EGI-Engage:Risk Plan

EGI-Engage project:	Main page	WP1(NA1)	WP3(JRA1)	WP5(SA1)	PMB	Deliverables and Milestones	Quality Plan	Risk Plan	Data Plan
	Roles and responsibilities	WP2(NA2)	WP4(JRA2)	WP6(SA2)	AMB	Software and services	Metrics	Project Office	Procedures

This page is under construction.

Help and support: quality@egi.eu

This page is proving rules regarding risk management within EGI-Engage project.

1. Risk identification
   • a process that is used to find, recognize, and describe the risks that could affect the achievement of objectives.
2. Risk analysis
   • a process that is used to understand the nature, sources, and causes of the risks that you have identified and to estimate the level of risk. It is also used to study impacts and consequences and to examine the controls that currently exist.
3. Risk treat
   • a process that is used to compare risk analysis results with risk criteria in order to determine whether or not a specified level of risk is acceptable or tolerable.
4. Risk monitor
   • a process which goal is to review of existing Risk database conducted periodically
     

Roles and responsibilities

define the lead, support and risk management team members for each type of activity in the risk management plan and clarify their responsibilities

Timing

when and how often risk management process will be performed

Definitions

Definition (iso 31000): risk is defined as the effect of uncertainty on objectives

Risk identification

Input:

Output:

Risk identification is a process that involves finding, recognizing, and describing the risks that could affect the achievement of an organization’s objectives. It is used to identify possible sources of risk in addition to the events and circumstances that could affect the achievement of objectives. It also includes the identification of potential consequences.

1. For all newly identified risks EGI Engage risk entry template should be filled in (Part Risk Description)
2. Sent the document to Quality Manager (quality@egi.eu)

Risk analysis

Input:

Output:

Risk description

Each risk in Risk Management Database (Access restricted) is described as follow:

• Risk no - unique risk identifier
• Risk - one sentence description of the risk
• Risk level - (Low/Medium/High/Extreme) The level of risk is its magnitude. It is estimated by considering and combining consequences and likelihoods. A consequence is the outcome of an event and has an effect on objectives. Likelihood is the chance that something might happen.
• Likelihood - (Unlikely, Possible, Likely, Almost Certain) Likelihood is the chance that something might happen.
• Consequences - (Minor/Moderate/Major/Catastrophic) A consequence is the outcome of an event and has an effect on objectives.
  
• Treatment - (Protective, mitigation measures, recovery activities, controls) description of possible treatment of the risk
  
• Impact - description of impact risk will have in case of occurrence
  
• Deliverables - Deliverables which might me impacted in case of occurrence
• KPIs - Impacted KPIs
• Objective - Impacted Objective
• WP1-WP6 - Impacted WPs
  
• Owner - A risk owner is WP that has been given the authority to manage a particular risk and is accountable for doing so.
• Trend - (Stable, Improving, Degrading, New, Depricated) Indication of risk trend comparing to previous risk review period
  
• Comment for PMB - additional comments for PMB after AMB review
  

Risk level calculation

Likelihood	Consequences
	Minor	Moderate	Major	Catastrophic
Unlikely	Low	Low	Medium	High
Possible	Low	Medium	High	High
Likely	Medium	High	High	Extreme
Almost Certain	High	High	Extreme	Extreme

Risk treatment

Input:

Output:

Risk level	Treatment	PMB involvement
Low	accept define recovery activities	Informed
Medium	define mitigation activities	Informed
High	add controls define recovery activities	Consulted
Extreme	add controls define contingency plan define recovery activities	Responsible

Protective measures: (activities designed to reduce the chances of a disruptive event occurring - likelyhood)

Mitigation measures: (activities designed to minimize the severity of the event once it has occurred.)

Recovery activities: (activities serve to bring back disrupted systems and infrastructure.)

Contingency plans: (process-level documents describe what an organization can do in the aftermath of a disruptive event; they are usually triggered based on input from the emergency management team.)

Controls: (additional controls applied to it in order to reduce it to an acceptable level. What the appropriate additional controls might be, whether they can be afforded.)

Risk monitor

Input:

Output:

Risk review process

A review is an activity. Review activities are carried out in order to determine whether something is a suitable, adequate, and effective way of achieving established objectives.

In general, ISO 31000 expects you to review your risk management framework and your risk management process. It specifically expects you to review your risk management policy and plans as well as your risks, risk criteria, risk treatments, controls, residual risks, and risk assessment process.