Chapter 10: Risk

Question 1

What is the purpose of the Risk theme?

Answer 1

The purpose of the Risk theme is to identify, assess, and control uncertainty, and, as a result, improve the ability of the project to suceed.

Question 2

Define Risk.

Answer 2

Risk is an uncertain event (or set of events) that, should it occur, will have an effect on the achievement of objectives.

Question 3

How is risk measured?

Answer 3

By a combination of the probability of a perceived threat or opportunity occurring, and the magnitude of its impact on objectives.

Question 4

TRUE or FALSE:
Risks can have a negative and a positive impact on the objectives if they occur.

Answer 4

TRUE.

If they have a negative impact then they are called threats.

If they have a positive impact then they are called opportunities.

Question 5

Define Risk Management.

Answer 5

Risk management is the systematic application of principles, approaches and processes to the tasks of identifying and assessing risks, planning and implementing risk responses, and communicating risk management activities with stakeholders.

Identify > Assess > Plan > Implement
—– Communicate —–

Question 6

What should be done for risk management to be effective?

Answer 6

• risks that might affect the project achieving its objectives need to be IDENTIFIED, captured and described
• each risk needs to be ASSESSED to understand its probability, impact and timing
• responses to each risk need to be PLANNED, and assigned to people to action and to own
• risk responses need to be IMPLEMENTED, monitored and controlled.
• throughout the process, information about the risks must be COMMUNICATED within the project and to stakeholders.

Question 7

Define risk exposure.

Answer 7

Risk exposure is the extent of risk borne by the organization at a time.

Risk exposure for a project can be calculated with the Expected Monetary value technique - likelihood x impact (sum of all identified risks)

Question 8

What are the minimum requirements for the Risk theme?

Answer 8

A PRINCE2 Project must:
1. define its risk management approach that includes:
* how risks are identified and assessed, how risk management responses are planned and implemented and how management of risk is communicated throughout the project lifecycle
* assessing whether identified risks might have a material impact on the business justification of the project
* the roles and responsibilities for risk management

2. maintain some for of risk register to record identified risks and decisions
3. ensure that project risks are identified, assesses, managed and reviewed.
4. use lessons to inform risk identification and management

Question 9

What are the two management products that are produced and maintained within the Risk theme?

When are they created?

Answer 9

1. Risk Management Approach - defines how risk will be managed on the project
2. Risk register - provides a record of identified risks, including their status and history

These documents are created during the initiating a project process.
The risk management approach should be reviewed and possibly updated at the end of each management stage. The risk management approach will define how the risk register is reviewed and updated.

Question 10

Summarize the risk responsibilities.

Answer 10

Product Manager creates the risk management approach and Executive ensures that it is appropriate.

All (Executive, Senior User, Senior Supplier, Project Manager, Team Managers) ensure that risks are being identified throughout the project lifecycle.

Project Assurance reviews the risk management practices during the life of the project.

Project Support assists the Project Manager in maintaining the project’s risk register.

Question 11

TRUE or FALSE:
The risk management approach should include the project board’s attitude towards risk-taking.

Answer 11

TRUE

It helps define the amount of risk that is acceptable and will, in turn, help set risk tolerances.

Question 12

TRUE or FALSE:
The project manager can undertake risk management activities.

Answer 12

TRUE
On smaller projects, the project manager can undertake most risk management activities, however, on more complex projects these activities might be delegated to a risk manager or risk management team.

Question 13

What should be considered when creating a risk management approach?

Answer 13

1. the project board’s attitude to risk
2. the project size, scale and complexity, and risk impact
   
   • risk impact - even though a project might be small, the risk can be huge (e.g., updating the company’s software on all computers might cause the whole company to stop working temporarily)
3. project delivery approach
   
   • if deliveries are happening often (e.g., every week) then risk review should adjust (e.g., check risks outlined initially in the risk register every week to assess whether they are likely to happen in the delivery stage)
4. commercial considerations
5. establishing a risk budget
   
   • to fund management responses to the project’s threats that were identified in the beginning
   • risks might not be identified in the beginning, so take into consideration a provision (extra money for unpredictable risks)

Question 14

Who can raise a risk?

Answer 14

Any member of the project, corporate or programme management, the customer, or other stakeholder.

Question 15

Where do you capture risks as soon as they are identified?

Answer 15

Risk register

Question 16

It is important to capture a clear and unambiguous expression of each risk. What aspect should be considered?

