Risk management, risk statuses and lessons learned

Risk Management

Olha Ilvachova IT PMO| Acino Kyiv, 30, Ukraine

For risk management we use several risk statuses:
- Identified
- Mitigation planned
- Materialized
- Accepted
- Resolved/Closed
- Not occurred
From risk management perspective I need to update statuses accordingly during the project. But for future analysis and lessons learned I need to know which risks were materialized and which were not.
How to achieve it? Will appreciate your help

Posted: Nov 24, 2020 3:49 AM (Updated by author: Nov 24, 2020 3:50 AM)

Sort By:

< 1 2 >

Olha Ilvachova IT PMO| Acino Kyiv, 30, Ukraine

Nov 25, 2020 7:58 AM

Replying to Kiron Bondale

...

Olha -

Are you able to modify the taxonomy to support the reporting you are looking for? Basically, you'd want to differentiate the following four cases:

1. Identified risks which were just accepted but were not realized
2. Identified risks which were just accepted and were realized
3. Identified risks which were responded to (e.g. avoid/transfer/mitigate/escalate) and were not realized
4. Identified risks which were responded to (e.g. avoid/transfer/mitigate/escalate) and were realized

Kiron

You actually gave me an idea that I might just need 2 different statuses for resolved: 1) 'Resolved (mitigated)' that can be used for risks that were successfully mitigated and thus prevented. 2) 'Resolved (materialized)' for risks that materialized and were fixed afterwards

Posted: Nov 25, 2020 10:30 AM

Olha Ilvachova IT PMO| Acino Kyiv, 30, Ukraine

Nov 25, 2020 7:58 AM

Replying to Kiron Bondale

...

Identified - risks that were identified and are in the process of investigation/response planning.
Mitigation planned - risks where we have created a mitigation plan and someone is assigned for taking care about it.
Materialized - risks that occurred. It can be both accepted risks and with mitigation plan (unsuccessful)
Accepted - when team could not suggest any mitigation plan and we leave it as is
Not occurred - risk that just not happened without any mitigation steps. Usually we se it for accepted risks
Resolved/Closed - risks either successfully mitigated, or materialized and the consecuences fixed.
So I assume that I might need to differentiate 2 types of 'resolved' and that should help. Because I manage risks via MS Project Online and it does not support historical information

Posted: Nov 25, 2020 10:41 AM

Sergio Luis Conte Helping to create solutions for everyone| Worldwide based Organizations Buenos Aires, Argentina

Nov 25, 2020 4:28 AM

Replying to Olha Ilvachova

...

Hi! I do ask each status when performing monitoring sessions. The problem is that when risk is materialized, and then resolved, I change the status from 'Materialized' to 'Resolved'. And I do the same after mitigation actions - change the status from 'Mitigation planned' to 'Resolved'. So in the end I have no indication which of the risks were materialized and which mitigated

Now I understood. This is an "ancient" problem in information technology (jeje). What you have to do is change the status but keep the previous record. I mean, when the status is changed you have to create a new record as a copy of the original but with the new status. In that way you will be able to trace the whole life of each risk/issue. This is a technique used in some place like bank/finance domains to pass SOX controls for example. Hope it helps.

Posted: Nov 27, 2020 9:51 AM (Updated by author: Nov 27, 2020 9:52 AM)

< 1 2 >

Please login or join to reply

Risk management, risk statuses and lessons learned

Sponsors

Vendor Events

Guessing is not a strategy: How to build decision velocity with AI and real-time data

Newsletters