Risk Accept-Avoid-Mitigate-Transfer

How to Manage Project Risks

Here's the scenario. You just bought a brand new car! It's the car you've been wanting for years and there it is, tucked safely away in your garage. It will be fun to show everyone at work the next morning. At the thought of parking at work, you become concerned about the paint getting scratched. What options do you have in dealing with this risk?

Accept the Risk of Your Car Being Scratched

An obvious response is just to accept the risk. It won't change what time you go to work or where you park. You will just hope that nobody parks too close or rubs up against your brand new car. In the event that somebody does scratch it, you'll cross that bridge when you come to it. Before that, you're not even going to think about it.

Avoid the Risk of Your Car Being Scratched

Don't like the idea of accepting the risk? Another choice is to avoid the risk altogether. You can do this by not going back to work, and keeping the car in the garage. Never letting your car see the light of day will nearly guarantee that your car won't be scratched.

Mitigate the Risk of Your Car Being Scratched

If avoiding risk is not an option, you could just lessen the chances of the risk occurring. Rather than leave your house when the traffic is the heaviest, you could leave an hour later to put more space between you and the cars around you. When you do make it to work, you could also park WAY over in the corner about a mile from the office where nobody else parks. Both steps would greatly reduce the risk of your new car being scratched.

Transfer the Risk of your Car Being Scratched

A final choice is to put someone else's car at risk of being scratched. That's right, call a taxi! You can pay someone else to remove the risk to your new car, and transfer it to someone else. They can decide how they want to handle the risk.

Types of Risk

Types of Risk

• Positive Risk - If it occurs there could be Opportunities
• Negative Risk - If it occurs there could be Threats
• Known Risk - Risks that have been identified and analyzed. Use Contingency Reserve.
• Unknown Risk - Unknown risks are not known until they happen. Use Management Reserve.
• Residual Risk - Risks remaining after implementation of planned responses (Mitigation Plan).
• Secondary Risk - Risk resulting due to implementation a risk response. If the risk response was not taken, the secondary risk would not exist.

Known-Known -> Known Risk - Known Impact
Have a mitigation plan which reduces either the Probability of occurrence or level of Impact. E.g build this plan into design, development, QC, process, skill set such that this Known Risk is mitigated as much as possible.

Known-Unknown -> Known Risk - Unknown Impact
Try to build a mitigation plan to the best possible extent. Have a Contingency Plan. E.g. add buffer to schedule &/or cost essentially consume project Contingency Reserves.

Unknown-Unknown -> Unknown Risk - Unknown Impact
Unknown risks are unknown; they are not known until they happen. You cannot make a response plan for these risks, and you cannot manage them proactively since they are not identified during the planning phase. Unknown risks are managed through the workaround, and to manage these kinds of risks, you will use the management reserve.
 
Residual Risks: Residual Risks are those risks that are expected to remain after planned responses (Mitigation Plan) of risks have been taken, as well as those that have been deliberately accepted.
For example, let’s say you are constructing a building in an earthquake prone zone. You constructed the building by assuming that the highest degree of earth quake that can happen is 6 on Richter Magnitude Scale. But what if an earth quake happens at 7 on the Richter Magnitude Scale? The Building might collapse.

Secondary Risks: A secondary risk can be defined as a risk created by the response to another risk. In other words, the secondary risk is a consequence of dealing with the original risk. A secondary risk is a risk that arises as the result of implementing a risk response. If the risk response was not taken, the secondary risk would not exist. Example
You are planning the annual employee recognition event. It will be an outdoor luau-themed event. Because there is a chance of rain, you decide to mitigate the risk of the employees getting wet and not having fun by putting up a tent.
There is still some residual risk that the employees will get wet walking from the parking lot to the tent.
There is also a secondary risk that someone will trip over the tent poles and get injured.

For identified Risk project creates Mitigation Plan.
Even after having put in the Mitigation plan the Risk happens. This is called Residual Risk then while the Residual Risk is happening or triggered implement the Contingency Plan.

In case even after the Mitigation plan and Contingency plan is implemented a Risk is existing then implement the Fallback Plan.

Just because the Mitigation &/or Contingency plan were implemented a new Risk would emanate. This Risk is called Secondary Risk. If the Mitigation &/or Contingency plan were not implemented this Risk would not have happened.

For Accepted Risk or Unknown Risks for which no planning was done a Workaround Plan is implemented.