Answer 16

1. Risk Cause = source of the risk (e.g., insufficient staffing capacity)
2. Risk Event = area of uncertainty (e.g., could cause the construction to stop for a while)
3. Risk Effect = impact on the project objectives (e.g., could result in the project taking one month longer than planned)

Question 17

How can the project manager identify the risks?

Answer 17

By looking at the project mandate, the project brief, and the project product description. For example:
* customer’s quality expectations
* number of organizations involved etc…

Also by looking at other project’s lessons.

Question 18

Give some examples of risk identification techniques

Answer 18

Review lessons - see other similar projects

Risk checklist - in-house documentation (if any)

Risk prompt lists - publicly available lists of risks categorized into types or areas

Brainstorming

Risk Breakdown structure - e.g., PESTLE analysis

Question 19

What is recommended by PRINCE2 to assess in terms of risk probability and impact?

Answer 19

• probability of threats and opportunities and how likely they are to occur
• the impact of each risk in terms of the project objectives
• the impact of the risk on the stage plan, project plan and business case
• how quickly the risk is likely to materialize if no action is take (i.e., risk proximity)
• how the impact of the threats and opportunities might change over the life of the project
• whether the project team is best placed to manage the risk or if the risk should be escalated to the project board

Question 20

Give some examples of Risk Estimation Techniques

Answer 20

1. Probability Impact grid
2. Expected value
3. Probability trees
4. Pareto analysis

Question 21

What is a risk profile?

Answer 21

A way of summarizing the set of risks and their estimations of probability and impact (more or less like the Probability Impact grid) and setting a risk tolerance line.

Question 22

Define Risk Appetite.

Answer 22

Risk appetite is an organization’s unique attitude towards risk-taking that in turn dictates the amount of risk that it considers acceptable.

Question 23

Define Risk Tolerance.

Answer 23

Risk tolerance is the threshold levels of risk exposure that, with appropriate approvals, can be exceeded, but which when exceeded will trigger some form of response.

Question 24

What are the two main risk evaluation techniques?

Answer 24

1. Risk Models (e.g., the Monte Carlo simulation)
2. Expected Monetary Value
   * Likelihood x Impact = Expected Value (sum of all risks) will give you the Expected Monetary Value

Question 25

What are the typical Risk Reponses? Give some examples.

Answer 25

1. Avoid a threat/ Exploit an opportunity
   e.g., avoid a threat - team lacks expertise in REACT > to avoid the risk, you outsource the dev of REACT components
   exploit an opportunity - opportunity to launch product earlier than competition > allocate more resources
2. Reduce a threat/ Enhance an opportunity
   e.g., reduce a threat - identified a risk of budget overruns due to unforseen construction complexities > to mitigate, you conduct a site survey and soil analysis to better plan for challenges
   enhance an opportunity - opportunity to easily add an extra feature to a software which will make it more competitive > allocate additional resources
3. Transfer the risk
   e.g., insurance
4. Share the risk
   - it seeks multiple parties, typically within supply chain, to share the risk on a pain/gain share basis
5. Accept the risk
   - the organization ‘takes the chance’
6. Prepare contingent plans
   - prepare plans now, but not taking action now

Question 26

Who can decide the appropriate response to a risk?

Answer 26

If the risk falls within the tolerances set for the project, the project manager decides on the appropriate response;
Otherwise, the decision is escalated to the project board.

Also, depending on the risk tolerance, escalation might also be to the overarching programme, corporate body or customer.

Question 27

What is residual risk?

Answer 27

When a threat is reduced (rather than removed), the remaining risk is called “residual” risk.

Question 28

How do you assess whether a risk response is worth it?

Answer 28

One way of assessing is to compare the cost of the risk response with the difference in the expected monetary value of the risk before and after the risk response.

Question 29

After a risk response implementation, what else should you do?

Answer 29

Planned risk responses need to be actioned, their effectiveness monitored and corrective action taken where responses do not match expectations.

Question 30

What are the roles of the Risk owner and Risk actionee in the risk response implementation stage?

Answer 30

Risk owner = a named individual who is responsible for the management, monitoring and control of all aspects of a particular risk assigned to them, incl. the implementation of the selected risk responses.

Risk actionee = a nominated owner of an action to address a risk.

Question 31

What are some reports that you can use to communicate information related to threats and opportunities?

Answer 31

checkpoint report - given by the team to the PM at a decided checkpoint
highlight reports - from PM to the board on management stage progress
end stage reports
end project report
exceptions reports