The PRINCE2 Risk Management procedure

 

PRINCE2 recommends a five step procedure for the management of risks; identify, assess, plan, implement, and communicate.  The first four steps sequential but the communicate step is done continuously and therefore is done in parallel with the first four.  Dealing with each step in turn:

 

Identify.  This has two steps to it, the first is Identify Context and the second is Identify Risks.  Identifying the context means determining the project objectives that are at risk and to formulate the Risk management Strategy document which describes how risks will be managed throughout the project.

 

Identify risks is to capture all threats and opportunities that may affect the project objectives, and an effective way of doing this is within a risk or planning workshop.

The next step is Assess, and this also has two steps; Estimate and Evaluate.  

 

Estimating each risk is determining their probability and impact, and for this a sensible set of scales will need to be chosen.  There are also several risk estimation techniques.  

 

Another aspect of risks which needs to be determined is their proximity.  Proximity is the time duration measured from today for when a specific risk may occur.  This is helpful in prioritising risks and evaluating their impact by understanding when they will occur.

 

A useful way to represent the total risk situation is to plot each risk on a Summary Risk Profile. This is a simple matrix plotting probability on the vertical axis against impact on the horizontal axis. Each risk will be represented by its reference number and the resulting picture will look like a scatter diagram.

 

The purpose of the Evaluate step is to assess the aggregated affect of all identified threats and opportunities.  From here, an assessment can be made on the overall severity of the risks facing the project.  

 

The risk severity needs to be checked that it is within the risk tolerance band set by the project board. Risk severity is often expressed as a monetary value determined by multiplying its probability by the financial impact. If this is done for each risk, and then summed, it is called the Expected Monetary Value.

 

The Plan step determines the possible responses for each threat and opportunity with the intent of removing or reducing the threats and maximising the opportunities.  An important factor in selecting each response is ensuring a balance between the cost of the response against the probability and impact of the risk occurring.

 

Examples of responses to a threat include Avoid, taking some different action, Reduce by reducing the probability/impact, Fallback, having a contingency plan to reduce the impact should the risk occur, Transfer, using some form of insurance or a third party, Share in terms of a pain/gain formula, or Accept by choosing to do nothing but to continue monitoring the situation.

 

For opportunities, the responses are; Exploit, taking some action to ensure the opportunity will happen, Share, the same as for threats, Enhance, which enhances the probability/impact by taking action now, and Reject, which is a deliberate decision not to exploit or enhance the opportunity.

 

The parallel Communicate step relates to the use of various reports throughout the project.  These are the Checkpoint Reports, Highlight Reports, End Stage Reports, End Project Reports, and Lessons Reports.

 

For more information CLICK HERE