Tracking and Controlling Risk
After you analyze the risks and assign actions to mitigate them, you must track the risks and keep the risk plan current to control them. This might result in adding, changing, or removing containment actions.
The project manager and the team must:
- Implement and track the risk management plan.
- Communicate the risk management plan status to the team members and other stakeholders. Be sure the plan is made clear to the sponsor and to the reviewers during project reviews
- Review the risk triggers. Have any of the risks occurred?
- Reassess risk sources on a regular basis. Are there new risks resulting from changes in the sponsor's technology, project, organization, or resources? If so, update the plan with the new risks.
- Evaluate the defined risks to decide whether they are still possible, whether they will have the same severity, and whether the tolerance is the same. Does the plan need to be updated? Does additional action need to be taken?
- Review the risk contingency reserve and ask whether the plans are still appropriate? Is any action required based on observed trends? Are backup strategies appropriate?
- Review risk mitigation strategies to determine if they are still appropriate. Determine whether backup strategies should be used or if additional actions are required to implement the strategies. Does the plan need to be updated?
- As time passes, you might need to consider that some risks, previously considered non-issues, might become issues, while others, previously deemed significant, might become insignificant. Do you need to update the plan?
- If a risk event occurs, you might need to make appropriate changes to the work breakdown structure (WBS) and the schedule.
- Maintain current, accurate, and complete documentation, and disseminate it to the appropriate stakeholders. Documentation serves as a record of lessons learned and actions taken, and as a means of communication.
Risk tracking and control is a PM subdomain in the Risk Management PM domain. For more information, go to the WWPMM Web site.
Reacting to Risk
Reacting to a risk includes executing the necessary risk responses and closing the risk as appropriate:
- Reacting to a risk occurrence means taking the steps that must be performed when a risk actually occurs.
- Closing a risk means reaching a final resolution concerning a risk that either has occurred or is no longer considered a significant threat to the project.