​PRINCE2 Risk Responses

​PRINCE2 Risk Responses - ​Who ​controls ​​RISK?

​You need to build the risk responses into the project and stage plans as appropriate in order to show the necessary activities and resources. Fairly obviously this will have implications for the overall cost of the project and the time you’re required to do it, but the project board are well aware of those implications because they have been involved in deciding the risk actions. In addition, you will need to be clear on who is in control of a risk and who is to act if that risk occurs.

PRINCE2 Risk owner

The person who is best place to monitor the risk and controlling any action is called the risk owner. The person who takes any action is there risk actionee.

It is possible that for a particular risk, the person who owns it, may also carry out the risk actions or responses.

I’m sure it is common sense as well as Best Practice, that if risk actions are a tool dangerous, you should appoint someone other than you to be the actionee.

This is not being a wimp or cowardly, but merely common sense.

Implementing is the final section of the external part of the risk procedure model and it may sound a little obvious. However, two important points emerge, The first is that you must make sure that the risk actions are indeed taken because often projects go wrong because no one checked that the risk responses were actually carried out.

The second point is about monitoring. Interestingly, ​the official PRINCE2 Manual makes little mention of this!

However, risk factors can change and for this reason you must have monitoring in place as part of implementing the planned actions.

Risk factors can change in two main areas:

​The outside area splits into two parts as well:

​All these factors can change the status of the risk and so necessitate a reevaluation of the risk and the measures being taken to control it.
If you use the rest cycle as a mindset, as well as the official PRINCE2 Diagram, this helps emphasize the monitoring aspects And how this will ensure that the cycle continues back into analysis​:

Communicating information about risk

The final part of the risk procedure in PRINCE2, It is the communicates aspect which as shown, is going on all the time.

In communication, you need to keep others up to date with the risk position in the project as well as gets information back into the risk management process (As per the above diagram)

For risk communications you may find the information that was captured in the communications management strategy document helpful, As the last two final sections within that document is where you listed stakeholders and others who need to be informed. Communicating risk information needs to be carried out in the most appropriate way considering the nature of your particular project.

In some cases, risk information can be included in the standard reports used for reporting progress and for reporting project status at set points – Particularly at the end of each project stage.

You need to be careful that risk reporting does not have to go through too many Management levels. A good approach here is to ensure risk to reporting comes directly from the source to the recipient.

An example here is that someone carrying out product creation along with the risk actionee should not have to go through more than one person before reaching whoever is responsible for the risk.

Care needs to be taken that the message did not get diluted As it goes up the management chain.

Use of the PRINCE2 Risk Register

You must regularly review the Risk Register and keep things like status up to date – As a minimum, you do this at the end of each stage where the PRINCE2 Process builds in this action.

For your easy reference, here are the sections within the risk register that are entered for each risk:

But you may need to review the risk management during the stages as well, especially if your project is high risk. Equally, you also need to check the risk impact of any problems or other issues, that as you know, can occur at any point during a project.

In PRINCE2, you document all risks by making a record of each one in the Risk Register.

You create the risk register in the initiation stage during the PRINCE2 “Initiating a Project” process. This occurs when creating the Risk Management Strategy document.

Risks that may be identified during the previous process Starting Up a Project, are captured in the project managers Daily Log so that they can be managed if required during that pre-project timeframe.

When the project enters the initiation stage as mentioned above, any risks within the Daily Log that need to be managed formally we’ll be transferred to the Risk Register

You will want to complete a risk register entry for every risk that has been identified and where the risk is to be formally managed, as I said above, during startup, the information may be quite sketchy, but as the project progresses it is important to keep the risk register up to date.

Keeping risks are to date may mean changing the information on each risk as is necessary such as a change of status causing you to modify the risk response control actions.

​IN SUMMARY

Do I need PRINCE2 risk management on my project?

An interesting question. But even if your project is a small low risk one, It is important to include risk management. By the very definition of a project, it is risky because it involves Managing and implementing change.

Turning a blind eye to the risks involved would be foolish not to say unprofessional!

The right question to ask is not "do I need risk management", but, "how much risk management should we do?"

This is where the real power of PRINCE2 comes into play via the section on “Tailoring PRINCE2 In a Project Environment” chapter. Here you will find general advice and guidance on the application of risk management to any project of any size or risk level, in any industry.