Risk management processes
This domain tests the risk management process and the techniques used at each step. Questions typically ask you to choose the next action, classify a response, or judge whether a risk has been assessed and escalated correctly.
Identify and assess
- Identify risks in context: workshops, checklists, interviews, prompt lists, assumption analysis and brainstorming. Record cause, event and effect, and capture threats and opportunities.
- Assess probability and impact using defined scales; consider proximity and velocity as well as the expected score.
- Evaluate the score against appetite and tolerance, then prioritise. A score is meaningless without agreed scales and thresholds.
Plan and implement
- Threat responses: avoid, reduce probability or impact, transfer, accept.
- Opportunity responses: exploit, enhance, share, accept.
- Define residual risk, secondary risks, actionees, deadlines and costs. Implement the response and monitor triggers. M_o_R is usually examined as identify, assess, plan and implement, with monitoring and review built into every step.
Worked example
A 5x5 grid gives probability 4 and impact 4, score 16; tolerance is 12. The threat is key data migration failure. Response: pilot migration to reduce probability to 2, impact remains 4, residual score 8. The pilot adds cost, which is recorded as a secondary risk. Insurance is not feasible, so transfer is rejected. The owner escalates the initial 16, then monitors a trigger: pilot defect rate above 2%.
Traps
Scoring without agreed scales; treating inherent risk as residual risk; ignoring secondary risks; accepting above-tolerance risk without escalation; and labelling an action transfer when it actually reduces or accepts the risk.