is not an output of Control Risk process?
3

a. Organizational process assets updates

b. Risk register updates

c. Variance and trend analysis

d. Change requests

Answer: c.

Explanation: Variance and trend analysis is the tool and technique used in Control Risk
process. Rest of them are output of this process.
© Copyright 2014, Simplilearn, All rights reserved. 46
 QUIZ Every status meeting should have time allotted for risk monitoring and control. Which
4 of the following sentences about risk monitoring and control is not true?

a. Risk identification and monitoring should occur throughout the life of the
project.
b. Risk audits randomly occur.

c. Risks should be monitored for their status and to determine whether the
impacts to the objectives have changed.
d. Technical performance measurement variances may indicate that a risk is
looming and should be reviewed at status meetings.

© Copyright 2014, Simplilearn, All rights reserved. 47

 QUIZ Every status meeting should have time allotted for risk monitoring and control. Which
4 of the following sentences about risk monitoring and control is not true?

a. Risk identification and monitoring should occur throughout the life of the
project.
b. Risk audits randomly occur.

c. Risks should be monitored for their status and to determine whether the
impacts to the objectives have changed.
d. Technical performance measurement variances may indicate that a risk is
looming and should be reviewed at status meetings.
Answer: b.
Explanation: The auditing happens as per the predefined period, and when the auditing
happens, risk auditing may become part of it. The frequency of auditing is less compared to
the status meeting in which identification and monitoring of risk happens.
© Copyright 2014, Simplilearn, All rights reserved. 48
 QUIZ
During the risk control, the risk response owner should be:
5

a. Identifying which risks he/she wants to monitor

b. Controlling the identification of response strategies

c. Informing the project manager of any mid-course correction needed

d. Updating stakeholders of new strategies for mitigating risks

© Copyright 2014, Simplilearn, All rights reserved. 49

 QUIZ
During the risk control, the risk response owner should be:
5

a. Identifying which risks he/she wants to monitor

b. Controlling the identification of response strategies

c. Informing the project manager of any mid-course correction needed

d. Updating stakeholders of new strategies for mitigating risks

Answer: c.

Explanation: The risk response owner is assigned to carry out responses and must keep the
project manager informed of any mid-course correction needed.
© Copyright 2014, Simplilearn, All rights reserved. 50
 QUIZ
Which of the following is not a primary objective of control project risk?
6

a. Tracking identified risks

b. Identifying new risks

c. Implementing risk response plans

d. Categorize risks

© Copyright 2014, Simplilearn, All rights reserved. 51

 QUIZ
Which of the following is not a primary objective of control project risk?
6

a. Tracking identified risks

b. Identifying new risks

c. Implementing risk response plans

d. Categorize risks

Answer: d.

Explanation: Categorize risks is the objective of identify risk process.

© Copyright 2014, Simplilearn, All rights reserved. 52

Summary

Here is a quick ● In the event of major organizational changes, risk management planning
recap of what we may need to be revised to reassess.
have learned in this ● Critical success factors for the Control Risks process are integrate risk
lesson: monitoring and control with project monitoring and control, monitor risk
trigger conditions continuously and maintain risk awareness.
● Inputs of Control Risk process are risk register, project management plan,
work performance data, and work performance reports.
● Some documented risk management information includes occurrence of
risk, effectiveness of risk responses, and unexpected or undocumented
risk.
● Risk audits may be performed by a third party, a project's risk officer, or a
qualified personnel.

© Copyright 2014, Simplilearn, All rights reserved. 53

 This concludes ‘Control Risks.’

Thank You and Happy Learning!

Based on the Project Management Institute, A Guide to the Project Management Body of Knowledge
(PMBOK® Guide ) ― Fifth Edition and The Practice Standard for Project Risk Management.
RMP and PMBOK are the registered marks of Project Management Institute, Inc.
©© Copyright 2014,
Copyright 2014, Simplilearn,
Simplilearn, All rights
All rights reserved.
reserved. 54