Risk Planning – Planning the Responses
Planning the responses to risks is the 3rd step in the PRINCE2 Risk Management procedure of Identify, Assess, Plan, Implement and Communicate. Its primary goal is to plan specific responses to the threats and opportunities.
The objective of planning the responses to risk is to reduce the threats and maximize the opportunities.
If the Project Manager fails to plan responses to a risk, they will be caught off-guard if this risk materializes. It is always good to be prepared. After all, failing to plan is planning to fail, for example, if your project is to organize an outdoor event and one of the risks is a threat of rain.
If you do nothing to prepare for this and halfway during the concert it starts to rain heavily, it’s a bit too late to start erecting a tent or ordering plastic ponchos to distribute.
Responses to Threats and Opportunities
Threat Responses
- Avoid
- Exploit
- Reduce(probability and/or impact)
- Fallback(reduces impact only)
- Transfer(reduces impact only, and often only the financial impact)
Opportunity Responses
- Enhance
- Share
- Accept
- Reject
It’s important to note that responses do not necessarily remove the risk. Most of the Risk Response actions taken in a project are done to reduce the Risk Impact.
To help to decide the type of responses that are best to use to reduce the impact of the risk, you can look in the Lessons Learned report from similar projects that have already been done.
PRINCE2 suggest 6 responses for threats and four responses for opportunities.
The 6 responses for threats are: Avoid, Reduce, Fallback, Transfer, Share and Accept while the 4 responses for Opportunity are Exploit, Enhance, Share and Reject. I mentioned “Share” twice as it both a response to threats and to opportunities.
Risk Planning – Plan the Responses to Threats
Here I will explain the different responses to Threats and give an example of each, as we have already seen, the responses are: Avoid, Reduce, Fallback, Transfer, Accept and Share.
1) Response Avoid Risk:
This involves changing something in the project so that the threat no longer has impact or can no longer happen. You avoid the risk.
Example: You are organizing an outdoor concert for 600 people in April in the UK. One of the risks is that it may rain, so you decide to move the concert indoors thus avoiding the risk. This response has removed the threat. Now, if it rains, then the rain has no impact on the concert.
2) Response Reduce Risk:
Here, actions are taken to:
a) Reduce the probability of the risk
b) Reduce the impact if the risk does occur
To help understand this, I will give an example of both reduce probability and reduce impact. Reduce response is the most common way of dealing with risks.
Example to Reduce Risk Probability:
The objective is to reduce the probability of the risk happening. Using the concert example with the threat from rain, we could move the concert to July where it’s 3 less times less likely to rain. This is a clear example of reducing the probability but the risk is still there.
Example to Reduce Risk impact:
The objective is to reduce the impact in case the risk occurs. Here, the organizers could order a load of sponsored plastic ponchos to be offered to the concert-goers when they arrive. If it does rain during the concert, the people would not get soaked from the rain and thus, you have reduced the impact of the rain.
3) Response Risk Fallback:
Fallback is also referred to as contingency. See fallback as a fallback plan of actions that would be done if the risk occurs and therefore would become an issue. These actions will help to reduce the impact of the threat.
Example:
There is an important tennis game at Wimbledon in Centre Court which now has a roof that can be closed. The fallback plan is to close the roof once it starts to rain.
This would not stop it from raining and it takes 5 minutes to close the roof of the tennis court, so the grass could still get a few drops of rain.
This fallback plan does reduce the impact of the rain, however, and it allows the game to continue after the roof has been closed.
Note: The action of closing the roof is only done once the threat is real.
4) Response Transfer:
Here you can transfer the financial risk to another party. For example, using an insurance policy, you could recover the costs if the threat does happen.
Example:
Let us use the example of the concert again. One of the threats might be that one of your top acts might not be able to play at the event due to illness or some other reason. Concert-goers might want to have their money back but you have spent a lot of money already just organizing the event. So you take out an insurance policy to cover any losses you could incur if this risk does happen.
5) Response Accept:
Here, a decision is taken to accept the risk. It just may cost too much money to do something about it or it may not be possible to do anything about it. However, you do keep the status of this risk open and continue to monitor it.
Example:
There is a risk that another outdoor concert could be held around the same day as your concert and this might affect ticket sales. After some consideration, you decide to do nothing about it and continue as normal. Moving the concert to another time will just cost too much and some people have already bought tickets, so you just live with the risk.
5) Share:
Share is both a response for threats and opportunities. Share is very common in customer/supplier projects where both parties share the gain if the costs are less than the planned costs and share the loss, too, if the costs are exceeded.
