PRINCE2 Risk Responses and Planning
Most folks find the PRINCE2 risk management procedure straightforward, yet when it comes to sitting the PRINCE2 Practitioner, they get confused on response types and get low scores.
I know why. It is because the exam questions will often set a risk scenario and the candidate is asked to choose which risk response type it is. It’s one thing memorizing risk responses, but spotting which action has been taken seems harder. So, let’s fix that right now.
The new PRINCE2 official Manual includes some subtle changes to the definition of the risk responses so pay special attention here!
AVOID the threats and exploit an opportunity
This option is about making the uncertain situation certain by removing the risk. This can often be achieved by removing the cause of a threat, or by implementing the cause of an opportunity.
This option may be adopted for no extra cost by changing the way the work is planned. More often though, costs will be incurred to remove or residual risk for threats and opportunities. Where costs are incurred, these must be justified, that is the cost of the response is warranted to make the situation certain.
REDUCE a threat or in enhance an opportunity
This solution involves definite action now to change the probability and/or the impact of the risk. The term ‘mitigate’ is relevant when discussing reduction of a threat, that is making the threat less likely to occur and/or reducing the impact if it did.
Enhancing an opportunity is the reverse process, that is, making the opportunity more likely to occur and/or increasing the impact if it did.
This option commits the organization to costs for reduction or enhancement now, response costs must be justified in terms of the change to residual risk.
TRANSFER the risk for a threat or an opportunity
Transfer is an option that aims to pass part of the risk to a third party. Insurance is the classic form of transfer, where the insurer picks up the risk cost, but where the insured, retains the impact on other objectives, for example time delay.
Transfer can be applied to opportunities, where a third party gains a cost benefit but the primary risk taker gains another benefit, but this is not a commonly used option whereas transfer of threats is commonly used.
The cost of transference must be justified in terms of the change to residual risk to determine if the premium to be paid is worth it. It is important to note that some elements of risk cannot be transferred, although an organization may choose to delegate the management of the risks to a third party.
SHARE the risk for a threat or opportunity
Share is an option that is different in nature from the transfer response. It seeks multiple parties, typically within a supply chain, to share the risk on a pain/gain share basis.
Rarely can risks be entirely shared in this way, for example, the primary risk taker will always need to protect its brand and reputation, but this can be a successful way of encouraging collaboration on risk management activities, particularly in programs and projects.
ACCEPT the risk threat or opportunity
The accept option means that the organization ‘takes the chance’ that the risk will occur, with its full impact if it did. This is the ‘take no action’ option.
There is no change to residual risk with the except option, but neither are any costs incurred now to manage the risk, or to prepare to manage the risk in future.
An example would be the risk to profitability because of currency fluctuations. An organization may decide to take the chance and not engage in any hedging or other provision to protect margins from a wide variation in rates.
This option would not be appropriate if the risk exposure exceeded the risk tolerance threshold for the organizational activity in question.
Note that in such a case as currency fluctuations, where the impact could be positive or negative, this is actually two risks, because a risk is the relationship between the uncertain events and the impact of that event.
There is a risk leading to loss and a risk leading to gain. Framing the uncertainty as two risks allows for different responses to each part.
Prepare CONTINGENCY PLANS for a threat or opportunity
This option involves preparing plans now, but not taking action now.
Most usually associated with the accept option, preparing contingency plans in this instance is stating that we will accept the risk for now, but we will plan for what we will do if the situation changes.
This option applies equally to other responses and is often referred to as a ‘fallback plan’, that is, what we will do if the original response does not work.
Fallback plans applied to all the other strategies, even avoiding a threat and exploiting an opportunity, because the plan to avoid/exploit may not be successful despite good intentions.
This option is important because it incorporates future managerial flexibility for a committed cost that is smaller than investing in more proactive strategies. This does not mean that investing money now to respond to a risk is wrong, but such investments do need to be cost-justified as previously mentioned.
Now let us look at planning your chosen responses.
Plan
The plan step involves identifying and evaluating the appropriate risk response to remove or reduce threats, and to maximize opportunities as described above.
If a threat is reduced rather than removed, the remaining risk is called a residual risk. If the residual risk is significant, then it may be appropriate to select more than one risk response.
In some cases, implementing a risk response will reduce or remove other related risks. It is also possible that the responses to risks, after they had been implemented, will change some aspect of the project.
This may lead to secondary risks, that is, risks that occur because of invoking a risk response. It is essential that these are identified, assessed and controlled in the same way as the initially identified risk.
It is important that risk responses balance the cost of implementing the response against a probability and impact of allowing the risk to occur.
One way of assessing this is to compare the cost of the risk response with the difference in the expected monetary value of the risk before and after the risk response.
If the cost of the risk response is lower than the reduction in the expected much we value, then it is worth undertaking the risk response. However, it is worth bearing in mind the overall effect of all risk response activities on the project team in terms of removing their focus away from delivering the project and on two risk response actions.
Any chosen response needs to be built into the appropriate level of plan. For more significant risks it may be appropriate to put in place not only early warning indicators to indicate whether the risk is likely to materialize, but also plans for managing the risk should it occur.
Consideration should be given to the effect the possible responses could have on:
- The project plan
- The management stage plan
- The work packages
- The business case
- Corporate, programme management or the customer
The risk response needs to identify the most appropriate body to manage a risk or an issue.
This may not be the project team, especially if:
- The project team do not have within the scope of influence the ability to implement an appropriate risk response
- Realization of risk will materially impact the projects business justification
- The project is part of an over-arching program and it would be more appropriate for the risks to be managed at programme level. For example, if a specific project identifies a risk that is common across projects within the programme
Implementation of a risk response will cause a project to exceed agreed tolerances, either within a management stage, or overall
Reporting of the risk to a corporate body is required by the corporate risk policies and procedures. This might typically occur in a regulated organization where certain risks might either be reportable by the organization, or where realization of the risk might cause a breach of a regulatory condition.
Escalation would first be to the project board. Depending on the risk tolerance, escalation might also be to the overarching programme, corporate body or customer.
This course is DEPRECATED
The old PRINCE2 6th Edition Foundation and Practitioner syllabus was upgraded in 2024. Check out the brand NEW PRINCE2 7th Edition Masterclass, covering all the current syllabus, training material and online exam benefits HERE
Your Route To PRINCE2 6th Edition Practitioner
Study PRINCE2 6 Foundation and Practitioner Exams with our famous on-line course with streaming HD Video Lessons, study guides and mock exams. In the last fifteen years we have had 6,000+ Academy students successfully transform their careers as PRINCE2 Practitioners.
