Risk Management Planning

Risk Management Planning is the process of developing an approach and executing risk management activities for a project.

Q.	Risk Management Planning should be completed ________ in the project planning phase.
		A.	Sometime
		B.	Late
		C.	Early
		D.	Never

The correct answer is C. Other risk management processes are driven by and dependent on the Risk Management Plan.

Inputs to Project Risk Management Planning

The inputs to Risk Management Planning include:

Environmental factors,

Organizational process assets,

Project Scope Statement, and

Project management plan, as described in earlier sections of this book.

Project Risk Management Planning Tools and Techniques

Meetings for planning and analysis are the primary tools for creating the Risk Management Plan, which is the output of this process. One of the ways that a project team can begin to define the types and sources of risk events is to create a Risk Breakdown Structure (RBS). An example of an RBS is shown in Table 15-1.

Table 15-1. Example Risk Breakdown Structure

Project
Technical	External	Organizational	Project Management
Requirements	Suppliers	Resources	Estimating
Technology	Regulatory	Funding	Planning
Quality	Market	Prioritization	Controlling
Performance and Reliability	Weather	Customer	Documentation

The Risk Breakdown Structure is one way to identify risks in a structured manner. It assists the team in conducting a systematic review of risks and development of responses to risks.

Q.	What is a Risk Breakdown Structure (RBS)?
		A.	Flowchart of risks
		B.	Risk impacts on the organization
		C.	List or diagram of risks by category
		D.	Risk management activities that are on the schedule

The best answer is C. An RBS is optional but may assist the team in identifying risks and opportunities by looking at the sources of risks or the areas where risks may occur.

The Risk Management Plan can include a Probability and/or Impact Matrix for organizing the information that will be used during the Risk Identification process to prioritize and quantify risks, and it may in some cases show opportunities for the project as well. Common information in the matrix includes numerical and/or descriptive definitions of impact, negative and positive, and the probability of occurrence. The combination of probability and impact determines whether a risk is rated high, moderate, or low. These descriptors are rank ordered in a relative scale. Numerical scales can also be used.

Q.	Which of the following would be used to describe the significance of the negative impact of threats or the positive impact of opportunities?
		A.	Cost, time, scope, and quality
		B.	Sources of the risk events
		C.	Types of risk responses
		D.	Very Low, Low, Moderate, High

The correct answer is D. Relative scales of impact are rank ordered to differentiate risks that require special attention from lesser risks. Numerical scales such as 0.1, 0.5, and 0.9 can also be used to assign values to the impact of the risks.

Outputs of Risk Management Planning

In summary, the Risk Management Plan should describe the entire risk management process, including auditing of the process. It should also define the content and format of the Risk Register, reporting, and risk tracking.

• Methodology Describes how risk management will be done on the project

• Roles and responsibilities Defines the risk management team and their responsibilities for risk management activities

• Budgeting Assigns budget for risk management activities to be included into the project cost baseline (project budget)

• Timing Specifies when and how often the risk management activities appear in the project schedule

• Risk categories Defines types and sources of risks to guide the Risk Identification process

• Definitions Operational definitions for the project team to use to ensure consistency in the assessment of risks and opportunities

• Probability and Impact Matrix Specific combinations of impact and probability, which lead to risk ratings such as high, medium, or low

• Revised thresholds Revised or validated descriptions that trigger taking action; scope, quality, cost, and time thresholds may be different from each other

• Reporting formats How to communicate risk activities and their results

• Tracking How to document risk monitoring and management activities

Table 15-2 shows the operational definitions of Impact on Project Objectives. This creates alignment and improved communication by the team when identifying and analyzing risks.

Table 15-2. Sample Definitions of Impact on Project Objectives

	Relative Scale for Impact
Project Objective	Very Low	Low	Moderate	High	Very High
CostBudget	Insignificant increase	< 10% increase	10%20% increase	20%40% increase	> 40% increase
TimeSchedule	Insignificant increase	< 5% increase	5%10% increase	10%20% increase	> 20% increase
ScopeDeliverable(s)	Scope decrease barely noticeable	Minor areas of scope are affected	Major areas of scope are affected	Reduction in quality is unacceptable	End item has limited use if any
QualityDeliverable(s)	Quality decrease barely noticeable	Only very demanding applications are affected	Reduction in quality to this level requires approval	Reduction in quality is unacceptable	End item has limited use if any

The Risk Management Plan will be used throughout the life cycle of the project. As the team moves through the subsequent Risk Management Processes, the plan will be revised, updated, and improved.

Q.	According to Table 15-2, the impact of a risk to the project schedule will be classified as ________ if the delay to the project (as a result of the risk event) will be one week to a 20-week project schedule.
		A.	Low
		B.	High
		C.	Very Low
		D.	Moderate

The correct answer is A. If there is a delay of one week over a 20-week time period, that is the equivalent of a 5% increase. According to the matrix, that is a Low impact to the Time objective of the project.