1. Risk Management How To Develop a Risk Response Plan alphaPM Inc. www.alphaPM.com

2. The Value of Risk Management Risk Management is one of the most powerful and effective tools for ensuring that a project meets its schedule, budget and quality objectives – yet it is all too often one of the least used. It is an obvious fact that problems occurring later in a project are harder and more costly to fix (if they can be fixed at all), than if they were anticipated and addressed earlier (think “Titanic”). The Risk Response Plan is a very easy tool to use for applying Risk Management to your project.

3. Risk Management Processes Risk Identification and they are iterated throughout the project Risk Response Planning Risk Monitoring and Control Risk Analysis There are four stages to developing and maintaining a Risk Response Plan

4. Risk Response Plan # Date Risk Probability of Occurrence (H/M/L) Impact (H/M/L) Expected Value (H/M/L) Mitigating Actions Action By – Target Date Status 1 2 3 4 5 6 7 8 9 10 This Risk Response Plan can be used to identify and maintain project risks, and covers all the stages of Risk Management (A soft copy of this template is available in the PM Toolkit library). Risk Response Planning Risk Analysis Risk Identification Risk Monitoring and Control

5. Risk Management Processes #DateRisk Probability of Occurrence (H/M/L) Impact (H/M/L) Expected Value (H/M/L) Mitigating Actions Action By – Target Date Status Risk Identification - Project Charter - Project Scope Statement - Project Plan - Historical Information - Lessons Learned Tools & Techniques - Documentation Reviews - Information Gathering techniques (e.g brainstorming) - Checklists - Assumptions Analysis - Diagramming techniques - Identified Risks - Project Plan updates Outputs Inputs Risk Analysis - Identified Risks - Work Performance information - Qualitative and Quantitative Risk Analysis techniques - Risk Probability and Impact Assessment - Probability and Impact matrix - Risk Categorization - Prioritized Risks Risk Response Planning - Prioritized Risks - Project Plan - Risk Response Plan - Contingency Reserve - Project Plan updates Strategies for addressing risks - Avoidance - Transference - Mitigation - Acceptance Risk Monitoring and Control - Work Performance - Change Requests - Project Plan - Ongoing Risk Analysis - Risk Reassessment - Risk/Project audits - Variance and Trend analysis - Performance measurement - Reserve management - Corrective actions - Workaround plans - Project plan updates - Update Risk Response Plan - Lessons learned The following are some of the inputs, tools and techniques and outputs that can be used to complete the Risk Response Plan through each Risk Management Stage.

6. Risk Response Plan # Date Risk Probability of Occurrence (H/M/L) Impact (H/M/L) Expected Value (H/M/L) Mitigating Actions Action By – Target Date Status 11/15/05Vendor may not deliver application software on time 21/15/05Subject matter experts may not be available on dates planned 31/15/05Snowstorm may prevent cutover team from working on site 41/15/05Server capacity may not support the planned number of users 51/15/05Client may change requirements causing delay in cutover 6 7 8 9 10 Step 1: Identify Risks Step 1 – Identify Risks Using some of the tools and techniques shown in the previous slide (e.g. brainstorming with subject matter experts and key team members or using checklists), identify the risks that may affect the project. Identify categories of risk (e.g. Technology, Staffing, Contractual etc.), to improve the process of discovering risks. Do not start to “red light” or resolve risks at this Risk Identification stage.

7. Risk Response Plan # Date Risk Probability of Occurrence (H/M/L) Impact (H/M/L) Expected Value (H/M/L) Mitigating Actions Action By – Target Date Status 11/15/05Vendor may not deliver application software on time HH 21/15/05Subject matter experts may not be available on dates planned LL 31/15/05Snowstorm may prevent cutover team from working on site LH 41/15/05Server capacity may not support the planned number of users MM 51/15/05Client may change requirements causing delay in cutover MH 6 7 8 9 10 Step 1 Identify Risks Step 2 Analyze Risks Step 2 – Analyze Risks Determine (with the involvement of subject matter experts and key project stakeholders) the probability of occurrence and the impact for each risk, using the following criteria as a guide. Probability of occurrence High – 70 - 100% Medium – 30 – 70% Low – 0 - 30% Impact High – Will delay cutover or have major cost impact e.g. more than $15,000. Medium – Will cause impact to major milestones or cause cost impact of $5,000 to $15,000. Low – Will have only minor effects on the schedule or the cost of the project. Note: These values can be adjusted to match the risk tolerance of your organization and the size and nature of the project.

