When managing projects, the concept of risk and risk management is incredibly critical. Risks have the potential to disrupt the entire project, affecting schedules, budgets, and quality. It keeps project managers on their toes, given the potential impacts it might have on their projects. Considering various types of risks, such as residual and secondary risks, and communicating their impacts is an essential part of the PMI Risk Management Professional (PMI-RMP) exam and in the real world profession.
Let’s start with the basics to clarify what these terms mean.
Residual Risks
Residual risks are the risks that remain after all the planned risk responses have been implemented. Theoretically, these are the “leftover” risks that still exist even after taking actions to avoid or mitigate specific threats.
For example, let’s say we’re constructing a building, and there’s a risk of a delay due to unpredictable weather conditions like sudden rainfall. We plan accordingly, scheduling indoor activities on forecasted rainy days and outdoor activities on sunny days as a risk response strategy. However, the risk that the weather forecast is incorrect and rains on a day it was supposed to be sunny, is a residual risk.
Secondary Risks
On the other hand, secondary risks are the risks that arise as a direct result of implementing a risk response. In other words, these are new risks that emerge from the actions we take to handle existing risks.
Continuing with our previous example, let’s say we hired an extra team to work on sunny days to speed up the process and mitigate the risk of delay. The secondary risk in this case could be the team failing to work efficiently due to having extra workers on the site, which might result in safety issues or miscommunication.
Update and Communicate the Impacts
In order to keep a project on track, it’s essential to not only identify, assess and plan response for residual and secondary risks, but also to monitor, update, and communicate their impact effectively.
The below table demonstrates how to update and communicate the impact of these risks:
| Steps | Description |
|---|---|
| Identify | Clearly identify all residual and secondary risks, noting their sources and potential impact. |
| Analyze | Perform both a qualitative and quantitative analysis to understand the severity of these risks. |
| Update | Regularly update the risk register, noting any changes or new risks that are identified. |
| Communicate | Convey risk information and the potential impact to all project stakeholders in an understandable and timely manner. |
| Review | Regularly review the effectiveness of the risk responses and make adjustments as necessary. |
By properly managing residual and secondary risks, we can keep these risks under control and steer our project more confidently towards its goals.
Conclusion
In conclusion, understanding the impact of residual and secondary risks, updating their status, and communicating their impact is not just critical to passing the PMI-RMP Exam, but also to successful project execution. This proactive approach to risk management ensures preparedness against all forms of risks, contributing to the overall success of your projects.
Practice Test
True or False: Residual risks are the risks that remain after all risk response strategies have been implemented.
- True
- False
Answer: True
Explanation: Residual risks are those that remain after all risk response strategies have been carried out. They represent the remaining threat after all mitigation measures have been taken into consideration.
True or False: Secondary risks arise directly as a result of implementing a risk response.
- True
- False
Answer: True
Explanation: Secondary risks are new risks that occur as a direct result of implementing a risk response. They are unintended consequences that need to be identified and managed in order to ensure a successful project.
Which of the following is an example of a secondary risk?
- a) The risk that a supplier may fail to deliver equipment on time
- b) The risk that equipment may fail after being installed
- c) The risk that the installation of equipment may cause other equipment to fail
- d) The risk that a supplier may increase their prices
Answer: c) The risk that the installation of equipment may cause other equipment to fail
Explanation: This is a secondary risk as it arises as a direct result of implementing a risk response – the installation of new equipment.
Which risk response strategy may increase the level of residual risk?
- a) Avoid
- b) Transfer
- c) Mitigate
- d) Accept
Answer: d) Accept
Explanation: Accepting a risk may increase the level of residual risk, as no attempt is being made to mitigate the risk.
True or False: Communicating the impact of residual and secondary risks is considered unnecessary in project risk management.
- True
- False
Answer: False
Explanation: Communicating the impact of residual and secondary risks is necessary in project risk management. It is important to keep stakeholders informed about these risks so they can make informed decisions.
Which of the following need to be updated when there is a change in the impact of residual and secondary risks?
- a) Risk register
- b) Project schedule
- c) Project budget
- d) All of the above
Answer: d) All of the above
Explanation: Changes in the impact of residual and secondary risks can potentially affect all aspects of the project. Therefore, it is necessary to update the risk register, project schedule and project budget.
