methodology

KRMC RISK MANAGEMENT SYSTEM OVERVIEW

Introduction

The KRMC risk management system is designed to ultimately reduce or eliminate risks that could negatively affect the organization’s goals and objectives.

Risks will be managed at three connected levels:

· Project

· Program

· Portfolio

Moving from a tactical approach (project and program) to a strategic one (portfolio). KRMC individual risk management includes:

· Risk Identification

· Risk Assessment

· Risk Response Plan

· Risk Response Implementation (includes mitigation and contingency plan)

· Risk Monitoring

· Closing Risk

Continuous improvement is part of the KRMC risk management system. The SEI | Carnegie Mellon identifies the seven principles for an effective risk management system as:

· Open Communication- refers to the sharing of ideas and opinions between professionals who are working on similar or related tasks.

· Integrated Management- refers to the management of all aspects of a project including processes and related systems, that insures the successful execution of a project.

· Teamwork- refers to the process of working collaboratively with a group of individuals in order to achieve a goal.

· Forward-looking View- refers to the capacity of developing a vision for the project, focusing on the customer’s requirements.

· Global Perspective- refers to the capability of understanding different cultures and geographical regions.

· Shared Product Vision- refers to the long-term mission of the product, that help develop a better product roadmap, improves the strategic decision-making, and will help align team and stakeholders across the company.

· Continuous Process- refers to the methodology that follows a cyclical approach throughout the life of a project. The continuous process provides the foundation for the next.

(Organizational Risk Management, 2012).

These systems are incorporated into the KRMC risk management process. A tool for assessing risk management systems is available here.

The Project Management Methodology found on the KRMC Project Management website Base has detailed process documents and supporting tools and templates for risk management. There are also risk management training modules available here.

Project Risk Management

The primary objective of using a project risk management is to increment organizational value. This process is used in identifying, assessing, monitoring, response planning and implementation, and closing project risk. At the beginning of the project, the project manager will create a risk management plan (template found here.) Project teams will then participate in a risk identification and assessment activity during project kick-off or first project team meeting and during the project as needed.

The project manager will create the risk register (template found here) with all risks submitted by project team members. The risk register will include a description of the risk, the type of risk (technical, benefits, resources, schedule, cost, scope, user acceptance), the impact, the likelihood, the risk score, internal risk controls, the mitigation plan and strength, the contingency plan, and a risk owner.

To monitor risks, the project manager is responsible for regularly reviewing and assessing project risks with the project team and adjusting the risk plan, risk register, and mitigation plans as necessary.

An optional risk identification and assessment process is also available for project risk management, document found here. This process is recommended for large projects but can be used on any. Please note: this process can take some time to complete, up to two weeks or so, but yields valuable information for risk management. Training modules for risk management can be found here. Tools for the project risk management process can be found here.

Program Risk Management

Programs are a selection of projects managed together to obtain benefits that would not be achieved if the projects were managed separately. Program risk management is the identification, assessment, and management of those risks that put the program benefits in jeopardy. Program risks can come from two sources - a program risk assessment or risks submitted from the program’s associated projects.

At the beginning of the program, the program manager will create a risk management plan (template found here.) Next, the program manager, in consultation with the program’s project managers, will create a program risk register (template found here.) Risk categories for a program risk assessment in the program risk register include research knowledge base, program delivery, community satisfaction, service excellence, and quality. These can be modified as needed. Program risks can also be based on project interdependencies for resources, funding, and schedule. The program manager, in collaboration with the program’s project managers, is responsible for regularly reviewing and assessing the program risks maintained in the program risk register. Tools for the program risk management process can be found her e .

Portfolio Risk Management

Portfolio risk management is the identification, assessment, and management of those risks that put the organization’s strategic objectives in jeopardy. Portfolio risks can include program or project risks, or risks identified by performing an organizational risk assessment. In addition, program managers or project managers, not associated with a program, will notify the organizational leader of risks to be reviewed and potentially added to the organizational risk register. Identifying, assessing, and monitoring other risks on the portfolio risk register, not specifically related to a program or project, are the responsibility of the organization’s leader. The portfolio leader will facilitate a quarterly division risk board meeting to review the portfolio risks. Portfolio risk categories map to the organization’s risk categories: xxx, yyy, zzz, and aaa. The portfolio risk management approach will be evaluated yearly, based on the strategic objectives for the upcoming year. Portfolio risk tools and templates can be found here.