Project Risk Management
Perform qualitative risk analysis
Qualitative risk analysis
• In later part of risk management effort what you are
going to do about risks
• Question : would you want to do something about all risk
identified?
• It is subjective analysis of risk identified in risk register
• This process is repeated as new risks are uncovered
throughout the project
Tools & techniques:
Probability and impact matrix page 331
• A probability and impact matrix is a grid for mapping the probability of
each risk occurrence, and its impact on each project objectives if that
risk occurs.
• By giving a rating, it allows project risks to be allocated into priority
groups.
Tools & techniques:
Probability and impact matrix page 331
• PROBABILITY: risk occurrence
• Low medium, high
• 1 to 10
Probability and impact matrix page 331
• IMPACT: amount at stake, or consequences, positive or negative
• Low medium, high
• 1 to 10
Tools & techniques:
Probability and impact matrix page 331
Very High
High
Medium
Low
Very Low
Very Low Low Medium High Very High
Tools & techniques:
Probability and impact matrix page 331
Risk
Response
Strategies
Response strategies for threats
• Avoid
• Mitigate
• Accept
• Transfer
• Escalate
Strategies for Threats
Avoid:
In this project team acts to eliminate threat or protect project from its impact.
May be appropriate for high-priority threats (high probability & large –ve impact).
May involve changing some aspect of PM plan or changing the under-threat objective to
eliminate the threat entirely, reducing its probability to zero.
Risk owner may also take action to isolate project objectives from the risk’s impact if it were
to occur.
Examples include removing the cause, extending schedule, changing project strategy, or
reducing scope. Some risks can be avoided by clarifying requirements, obtaining
information, improving communication, or acquiring expertise.
Strategies for Threats
Avoid:
A software project identifies a high risk of delays due to dependence on a legacy
system. The team decides to replace the legacy system with a new platform early in
the project, avoiding the risk of failure or incompatibility.
In an event planning project, the risk of bad weather is avoided by booking an
indoor venue instead of an outdoor one.
Strategies for Threats
Mitigate:
Reducing probability and/or impact to bring the risk within acceptable limits
(threshold).
Early mitigation action is often more effective than trying to repair the damage
after the threat has occurred.
Adopting fewer complex processes, conducting more tests, prototyping, or
choosing a more stable seller are examples of mitigation actions.
Where it is not possible to reduce probability, a mitigation response might reduce
the impact by targeting factors that drive the severity.
For example, designing redundancy into a system may reduce the impact from a
failure of the original component.
Strategies for Threats
Mitigate:
To reduce the risk of resource shortages, the project manager cross-trains
team members so they can cover for each other if someone is
unavailable.
For a construction project with a risk of safety incidents, the company
implements stricter safety protocols and regular training to lower
accident likelihood.
Strategies for Threats
Escalate:
Escalation is appropriate when a threat is outside the scope of the project or that
the proposed response would exceed the project manager’s authority.
Escalated risks are managed at the program level, portfolio level, or other
relevant part of the organization, and not on the project level.
The project manager determines who should be notified about the threat and
communicates the details to that person or part of the organization.
It is important that ownership of escalated threats is accepted by the relevant
party.
Escalated threats are not monitored further by the project team after escalation,
although they may be recorded in the risk register for information.
Strategies for Threats
Escalate:
A critical supplier notifies about a major delay that could halt the project. The project manager
escalates the issue to senior management to negotiate alternative suppliers or adjust project
deadlines.
A legal compliance risk arises that could affect the company’s reputation. The project manager
escalates it to the legal department and executive team for guidance and action.
Strategies for Threats
Accept:
It acknowledges the existence of threat, but no proactive action is taken.
Appropriate for low-priority threats; or where it is not possible/cost-effective to
address a threat in any other way; or when the team has decided not to change the
project management plan to deal with the risk.
Acceptance can be either active or passive.
A common active acceptance strategy is to establish a contingency reserve,
including amounts of time, money, or resources to handle threat if it occurs.
Passive acceptance involves no proactive action apart from periodic review of the
threat to ensure that it does not change significantly.
Strategies for Threats
Accept:
Example:
Example
A marketing project accepts the risk that a small percentage of campaign recipients
might unsubscribe, considering the overall impact minimal.
Example 2:
A software release accepts minor bugs post-launch, planning to fix them in
subsequent patches rather than delaying the release.
Strategies for Threats
Transfer:
Transfer involves shifting ownership of a threat to a third party to manage
the risk and to bear the impact if the threat occurs against some payment (in
form of a risk premium to the party taking on the threat).
Transferring the risk simply gives another party responsibility for its
management – it does not eliminate it.
Most effective in dealing with financial risk exposure.
