Project risk management (プロジェクトリスクマネジメント) is the work of spotting uncertain events that could affect a project's goals (risks) ahead of time, weighing them, deciding how to respond, and watching them until the project ends.
Identify risks
Analyze risks
Control risks
Starting with the heaviest, decide on responses, carry them out and watch for changes. When a new risk turns up, go back to identification and add it.
3 / 3
First list the risks to identify them, then weigh each by its probability (発生確率), how likely it is to happen, and its impact (影響度), how large the loss would be. In risk control that follows, effort goes to risks in order of weight rather than equally to all, and the chosen responses are carried out and monitored until the end. Risks are not only negative ones that lead to loss: there are also positive risks (プラスのリスク) that, if used well, can cut cost or time.
AnalogyIt is like listing what could go wrong before a family trip, such as traffic, rain or a child running a fever, ranking them by how likely and how troublesome they are, and planning from the top down. Once you set off, you still check the forecast and add any new worries to the list.
How to rememberSomething that has not happened yet is a risk; once it has happened it is an issue. Remember it by direction in time: risk management is the groundwork done before things happen.
Exam points
ExamWhich risk to tackle first is decided by ranking risks on both probability and impact. In numbers, compare probability × loss amount (the expected loss), and if values tie, follow the condition the question gives.
ExamIn risk identification, candidates are gathered widely, for example by brainstorming among the people involved, and past checklists serve only as a reference. Not every risk has to be found at the start; when a plan change or similar brings a new one, add it then.
ExamResponding to a positive risk means going after an opportunity: if finishing early could win the next contract, assigning experienced staff to finish sooner is an example. Measures that prevent or make up for a loss respond to negative risks.
Risk response strategies (リスクの対応策) are the ways of deciding how to handle risks that have been identified and analyzed, and they fall into four types: avoidance, mitigation, acceptance and transfer.
Strategy
What you do
Where the money and effort go
Avoidance
Change or drop the plan or task that causes it
Changing the plan (scope may shrink)
Mitigation
Lower the likelihood or the damage if it happens
The preventive or preparatory measures themselves
Acceptance
Take no steps to reduce it
A reserve to use if it happens (sometimes none)
Transfer
Shift the loss to a third party by insurance or contract
Insurance premiums or contract fees
The four differ in whether you remove the cause from the plan, keep the cause but shrink the risk, accept it as it is, or have someone outside carry the loss. For each risk you compare probability and impact with the cost of the measure before choosing, and a single risk may get several responses combined. The chosen responses go into a risk response plan (リスク対応計画), and when a risk materializes you act as that plan says.
AnalogyIf rain threatens an outdoor barbecue, you could move it indoors, put up a tent, decide to carry on with nothing prepared since a little drizzle is fine, or buy insurance that refunds you if it is called off. Which you pick depends on how likely rain is versus the effort and money each option takes.
How to rememberOnly transfer sends the loss outside your own side. The other three stay with you, and three verbs cover them: remove, reduce, retain.
Exam points
ExamPreparing an alternative in case of a delay or breakdown, and switching to it when that actually happens, counts as implementing the risk response plan (リスク対応計画の実行).
ExamYou do not try to wipe out every risk by avoidance. Changing the plan heavily is not always possible, so you weigh the risk against the cost of the measure and pick another response.
ExamOther names are used too: mitigation is also called reduction (低減). Transfer may appear as 移転 (shifting), and acceptance as 保有 (retention).
Avoidance (回避) is the response of changing or dropping the plan or task that causes a risk, so that the risk has no chance to occur.
Taking a feature that would do serious damage if it failed out of this release, or removing a process that involves dangerous work from the plan, are examples of avoidance. Because the cause is gone from the plan, that risk's probability and impact no longer need attention. The trade-off is that the changed plan may deliver fewer features or a smaller scope, or create extra work elsewhere.
AnalogyIt is like someone afraid of heights never choosing the tour that climbs an observation tower. Skip that tour and there is simply no scary moment to face.
How to rememberThink of a detour: rather than driving through the hazard, you change the route of the plan itself so the hazard is never on it.
