TAPUniversity » Plan Risk Responses

Secondary Risk versus Residual Risk

David Kohrell — Tue, 28 Dec 2010 16:03:10 +0000

Synonymous term or a different term, that’s a common question we receive in our course delivery for secondary versus residual risks.

Don't let residual or secondary risk trip you up before the finish line!

Those two terms do sound quite a bit a like. Are they?

They’re similar concepts but are different!

Secondary risk occurs once a risk event triggers and the appropriate management response strategy deployed. The PMBOK® 4th Edition, page 303, describes this aptly as “driven by the strategies”. For example, in software development, per Steve McConnell, the silver bullet syndrome is a risk of relying or wishing upon that perfect tool to solve all of your problems. The mindset is typically “if we only had this LAMP, API, SQL widget, we’d cut our development time by 25%”! When that risk event triggers, it’s important for a project manager and team to step back and calmly assess the reliance and vulnerability on that assumed “perfect tool”. A secondary risk as the team addresses it might be contractor competency or solvency. Perhaps the new tool will work wonders, but only with gifted hands (and minds) guiding it. As the team reaches out to find that mind, risks associated with contractor management now jump to the forefront. That risk is a secondary risk.
Residual Risk is risk that exists after qualitative and quantitative risk assessment. It often falls in that area of unknown/unknown on the risk identification continuum. In software project management residual risk typically associates with environmental factors (computer environment) that a team has not reviewed, for example a new software patches incompatibility with a lesser known or evolving platform (e.g., mobile web or cloud computing).Health-care provides a good field to understand how both risks may exist. Prior to my father’s passing in 2008, he had a series of medical issues over a five-year period. For example, after a procedure to repair a carotid artery, residual risk of stroke existed (though it was not known). The repaired carotid artery, yet inability to determine stroke risk, restricted the ability to treat an invasive form of prostate cancer (secondary risk from yet another procedure). Due to his age and compounding risk factors, the residual and secondary risks were replete.

Risk Management Approaches (tapuniversity.com)
Risk Types from Auditing (tapuniversity.com)
Software Risk List (tapuniversity.com)
Risk from a Business Analysis Perspective (tapuniversity.com)
10 Project Management Skills Essential for Every Project Manager (brighthub.com)
Understanding Primary and Secondary Osteoarthritis (everydayhealth.com)

Filed under: Agile, Business Analysis, Lean Six Sigma, PMP Exam, Project Management, Virtual Teams Tagged: A Guide to the Project Management Body of Knowledge, Agile, Application programming interface, Plan Risk Responses, PMBOK, Project Management, Project Manager, residual risk, Residual Risks, Risk, Risk assessment, Risk factor, Risk Management, Risk Register, secondary risk, Secondary Risks, Software, Software Risk, SQL, Steve McConnell

Risk Treatment

tapuniversity — Tue, 04 May 2010 12:00:24 +0000

Selecting how to respond to specific risks is called Risk Treatment. This may also include writing a plan and actually implementing these responses. Risk Treatment is not a term found in the fourth-edition PMBOK® but the concept is there nonetheless. The PMBOK’s Plan Risk Responses process is where one selects how to respond to individual risks. The broad choices are transfer, avoidance, mitigate, and accept for negative risks, and exploit, enhance, share, and accept for positive risks. The resulting decisions of Risk Treatment may be written in a Risk Treatment Plan. The PMBOK does not use this term either, but rather has the risk responses added to the Risk Register and various other documents updated as necessary. To learn more, please see the earlier postings of “Plan Risk Responses Process” posted 04.09.09, “Positive Risk Strategies” posted 04.01.09, “Negative Risk Strategies” posted 03.31.09, and “Risk Register” posted 03.27.09.