What is the main output of the process monitor and control risks in project risk management?
- a) Risk register updates
- b) Work performance information
- c) Change requests
- d) Project documents updates
Answer: a) Risk register updates
Explanation: When monitoring and controlling risks, the main output is updates to the risk register, which should include information about residual and secondary risks.
What impact does the identification of secondary risks have on the project?
- a) It stops all work on the project until risks are managed
- b) It may alter the risk profile of the project
- c) It has no impact on the project
- d) It creates unnecessary fear among the team
Answer: b) It may alter the risk profile of the project
Explanation: The identification of secondary risks may alter the risk profile of the project, as new risks have been identified due to the implementation of risk responses.
True or False: Secondary risks are always regarded as negative risks or threats to the project.
- True
- False
Answer: False
Explanation: While secondary risks can indeed be threats to the project, they can also present opportunities and not always be negative.
How should information about the impact of residual and secondary risks be communicated to stakeholders?
- a) Through formal reports
- b) In a informal verbal communication
- c) Through emails
- d) All of the above
Answer: d) All of the above
Explanation: The format of communication will depend on various factors such as the urgency of the information and the nature of the information. All mentioned methods could be used to ensure that stakeholders are kept informed.
Interview Questions
What is a residual risk in the context of risk management?
Residual risk refers to the risk that persists after all risk management strategies and actions have been applied.
How should the impact of residual and secondary risks be communicated in a project management context?
The impact of residual and secondary risks should be communicated clearly, accurately, and promptly to all relevant stakeholders. This can be done through project status meetings, detailed reports, or specific risk communication tools.
What would be considered a secondary risk in a project?
A secondary risk arises as a direct consequence of implementing a risk response. It is essentially a risk created when dealing with another risk.
What is the importance of updating the impacts of residual and secondary risks?
The impacts of residual and secondary risks may change over time or as the project progresses. Regularly updating these impacts helps keep everyone involved with the project informed, allowing them to make timely and effective decisions if these risks arise.
What tools can be used to communicate the impact of residual and secondary risks?
Communication tools such as risk breakdown structures (RBS), influence diagrams, risk reports, and risk registers can be used to effectively communicate the impacts of residual and secondary risks.
How are residual risks treated in a project?
Residual risks are typically accepted and monitored, as they are the risks that remain after all risk responses have been deployed. However, if a residual risk is deemed too high, additional measures or controls may be implemented.
How can we identify secondary risks?
Secondary risks can be identified during the risk response planning process. It involves carefully analyzing the potential consequences of planned risk responses.
Why is it important to update stakeholders about the status of residual risks?
Updating stakeholders about residual risks keeps them informed about any potential threats that might still exist. This fosters trust and transparency, enabling stakeholders to make informed decisions.
When should the impacts of residual and secondary risks be communicated to stakeholders?
It depends on the nature and impact of the risks involved, but generally, these should be communicated in a timely manner whenever there are significant changes or updates. Some organizations may have specific communication protocols in place for risk management.
Does a change in the status of residual or secondary risks often lead to revision in the risk management plan?
Yes, a significant change in the status of residual or secondary risks could necessitate a revision of the risk management plan, particularly if they may impact the project’s objectives, schedule, or budget.
How does good communication of residual and secondary risk impact help in risk mitigation?
Good communication enables timely decision-making and can potentially reduce, if not avoid, the potential negative impacts of the risks on the project.
In risk management, what documentation could be used to record and communicate about residual and secondary risks?
Risk registers, risk management plans, and risk reports are typically used to record and communicate about residual and secondary risks.
Who is responsible for communicating the impact of residual and secondary risks within a project team?
While it can vary based on the organization and project, it is typically the responsibility of the project manager or the risk manager to communicate the impact of these risks.
Why is it necessary to reassess and update the status of residual risks regularly?
It’s necessary to reassess and update the status of residual risks regularly to ensure the remaining level of risk is still acceptable and within the project’s risk appetite.
Is the process of documenting the impact of residual and secondary risks an ongoing process?
Yes, documenting the impact of residual and secondary risks is an ongoing process as these risks can change, appear, or disappear as the project progresses.
extutorials.com