p. 330 · PDF 335

2 - 6 Project Risk Management

The purpose of project risk management is to clarify and control the risks (i.e., uncertain events that exert either a positive or negative influence) hidden in the project. The following processes are implemented in order to increase the number of risks that exert a positive influence and reduce the number of risks that exert a negative influence.

Process groups	Process to implement
Initiating	–
Planning	[Plan risk management]
	Identify risks
	Assess risks [Perform qualitative risk analysis] [Perform quantitative risk analysis]
	[Plan risk responses]
Implementing [Executing]	Treat risks
Controlling [Monitoring and controlling]	Control risks

View original table · p. 330

Enlarge original table

p. 331 · PDF 336

Closing	–

View original table · p. 331

Enlarge original table

Note: The terms enclosed in brackets [ ] are used only in PMBOK.

(1) Risk management plan

This process specifies the risk management methods (e.g., techniques and tools) and the risk category in a project, and prepares a risk management plan, on the basis of the project risks (i.e., high-level risks) that are described in the project charter, the project management plan, and the subsidiary plans. In the risk category, a RBS (Risk Breakdown Structure) is prepared in which stepwise refinement of risks is performed in order to classify and organize the risks.

(2) Risk identification

This process identifies the risks that affect the project on the basis of the management plan and the project documents (e.g., various estimates, baselines) that are created in each process, and creates a risk register describing the characteristics of each risk. If an executable risk treatment can also be identified during risk identification, it must also be listed in the risk register. The following techniques are available for collecting information for risk identification.

• • Brainstorming
  This is a technique to uncover and reveals the project risks by exchanging opinions freely and openly with the project team and external expert groups.
• • Delphi method
  This is a technique to identify (or create an agreement on) the project risks by repeatedly collecting, summarizing, and redistributing the opinions of several experts through questionnaires. · 1 question

The following risk identification techniques are available.

• • Checklist analysis
  The risks are identified by cross-checking against a checklist prepared by compiling together the expected risks on the basis of the information and knowledge accumulated from similar projects in the past.
• • Monte Carlo method
  The risks are identified by performing several simulations or numerical analyses that make use of probability distribution and random numbers.
• • Assumptions analysis
  The risks that occur as a result of inaccurate, incomplete, and unstable assumptions are

p. 332 · PDF 337

identified by checking the validation of the assumptions of the project.

(3) Qualitative risk analysis / quantitative risk analysis

In these analyses, the identified risks are analyzed, and each risk assessment is performed. (For example, the priority for risk response and the risk acceptance/permission are assessed.) In qualitative risk analysis, a priority order is given to the risk on the basis of the occurrence probability (or the occurrence frequency) of the risk and the extent of impact during the time of risk being actualized, and thereafter, the risk is listed in the risk register. In quantitative risk analysis, the accuracy is improved by performing a detailed analysis starting from the risk with a high priority order, the effect of the risk is quantified into amount of money, hours, and number of persons, and this is described in the risk register.

(4) Risk response plan (risk treatment plan)

A risk response plan is created to increase the number of risks that exert a positive influence (i.e., opportunities) and reduce the number of risks that exert a negative influence (i.e., threats). The response to risks that exert a positive influence includes “utilization, sharing, and enhancement” and the response to risks that exert a negative influence includes “avoidance, transfer, and mitigation.” However, a response called “risk acceptance” is applicable for both types of risks.

A contingency plan (emergency response plan) is also set up as a measure in cases where a threat with a particularly large impact has manifested itself.

(5) Control of risks

Risk response is implemented according to risk response planning. At this time, a follow-up check of the identified risks is performed, and the residual risks are monitored. If there is a possibility of intervention of new risks along with the progress of the project, the risks are identified and appropriate measures are taken. The series of activities are controlled and the effectiveness of risk management is evaluated. Since the risk environment changes with time and situation, it is desirable to repeatedly perform risk management according to the PDCA cycle.