Risk identification and analysis is necessary, but it is meaningless without following through by implementing risk responses. There are several ways you can respond to risks, ranging from avoiding them altogether to accepting them. For risks that you accept, you may choose to have a contingency plan or use contingency reserve.

In this chapter you will learn about five categories of risk responses that can be used for threats on predictive and adaptive projects. You will see how you can adjust a backlog to accommodate risk responses. We will also demonstrate different techniques for estimating the necessary contingency reserve to conduct risk activities and fund risks that you decide to accept.

RISK RESPONSES

There are some risks where you know right away how you should respond. Others require a bit more thought to determine the best response. In this chapter we will explore five categories of risk responses:

• Avoid;
• Mitigate;
• Transfer;
• Escalate; and
• Accept.

You can employ multiple responses to a risk event if you feel it is necessary. Threats and opportunities have similar responses; however, we will focus on responses for threats, with only a brief explanation of the complementary opportunity responses.

IMPLEMENTING RESPONSES

Once you have identified risk responses, you should reanalyze your risks. You would expect to see the risk score drop based on your responses. Table 16‐1 shows an example of the updated risk register for the Dionysus Winery once the risk responses have been determined. You can see a new row has been inserted under the probability and impact and score row. The new row is shaded and shows the change in rating after the response has been developed.

Note that the scores for risks 2, 3, and 4 went down. The score for risk 1 stayed the same because the team accepted the risk. Because risk 5 is an opportunity, the score went up due to the response.

When you have agreement on the risk responses, you will likely need to update various plans and project documents. For example, for the risks identified for the Dionysus Winery you would take the following steps.

Risk 1. No action required other than purchasing the cameras.

Risk 2. Assuming the risk analysis is done before baselining, the budget would reflect the higher cost for the vendor.

Risk 3. Work with the contracting department to bring a staffing agency on board. This may result in a secondary risk of increased costs, both for the staffing agency fees and the signing bonuses. You would likely escalate this to the project sponsor to confirm that performance is a higher priority than budget for this risk.

Risk 4. Update the schedule to order the de‐stemmer crusher as soon as possible. You may incur storage fees if you don't have the space to store the equipment before the production facility is renovated.

Risk 5. Work with the relevant party at the nearby winery to purchase their barrels.

RISK‐ADJUSTED BACKLOG

Projects that use Agile methods may keep a risk register or impediment log. One of the principles associated with Agile is early and continuous delivery. Thus, anything that gets in the way of delivery is a risk or impediment. Project work is kept in a backlog that can be reprioritized at the start of each iteration. Therefore, the product owner may choose to incorporate risk reduction work items into the backlog and prioritize them along with the development work. This results in a risk‐adjusted backlog.

Here are three sample risks from the Dionysus Winery management system:

1. Greek God Wineries is updating their enterprise architecture. There are two options under consideration; one will not entail a change to our interface mapping, the other will.
2. Greek God Wineries is installing a new knowledge management system at the same time we will be creating the user instructions. The system will not allow new content until after the new knowledge management system is installed and tested. This will cause a delay in user instructions.
3. The cloud carrier is upgrading their system. Once the upgraded system is live, we will have to test our data and functionality to ensure it works correctly in the new environment.

These risks will need to be addressed and the responses incorporated into the prioritized backlog.

Figure 16‐1 assumes the first iteration is complete. At the iteration planning meeting the product owner reprioritized the backlog. The following changes were made:

1. A new task was added to develop an interface map that would meet the needs of the other potential enterprise architecture. The team estimated that it would take less effort than the original interface mapping since they could reuse some of the work.
2. Writing the user instructions was moved up to accommodate the new knowledge management system. By getting the work done early, the user instructions will be brought over when the new knowledge system cuts over.
3. A new task was added to test the upgraded cloud environment. It is scheduled for the next iteration.

The new or reordered tasks are shown with a thick border.

For hybrid projects you would track all risks and responses on the risk register to ensure you have an overarching view of risk for the project. As you can see, these risk responses added another iteration to the schedule. The project manager and product owner would need to confer to determine if additional team members could be brought in to clean the data and thus shorten the duration or if the few extra days can be absorbed in the overall schedule.

RESERVE

Reserve is an umbrella term that refers to additional funds or additional time that the project team uses to deal with risk. There are two types of reserve, contingency reserve and management reserve.

Contingency Reserve

Contingency reserve is usually under the control of the project manager. It is used to accommodate accepted risks and variances that are within the variance thresholds. Because contingency reserve is considered part of the cost and schedule baselines, it is expected to be used. This gives the project manager the freedom to make decisions for the good of the project, such as taking a few extra days to ensure the requirements are complete or spending some funds for a subject matter expert to provide feedback on a prototype. These decisions can ultimately reduce risk on the project and lead to better outcomes.

