A risk score of: Below 30 will give a ‘green’ risk. Between 31 and 59 give an ‘amber’ risk Above 60 give a ‘red’ risk Risk Actions Risk Impact Score Frequency of Review No action necessary < 10 n/a Monitor as necessary - ensure being properly managed < 20 Quarterly Monitor as necessary - less important but still could have a serious effect on the provision of key services or duties < 30 Quarterly Monitor as necessary- less important but still could have a serious effect on the provision of key services or duties < 40 Monthly Monitor as necessary - less important but still could have a serious effect on the provision of key services or duties < 50 Monthly Important risks - may potentially affect provision of key services or duties < 60 Weekly Key risk- may potentially affect provision of key services or duties > 60 Immediate Immediate action needed - serious threat to Provision and/or achievement of key services or duties > 80 Immediate Plan Objective of Risk Planning The primary objective of this step is to prepare management responses using Risk Response Categories for each of the identified threats and opportunities in order to reduce or remove the threat or to maximize the opportunity. This should leave the project prepared with an action plan should any risk materialise. Concentration should be on ‘red’ as these have the greatest chance of arising and are likely to impact the project most severely. Consideration should be given to ‘amber’ risks and ‘green’ risks in order to: Keep the risk at as low a level as is practical Be prepared to respond to the risk should its severity increase during the project Ensure that ‘green’ or ‘amber’ risks do not increase the chance of a ‘red’ risk being encountered
Risk Response Categories Avoid – typically change an aspect of the project so the threat can no longer happen Reduce – Either reduce the chance of the threat occurring or reduce the impact of the threat should it occur Fallback – Build a fallback plan for actions which will reduce the threat should the risk occur Transfer – A third party takes on responsibility for some of the financial impact of the threat (via insurance or contractual agreement) to reduce the financial cost of the threat Accept – accept that the threat may be encountered, usually because it is either unavoidable or financially unviable to avoid the threat Share – work with third parties to share either the cost loss or gain associated with the threat Exploit – seize an opportunity to ensure the opportunity will happen and the beneficial outcome will be realised Enhance – take actions to improve the probability of an event occurring and to enhance the beneficial outcome should it occur Reject – a conscious decision not to exploit an opportunity as it is more economical to continue without responding Implement The primary objective of this step is to ensure the planned risk responses are implemented, their effectiveness monitored and corrective action taken where responses do not provide effective solutions. To ensure this is carried out efficiently, there will be a sole Risk Owner. This is a named individual who is responsible for the management, monitoring and control of all aspects of a particular risk. There may be a Risk Actionee responsible for carrying out the required response action for a risk or set of risks. The Risk Actionee should perform under the direction of the Risk Owner. The Risk Owner and Risk Actionee may be the same person. A risk will be assigned to a single individual. An individual may be responsible for more than one risk but consideration should be to their workload and abilities to ensure any individual is not allocated more risks than they can practically manage. Communicate Risks will be communicated outwards as part of: Checkpoint Reports - frequency defined in each Work Package, minimum of monthly Highlight Reports - defined by Project Board, minimum of monthly End Stage Reports End Project Reports Lessons Reports – at End Stage and End Project
Appendix B – Risk Register RISK REGISTER FORM [Form ID if applicable] Ref:[Location/Filename] Version: Programme Name:[If applicable] Project Name: Risk Identifier: [A unique reference for every risk entered into the Risk Register e.g. 0001] Risk Description: [In of the cause, event (threat or opportunity) and effect (description in words of the impact)] Risk Category: [Type of risk in terms of the project’s chosen categories (e.g. schedule, quality, legal] Probability: [These should be recorded in accordance with the project’s chosen scales] Impact: [These should be recorded in accordance with the project’s chosen scales] Expected Value: [These should be recorded in accordance with the project’s chosen scales] Proximity: [How close to the present time the risk event is anticipated to happen] Pre-Response [Estimate the inherent values (pre-response action)] Post-Response [Estimate the residual values (post-response action)] Pre-Response [Estimate the inherent values (pre-response action)] Post-Response [Estimate the residual values (post-response action)] Pre-Response [Estimate the inherent values (pre-response action)] Post-Response [Estimate the residual values (post-response action)] Risk Response Category: [How the project will treat the risk – in terms of the project’s chosen categories e.g. - For threats: reduce, fallback, transfer, accept, share - For opportunities: enhance, exploit, reject, share] Risk Response: [Actions to resolve the risk (should be aligned to the chosen response categories. Note that more than one risk response may apply to a risk)] Date Registered: [Date the risk was identified] Risk Author: [Person who raised the risk] Risk Owner: [Person responsible for managing the risk] Risk Actionee: [Person(s) who will implement the action(s) described in the risk response] Risk Status: [Active or Closed]