PRINCE2 risk management alignment
A project may need to align its Risk Management Approach with organizational, programme or portfolio policies, standards or processes. This might include
- Aligning with any centrally defined risk management policies, standards and approaches
- Using any centrally defined risk management techniques
- Adopting any centrally deployed tools
- Aligning with any centrally defined risk management roles or competency frameworks
Organizations will often require that a consistent, mandated process is used across different projects, typically to ensure they can assess the overall risk exposure of the organization across projects.
This will also be the case when organizations are seeking to develop their project management maturity using a maturity model such as P3M3
PRINCE2 Recommended risk management procedure
PRINCE2 recommends, but does not mandate, a risk management procedure as shown in the diagram below:
The process consists of five steps, the first four of which are sequential:
- Identify context and risks
- Assess, estimate and evaluate
- Plan
- Implement
‘Communicate’, the fifth step, operates in parallel as the outputs of any of the other steps may need to be communicated to stakeholders at any point in the process
All the steps are repeatable. When the additional information becomes available, it is often necessary to repeat earlier steps based on this new information
The project board attitude to risk
A key decision that needs to be recorded within the Risk Management Approach, is the project board attitude towards risk taking. This will determine the amount of risk that is acceptable and will, in turn, help set risk tolerances.
Project size, scale and complexity, and risk impact
It’s important to ensure that the Risk Management Approach is appropriate not only to the project size, style and complexity, but also to the projects likely risk impact.
It is important that the Risk Management Approach for a project, supports effective decision-making on the project and does not create an undue burden or bureaucracy.
In general, smaller, simple projects will need correspondingly simpler risk management arrangements.
As an example, on a less complex project, the project manager would typically undertake most risk management activities, but on a more complex project, these might be delegated to a dedicated risk manager.
Similarly, a Risk Register might be held in a simple list on a whiteboard, in a spreadsheet or in a dedicated IT system. The most important point here, is that the Risk Management Approach is appropriate.
To do this, it is critical to consider not just the project’s cost, size, scale and complexity, but also the potential scale of risk impact from the project.
It is possible for projects to create impacts that far outweigh their apparent size, style and complexity.
Project delivery approach
It is important that the approach to managing risk works with and supports, the projects chosen delivery approach. As an example, a Risk Management Approach that includes monthly risk review meetings, is unlikely to effectively support and agile project delivery approach with deliveries may be happening every two weeks.
PRINCE2 does not mandate a format for risk management products, nor does it mandate specific timings for risk management activities.
What is important, is that they are appropriate for the format and pace of the project.
It is also important to recognize that the projects delivery approach might work to mitigate or reinforce specific risks. An example here is the use of agile where requirements at the beginning of a project should be high level, and therefore, risks of insufficient requirement detail are inappropriate.
Again, with agile, the high level of engagement with customers directly involved in the project can lead to uncontrolled changes if not managed correctly.
Commercial considerations
In a commercial context, there may be a need for more than one Risk Register as some project risks could be unique to only one party, with good reasons for them not to be visible to the other party.
Where a joint Risk Register is used, care should be taken to establish moves risk it really is, and the risk owner appointed accordingly. As an example, on a fixed price contract, any cost overruns will impact the supplier’s business case, whereas timescale overruns will typically impact the customer’s business case.
Establishing a Risk Budget
It might be appropriate to identify and ring-fence an explicit Risk Budget within the project’s budget. This is a sum of money to fund specific management responses to the project threats and opportunities, for example the cost of any contingent plans being implemented if a risk materializes.
The Risk Budget is based on the aggregate costs of all the projects planned risk responses. For simple projects, it will usually be enough to add up the cost of all risk responses.
For more complex projects, care needs to be taken that the aggregation of the factored costs is not skewed by a small number of large risks.
This is where analytical techniques, such as Monte Carlo simulation and associated software tools can help.
As the project progress is, some of the risks previously identified will occur, while others will not. New risks may be identified during the project whose response costs will not have been included within the Risk Budget.
This means that it is prudent to include a provision for unknown risks that are yet to be identified, within the Risk Budget.
As the Risk Budget is part of the project budget, there may be a tendency to treat it as just another sum of money that the project manager can spend. This culture should be discouraged in favor of the Risk Management Approach defining the mechanisms for control of, and access to, this budget.
Pass Your PRINCE2 Practitioner Exam At First Try HERE!
This course is DEPRECATED
The old PRINCE2 6th Edition Foundation and Practitioner syllabus was upgraded in 2024. Check out the brand NEW PRINCE2 7th Edition Masterclass, covering all the current syllabus, training material and online exam benefits HERE
Your Route To PRINCE2 6th Edition Practitioner
Study PRINCE2 6 Foundation and Practitioner Exams with our famous on-line course with streaming HD Video Lessons, study guides and mock exams. In the last fifteen years we have had 6,000+ Academy students successfully transform their careers as PRINCE2 Practitioners.
