The Risk Practice – Part 2
PRINCE2 7 Risk Management Road Map
Risk management is an ongoing process throughout an entire project and should not be thought of as just a ‘front end’ activity. The recognition of potential risks or new or emerging ones could occur at any time.
It is helpful here to note that there are key points within a typical PRINCE2 7 project where risk management needs special attention.
The whole purpose of risk management is to identify those threats and opportunities that potentially have an impact on the project meeting its objectives.
The risk management responsibilities of the Project Manager are to ensure that such responses are having the desired effect and therefore maximizing the potential for project success.
The trigger to start a new project comes from either corporate or programme management in the form of the Project Mandate which should provide the terms of reference for the project and identify at a minimum, the prospective Executive of the project board.
It may also contain any known risks so therefore risk management is used pre-project.
The Project Mandate is refined within the Starting Up a Project process to create the Project Brief containing the project approach, Outline Business Case, and the Project Product Description containing the customer’s quality expectations and acceptance criteria.
Within the above PRINCE2 management products, there may be many PRINCE2 7 risk management triggers, for example, the project approach may be a ‘risky’ one.
In addition, a plan for the initiation stage is prepared. Whenever a PRINCE2 7 plan is created, the risk management activities are also carried out, resulting in new or modified risks being identified and an appropriate response is added to the newly created Risk Register within the Project Log.
In addition to adding the risks in the Risk Register, each plan will have PRINCE2 risk management responses added. The Project Board will now decide whether or not to authorize the Initiation stage.
Their ‘risk tolerance’ or ‘risk appetite’ along with the information of all known risks, plays a key role in the Project Board making an informed choice about the project risk, and when the Project Board use the ‘authorize the initiation’ activity, it helps them decide whether or not to proceed to the Initiation stage.
During the Initiation stage the Project Initiation Documentation is prepared and assembled and will be brought before the Project Board in the activity ‘authorize the project’ to decide whether or not to proceed to the first, or only, delivery stage.
When creating the Risk Management Approach document (which defines how risk management will occur in this particular project), along with the Project Plan and Business Case, the newly refined risk situation will again play a key role in the project board’s decision whether to proceed or not.
In parallel with the above, the Project Manager will use the Managing a Stage Boundary process to create the Next Stage Plan, and this again will trigger risk management to determine, refine known risks, or enter new risks.
The Project Board will use the ‘authorize a stage or exception plan’ activity to approve or otherwise this Next Stage Plan, where the Risk Management Approach document and the aggregated risk impacts will be considered as part of making their decision.
As you will notice both the Project Initiation Documentation and the Next Stage Plan must be approved if the project is to proceed to the first (or maybe only) delivery stage, and again, the total risk management situation provides key evidence about making such a decision.
After all of these control activity points, the Project Board will set appropriate Stage tolerances and the choice of risk tolerance may be set (risk tolerance will be documented within the Risk Management Approach document).
What this means, is that during the delivery stage, the Project Manager will use the risk tolerance metrics that the Project Board have set, and providing the stage is forecast to be complete within such tolerances, the Project Manager needs to take no further action.
If however, (using risk tolerance as an example here), tolerance is forecast to be exceeded, then the Project Manager must raise this as an issue on the Issue Register and bring this to the attention of the Project Board via an Exception Report.
The Project Board will then decide on what to do next, most likely, to request the Project Manager to create an Exception Plan for review at an Exception Assessment (EXA).
Risk Management within the Stage
Returning to the point where the Project Manager is given authority to control and manage the first delivery stage, the first action is for the Project Manager to issue one or more work packages to the specialist team(s).
During the planning of the relevant stage, PRINCE2 7 recommends that work package descriptions and their optional Team Plans are developed in parallel.
This makes good sense as it ensures that the risk situation for both Stage and Work Packages are considered, so that when the Project Manager issues such work packages they contain any relevant risk management information along with appropriate responses.
By the same token, the specialist team or Team Manager needs to agree to carry out the Work Package via the ‘accept a Work Package activity within the Managing Product Delivery process.
As part of accepting it, the risk management situation and responses are possibly refined by the Team Manager, and such changes also need to be agreed upon.
The Team Manager may create an optional Team Plan, and in doing so will carry out risk analysis and embed the appropriate risk management responses in that plan.
Now let us consider the key points within a typical PRINCE2 7 stage in relationship to risk management:
- The Project Manager will receive regular Checkpoint Reports (the frequency of these are described within the relevant Work Package), from the specialist team or Team Manager.
These will include information on the risk management and status within each Work Package, and are included so that the Project Manager may have confidence that the work package remains on track to deliver the agreed product quality.
- The Project Manager will use the activity ‘review work package status’ to review the risk situation within that specific Work Package
- A typical PRINCE2 7 management stage will contain several work packages, and so the Project Manager must use the ‘review stage status’ activity to ensure that risk management is being effectively applied within the current stage.
