Risk and opportunity management
Risk and opportunity management
This domain tests a disciplined risk process that includes threats and opportunities.
Core rules
- Process: identify, analyse probability and impact, plan responses, implement, monitor and review.
- Threat responses: avoid, reduce, transfer, accept. Opportunity responses: exploit, enhance, share, accept.
- Record in a risk register: cause, event, effect, owner, rating, response and residual risk.
- Distinguish risk (uncertain future) from issue (already happened).
- Risk appetite and tolerance are set by governance; escalate above tolerance.
Worked example
A supplier may miss a delivery date. Probability is 4/5 and impact is 4/5, giving a score of 16 (high). The response transfers part of the risk through a liquidated-damages clause and reduces it by qualifying a second supplier. Residual score is 8 (medium). The owner is the procurement lead. Reasoning: response selection depends on appetite and cost-effectiveness; transferring does not eliminate the risk.
Traps
- Treating opportunities as threats with negative responses.
- Assigning a risk owner who has no authority.
- Confusing cause and effect in the register.
- Ignoring secondary risks created by the response.
- Leaving risks un-reviewed at stage gates.