Second Pillar of Risk Management (Respond, Monitor, and Control)

Risk Response Planning

Our project team is committed to making effective use of the actionable information that emerges from risk identification and analysis.3 Risk response strategy is the process of our team determining what, if anything, should be done with identified risks significant enough to impact project objectives. It leads to specific actions we will incorporate into our Project Management Plan (PMP) and work plans and then proactively execute. We can pursue response actions for threats (avoid, transfer, mitigate, reduce) and opportunities (exploit, share, enhance), or we can accept the risk event if the response action is not cost-effective.

We will promptly develop and implement response actions following identification and analysis. Risks have a shelf life, and Risk Management Plans (RMPs) can become stale if not monitored and updated regularly. We are committed to making use of information when it is fresh and keeping our PMPs and RMPs up to date so they do not lapse into irrelevance because they have become outdated and obsolete.

The project work plan, including the schedule and resource assignment, establishes points at which we will implement response actions to identified risks, including immediately following the CRA workshop for this project. In addition, we are reminded to be vigilant regarding risk for this project and to identify potential risk events as we think of them, so we can respond appropriately to risks encountered.

Residual Risks and Responses (primary and secondary risks)

As a project develops, its risk profile will change. Risks are identified, and response actions are implemented, which changes the nature of the project risk profile and new risks are identified. During risk identification, we identify risk events. The first time this is accomplished, it constitutes a list of primary risks; as actions are taken, secondary risks can emerge as a result of implementing the treatment response to the primary risk.

Where possible, we will deal with secondary risks as part of the primary risk response action. When developing our response actions, we will be vigilant in considering the ramifications of the response actions. We will take measures to include strategies that deal with the primary risk as well as secondary risks and endeavor to minimize or eliminate residual risk as part of risk response efforts.

Risk Monitoring and Control

Monitoring and control are not complete unless communication has occurred. COMMUNICATION is the lynch-pin of effective project management and risk management.

Communication within and among the project team will be crisp, concise, complete, correct, and timely, as will the communication to upper management and executives. Effectiveness of the risk response actions will be monitored and reported regularly, as indicated previously, at our project meetings; adjustments will be made as needed

Risk Monitoring and Control (Communication)

· Project Team

1. Record assumptions that underlie judgments and decisions.

2. Monitor and document results of implemented risk response actions.

· Upper Management and Executives

1. Avoid unpleasant surprises.

2. Fully inform parties of risks, response actions, and trade-offs.

· Accountability

1. The Project Manager documents the risk assessment process in such a way that it can be reviewed and examined to learn the reasons particular judgments and decisions were made.

· Control of Risk and Management Activities

2. The Project Manager must specify criteria for risk management success, including targets and measures used to assess performance.

3. Follow up with risk owners regarding the status of completing the risk response actions and the resulting effect; track resource allocation(s) associated with risk response actions.