The Project Manager is responsible for taking proactive action promptly whenever needed, and this takes the form of using the activity ‘take corrective action’ to implement the activities that will bring the stage back on track if required.
This will often be needed due to changing risk status and implementing risk management actions to counter this.
Of the many reasons why corrective action may be needed, would include modifying risk responses so that they are effective or carrying out risk analysis on new emerging risks and hence result in adding new activities to existing or new Work Packages.
The activity ‘capture and examine issues and risks’ is used to carry out the above.
During this stage, the Project Manager will create regular Highlight Reports for the Project Board and other key stakeholders to be kept up to date with the overall risk situation.
Each Highlight Report should contain the status of risks during the stage so that the Project Board has confidence that risk management in general, and such risks in particular, are being managed effectively.
As a result of examining issues and risks, it may be that stage tolerances are impacted by one or more risks and it may be that the Project Manager can take no effective corrective action.
In such a case, the Project Manager raises an Exception Report to bring this matter to the attention of the Project Board so that an informed choice can be made about what to do next.
Management by exception is a vital part of the Risk Management Approach within a PRINCE2 7 project. Throughout the stage, there is a ‘communication conduit’ activity between the Project Manager and the Project Board called ‘give ad hoc direction’.
This will be used as and if needed by either the Project Board or the Project Manager to ask questions, seek answers, give advice and guidance, or to give directions from the Project Board that the Project Manager should follow.
For example, if the Project Manager needs to seek advice and guidance about a risk situation, then the Project Board may be contacted informally to obtain such advice.
As another example, it may be that the Project Board knows a new or emerging risk that needs to be brought to the attention of the Project Manager so that effective risk management can be applied.
For each risk, a suitable Risk Owner/Risk Actionee must be assigned. It may be that for certain external or commercial risks one or more members of the Project Board are appointed as a Risk Owner.
This again may trigger the ‘give ongoing direction’ activity to inform the project manager.
When using the PRINCE2 7 process Closing a Project, there may be existing risks that have yet to happen, but if they did would do so after the project has finished and when the end products are being used in their operational areas.
In such a case, the Project Manager will capture such information within the Follow-on Action Recommendations document to ensure that such risk management continues to be managed and controlled after the project has closed.
PRINCE2 7 Risk Responsibilities
The Project Manager is responsible for ensuring that risks are identified, recorded and regularly reviewed.
The Project Board has four risk responsibilities:
- Keeping the Project Manager informed of any external risk exposure to the project
- Agreeing or otherwise to the project manager’s planned risk actions
- Ensuring that there is a balance between the level of risk and the business case benefits
- Keeping corporate and other senior stakeholders informed of any risks that may affect their objectives
Each risk should be allocated to a Risk Owner who is responsible for managing the risk, and a Risk Actionee, who is responsible for carrying out the risk actions (they may be the same person).
The Project Board and Project Manager may themselves own particular risks. All risks and their details are entered into the Risk Register. This is kept updated throughout the project.
New risks may arise, and existing risks may change – for example become more, or less, likely, and their impacts may increase, decrease, or change. As a result of risk status change, new actions or countermeasures may need to be planned.
The proximity of each risk should be considered – expressed as a time from today, or a specific date. This helps prioritize risk actions, and determining the severity of a risk due to the time frame when it actually might occur.
Every project should have a Risk Management Approach, describing the procedures for capturing and registering risks, and a means of control – the Risk Register, which is used to capture and maintain information on identified threats and opportunities.
PRINCE2® 7 Foundation and Practitioner
Learn PRINCE2® 7 Foundation and Practitioner Online
** Enhance your PRINCE2 career now **
PRINCE2® Masterclass gives you the skills necessary to manage projects effectively and achieve your objectives.
Get 7 days a week 12 months one to one coaching with ex PRINCE2 examiner Dave Litten.
PRINCE2® is a globally recognized project management framework. By completing both the Foundation and Practitioner courses through our self-paced e-learning, you will develop an understanding of the methodology and learn how to effectively adapt it to any project.
The PRINCE2® 7 Foundation and Practitioner Masterclass is PeopleCert Accredited and guarantees to take you from PRINCE2 Novice to PRINCE2 Practitioner with our famous video learning, study guides and practice exams.
What Does the Masterclass Cover?
The PRINCE2 Foundation examination assesses your knowledge and comprehension of the PRINCE2 project management methodology as detailed in the syllabus. The PRINCE2 Practitioner examination, on the other hand, gauges your ability to apply and tailor the PRINCE2 method. Candidates who pass the Practitioner exam should be able to start implementing the method on an actual project with some guidance. However, their effectiveness may differ based on their experience in project management, the complexity of the project, and the level of support they receive in their work environment.
