11.1 Plan Risk Management The process of defining how to conduct risk management activities for a project Detailed risk planning enhances the overall probability of successful project completion Risk planning creates visibility of the degree and types of risk inherent in a specific project For high risk, large and complex projects – contingency is often added to cover responses to unexpected risks The risk planning process (11.1) happens concurrently with the project management planning process (4.2) Occurs during Planning Initiation Planning Execution Close Monitor Control Adapted from PMBOK 4th Edition

11.1 Plan Risk Management Inputs to Plan Risk Management Project Scope Statement Cost Management Plan Schedule Management Plan Communications Management Plan Enterprise Environmental factors Organisational Process Assets - Risk management standards Risk management policies and procedures Risk categories and definitions Standard templates Lessons learned from previous projects Stakeholder registers Initiation Planning Execution Close Monitor Control Adapted from PMBOK 4th Edition Adapted from PMBOK 4th Edition

11.1 Plan Risk Management The PMBOK includes only one technique for this process – Planning Meetings and Analysis, this is a very simplistic view. Other tools and techniques have been included here from practice - Risk Management Standards Workshops Risk Management Methodologies Planning Meetings Risk Analysis Tools Stakeholder Consultation Subject Matter Experts Templates Standard Risk Categories Risk Registers

11.1 Plan Risk Management Outputs of this process include – Risk Management Plan Risk management methodology Risk management roles and responsibilities Risk Action plans including costs and resources required to manage specific risks Risk categories Risk probability and likelihood matrix Risk Log Project Document Updates Stakeholder Register and Responsibility Assignment Matrices (part of Project HR) Change Requests Initiation Planning Execution Close Monitor Control Adapted from PMBOK 4th Edition

Risk Categories Risk categorisation is critical It helps to ensure that all aspects of risk on the project are considered Standard risk categories are hard to find Start with the Project Management Key Knowledge Areas and industry frameworks Risk Breakdown Structure – Lists the categories and sub-categories within which risks may arise for a typical project Different RBSs will be appropriate for different types of projects, different organisations and different industries Provides a framework to help ensure all risks are considered

Example Risk Breakdown Structure Adapted from PMBoK Guide – Fourth Edition

Probability and Impact Definitions Likelihood = Probability Consequences = Impact Likelihood is the probability that a risk will occur on a project Consequences are the impacts that the risk will have on the project outcomes (Scope, Time, Cost and Quality) if it does occur

Likelihood and Consequences Simple Likelihood Scale Simple Consequences Scale Rating Definition Scale Almost Certain Will definitely occur or will occur on an annual cycle 5 Likely Similar events have been experience several times in the past 20 years 4 Possible Will occur once every 20 years 3 Unlikely Occurs from time to time 2 Rare Occurrence is possible but highly unlikely 1 Rating Definition Scale Severe Most objectives cannot be met 5 Major Some important objectives cannot be met 4 Moderate Some objectives impacted but may still be met 3 Minor Minor effects that can be remedied 2 Negligible Almost no impact on objectives 1 Adapted from Risk Management Guidelines – Companion to AS 4360:2004

Simple Risk Rating Matrix Put your likelihood and consequence ratings together and what do you get? Risk Rating = Likelihood x Consequences Rating Severe Major Moderate Minor Negligible Almost Certain Red 25 20 15 Amber 10 Green 5 Likely 16 12 8 4 Possible 9 6 3 Unlikely 2 Rare 1

Inclusions in Risk Register during Planning Risk ID Risk Category Risk Description Risk Owner Likelihood Impact Risk Rating Management /Mitigation Strategies Residual Likelihood Residual Impact Residual Rating Status Priority Risk Id Can be a simple as a number May relate to the risk category Used as a unique identifier may be an internal standard Risk Description Plain English explanation of the risk One to two sentences in length Ensures common understanding Risk Category Can be taken from industry frameworks Can be set at internal standards May need to be developed/tailored Ensures identification of all risks Assists with monitoring and control Risk Owner A specific person or role Ensures clear ownership of the risk Responsible for monitoring & control Adapted from PMBOK 4th Edition