8. Risk Response Plan # Date Risk Probability of Occurrence (H/M/L) Impact (H/M/L) Expected Value (H/M/L) Mitigating Actions Action By – Target Date Status 11/15/05Vendor may not deliver application software on time HH 21/15/05Subject matter experts may not be available on dates planned LL 31/15/05Snowstorm may prevent cutover team from working on site LH 41/15/05Server capacity may not support the planned number of users MM 51/15/05Client may change requirements causing delay in cutover MH 6 7 8 9 10 Step 1 Identify Risks Step 2 Analyze Risks H M L LMH Probability Impact Expected Value High Medium Low Step 2 – Analyze Risks (continued) Using the tables below, match the probability and impact for each risk to find the Expected Value of the “Risk Exposure”.

9. Risk Response Plan # Date Risk Probability of Occurrence (H/M/L) Impact (H/M/L) Expected Value (H/M/L) Mitigating Actions Action By – Target Date Status 11/15/05Vendor may not deliver application software on time HHH 21/15/05Subject matter experts may not be available on dates planned LLL 31/15/05Snowstorm may prevent cutover team from working on site LHM 41/15/05Server capacity may not support the planned number of users MMM 51/15/05Client may change requirements causing delay in cutover MHH 6 7 8 9 10 Step 1 Identify Risks Step 2 Analyze Risks H M L LMH Probability Impact Step 2 – Analyze Risks (continued) Using the tables below, match the probability and impact for each risk to find the Expected Value of the “Risk Exposure”. Expected Value High Medium Low

10. Risk Response Plan # Date Risk Probability of Occurrence (H/M/L) Impact (H/M/L) Expected Value (H/M/L) Mitigating Actions Action By – Target Date Status 11/15/05Vendor may not deliver application software on time HHH Establish a penalty clause in the contract with the vendor. JR – 1/23/05 21/15/05Subject matter experts may not be available on dates planned LLL (No need to address since Expected Value is “Low”) 31/15/05Snowstorm may prevent cutover team from working on site LHM Arrange for key team members to stay in a nearby hotel. BD – 1/20/05 41/15/05Server capacity may not support the planned number of users MMM Arrange for extra server capacity to be installed JR – 1/28/05 51/15/05Client may change requirements causing delay in cutover MHH Establish a “freeze” date, with any changes applied to a future release LK – 1/22/05 6 7 8 9 10 Step 1 Identify Risks Step 2 Analyze Risks Step 3 Identify actions to mitigate each risk Step 3 – Identify actions to mitigate each risk For risks with a High and Medium Risk Exposure, identify the actions that can be taken to “mitigate” each risk (i.e. Reduce the probability and/or the impact of the risk). Ensure an “owner” and due date is assigned for each action. Note: A “best practice” is to directly address any risks that have a probability of occurrence that is greater than 50% and incorporate the mitigating actions for those risks in the project plan.

11. Risk Response Plan # Date Risk Probability of Occurrence (H/M/L) Impact (H/M/L) Expected Value (H/M/L) Mitigating Actions Action By – Target Date Status 11/15/05Vendor may not deliver application software on time HHH Establish a penalty clause in the contract with the vendor. JR – 1/23/05 1/25/05 – Penalty clause inserted in contract to cover any expenses resulting from a delay in delivery. 21/15/05Subject matter experts may not be available on dates planned LLL (No need to address since Expected Value is “Low”) 31/15/05Snowstorm may prevent cutover team from working on site LHM Arrange for key team members to stay in a nearby hotel. BD – 1/20/05 1/25/05 – Accommodations booked for weekend of cutover for key staff 41/15/05Server capacity may not support the planned number of users MMM Arrange for extra server capacity to be installed JR – 1/28/05 1/25/05 – Vendor has not confirmed delivery yet 51/15/05Client may change requirements causing delay in cutover MHH Establish a “freeze” date, with any changes applied to a future release LK – 1/22/05 1/25/05 – Client Sponsor notified in writing that requirements will be frozen as of 2/15/05. 6 7 8 9 10 Step 1 Identify risks Step 2 Analyze risks Step 4 – Monitor and control risks This Risk Response Plan should be started at a high level at the very beginning of the project, and then done at a more detailed level during the planning phase, with high risks directly addressed in the project plan. The status of each risk and mitigating action should be reviewed regularly (e.g at the weekly project team meeting, along with the review of the project schedule) and documented here to provide an audit trail. The Risk Response Plan should be revisited formally at least monthly during the project life cycle, and/or at the end of each phase, to monitor identified risks and ensure new potential risks are identified and addressed. Step 3 Identify actions to mitigate each risk Step 4 Monitor and control risks

12. Risk Management: Lessons Learned RMS Titanic left Queenstown at 1:30pm on April 11, 1912 Received ice warnings on April 12, 13 and six on April 14, from 9am to 9:40pm. (Not known if messages were delivered to the bridge, or ignored). Iceberg hit at 11:40pm on April 14, causing holes in 5 bulkheads. Ship finally starts sinking just after 2am on April 15. Reference: www.titanic.com April 11April 12April 13April 14April 101912 What are some of the Lessons Learned

13. Risk Management How To Develop a Risk Response Plan alphaPM Inc. www.alphaPM.com