Filed under: Business Analysis, PMP Exam, Project Management Tagged: Plan Risk Responses, Project Management, Risk Response, Risk Strategies, Risk Treatment

Plan Risk Responses Process

tapuniversity — Thu, 09 Apr 2009 19:41:07 +0000

Plan Risk Responses is one of the 42 project management processes described in the fourth edition PMBOK®. It’s one of the six Risk knowledge area processes, and one of the twenty Planning processes. The purpose of this process is to develop plans to minimize threats (negative risk) and maximize opportunities (positive risk). The Risk Register, which lists the project risks and information about them, and the Risk Management Plan, which provides overall guidance for the risk processes, are both needed. For each risk on the register that is important enough to warrant investing time into planning a response, a strategy is chosen. The seven strategies are: Avoid, Transfer, Mitigate, Accept, Exploit, Share, and Enhance. Please see the earlier postings of Positive Risk Strategies (posted April 1, 2009) and Negative Risk Strategies (posted March 31, 2009) to read more about these strategies. Contingency Response Strategies may also be developed, which are plans that are executed only if a certain trigger occurs. The outputs of this process include Risk-Related Contract Decisions and updates to several documents including the Risk Register, Project Management Plan, and Project Document updates.

Posted in PMP Exam, Project Management Tagged: BABOK, Business Analysis, CISA, Contingency Response Strategies, Plan Risk Responses, PMBOK, pmp, PMP Exam, Project Management

Positive Risk Strategies

tapuniversity — Wed, 01 Apr 2009 19:17:52 +0000

For a project manager, a risk is an uncertain event. This potential event could be either desired (positive) or undesired (negative). A positive risk may be referred to as an opportunity, and a negative risk may be referred to as a threat. There are three unique strategies used for handling positive risk (exploit, share, and enhance), and one strategy that can be used for either positive or negative risk (accept). These are described as a tool and technique of the fourth edition PMBOK®’s Plan Risk Responses process. Here are some examples involving Katy, who is hoping that the positive risk event of “cookies being available this afternoon” occurs.

Exploit means that the potential positive event is made to occur. Katy drives to a grocery store and buys a box of chocolate chip cookies.

Share means that the opportunity is shared with a third party for the benefit of both. Katy has a friend who makes delicious oatmeal raisin cookies. Katy offers to buy the ingredients if her friend will bake a batch that they can share.

Enhance means that the probability and positive impact of the opportunity is increased. Katy sends a text message to her mother that reads “I wish someone cared enough to bring me cookies.”

Accept means that plans are not changed due to the risk, but if the opportunity does occur, it will be accepted. Katy hopes that because people know she is addicted to cookies, someone will think of her and give her some. She won’t ask anyone to get her some though.

Posted in PMP Exam, Project Management Tagged: Plan Risk Responses, pmp, PMP Exam, Positive Risk, Project Management, Risk Strategies

Negative Risk Strategies

tapuniversity — Tue, 31 Mar 2009 19:45:07 +0000

For a project manager, a risk is an uncertain event. This potential event could be either desired (positive) or undesired (negative). A positive risk may be referred to as an opportunity, and a negative risk may be referred to as a threat. There are three unique strategies used for handling negative risk (avoid, transfer, and mitigate), and one strategy that can be used for either positive or negative risk (accept). These are described as a tool and technique of the fourth edition PMBOK®’s Plan Risk Responses process. Below are some examples of the negative risk strategies as related to Katy baking a wedding bake for her daughter’s wedding.

Avoid means that plans are modified to completely eliminate the threat. Katy originally planned to bake a five-tier wedding cake, but she is so afraid that it will collapse, that she has decided to avoid the risk of collapsing altogether by baking the five cakes and setting them each on their own platter beside each other on the cake table.

Transfer means that the ownership and consequences of the risk are transferred to another party. Katy decides to buy cake insurance from a local baker—so that if the risk of her cake being ruined occurs, the baker will be able to bring a replacement cake in time.

Mitigate means that the probability or impact of the risk is lessened. Katy found a sturdy silver stand with five platforms for the five layers of cake. Although it appears that the cakes are balanced on top of each other, they actually aren’t. Because of this, it is very unlikely that the risk of the cake collapsing will occur.

Accept means that plans are not changed due to the risk, and the consequences of the risk event happening are simply accepted. Katy decides to make the five-tier cake. In the unlikely case that it becomes ruined, there simply won’t be wedding cake for the guests to eat.