Exam points
ExamWhat separates avoidance from mitigation is whether the cause stays in the plan. Keeping the task or equipment that causes the risk and arranging substitute people or means to limit delay or damage is mitigation, not avoidance.
Mix-upRemoving a dangerous task from the plan is avoidance; handing that task to an outside party and making them bear the loss by contract is transfer. The outsourced task is still part of the project.
Mitigation (軽減) is the response that keeps the cause of a risk but lowers its probability or reduces its impact when it happens.
Lower the probability
Reduce the impact
When it works
Before it happens
After it happens
Aim
Make it less likely
Keep the damage small even if it happens
Example measure
Add more checks and review steps
Prepare a backup to switch to if things stop
Lowering probability is prevention that works before the event, and reducing impact is preparation that limits damage afterward; both count as mitigation. Both cost money, so you compare the expected drop in loss with the cost of the measure to decide how far to go. Unlike avoidance the cause remains, so you keep watching the leftover risk after acting.
AnalogyIt is like servicing your bike so it is less likely to break down and wearing a helmet so a fall hurts less. You have not given up riding.
How to rememberMitigate comes from a Latin root meaning "to soften": the blow still lands, just more gently. Avoidance means it never lands at all.
Exam points
ExamMitigation covers both prevention that makes a risk less likely and preparation that limits the damage if it occurs. Do not assume prevention alone will stop it entirely; have a plan for after it happens too.
ExamQuality risk can be lowered only by changing how the work itself is done. Insurance merely moves the cost of a loss elsewhere and does nothing for the quality of what is built, so it is not a quality mitigation measure.
Acceptance (受容) is the response of taking no steps to reduce a risk and deciding to absorb the loss yourself if it occurs.
It is chosen for risks judged unlikely, low in impact, or not worth the cost of a countermeasure. Besides preparing nothing at all, setting aside spare budget or days in advance for use if the risk occurs also counts as acceptance. Money kept aside for events that might happen but are not certain is called a contingency reserve (コンティンジェンシー予備).
AnalogyIt is like living with a small scratch on your phone screen because fixing it is not worth the money, while keeping some savings aside in case the screen ever cracks.
How to rememberIts other name, retention (保有), means you keep the risk in your own hands. Learn the pair: if someone takes it off you, that is transfer; if no one does, that is acceptance.
Exam points
ExamSetting aside spare budget or days in advance is acceptance. It leaves the likelihood and the damage untouched and absorbs the loss from your own reserve, so it is not mitigation; nobody else carries the loss, so it is not transfer either.
ExamA contingency reserve covers only events that might occur within the original scope. Costs known for certain, and costs for requests from outside the scope, go through the normal estimate or the change procedure.
Mix-upAcceptance is not neglect. It is a deliberate choice, made after assessing probability and impact, not to reduce the risk.
Transfer (転嫁) is the response of using insurance or a contract to shift the loss or responsibility from a risk onto a third party.
The typical case is insurance: you pay a premium, and the insurer covers the loss if the risk occurs. Outsourcing work under a contract that makes the other party pay for damage caused by delays is also transfer. The likelihood and impact of the risk stay the same; only who bears the loss changes.
AnalogyIt is like buying travel insurance so the insurer covers you if your luggage is stolen on the trip. The chance of it being stolen stays the same.
How to rememberThink of passing the buck: transfer hands the bill to someone else, while the problem itself stays exactly where it was.
Exam points
ExamTaking out insurance is the classic example of transfer. The party bearing the loss is outside your own side, which is what separates it from acceptance, where you build up your own reserve.
ExamA contract that makes the other party pay for damage moves the burden of loss outside, but does not lower the chance of a delay. So it is neither acceptance nor mitigation but transfer.
Weigh risks by probability and impact and deal with the heaviest first. Decide responses before anything happens, and add new risks as the project moves on.
The four risk response strategies differ in whether you remove the cause from the plan, keep it but make the risk smaller, take it on as it is, or move the loss outside.
Avoidance changes the plan to remove the cause; mitigation keeps the cause and lowers probability or impact.
Setting aside spare budget or days is acceptance; making a third party bear the loss through insurance or a contract is transfer.