Risk management is an ongoing process throughout an entire project and should not be thought of as just a ‘front end’ activity. The recognition of potential risks or new or emerging ones could occur at any time, but it is helpful here to note that there are key points within a typical PRINCE2 project where risk management need special attention.
The whole purpose of risk management is to identify those threats and opportunities that potentially have an impact on the project meeting its objectives. The risk management responsibilities of the project manager is to ensure that such responses are having the desired effect and therefore maximising the potential for project success.
I want to use the diagram below them as an aid to show exactly where these key points are:
The trigger to start a new project comes from either corporate or programme management in the form of the project mandate which should provide the terms of reference for the project and identify as a minimum, the prospective executive of the project board. It may also contain any known risks so that risk management can start pre-project.
The project mandate is refined within the ‘starting up a project’ process to create the project brief containing the project approach, outline business case, and a the project product description containing the customers quality expectations and acceptance criteria.
Within the above PRINCE2 management products, there may be many PRINCE2 risk management triggers, for example, the project approach may be a ‘risky’ one.
In addition, a plan for the initiation stage is prepared. Whenever a PRINCE2 plan is created, the risk management activities are also carried out, resulting in new or modified risks be identified as an appropriate response is added to the newly created risk register.
Also along with the PRINCE2 risk management risks in the risk register, each plan will have PRINCE2 risk management responses added.
Along with the management products described in the above two paragraphs, the project board decide whether or not to authorize the initiation stage. Their ‘risk tolerance’ or ‘risk appetite’ along with the information of all known risks, play a key role in the project board making an informed choice with regard to PRINCE2 risk management when using the ‘authorize the initiation’ activity, about whether or not to proceed to the initiation stage.
During the initiation stage the project initiation documentation is prepared and assembled and will be brought before the project board in the activity ‘authorize the project’ to make a decision whether or not proceed to the first, or only, delivery stage.
In creating its the various strategy documents (in particular here is the Risk Management Strategy document which defines how risk management will occur in this particular project), along with his project plan and business case, as the newly refined risk situation will again play a key role in the project board’s decision whether to proceed or not.
In parallel with the above, the project manager will use the ‘managing a stage boundary’ process to create the next stage plan, and this again will trigger risk management to determine and refine known enter new risks. The project board will use the ‘authorize a stage or exception plan’ activity to approve or otherwise this next stage plan, where the risk management strategy and the aggregated risk impacts will be considered as part of making their decision.
As you will notice both the project initiation documentation and the next stage plan must be approved if the project is to proceed to the first (or only) delivery stage, and again, the total risk management situation provides key evidence about making such a decision.
After all of these control activity points, the project board will set appropriate tolerances, and the choice of risk tolerance may be set (risk tolerance will be documented within the Risk Management Strategy document). What this means, is that during the delivery stage, the project manager will use the risk tolerance metrics that the project board have set and providing the stage is forecast to complete within such tolerances the project manager need take no further action.
If however, (using risk tolerance as an example here), tolerance is forecast to be exceeded, then the project manager must mortgage this as an issue on the issue register and bring this to the attention of the project board via an exception report.
Returning to the point where the project manager is given authority to control and manage the first delivery stage, the first action is for the project manager to issue one or more work packages to the specialist team(s).
During the planning of the relevant stage, PRINCE2 recommends that work packages and their optional team plans are developed in parallel. This makes good sense as it ensures that the risk situation for both stage and work packages are considered, so that when the project manager issues such work packages they contain any relevant risk management information along with appropriate responses.
By the same token, the specialist team or team manager needs to agree to carry out the work package via the activity within the ‘managing product delivery’ process of ‘accept a work package’. As part of accepting it, the risk management situation and responses are possibly refined, as the ultimately, also need to be agreed.
The team manager may create the optional team plan, and in doing so will carry out risks analysis and embed the appropriate risk management responses.
Now let us consider the key points within a typical PRINCE2 stage in relationship to risk management:
The project manager will receive regular checkpoint reports from the specialist team or team manager and these will include information on the risk management and status within each work package, and are included so that the project manager may have confidence that the work package remains on track to deliver the agreed product quality.
The project manager will use the activity ‘review work package status’ to carry this out. A typical PRINCE2 management stage will contain several work packages, and so it is also important that the project manager uses the ‘review stage status’ activity to ensure that risk management is being effectively applied within the current stage.
The project manager is responsible for taking proactive action in a timely manner whenever needed, and this takes the form of using the activity ‘take corrective action’ to implement the activities that will bring the stage back on track if required. This will often be needed due to changing risk status and impleneting risk management actions to counter this.
Of the many reasons why corrective action may be needed would include modifying risk responses so that they are effective or carry out risk analysis on new emerging risks and hence add new activities to existing or new work packages.
The activity ‘capture and examine issues and risks’ is used to carry out the above.
During the stage, the project manager will create regular highlight reports for the project board and other key stakeholders. These two should contain the status on risks’ during the stage so that the project board have confidence that risk management in general, and such risks in particular, are being managed effectively.
As a result of examining issues and risks, it may be that stage tolerances are impacted by one or more risks’ and that the project manager can take no effective corrective action. In such a case, the project manager raises an exception report to bring this matter to the attention of the project board to the an informed choice can be made about what to do next. Management by exception is a vital part of the risk management strategy within a PRINCE2 project.
Throughout the stage, there is a ‘communication conduit’ between the project manager and the project board called ‘give ad hoc direction’. This will be used as and if needed by either the project board or the project manager to ask questions, seek answers, give advice and guidance, or to give directions that the project board want the project manager to follow.
For example if the project manager needs to seek advice and guidance with regard to a risk situation, then the project board may be contacted in an informal manner to obtain such advice.
As another example, it may be that the project board have knowledge of a new or emerging risk that needs to be brought the attention of the project manager so effective risk management can be applied.
For each risk, a suitable owner/’actionee’ must be assigned, then it may be that for certain external all commercial risks’ that one or more members of the project board are appointed as such an owner. This again may trigger the ‘give ad hoc direction’ activity to inform the project manager.
Finally, I want to remind you about when using the PRINCE2 process ‘closing a project’. There may be existing risks that the have yet to happen, but if they did would do so after the project has finished as the end products are in their operational status’.
In such a case, the project manager will capture such information within the ‘follow-on action recommendations’ document to ensure that such risk management continues to be managed and controlled.
For more information on this click on PRINCE2 Risk Management.
I hope you found my risk management article useful!
David spent 25 years as a senior project manager for USA multinationals, and has deep experience in project management. He now develops a wide range of project-related downloadable video training products under the Primer and PM Mastery System brand names. In addition, David runs project management training seminars across the world, and is a prolific writer on the many topics of project management.