Components of Risk Management and Risk Response Plans

H. Stanley Judd, author, film producer, and communications consultant, once said, "A good plan is like a road map: it shows the final destination and usually the best way to get there." Like a good roadmap, a good project plan points out potential risks and includes strategies for managing and responding to those risks. The plan accomplishes this with a risk management plan and a risk response plan, two important aspects of project risk monitoring and control.

Risk management plan
The risk management plan, created during the risk management planning process, is a document that focuses on how to plan for and deal with all risks associated with a project. It describes how risk monitoring and control will be carried out during the project's life cycle. It does not look at the specific responses that will be implemented if a risk occurs.

The risk management plan has several components that are inputs to risk monitoring and control.

• Methodology - outlines the approaches, tools, and resources that can be used to carry out risk monitoring and control. The methodology used will depend upon the information available and the current project phase.
• Roles and responsibilities - is the designation of risk monitoring and control actions to specific individuals or groups. External risk monitoring and control teams are able to provide independent, unbiased risk analyses.
• Budgeting - requires a specific amount of funds to be allocated to the risk monitoring and control process of a given project.
• Timing - is how often risk monitoring and control processes will occur during the project's life cycle. Results must be reviewed periodically so they can be used in decision making.
• Scoring and interpretation - are methods used to score risks and assign them a rank. This risk-ranking process will indicate which risks need constant, close monitoring in order to control their impact on important project objectives.
• The acceptable threshold - is the set limit that the project team members will use to decide when they will implement a control.
• Reporting formats - describe what is in the risk response plan and how it is formatted. It also identifies how the outcomes of risk monitoring and control will be documented, analyzed, and communicated to team members and stakeholders.
• Tracking - is the documentation process that records information about risk monitoring and control activities. The tracking process saves the information so you can use it for the current project, or for future projects.

Risk response plan
The risk response plan is a document that addresses the specific responses to individual project risks.

The project manager and project team create the risk response plan during the risk response planning process. The plan provides project team members with the details they need when a risk occurs. The information in the risk response plan allows team members to take specific actions to control risks.

The risk response plan has several components that project teams use during the risk monitoring and control process.

• Identified risks - The risk response plan lists the identified project risks. The project team will monitor and control the identified risks throughout the project's life cycle.
• Risk owners and responsibilities - The risk response plan identifies risk owners and the details of their responsibilities. The risk monitoring and control process examines and documents the effectiveness of the risk owner.
• Agreed responses - The risk response plan clearly states the agreed responses for each identified risk. These responses may include avoidance, transference, mitigation, or acceptance. Once the project team implements a response, the response will be monitored to determine if further action is necessary.
• Specific actions - The risk response plan not only describes the response strategy for each risk, but also describes the specific actions that will be necessary to carry out each strategy. Risk monitoring and control determines if these actions are adequate.
• Residual risk - The risk response plan outlines the expected residual risk. Residual risks are the risk effects that remain after the implementation of a risk response. These residual risks must be monitored and controlled.
• Contingency and fallback plans - The risk response plan will outline any potential contingency or fallback plans. The project team will monitor the use of these contingency and fallback plans and take action if the plans are deemed inadequate.

The risk management and risk response plans provide you with the processes and actions required to prevent, reduce, recognize, and deal with risks. Using these plans as inputs will help lead your project along the path of success.