By Rex M. Holmlin, PMP
I teach project management to undergraduate and graduate students, as well as students in continuing corporate education programs. During one class on project risk management, we discussed retiring risks once the activities associated with them were complete. That's when a student asked, “What about zombie risks?”
He had worked on a project in which the team diligently identified risks and included them in the risk register. As the likelihood of each risk became low enough, the team retired it, and the contingency funds set aside for that risk were freed up for other purposes.
Unfortunately, after being retired, one risk “came back to life”—much like a zombie—and was realized. At this point, the funds associated with the risk response plan had been used for other purposes.
In our discussion about zombie risks, three important points emerged. First, project risk management tools should be integrated with other tools we use in project management to provide a better understanding of interdependencies. One option is to map risks to either the work breakdown structure (WBS) and/or the project schedule. (For more information on this, see the PMI Global Congress paper Understanding Risk Exposure Using Multiple Hierarchies by David Hillson, PhD, PMP, PMI Fellow.)
By mapping risks to the WBS, we know which deliverables have risks associated with them. We also get a much better idea about where clusters of risk may lie in our project. A project team could map risks directly to activities in the schedule, but there is potential value in taking a “top-down” approach and mapping to the WBS first. While risks may be primarily associated with a particular activity, mapping to the WBS and then decomposing deliverables into activities could better identify other relationships or dependencies.
A second theme in our discussion on preventing zombie risks was the need for a structured process for risk retirement and the release of funds associated with the risk. When should a risk be retired? When the activity it is primarily associated with is complete? Or when a deliverable the activity is associated with is complete? Making this decision takes considerable judgment, and organizations could benefit from a formalized discussion about risk retirement, as well as a documented risk retirement process.
Lastly, the discussion stressed the importance of the role of risk owner, the project team member who is charged with monitoring and managing a particular risk. The risk owner should have a very clearly delineated role to play in recommending risk retirement and requesting release of contingency funds associated with that risk.
With these processes in place, project teams can make sure their risks won't come back to haunt them after they've been retired. PM
Rex M. Holmlin, PMP, is a visiting professor of project management in the Mason School of Business at the College of William and Mary, Williamsburg, Virginia, USA.
JULY 2015 PM NETWORK