Can be achieved through actions like use of insurance, performance bonds,
warranties, guarantees, use of appropriate contract type/agreement clauses
etc.
Strategies for Threats
Transfer:
A project contracts a courier service with a penalty clause for late deliveries,
transferring the risk of shipping delays to the courier company.
The project purchases insurance to cover potential equipment theft or
damage at the construction site.
Strategies for Opportunities
Exploit
Ensure the opportunity definitely happens.
Action: Allocate resources, adjust plans, or prioritize activities to guarantee the
opportunity is realized.
Example: Fast-tracking a product launch to capture a market window.
Enhance
Goal: Increase the probability or impact of the opportunity.
Action: Take actions to improve the chance of occurrence or boost benefits.
Example: Investing in additional R&D to improve product features and market appeal.
Strategies for Opportunities
Share
Goal: Partner with others who can help capitalize on the opportunity.
Action: Collaborate, outsource, or form joint ventures to leverage complementary strengths.
Example: Partnering with a local distributor to enter a new geographic market faster.
Accept
Goal: Acknowledge the opportunity but take no active steps to pursue it.
Action: Monitor and be ready to act if it materializes, but no proactive investment.
Example: Monitoring a potential technology trend and deciding not to invest immediately but
keeping an eye on it.
Identify the type of risk response strategy (avoid, mitigate probability, mitigate impact, transfer, exploit,
enhance the probability, enhance the impact, share, escalate or accept).
Description Risk Response Strategy
Remove a work package or activity from the project Avoid
Assign a team member to frequently visit the seller's manufacturing facilities to
Mitigate the Impact
learn about problems with deliveries as early as possible.
Move a work package to a date when a more experienced resource is available
Exploit
to be assigned to project.
Begin negotiation for the equipment earlier than planned so as to secure a lower
price. Enhance the
Impact
Outsource a work package so as to gain an opportunity. Share
Notify management that there could be a cost increase if the risk occurs because
no action is being taken to prevent the risk.
Accept
Remove a troublesome resource from the project. Avoid
Provide training to a team member who has limited experience. Mitigate Probability
Identify the type of risk response strategy (avoid, mitigate probability, mitigate impact, transfer, exploit,
enhance the probability, enhance the impact, share, escalate or accept).
Description Risk Response Strategy
Train the team on conflict resolution strategies. Mitigate the Impact
Outsource difficult work to a more experienced company. Transfer
Ask the client to handle some of the work. Transfer
Prototype a risky piece of equipment. Mitigate Probability
Notify PMO that testing software for the project could be
Escalate
used by three other IT groups, if the enterprise solution is
purchased.
Description of strategy Name of response strategy
1 Remove a work package or activity from the project
2 Assign a team member to visit the seller’s manufacturing facilities frequently
to learn about a problem with delivery as early as possible
3 Move a work package to date when more experienced resource is available to
be assigned to the project
4 Begin negotiation for the equipment earlier than planned so as to secure a
lower price
5 Outsource a work package so as to gain an opportunity
6 Notify management that there could be cost increase if a risk occurs because
no action is being taken to prevent the risk
7 Remove a troublesome resource from the project
8 Provide a team member who has limited experience with additional training
9 Train the team on conflict resolution strategies
10 Outsource difficult work to more experienced company
11 Ask the client to handle some of the work
12 Prototype a risky piece of equipment
Description of strategy Name of response strategy
1 Remove a work package or activity from the project AVOID
2 Assign a team member to visit the seller’s manufacturing facilities frequently MITIGATE
to learn about a problem with delivery as early as possible
3 Move a work package to date when more experienced resource is available to EXPLOIT
be assigned to the project
4 Begin negotiation for the equipment earlier than planned so as to secure a ENHANCE
lower price
5 Outsource a work package so as to gain an opportunity SHARE
6 Notify management that there could be cost increase if a risk occurs because ACCEPT
no action is being taken to prevent the risk
7 Remove a troublesome resource from the project AVOID
8 Provide a team member who has limited experience with additional training MITIGATE
9 Train the team on conflict resolution strategies MITIGATE
10 Outsource difficult work to more experienced company TRANSFER
11 Ask the client to handle some of the work TRANSFER
12 Prototype a risky piece of equipment MITIGATE PROBABILITY
Project Documents
Lessons Learned Register – Lessons learned earlier in the project with regard to
implementing risk responses can be applied to later phases in the project to improve
the effectiveness of this process.
Risk Register – It records the risk responses for each individual risk and the
nominated owners for each response plan.
Risk Report – It includes an assessment of the current overall project risk, as well as
agreed-upon risk response strategy and describes the major individual risks with their
planned responses.