Example:
In the concert example, suppose you have a supplier that provides VIP toilet facilities and people are charged €1 for each service. There is a certain fixed cost that you must pay to provide this service and you agree with the supplier to share the profits if the revenue is above this fixed cost amount and share the losses if it is below this amount.
We have covered the 6 responses to threats which are Avoid, Reduce, Fallback, Transfer, Accept and Share. I am sure that the examples included have helped to explain these.
Plan the Risk Responses to opportunities
Here you will learn how to plan the responses to the opportunities. The responses to opportunities are: Share, Exploit, Enhance and Reject.
Note: For the exam, you just need to aware of what each response is.
1) Share:
I already covered “Share” when discussing the planning responses to threats. It’s where you share the profits and losses with another party.
2) Exploit:
Exploit is where if the risk does happen, you would take advantage of it and use it.
Example:
I will use the outdoor concert event project. The Risk is: Due to the fact that your local radio station regularly interviews artists who are playing in the local region, there is an opportunity to get your top artist interviewed, which would result in more publicity and selling more tickets. If this risk does happen, then you have agreed with the record company to exploit it and do the interview.
3) Enhance:
Enhance is where you take actions to improve the likelihood of the event occurring and you enhance the impact if the opportunity should occur. This is not the same as “Exploit,” but doing certain things will give a greater chance for the opportunity to happen.
Example:
The Risk is: Due to the fact that your local radio station regularly interviews artists who are playing in the local region, there is an opportunity to get your top artist interviewed, which would result in more publicity and selling more tickets.
So you take the following actions to enhance the likelihood of this happening:
- You contact the radio station’s managers with a suggestion
- You ask the record company to contact the radio stations
- You ask your other contacts at the radio station to make this happen
- You suggest the idea of a ticket giveaway with an interview
So what is the difference with Exploit?
- With Exploit, if the risk does happen, then you take advantage of it
- With Enhance, you try to increase the chances of making it happen.
4) Reject:
This is where you identify an opportunity and decide not to take any action on this opportunity. There can be many reasons not to do this. For example, it could cause you to lose focus on your main objective, or the return on this opportunity could be low compared to the rest of the project.
Example:
There is an opportunity to invite another equally known guest star free from the same label as your lead top act; however, you decide not to go ahead with this, as you cannot mention the artist’s name on the posters and advertising, so you will not sell any extra tickets because of this.
Also, it will cost you extra to provide facilities for this extra artist. So it sounded like a cool idea, but did not bring any extra value to the bottom line for the concert, only extra costs.
The 4 responses for Opportunity were Share, Exploit, Enhance and Reject. Again, I hope the examples help your understanding.
Implement the Risk Responses
Implement the Responses is the 4th step in the PRINCE2 Risk Management procedure. The goal of this step is to ensure that the Planned Responses to risk are done, i.e., both monitored and corrective action taken. The main thing to decide in this step is:
- Who is going to monitor these Risks? (Risk Owner)
- Who is going to carry out the planned Risk Responses? (Risk Actionee)
The PRINCE2 manual mentions two specific roles which are: Risk Owner and Risk Actionee.
- The Risk Owner is responsible for managing & monitoring risks aspects. They can also carry out actions that have been assigned to them
- The Risk Actionee is someone who is assigned to carry out a particular action and they support the Risk Owner. So they are not responsible for monitoring or managing the risk.
Let me give you an example to explain this:
Let us say you are working a project and you need to get very specific parts from a supplier in Asia. Currently you have a buffer of one week for these parts to arrive in your company but need someone to monitor this and put the planned response actions into effect if products are going to be late.
As a precaution, some of the parts will stay at the factory and can be sent by air freight if there is an issue with the much cheaper shipping service.
So you need a person to own this responsibility, monitor it and take ownership. You also need a person to put the Response Plan into action who will arrange the air freight.
In this instance, the Team Manager of the team that will use these products will be the Risk Owner, and the Risk Actionee will be a person in the purchasing department who has experience with air freight.
Note: The Risk Owner and Risk Actionee can be the same person
Step 5: Communicate the Risk
Communicate is the 5th step in the PRINCE2 Risk Management procedure, but is actually done throughout the whole Risk Management procedure.
This communication step ensures that the information related to the threats and opportunities faced by the project are communicated within and outside the project to all necessary stakeholders.
How do you think the Project Manager communicates?
