Risk Management Plan

Risk is some uncertain event or condition that can happen. If that happens, it will make positive or negative impact to the project.
Risk Identification
• Identify and name the risks.
• Workshops are organized with business people and IT people to identify the risks.
• Apart from that standard risk lists is also reviewed.
All stakeholders must commit to the risks.
Risks must have owners to monitor it. Therefore stakeholders are assigned for the each risk to monitor and inform about the status of the risk.
• Business Risks are handled by the business people. For example if system will not finish before end of this year, existing system must use for another year.
• Risks are identified as two parts to remove duplicates. First part is the situation and second part is the impact. For example vendors not meet deadline is the situation and budget overrun in the impact.


Risk Quantification
Risks are quantified using two dimensions. First one is the impact and the second one is the probability (likelihood).
Indexes called Low, High, Medium and Critical are used to measure the impact and numbers from 1 to 4 is used to measure the likelihood.
For example if one risk have low impact and there is a high probability, it is called medium risk.
If one risk have high impact and there is less probability, it is called high risk.

Risk Response
Project managers are responsible to minimise the impact of the risks.
The strategies for that is,
Avoid the risk. That means do something to remove it.
Transfer the risk. Make someone else is responsible for the risk.
Mitigate the risk. Take appropriate actions to minimum the chance of happening the risk.
Accept the Risk. If the impact of the risk is minimum. Then effort to minimise that risk is not worth.

Risk Control
Owner of the risk must continuously monitor the risk to identify any change in the risk.
This will help to identify new risks.
This will help to identify the impact and probability of risks