Alert.png The wiki is deprecated and due to be decommissioned by the end of September 2022.
The content is being migrated to other supports, new updates will be ignored and lost.
If needed you can get in touch with EGI SDIS team using operations @ egi.eu.

EGI-Engage:Risk Plan

From EGIWiki
Revision as of 10:09, 15 September 2015 by Krakow (talk | contribs) (→‎Definitions)
Jump to navigation Jump to search
EGI-Engage project: Main page WP1(NA1) WP3(JRA1) WP5(SA1) PMB Deliverables and Milestones Quality Plan Risk Plan Data Plan
Roles and
responsibilities
WP2(NA2) WP4(JRA2) WP6(SA2) AMB Software and services Metrics Project Office Procedures


Baustelle.png This page is under construction.



Help and support: quality@egi.eu

This page is proving rules regarding risk management within EGI-Engage project.


Risk process.png


  1. Risk identification
    • goal: determining which risk can affect the project and documenting it in Risk registry
    • a process that is used to find, recognize, and describe the risks that could affect the achievement of objectives.
  2. Risk analysis
    • goal: assessing likelihood and consequences, calculate risk level
    • a process that is used to understand the nature, sources, and causes of the risks that you have identified and to estimate the level of risk. It is also used to study impacts and consequences and to examine the controls that currently exist.
  3. Risk response 
    • goal: defining risk response plan for each risk
    • a process of defining risk response, appropriate for the significance of the risk (risk level), cost-effective, realistic and agreed by involved parties.
  4. Risk control
    • goal: improve efficiency of risk approach through continuously monitoring and adjustment 
    • a process of implementing risk response plan, tracking identified risks, performing risk reviews

Roles and responsibilities

Quality and Risk Manager:

Risk Manager


Technical Coordinator:


Work Package leaders:

Risk management team members 




Timing

Risk management process is daily responsibility of EGI-Engage Work Package leaders. Risks should be treated and identified on daily basis.

Periodically as part of the review process Project Management Board is involved to review status of risk management performed by Work Package leaders.

Definitions

Risk

  • iso 31000: a risk is defined as the effect of uncertainty on objectives
  • PMBOK (Project Management Institute): a risk is an uncertain event or condition that if it occurs, has a positive or negative effect on a Project's Objectives

Risk Registry (Access restricted)

  • database of identified risks with recorded their analysis and response planning


Risk entry

Each risk is described as follow:

  • Risk no - unique risk identifier
  • Risk - one sentence description of the risk
  • Risk level - (Low/Medium/High/Extreme) The level of risk is its magnitude. It is estimated by considering and combining consequences and likelihoods. A consequence is the outcome of an event and has an effect on objectives. Likelihood is the chance that something might happen.
  • Likelihood - (Unlikely, Possible, Likely, Almost Certain) Likelihood (probability) is the chance that something might happen.
  • Consequences - (Minor/Moderate/Major/Catastrophic) A consequence (impact) is the outcome of an event and has an effect on objectives.
  • Treatment - (Protective, mitigation measures, recovery activities, controls) description of possible treatment of the risk
  • Impact - description of impact risk will have in case of occurrence
  • Deliverables - Deliverables which might me impacted in case of occurrence
  • KPIs - Impacted KPIs
  • Objective - Impacted Objective
  • WP1-WP6 - Impacted WPs
  • Owner - A risk owner is WP that has been given the authority to manage a particular risk and is accountable for doing so.
  • Trend - (Stable, Improving, Degrading, New, Deprecated) Indication of risk trend comparing to previous risk review period
  • Comment for PMB - additional comments for PMB after AMB review


Risk identification

Input: Work Package leaders expertise 

Output: Initial Risk entry in Risk registry

Risk identification is a process that involves finding, recognizing, and describing the risks that could affect the achievement of an organization’s objectives. It is used to identify possible sources of risk in addition to the events and circumstances that could affect the achievement of objectives. It also includes the identification of potential consequences.

Risk are identified:

  1. Periodicaly: 
    • During Risk registry review through interviews and brainstorming with Work Package leaders
  2. On daily basis:
    • For all newly identified risks EGI Engage risk entry template should be filled in (Part Risk Description)
    • Sent the document to Quality Manager (quality@egi.eu)

Risk analysis

Input: risk entry in Risk registry

Output: prioritized list of risks (list of risks that pose the greatest threat), risk trends 

The level of likelihood and consequences for each risk is evaluated during the interviews with Work Package leaders performed by Quality manager. 

Risk rating (level) is calculated according to Likelihood and consequences matrix:

Risk likelihood and consequences matrix (risk level)

The matrix is a grid for mapping the consequences and likelihood of each risk occurrence and its impact to the project objectives if that risk occurs. Risks are prioritized according to their potential implications on project objectives.

Likelihood Consequences
Minor Moderate Major Catastrophic
Unlikely Low Low Medium High
Possible Low Medium High High
Likely Medium High High Extreme
Almost Certain High High Extreme Extreme

Risk response 

Input: Risk registry

Output: Risk response plan for each risk

Within this process risk owner, who is responsible for given risk and its risk response, must be identified. Risk response should be appropriate for the significance of the risk (risk level), cost-effective, realistic and agreed by involved parties.

Following response activities are foreseen:

  • Accept
  • Mitigate
  • Avoid


Following response activities are foreseen:

  • Mitigation activities: activities designed to minimize the severity of the event once it has occurred.
  • Recovery activities: activities serve to bring back disrupted systems and infrastructure.
  • Contingency plan: process-level documents describe what an organization can do in the aftermath of a disruptive event; they are usually triggered based on input from the emergency management team.
  • Controls: additional controls applied in order to reduce it to an acceptable level.


Following table presents for each Risk level expected response to be defined and involvement of Risk management team members.

Risk level
Response Involvement
Quality manager
Technical Coordinator
Work Package leader
PMB
Low
  • Accept
  • Define
    • recovery activities
Informed Informed Accountable, Responsible Informed
Medium
  • Mitigate
  • Define
    • mitigation activities
Consulted Consulted Accountable, Responsible Informed
High
  • Mitigate
  • Define
    • controls
    • mitigation activities
    • recovery activities
Consulted Responsible Accountable, Responsible Informed, Consulted
Extreme
  • Avoid/mitigate
  • Define
    • controls
    • contingency plan
    • recovery activities
    • mitigation activities
Responsible Responsible Accountable, Responsible Responsible


Risk control

Input: Risk registry

Output: Improved efficiency of risk approach

Risk control is a process which goal is to improve efficiency of risk approach through continuously monitoring and adjustment. It  is implementing risk response plan, tracking identified risks, performing risk reviews.

Activities

  1. Periodically - every 3 months (AMB and PMB):
    • performing Risk registry review through interviews and brainstorming with Work Package leaders. Outcome is reported by Quality manager to PMB.
  2. On daily basis (Work Package Leavers):
    • implementation of risk response plan
    • tracking identified risks