PRINCE2 Practices · Topic 6 of 9
The Risk Practice
PRINCE2 7 risk practice: threats and opportunities, risk appetite and tolerance, cause, event and effect, owners, responses, bias and technique.
- 5 min
- Purpose: identify, assess and control uncertainty to improve the chance of success.
- A risk can be a threat (negative) or an opportunity (positive).
- Describe risks by cause, event and effect.
What it is
The purpose of the risk practice is to identify, assess and control uncertainty during the project and, as a result, improve the ability of the project to succeed.
A risk is an uncertain event or set of events that, should it occur, will have an effect on the achievement of objectives. A risk with a negative effect is a threat; one with a positive effect is an opportunity.
How it works
Key concepts
| Term | Meaning |
|---|---|
| Risk cause | The source of the risk: a situation that exists now |
| Risk event | The uncertain occurrence that may happen because of the cause |
| Risk effect | The impact the event would have on the project's objectives |
| Risk probability | How likely the risk event is to occur |
| Risk impact | The size of the effect on objectives if the risk occurs |
| Risk exposure | The extent of risk borne by the project, reflecting probability and impact together |
| Risk appetite | An organization's unique attitude towards risk taking |
| Risk tolerance | The threshold levels of risk exposure that, if exceeded, trigger escalation |
| Risk owner | The person responsible for managing all aspects of a particular risk |
| Risk action owner | The person who carries out a specific risk response, on behalf of the risk owner |
Example: "Because the supplier is moving offices (cause), there is a risk that hardware deliveries are delayed (event), which would delay testing by two weeks (effect)."
Management products
| Product | Purpose |
|---|---|
| Risk management approach (PID) | Describes how risk will be managed: procedure, tools, records, reporting, timing, roles, scales for probability and impact, risk tolerance and any risk budget |
| Risk register (project log) | Records identified risks, their cause, event and effect, probability, impact, proximity, owner, responses and status |
Guidance: planning, analysis and control
Risk planning sets up how risk will be managed, captured in the risk management approach, taking account of the organization's risk appetite.
Risk analysis identifies risks and assesses their probability, impact and proximity, both one by one and as an overall picture of the project's exposure.
Risk control plans and carries out responses, assigns owners, monitors whether responses work, and escalates when risk exposure is forecast to exceed tolerance.
Recommended risk response types
PRINCE2 7 recommends a set of response types for threats and for opportunities. You need to recognise the idea of each type rather than recite a fixed list.
| Idea | For threats | For opportunities |
|---|---|---|
| Remove the uncertainty | Avoid: change something so the threat cannot happen or cannot affect the project | Exploit: make sure the opportunity happens |
| Change probability or impact | Reduce: make the threat less likely or less severe | Enhance: make the opportunity more likely or larger |
| Pass to or share with others | Transfer or share part of the impact with a third party, such as an insurer or partner | Share gains with a partner |
| Prepare in advance | Plan a contingent action to be used only if the risk occurs | Plan how to respond if the opportunity arises |
| Take no action now | Accept and monitor | Accept and monitor |
Guidance: risk culture and decision bias
Risk culture is how people in the project and organization think about and act on risk. In a healthy risk culture, people raise risks openly without fear of blame.
Decision bias distorts how risks are judged. Examples include optimism bias (underestimating cost and time), groupthink (going along with the group view), and confirmation bias (favouring evidence that supports a decision already made). Awareness, challenge from assurance and the use of data help counter bias.
Guidance: use of data
Historical data from earlier projects can inform estimates of probability and impact, and current project data can reveal trends that signal new or changing risks.
The risk technique
In outline: identify the context and the risks; assess each risk and the overall exposure; plan suitable responses; implement those responses with clear owners. The fifth step, communicate, runs alongside all of them.
Relationship to the principles
| Principle | Link to risk |
|---|---|
| Ensure continued business justification | Major risks are part of the business case |
| Manage by exception | Risk tolerance triggers escalation |
| Learn from experience | Risks from earlier projects inform identification |
| Define roles, responsibilities and relationships | Risk owners and risk action owners |
| Manage by stages | Risks reviewed at each stage boundary |
| Focus on products | Risks to products and their quality are identified |
| Tailor to suit the project | Risk procedure scaled to the project's risk level |
A worked example
A festival organizer identifies a risk: because the venue is outdoors (cause), heavy rain may occur on the day (event), reducing ticket sales and damaging equipment (effect). Probability is medium and impact high, so it is entered in the risk register with the operations director as risk owner.
Responses include buying weather insurance (transfer) and pre-booking marquees that can be released if the forecast is good (contingent plan). The site manager is risk action owner for the marquees.
How the exam asks about this
- "What is the threshold of risk exposure which, if exceeded, triggers escalation?" Risk tolerance.
- "Who carries out a specific risk response on behalf of the risk owner?" The risk action owner.
- "Which management product records identified risks and their responses?" The risk register, within the project log.
What to remember for the exam
- Purpose: identify, assess and control uncertainty to improve the chance of success.
- A risk can be a threat (negative) or an opportunity (positive).
- Describe risks by cause, event and effect.
- Appetite is the organization's attitude; tolerance is the escalation threshold.
- Risk owner manages the risk; risk action owner carries out a response.
A risk has not happened yet. Once an event has happened, it is an issue, managed through the issues practice.
Common mistakes
Mixing up appetite and tolerance. Appetite is the attitude; tolerance is the measurable limit.
Recording only threats. Opportunities are risks too and should be managed.
Ignoring bias. Optimistic estimates and groupthink make risk exposure look smaller than it is.
Check yourself
What is risk exposure?
The extent of risk borne by the project, reflecting the probability and impact of its risks.
What is the difference between a risk cause and a risk event?
The cause is a situation that exists now; the event is the uncertain occurrence that may follow from it.
Where is the risk management approach documented?
In the PID.
Topic 6 of 9 in PRINCE2 Practices
Test yourself on PRINCE2 Practices
The full PeopleCert PRINCE2 7 Foundation question bank has 564 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by PeopleCert. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.