Risk Management Planning

Careful and explicit planning enhances the possibility of success of the five other risk management processes. Risk Management Planning is the process of deciding how to approach and conduct the risk management activities for a project. Planning of risk management processes is important to ensure that the level, type, and visibility of risk management are commensurate with both the risk and importance of the project to the organization, to provide sufficient resources and time for risk management activities, and to establish an agreed-upon basis for evaluating risks. The Risk Management Planning process should be completed early during project planning, since it is crucial to successfully performing the other processes described in this chapter.

11-3. : Risk Management Planning: Inputs, Tools & Techniques, and Outputs

Section 11.1.1 Risk Management Planning: Inputs

.1 Enterprise Environmental Factors

The attitudes toward risk and the risk tolerance of organizations and people involved in the project will influence the project management plan (Section 4.3). Risk attitudes and tolerances may be expressed in policy statements or revealed in actions (Section 4.1.1.3).

.2 Organizational Process Assets

Organizations may have predefined approaches to risk management such as risk categories, common definition of concepts and terms, standard templates, roles and responsibilities, and authority levels for decision-making.

.3 Project Scope Statement

Described in Section 5.2.3.1.

.4 Project Management Plan

Described in Section 4.3.

Section 11.1.2 Risk Management Planning: Tools and Techniques

.1 Planning Meetings and Analysis

Project teams hold planning meetings to develop the risk management plan. Attendees at these meetings may include the project manager, selected project team members and stakeholders, anyone in the organization with responsibility to manage the risk planning and execution activities, and others, as needed.

Basic plans for conducting the risk management activities are defined in these meetings. Risk cost elements and schedule activities will be developed for inclusion in the project budget and schedule, respectively. Risk responsibilities will be assigned. General organizational templates for risk categories and definitions of terms such as levels of risk, probability by type of risk, impact by type of objectives, and the probability and impact matrix will be tailored to the specific project. The outputs of these activities will be summarized in the risk management plan.

Section 11.1.3 Risk Management Planning: Outputs

.1 Risk Management Plan

The risk management plan describes how risk management will be structured and performed on the project. It becomes a subset of the project management plan (Section 4.3). The risk management plan includes the following:

Methodology. Defines the approaches, tools, and data sources that may be used to perform risk management on the project.
Roles and responsibilities. Defines the lead, support, and risk management team membership for each type of activity in the risk management plan, assigns people to these roles, and clarifies their responsibilities.
Budgeting. Assigns resources and estimates costs needed for risk management for inclusion in the project cost baseline (Section 7.2.3.1).
Timing. Defines when and how often the risk management process will be performed throughout the project life cycle, and establishes risk management activities to be included in the project schedule (Section 6.5.3.1).
Risk categories. Provides a structure that ensures a comprehensive process of systematically identifying risk to a consistent level of detail and contributes to the effectiveness and quality of Risk Identification. An organization can use a previously prepared categorization of typical risks. A risk breakdown structure (RBS) (Figure 11-4) is one approach to providing such a structure, but it can also be addressed by simply listing the various aspects of the project. The risk categories may be revisited during the Risk Identification process. A good practice is to review the risk categories during the Risk Management Planning process prior to their use in the Risk Identification process. Risk categories based on prior projects may need to be tailored, adjusted, or extended to new situations before those categories can be used on the current project.

Figure 11-4. Example of a Risk Breakdown Structure (RBS)
Definitions of risk probability and impact. The quality and credibility of the Qualitative Risk Analysis process requires that different levels of the risks' probabilities and impacts be defined. General definitions of probability levels and impact levels are tailored to the individual project during the Risk Management Planning process for use in the Qualitative Risk Analysis process (Section 11.3).

A relative scale representing probability values from 'very unlikely' to 'almost certainty' could be used. Alternatively, assigned numerical probabilities on a general scale (e.g., 0.1, 0.3, 0.5, 0.7, 0.9) can be used. Another approach to calibrating probability involves developing descriptions of the state of the project that relate to the risk under consideration (e.g., the degree of maturity of the project design).

The impact scale reflects the significance of impact, either negative for threats or positive for opportunities, on each project objective if a risk occurs. Impact scales are specific to the objective potentially impacted, the type and size of the project, the organization's strategies and financial state, and the organization's sensitivity to particular impacts. Relative scales for impact are simply rank-ordered descriptors such as 'very low,' 'low,' 'moderate,' 'high,' and 'very high,' reflecting increasingly extreme impacts as defined by the organization. Alternatively, numeric scales assign values to these impacts. These values may be linear (e.g., 0.1, 0.3, 0.5, 0.7, 0.9) or nonlinear (e.g., 0.05, 0.1, 0.2, 0.4, 0.8). Nonlinear scales may represent the organization's desire to avoid high-impact threats or exploit high-impact opportunities, even if they have relatively low probability. In using nonlinear scales, it is important to understand what is meant by the numbers and their relationship to each other, how they were derived, and the effect they may have on the different objectives of the project.

Figure 11-5 is an example of negative impacts of definitions that might be used in evaluating risk impacts related to four project objectives. That figure illustrates both relative and numeric (in this case, nonlinear) approaches. The figure is not intended to imply that the relative and numeric terms are equivalent, but to show the two alternatives in one figure rather than two.

Figure 11-5. Definition of Impact Scales for Four Project Objectives

Probability and impact matrix. Risks are prioritized according to their potential implications for meeting the project's objectives. The typical approach to prioritizing risks is to use a look-up table or a Probability and Impact Matrix (Figure 11-8 and Section 11.3.2.2). The specific combinations of probability and impact that lead to a risk being rated as 'high,' 'moderate,' or 'low' importance-with the corresponding importance for planning responses to the risk (Section 11.5)-are usually set by the organization. They are reviewed and can be tailored to the specific project during the Risk Management Planning process.

Revised stakeholders' tolerances. Stakeholders' tolerances may be revised in the Risk Management Planning process, as they apply to the specific project.

Reporting formats. Describes the content and format of the risk register (Sections 11.2, 11.3, 11.4, and 11.5) as well as any other risk reports required. Defines how the outcomes of the risk management processes will be documented, analyzed, and communicated.
Tracking. Documents how all facets of risk activities will be recorded for the benefit of the current project, future needs, and lessons learned. Documents whether and how risk management processes will be audited

Super Business - Project Management Articles

Risk Management Planning