The Risk component forms part of any PRINCE2 Practitioner training courses.
On any project there might be many uncertainties about the outcomes that may be achieved. These uncertainties may be positive outcomes or negative threats. PRINCE2 defines risk very broadly as any ‘uncertainty of outcome’. Another way of thinking about risk is a problem that might need to be faced in the future that can be identified today.
The process of thinking through these potential problems before they occur is known as risk analysis and allows us the opportunity to put in place counter-measures which can reduce the negative consequences. The results of risk analysis are written into a PRINCE2 management product known as the Risk Log. This log contains details of all of the project risks, the results of the analysis and details of what is being done about them.
In PRINCE2, risk analysis consists of 4 steps.
1. Firstly, the risk is identified e.g. there is a risk that a supplier cannot deliver materials by 30th June.
2. Secondly, the impact on the project if the risk occurs is considered and evaluated. Here, PRINCE2 suggests considering what is the impact on cost, time, quality, scope, benefits and people/resources if this risk occurs. For example, if the supplier cannot deliver materials by 30th June, the impact on costs might be considered as high impact (adding £5,000 to project costs).
Another factor to consider is how likely the risk is to occur. For example, the risk of the supplier not delivering materials by 30th June might be considered highly likely, or not very likely. Similarly, it is important to know the proximity (how close in time) when this risk might occur. In this case, the proximity is 30th June. The results of all these factors are recorded in the Risk Log.
3. Thirdly, it is important to consider suitable responses to the risks. PRINCE2 considers 5 different responses.
Prevention – doing things differently to prevent this risk occurring – for example, not ordering the materials from this supplier.
Reduction – taking steps to either reduce the negative consequences, or reduce the likelihood of this risk to occur – for example, by ordering the materials earlier therefore giving the supplier more time to deliver.
Transference – transferring the risk to a third party via an insurance policy, or perhaps by adding in a penalty clause into the supplier contract.
Acceptance – this is where the risk is tolerated perhaps because nothing can be done about it.
Contingency – this is a series of actions that are performed as and when this risk materialises – for example, if the supplier doesn’t deliver materials by 30th June, then cancel their contract and find another supplier instead.
Any risk may have one or more potential responses for each of these categories, only some of which might be suitable.
4. The fourth step of risk analysis is to select a suitable response(s) from those just identified. Here, the cost of taking the action must be weighed up against both the likelihood of the risk to occur and the impact of the risk if it does occur. It would not be sensible to spend much money on counter-measures for a risk which is unlikely to occur and if it does, shall have negligible consequences. On the other hand, if the risk is likely to occur and its consequences are enormous, then relatively large funds might be allocated to one or more suitable responses.
PRINCE2 then defines two further steps which form part of risk management.
1. Identify the resources required to perform the selected countermeasures and add these to the plan. The actions may be no more than someone keeping a watchful eye on a risk to see if its status has changed.
2. Monitor these actions to see if they are having the desired effect. If the desired effect is not being met, then risk analysis may need to be performed again.
Each risk should have an owner which is someone best situated to keep an eye on it. The Project Manager would normally recommend an owner, and the Project Board would decide the owner. The owner would then monitor each of the risks they own. The Project Manager must know who all the owners are and make sure they are monitoring the risks.
The Project Manager is responsible for ensuring that risks are identified, recorded and regularly reviewed. The Project Manager is expected to report to the Project Board the status of risks in Highlight Reports and End Stage Reports. The Project Board takes decisions about what to do about risks.
PRINCE2 refers to the concept of ‘risk tolerance’, sometimes known as ‘risk appetite’ – in other words, how much risk is the Project Board prepared to tolerate on the project. For example, the Project Board may be prepared to tolerate some financial risk but would not tolerate any risks to health and safety. It is important to remember that all projects have some risk and simply ignoring risks is not a sensible option. The PRINCE2 management of risk component therefore allows the Project Board to manage the project’s exposure to risk.
This article was taken from the booklet Concise PRINCE2™ (PRINCE2 ™ is a Trade Mark of the Office of Government Commerce) which was offered to students as part of the PRINCE2 training course (version 2005) by Knowledge Train. This booklet has been based on OGC (PRINCE2™) material. Reproduced under licence from OGC.
No part of this work may be reproduced, transcribed, or used in any form or by any means – graphic, electronic or mechanical, including photocopying, recording, taping, web distribution, or information storage and retrieval systems – without the prior written permission of the publisher.
©2008 Knowledge Train Limited unless otherwise stated.
