<Project Name>

Risk Management Plan

Risk Management Template Instructions

(Please remove this section before completion of template)

The project manager(s) should prepare a Risk Management Plan which includes identified risks, who should be involved in their mitigation and how the risks will be managed / organized. The project manager(s) should seek advice from other Steering Committee and Implementation Team members to create the plan.

Be sure to maintain version control as the plan is modified and/or edited.

All instructions within the template are italicized within the document.

Any examples are in a red font.

Any portion of the template that does not fit or pertain to your project should be documented that it was reviewed and is not relevant. See below for requirements for a project and deliverable approvals.

Be sure to unlock table of contents by selecting TOC then Ctrl-Shift-F11 to enable TOC updating in Word docx.

Project Deliverable	Requirements by Project Size
Planning/Development Phase	Large	Medium	Small	Requirements	Approvals
Risk Management Plan	R	HR	O	The Risk Plan is required for large scale projects and highly recommended for medium scale projects and optional small scale projects.	The Risk Management Plan should be approved by the Sponsor and Requestor, at a minimum.

Table of Contents

1.	Introduction	2

1.1.	Purpose	2

1.2.	Definitions	2

2.	Version Control	3

3.	Risk Management Strategy	4

4.	Risk Management Process	4

4.1.	Risk Identification	5

4.2.	Risk Assessment	5

4.3.	Risk Handling	6

4.4.	Risk Monitoring	7

5.	Risk Management Roles & Responsibilities	8

6.	Risk Log	9

7.	Approval	10

Introduction

Purpose

The Risk Management Plan defines process for implementing proactive risk management as part of overall project management. The purpose is to identify potential problems before they occur, so that risk-handling activities may be planned and invoked as needed across the project to mitigate adverse impacts on achieving objectives. This document describes the process to:

Identify risk events

Evaluate risks with respect to probability and impact

Assess options and develop mitigation plan

Track risk mitigation efforts & conduct periodic reassessments of project risks

Definitions

Risk: Risk is an uncertain event or condition that if it occurs has a positive or negative impact on one or more of project objectives.

Scope Risk: Scope Risk is the uncertainty of achieving project requirements for function, performance, and operability within the planned cost and schedule. Typical risk drivers include requirements, constraints.

Cost Risk: Cost risks are associated with ability of the project to achieve its overall cost objectives. Typical cost risk drivers include requirements, resources availability, tools and environment.

Schedule Risk: Schedule risks are associated with adequacy of estimated and allocated time for project implementation. Typical risk drivers include requirements, need/delivery dates, technology availability and resources.

Project Risk: Project Risk is associated with overall status of the project. Failure to meet cost, schedule and scope can produce project risks, in addition to external budget, priority and political considerations.

Risk Assessment: Risk Assessment is translation of risk data into information for evaluating risk and determining probability and impact.

Version Control

Version	Date	Person	Change
1.0	Initial Document Creation

Risk Management Strategy

The project will continuously and proactively assess critical areas to determine specific risks, analyze potential impacts, determine mitigation actions and monitor risks. This will be done to manage risks, before they can cause serious cost, schedule or performance impacts.

Risk Management Process

This section provides an overview of the process involved in identification, assessment, handling and monitoring risks on the project.

Identify Risks Analyze Risks Assess risk handling options Monitor Communicate & Track Risks

Risk Identification

The following Risk Breakdown structure will be used as a basis for the discussions:

Project
Technical	External	Organizational	Project Management
Requirements	Vendors	Project Dependencies	Estimating
Technology	Regulatory	Resources	Planning
Complexity/ Interfaces	Market	Funding	Controlling
Performance/Reliability	Prioritization	Communication
Quality

In addition, one or more of the following process may be followed to identify risks:

Examine the work breakdown structure to uncover risk areas

Interview SC team and Implementation team

Review risk management efforts on similar projects

Examine lessons learned databases/documents, if available

Examine project documents [charter, etc.]

Risk Assessment

The following process will be used to analyze known risks and prioritize them based on impact to project objectives.

Determine cause and effect of each risk

Rate each risk based on probability and severity of impact to cost, schedule and scope. The probability and risk impacts will be rated in qualitative terms [High, Medium and Low].

Categorize risks.

