 |
RK 01 describe the purpose of the Management of Risk (p) |
|
RK 02 understand the purpose of the Risk Log, where
within the eight processes it is created and updated, and the main
responsibilities of the PRINCE2® roles in this regard (p) |
|
RK 03 apply the Management of Risk to a given project
scenario |
|
RK 04 create, modify or discuss a Risk Log for given
project scenario |
|
RK 05 demonstrate the interfaces between the Risk Log and
other PRINCE2® products especially Project Issues in a given project scenario |
|
RK 06 identify the relationship between Management of
Risk and other PRINCE2® components in a given project scenario |
|
17.1 “The task of risk management is
to manage a project’s exposure to risk (that
is, the probability of specific risks occurring and the potential impact if
they did occur). The aim is to manage that exposure by taking action to keep
exposure to an acceptable level in a cost-effective
way.” |
|
17.2.1 Risk Tolerance “amount of
risk the project manager and project board are prepared to tolerate”
 |
IE live with knowing what contingencies are in place
and cost of action & inactions |
|
|
17.2 Project board’s responsibility to recognise and
accept costs of risk management
|
Spend just enough on management of risk to make
balanced judgements between pro-active and reactive
costs |
|
17.5 Budgets needed to cover assessment, management,
responses & contingency |
|
Contingency is resources
planned and allocated but only to be used if the linked risk occurs
16.4.1 p.236 |
|
|
Tolerance & responses complicated by interdependency
between risks(17.7)
|
Consider the interaction between risks and
countermeasures |
|
|
Risk tolerance or appetite defines the
threshold between proactive management
and reactive (contingency)
response |
|
Where cost effectiveness of actions is balanced by
probability, impact and proximity |
|
Intolerable risks, by definition, require action to
address cause and/ or effect |
|
Risk is tolerable when exposure passes the point where
“anything else we will only do if the risk happens” |
|
Tolerable risk means any contingencies in place are good
enough |
|
Contingency might include “stop the project” |
|
An intolerable risk may be rendered tolerable by
proactive means plus contingencies (reactive means) |
|
Risk identifier: unique code to allow
grouping of all information on this risk |
|
Author: who submitted the risk |
|
Date identified: when first recognised |
|
Description: explanation of the event(s)
and its/ their outcome(s) |
|
Risk category: from Appendix C, E.G.
commercial, legal, technical |
|
Impact: affect on time, cost, quality,
scope, benefits, people/resource at project, programme, organisation level
if this risk were to occur Normally assessed as Hi, Med or Low |
|
Probability: estimate of the %age
likelihood of the risk occurring |
|
Proximity: the closeness in time in which
the risk is likely to occur |
|
Counter-measure(s):
the actions that have been taken or will be taken to counter this risk |
|
Owner: the person who has been appointed
to keep an eye on this risk |
|
Date of last update: when the status of
this risk was last checked |
|
Current status: for example, closed,
reducing, increasing, no change |
|
17.3 The risk management cycle |
|
Two halves to PRINCE2® Management of Risk
|
17.3.1 Risk Analysis:
comprises 4 steps
-
Identify the risk (Describe it)
-
Evaluate the risk (Qualify impact, probability and
time horizon)
-
Identify suitable responses (Prevent, Reduce, Accept,
Transfer, Contingencies)
-
Select a response
|
|
17.3.2 Risk Management:
comprises 2 parts of 2 parts
 |
Plan and Resource (include in product model, activity
lists, estimates and resource) |
|
Monitor and Report (take actions, confirm their
effectiveness or not) |
|
|
|
Risk analysis performed in
|
SU4, IP3, SB4, PL6, CS4 (§20.2) |
|
|
Risk Management performed in
|
PL3, MP2-->CS2-->CS5 |
|
|
Poor
leadership/ Vested interests, Clashing aims, interests or personalities,
Inappropriate & disproportionate influence |
|
Management:
Incompetent/ poor policy & practices, Indecision, Wrong decision |
|
Information:
poor, wrong, untimely |
|
Key people:
poorly selected, unclear Roles &Responsibilities/ lack authority, |
|
HSE issues |
|
3rd Identify suitable responses
|
Consider 1 or more for each of: Prevent, Reduce,
Accept, Transfer & Contingency |
|
Risks should always consider all 5 response types |
|
|
4th Select (a response or responses)
|
Of the possible responses none, one or more are
selected for implementation in risk management |
|
Selected control action must represent value for money
|
“balancing the cost of
taking that action against the likelihood and impact of allowing the risk
to occur,” (p256) |
|
|
Selected response recorded in the risk log |
|
|
P.R.A.C.T. (see next section) are the PRINCE2® response
types that must be understood for the exam
|
They are all negative while in reality don’t forget
responses to opportunity Encourage, Enhance, Accept (Windfall) and Share or
partner, |
|