The existing management report products are mostly used to communicate Risk information, such as
- The Project Brief
- Highlight Report
- End Stage Report
- Lessons Learned reports
The guidelines for reporting come from the Communication Management Strategy document.
How does the Project Manager decide which risk information to communicate?
The Project Manager will ask such questions as, “What has changed since the last report?” as Risk is never static.
Think again of the Summary Risk Diagram and that a Risk can move around the diagram or even above or below the Risk threshold line during the project as conditions change.
Other less formal methods such as meetings and memos can also be used.
Effective Risk Management is dependent on good communication. The more the Project Manager communicates, the more feedback they will get and increase trust within the project.
What is a Risk Budget?
A Risk Budget is a sum of money that is put aside just to deal with specific responses to threats or opportunities and it cannot be used for anything else. Certain responses to Risk will require certain actions to be done that cost money; this will be budgeted in the Risk Budget.
How do you think you can calculate a value for the Risk Budget?
There is a certain process that needs to be followed in order to calculate a value for the Risk Budget. You cannot just pull a value out of thin air. Each risk needs to be analyzed and a value assigned to the costs of the response and the likelihood. Using the likelihood and cost of Response Information for all risks, it is possible to calculate a value for the risk budget.
What can the Risk Budget be used for?
The PRINCE2 manual reminds us that this budget is used for responding to risks that occur. It should not be used to fund extra requirements that are introduced in the project or cover the cost of any delays.
The Risk Budget has nothing to do with the Change Budget, so it should not be raided if the Change Budget is empty.
The Risk Budget is set at the start of the project but new risks can be detected during the project, so it’s a good idea to increase the original Risk Budget to cover extra risks that may be identified during the project.
Risk Roles and Responsibilities
What are the Corporate and Program Management responsible for with regard to risk?
Provide the Corporate Risk Management policy and information.
What is the Executive responsible for?
- Accountable for all aspects of the Risk Management
- Ensure that a Risk Management Strategy exits
- Ensure that Risks associated with the Business Case are identified, assessed and controlled
- Escalate Risk to the Corporate or Project Management if necessary.
What is Senior User responsible for with regard to risk?
- Ensure that Risks to the Users are identified, assessed and controlled
- This encourages Users to identify risks and provide information to the Project Manager and also to read the reports provided by the Project Manager.
What is the Senior Supplier responsible for with regard to risk?
- Ensure that risks to the supplier are identified, assessed and controlled.
What is the Project Manager responsible for with regard to risk?
- Create the Risk Management Strategy document. They can get a good template from Program Management, which will reduce the amount of work
- Create and maintain the Risk Register. They can get assistance from Project Support
- Ensure that risks are continually identified, assessed and controlled throughout the project lifecycle
- Keep the Summary Risk Diagram up to date and communicate to the project stakeholders.
What is the Team Manager responsible for with regard to risk
- Help with the identifying, assessing and controlling risk. For example, they would be asked to participate in the workshops used to identify risks.
What is the Project Assurance responsible for with regard to risk?
- Review the Risk Management practices to make sure they are performed in line with the projects Risk Management Strategy.
What is the Project Support responsible for with regard to risk?
- Assist the Project Manager in maintaining the projects Risk Register
- We have just discussed the main responsibilities and it is good to be aware of these.
PRINCE2® 7 Foundation and Practitioner
Learn PRINCE2® 7 Foundation and Practitioner Online
** Enhance your PRINCE2 career now **
PRINCE2® Masterclass gives you the skills necessary to manage projects effectively and achieve your objectives.
Get 7 days a week 12 months one to one coaching with ex PRINCE2 examiner Dave Litten.
PRINCE2® is a globally recognized project management framework. By completing both the Foundation and Practitioner courses through our self-paced e-learning, you will develop an understanding of the methodology and learn how to effectively adapt it to any project.
The PRINCE2® 7 Foundation and Practitioner Masterclass is PeopleCert Accredited and guarantees to take you from PRINCE2 Novice to PRINCE2 Practitioner with our famous video learning, study guides and practice exams.
What Does the Masterclass Cover?
The PRINCE2 Foundation examination assesses your knowledge and comprehension of the PRINCE2 project management methodology as detailed in the syllabus. The PRINCE2 Practitioner examination, on the other hand, gauges your ability to apply and tailor the PRINCE2 method. Candidates who pass the Practitioner exam should be able to start implementing the method on an actual project with some guidance. However, their effectiveness may differ based on their experience in project management, the complexity of the project, and the level of support they receive in their work environment.
