Risk Identification, Analysis, and Response Planning
Risk questions ask you to identify, analyze, and respond, in that order, and to distinguish the reserves. The biggest mark-loser is answering a risk question with a scheduling or quality action.
Core rules
- The risk management plan defines methodology, roles, appetite and thresholds, risk categories (a risk breakdown structure), funding, and reporting.
- Identification uses brainstorming, Delphi (anonymous consensus), interviews, SWOT, prompt lists, and assumptions analysis. Outputs are the risk register and the risk report.
- Qualitative analysis rates probability and impact plus urgency and data quality, producing a prioritized list. Quantitative analysis (expected monetary value, decision trees, Monte Carlo, sensitivity or tornado diagrams) is used when the numbers matter and data supports it.
- Threat responses: escalate, avoid, transfer, mitigate, accept. Opportunity responses: exploit, share, enhance, accept. Every response needs an owner and, where relevant, a contingency plan and trigger condition.
- Residual risk remains after the response; secondary risk is created by the response. Contingency reserves cover accepted identified risks; management reserve covers unknown-unknowns.
Worked example
A vendor-integration risk has a 20% chance of a $50,000 impact, so EMV = $10,000. A mitigation costing $4,000 drops the probability to 5%, giving an EMV of $2,500. The mitigation is worth buying: expected loss falls by $7,500 for a $4,000 spend, a net gain of $3,500. Had the mitigation cost $9,000, accepting the risk and holding the $10,000 in contingency would be cheaper. The $4,000 is a mitigation cost, not contingency reserve.
Traps
Treating transfer as elimination. Applying EMV to risks with no quantified data. Responding to an opportunity like a threat. Assigning a response without an owner. Funding accepted risks from the wrong reserve.