Assign priority number to define priority sequence for planning/handling of all risks rated “High/Medium”

Conduct quantitative analysis for all risks rated “High/Medium”

Risk Assessment Matrix:

Severity of Impact
Probability	Low	Medium	High
Low	Low	Low	Medium
Medium	Low	Medium	High
High	Medium	High	High

Impact assessment criteria:

Project Objectives	Low	Medium	High
Scope	Scope change barely noticeable. No impact to schedule/cost	Minor areas of scope affected. No impact to critical path	Major impact to Scope. Critical path/cost impacted
Schedule	<2 weeks behind schedule	2-4 weeks behind schedule	>4 weeks behind schedule
Cost	< 1 K over budget	<5 K over budget	>5K over budget

Risk Handling

Risk handling involves identifying, evaluating, selecting and implementing options to set risk at acceptable levels given project constraints and objectives. This will include:

Identify approach [Mitigate, Avoid, Accept, Transfer]

Define Risk Response plan

Triggers/timelines for implementing the plan

Identify owner

Determine associated cost/schedule

Track criteria and decision dates

The strategy for each risk will be determined by the overall risk assessment rating as below:

Risk Assessment	Handling Strategy
High	PMs and risk owner will discuss the status of risk on a daily basis till it is closed. The risk owner will document the actions taken to avoid/mitigate the risk and contingency plans
Medium	Same as High. The risk status reviews will be done weekly.
Low	PM will add list to the “Watchlist” for possible escalation.

Risk Monitoring

The risks and status/results will be tracked/monitored regularly as part of the project implementation team meetings. The Risk response tasks will be tracked against the defined start and target completion dates.

Watchlist will be monitored periodically to evaluate change to Probability/impact.

Risk Management Roles & Responsibilities

Role	Responsibility
Project Manager(s)	Overall responsible for risk management on the project Establish& maintain Risk Management Plan Participate in Identification of risks & facilitate risk assessments Evaluate costs associated with risk handling/control Communicate risk activities to SC and IT Team Monitor risk triggers/dates & track implementation of risk response plans
IT Team / Vendor	Identify and assess new risks Ensure timely implementation of risk response plans Report risk status
SC Team	Review all risks rated as High Review and approve risk response plans of Risks that are rated as “High” for completeness, feasibility and adequacy Approve implementation of risk response plans for high risks, when risk occurs

Risk Log

Risk ID	Date Logged	Risk	Project Obj. Impacted	Probability of Event	Impact	Approach	Mitigation Plan	Owner	Due Date	Status

Approval

The individuals below agree that they have reviewed and approved the contents outlined in this Support Documentation.

APPROVED BY:
Function Role	Name and Title	Signature	Date

[REMOVE THE FOLLOWING PAGES AFTER COMPLETING THE PLAN]

RISK MANAGEMENT PLAN INSTRUCTIONS

The risk management process is a systematic and proactive approach to taking control of projects and decreasing the uncertainties. The project manager(s) should prepare a Risk Management Plan which includes identified risks, who should be involved in their mitigation and how the risks will be managed / organized. The project manager(s) should seek advice from other Steering Committee and Implementation Team members to create the plan.

What is a project risk?

A risk is an event which may impact the project. The key word is MAY. A risk is not a certainty.

Generally there are three main categories which risks can impact:

Budget/costs

Schedule/time

Quality

The sections of the Risk Management Plan should be completed with the most current and accurate data. Section 1 should include the purpose for the risk plan and any definitions that will be needed for the document.

Section 3 will include the strategy that the Project Manager(s) and the Implementation team will use to identify and manage risks.

Section 4 may be a more complicated. Sub-section 4.1, after the table, a detailed description will be included to explain the risk identification process used. Sub-section 4.2, before the table, the process that the team developed for risk assessment should be documented. Sub-section 4.3 should have a narrative of how risks will be handled and the table should be completed. Sub-section 4.4 will be the description of the process for monitoring the identified risks.

Section 5 table will outline the responsibilities for those involved with the project.

Section 6 will be the actual risk log. The table is an output of the risk management planning process. It should be updated and maintained throughout the project life cycle. All risks are candidates for logged into the Project and Portfolio Management System. This table should be maintained separately and housed in the attachments tab.

Risk ID - A sequential numbering system can be used to identify risks.

Date Logged - The date the Project Manager(s) officially logged the risk.

Risk – Briefly describe the risk.

Project Obj. (Object) Impacted - The component of the project impacted by the risk. This is a good place to include any potential benefits a risk might have on the project.

Probability of Event – A percent estimate / likelihood the risk will occur.

Impact – Quantification on the level the risk might impact the project (i.e.: high impact, medium, or low).

Approach - Explanation of how the risk can be avoided or how the team can lessen the probability or impact to the project.

Mitigation Plan – The plan for risk mitigation.

Owner – Every risk should have an owner assigned to monitor and control the risk. It does not have to be the Project Manager(s), it can be any team member that has direct visibility to the risk event.

Due Date – Expected date of mitigation.

Status – Mitigation action status.