Project Management Institute

Zombie risks


By Rex M. Holmlin, PMP

I teach project management to undergraduate and graduate students, as well as students in continuing corporate education programs. During one class on project risk management, we discussed retiring risks once the activities associated with them were complete. That's when a student asked, “What about zombie risks?”

He had worked on a project in which the team diligently identified risks and included them in the risk register. As the likelihood of each risk became low enough, the team retired it, and the contingency funds set aside for that risk were freed up for other purposes.

Unfortunately, after being retired, one risk “came back to life”—much like a zombie—and was realized. At this point, the funds associated with the risk response plan had been used for other purposes.

In our discussion about zombie risks, three important points emerged. First, project risk management tools should be integrated with other tools we use in project management to provide a better understanding of interdependencies. One option is to map risks to either the work breakdown structure (WBS) and/or the project schedule. (For more information on this, see the PMI Global Congress paper Understanding Risk Exposure Using Multiple Hierarchies by David Hillson, PhD, PMP, PMI Fellow.)

By mapping risks to the WBS, we know which deliverables have risks associated with them. We also get a much better idea about where clusters of risk may lie in our project. A project team could map risks directly to activities in the schedule, but there is potential value in taking a “top-down” approach and mapping to the WBS first. While risks may be primarily associated with a particular activity, mapping to the WBS and then decomposing deliverables into activities could better identify other relationships or dependencies.

A second theme in our discussion on preventing zombie risks was the need for a structured process for risk retirement and the release of funds associated with the risk. When should a risk be retired? When the activity it is primarily associated with is complete? Or when a deliverable the activity is associated with is complete? Making this decision takes considerable judgment, and organizations could benefit from a formalized discussion about risk retirement, as well as a documented risk retirement process.

Lastly, the discussion stressed the importance of the role of risk owner, the project team member who is charged with monitoring and managing a particular risk. The risk owner should have a very clearly delineated role to play in recommending risk retirement and requesting release of contingency funds associated with that risk.

With these processes in place, project teams can make sure their risks won't come back to haunt them after they've been retired. PM


Rex M. Holmlin, PMP, is a visiting professor of project management in the Mason School of Business at the College of William and Mary, Williamsburg, Virginia, USA.

This material has been reproduced with the permission of the copyright owner. Unauthorized reproduction of this material is strictly prohibited. For permission to reproduce this material, please contact PMI.




Related Content

  • PM Network

    Trees of Life

    By Hendershot, Steve The world needs more trees—and a lot of them—to stem the damage wrought by mass deforestation. Brazil alone is destroying the equivalent of three football pitches per minute in the Amazon rainforest…

  • PM Network

    Rising Risks

    By Nilsson, Ryan For as long as humans have been building cities, they have migrated toward the coasts -- for food, ease of transportation and any number of ecological benefits. Today, it's estimated that more than…

  • PM Network

    Playing with Fire

    By Jones, Tegan With the coastline of an entire continent burning, a scorched-earth urgency had teams across Australia racing to control the damage. Between September 2019 and January 2020, bushfires ravaged…

  • PM Network

    From the Rubble

    By Thomas, Jennifer Puerto Rico's infrastructure woes began long ago. But a series of earthquakes this year coupled with hurricanes Irma and Maria in 2017—which racked upUS$139 billion in damage—exacerbated the U.S.…

  • PM Network

    Trading Transformed?

    Blockchain—the technology that made cryptocurrency mainstream—is now entering the U.S. stock market. In November, the U.S. Securities and Exchange Commission approved a pilot project to use…