Assessing Risk in PRINCE2 - Part 3

Dealing with residual risk in PRINCE2

With the assessment of impact and probability you need to think about the measures before you take control actions and after you take them.

There are advantages in ultimately recording both, and the PRINCE2 Risk Register now covers that point too.

At first you may circulate a copy of the summary risk profile showing the “Before “Or inherent values. Then, when action has been decided, you can change this to show the position “After “Risk management actions are taken into account, the residual risk.

For ongoing reference during the project you need to show the new “After “assessment of impact and probability after the effect of risk management actions, otherwise your assessment does not reflect the present state of the risk that you are managing.

Even when you arrive at the “After “Position it is still helpful to record the “Before “Ratings in the risk register as well. Otherwise managers looking at the probability and impact measures may think of risk is insignificant being “Very low – Very low “And not worth managing.

But the true picture maybe that without those management actions the risk or revert to its “Before “Measures of “Very high – Very high “.

If you do not have many risks, you can get really clever, assessing both before and after, and linking the two points to the summary risk profile.

Planning how to deal with a PRINCE2 Risk

Consider all the possible actions that you can take to control a particular risk. You have to think broadly here, do not limit your response to throwing money at the problem as sometimes you can come up with an imaginative solution that requires brain power rather than money.

Do remember the word “Suitable “When you consider risk actions. Although silly ideas have their place because they can sometimes trigger sensible ones, you do not want the risk analysis sessions, particularly those involving any young and junior team members, to descended into farce.

All this analysis costs the project money in terms of staff time, so although identifying risks and in actions can be fun, do not allow it to waste time. A risk suggesting the world is going to be hit by a giant toxic meteor should not usually be in the risk register of a project to enhance your payroll system!

Categorizing the PRINCE2 Risk Responses 

Different risk approaches use different categories for the types of response, and the latest PRINCE2 Manual has identified 10 responses types – 6 for Risk threats, and 4 For the opportunity risks.

The “share “Response can be used for both positive and negative risks.

Taking a more straightforward approach, you could see that for risk threats, actions such as avoid, transfer and mitigate would be suitable, and for positive risk opportunities, then using exploit, share and enhance would be a far simpler approach.

Responses to PRINCE2 Risk Threats

Risk Contingency time in the plan

Contingency budget, that is money pre-authorized by the project board to use if a particular risk happens

Contingent actions – These are alternatives put in place so that if something happens it means plan cannot work, so you move to plan B

Multiple PRINCE2 Risk Management Actions

You can use risk management actions in combination. As an example, take home insurance. Here are two actions are in force, if you have an insurance policy it probably says that you must close the door and lock it before you go out. 

This prevents someone just walking in. But your locks are only prevention to a certain level and you are not required to recruit your own personal security force to keep a 24 hour watch on your home.

Just lock the door, and after that, the insurance company accepts the transfer of the risk.

Deciding which of the possible actions to take and which not to take is down to your best judgment.

Given that many of the actions required money, or staff time that represents money, this decision belongs to the project board and especially the executive who earns the business case and is responsible for a value for money.