Risk

• Purpose
• Risk defined
  • What is a risk?
  • What is at risk?
  • What is risk management?
• Management of Risk
  • M_o_R_principles
• Risk management in projects
• Risk Management Strategy
• Risk Register
• Risk management procedure
  • Overview
  • Identify part 1
  • Identify part 2
  • Assess
  • Plan
  • Implement
  • Communicate
• Risk budget
• Responsibilities

Key sections

• Introduction
• Business case
• Organization
• Quality
• Plans
• Risk
• Change
• Progress
• Introduction to processes
• Starting up a projectDirecting a project
• Initiating a project
• Controlling a stage
• Managing Product Delivery
• Managing a Stage Boundary
• Closing a Project
• Tailoring PRINCE2 to the project environment
• Directing Projects with PRINCE2

The PRINCE2 approach

Risk management procedure

© Crown copyright 2005 Reproduced under licence from OGC

Identify – part 1

The primary goal of the ‘Identify context’ step is to obtain information about the project in order to understand the specific objectives that are at risk and to formulate the Risk Management Strategy for the project.

The Risk Management Strategy describes how risks will be managed during the project.
It is created during the initiation stage and then reviewed and possibly updated at the end of each stage.
The project’s Risk Management Strategy should be based on the corporate risk management policy or on the programme’s Risk Management Strategy.

The following will have an influence on the project’s Risk Management Strategy:

• Customer’s quality expectations
• Number of organizations involved and the relationship between them
• The needs of the stakeholders involved with the project
• The importance, complexity and scale of the project
• What assumptions have been made
• The organization’s own environment (e.g. legislative or governance requirements)
• The organization’s approach to risk management as described by its risk management policy.

This information will be derived from the project mandate, the Project Brief and the Project Product Description.
The Risk Management Strategy will include decisions on the:

• Risk management procedure
• Tools and techniques to be used
• Records to be kept
• Risk reporting
• Timing of risk management activities
• Roles and responsibilities for the risk management procedure
• Risk scales to be used (for likelihood, impact, proximity)
• Any categorization of risks (and possibly the risk breakdown structure to use)
• Risk response categories to be used
• Early warning indicators
• Any risk tolerances
• Whether a risk budget will be established and, if so, how it will be controlled.

The early warning indicators (relevant to the project) will provide advanced warning that one or more of the project’s objectives could be at risk.
Early warning indicators could include progress performance data (see the section covering ‘progress’) such as:

• Percentage of Work Packages accomplished/not accomplished to schedule
• Percentage of approvals accomplished/not accomplished to schedule
• Number of issues being raised (per week/month)
• Percentage of issues that remain unresolved
• Average number of days that issues remain unresolved
• Average number of defects captured in quality inspections
• Adherence to budget (e.g. rate of spend behind or ahead of planned spend)
• Adherence to schedule (e.g. days behind or ahead of schedule).

Other early warning indicators could include non-project data such as customer satisfaction, absenteeism levels, staff attrition rates etc., if they are relevant to the project.
It is also useful to analyse and report on the direction of travel of these early warning indicators (i.e. are they improving/deteriorating) as that can be of more significance than their snapshot value.

The primary goal of the ‘Identify risks’ step is to recognize the threats and opportunities that may affect the project’s objectives.

PRINCE2® recommends the following actions:

• Capture identified threats and opportunities in the Risk Register
• Prepare early warning indicators to monitor critical aspects of the project and provide information on the potential sources of risk
• Understand the stakeholders’ view of the specific risks captured.

An effective way of identifying risks is to use a risk workshop.
This is a group session designed to identify threats and opportunities.
The session should be facilitated by someone who is able to use a range of identification techniques, such as those listed in the ‘Risk identification techniques’ example next.

Workshops should lead to the identification of a broad range of risks and possible risk owners.

Risk management is a large area and is covered in depth in ‘The Complete Risk Management package’.

PRINCE2® is a Registered Trade Mark of the Office of Government Commerce in the United Kingdom and other countries.