One of the easiest ways to determine the appropriate amount of reserve is to take a percentage of the schedule duration or budget. For low‐risk projects, 10% is standard. For high‐risk projects, 50% is more realistic. But these are very broad parameters. To get a more accurate number, you can develop risk‐adjusted estimates.

Risk‐Adjusted Estimates

Risk‐adjusted estimates consider the range of outcomes associated with a work package by using the multipoint estimating technique described in Chapter 10. This generally entails interviewing the people who will be doing the work and asking them what their optimistic estimate is for the work, their pessimistic estimate, and their most likely estimate. When doing this, it helps to understand the rationale for each estimate. In other words, what would have to happen for the optimistic estimate, what would go wrong for the pessimistic estimate, and what assumptions are present for the most likely estimate.

Table 16‐2 shows five work packages with optimistic, most likely, and pessimistic cost estimates.

For risk‐adjusted estimates, a beta distribution equation is used to determine an expected value. The beta distribution equation is . This equation weights the most likely estimate more than the optimistic and pessimistic estimates. The expected value is an average outcome. In other words, 50% of the time the results will be less than the expected value, and 50% of the time they will be greater than the expected value.

When you apply the weighted average equation and sum the totals, you can see the outcome in Table 16‐3.

Work package	Optimistic	Most likely	Pessimistic
A	$ 2,000	$ 3,050	$ 5,000
B	$ 1,500	$ 1,600	$ 1,850
C	$ 3,000	$ 5,100	$ 6,000
D	$ 4,500	$ 5,200	$ 6,200
E	$ 2,500	$ 3,000	$ 4,100
Total	$13,500	$17,950	$23,150

Work package	Optimistic	Most likely	Pessimistic	Expected value
A	$ 2,000	$ 3,050	$ 5,000	$ 3,200
B	$ 1,500	$ 1,600	$ 1,850	$ 1,625
C	$ 3,000	$ 5,100	$ 6,000	$ 4,900
D	$ 4,500	$ 5,200	$ 6,200	$ 5,250
E	$ 2,500	$ 3,000	$ 4,100	$ 3,100
Total	$13,500	$17,950	$23,150	$18,075

If your expected value total is greater than the sum of your most likely estimates, there is less than 50% likelihood that you will achieve your cost or schedule goal. Which means the sum of the most likely estimates is not very likely!

Once you discover that the most likely estimates are not sufficient, what do you do? There are two ways to handle this; one uses a spreadsheet to provide a quick but not precisely accurate estimate, and the other entails modeling software, which provides excellent information for estimating and forecasting. Purchasing and using modeling software is usually considered overkill for projects that are less than $20,000,000, so we will focus on the simpler spreadsheet version.

Calculating Contingency Reserve

When you apply the beta distribution equation, you get a distribution of outcomes with the expected value as the 50% point. Figure 16‐2 shows an outcome distribution with the sum of the most likely and the sum of the expected values indicated.

Work package	Optimistic	Most likely	Pessimistic	Expected value	Standard deviation	Variance
A	$ 2,000	$ 3,050	$ 5,000	$ 3,200	$ 500	$250,000
B	$ 1,500	$ 1,600	$ 1,850	$ 1,625	$ 58	$ 3,403
C	$ 3,000	$ 5,100	$ 6,000	$ 4,900	$ 500	$250,000
D	$ 4,500	$ 5,200	$ 6,200	$ 5,250	$ 283	$ 80,278
E	$ 2,500	$ 3,000	$ 4,100	$ 3,100	$ 267	$ 71,111
Total	$13,500	$17,950	$23,150	$18,075		$654,792

To get a rough estimate that will get you approximately in the 84% confidence range, subtract the optimistic estimates from the pessimistic estimates and divide by six for each work package. This gives you a standard deviation for each work package.

Next, square the standard deviation for each work package to get the variance. Table 16‐4 shows the worksheet with the standard deviation and variance calculated.

Sum all the variances to get a total variance for the project; for our example the total variance is $654,792. Once you have the project variance, take the square root of that number. That is the standard deviation for the project. For our example, the standard deviation of the project is $809. If you add the standard deviation for the project to the sum of the expected values, you will get a number that you should be able to meet or beat 84% of the time. For our example the expected value plus one standard deviation is $18,884.

SUMMARY

In this chapter we looked at responding to risks. We covered five risk responses: avoid, mitigate, transfer, escalate, and accept. Some risk responses result in secondary risks, which need to be analyzed and responded to. For risks that are accepted, it is a good idea to establish risk triggers and fallback plans. Agile projects may integrate risk reduction activities into their backlog to create a risk‐adjusted backlog.

Contingency reserve protects your cost and schedule baselines and allows you to make good decisions to reduce risk. We showed how to estimate contingency reserve by comparing most likely estimates to expected values and then calculating the needed contingency.