Concepts
These risks, if not managed effectively, could compromise the product/service
quality performance, impact the project’s timeline, and budget. Being proactive
about understanding, updating, and communicating the implications of these risks
contributes significantly to the project’s success.
I. Understanding Residual and Secondary Risks
Before diving into the importance of updating and communicating these risks,
let’s break down what residual and secondary risks are:
- Residual Risks: These are the risks that remain after risk
response strategies have been implemented. They’re essentially the “leftover”
risks that still exist, even after you’ve done everything you can to address
them. - Secondary Risks: These are the risks that arise as a
direct outcome of implementing a risk response. Essentially, they’re the
“rebounds” or unintended consequences that come up as a result of dealing with
the initial risks.
II. Updating and Communicating the Impact of Residual and Secondary Risks
1. Continuous Risk Assessment:
Risk management is a continual process. The residual and secondary risks need
to be constantly assessed, updated, and communicated to all the key stakeholders.
For instance, if the mitigated primary risk was delay in critical path
activities, the residual risk could be still not accomplishing the task within
the adjusted timelines, and the secondary risk could be incurring additional cost
or delay in downstream activities. The impact of such risks needs to be promptly
updated and communicated.
2. Residual Risk Examples and Communication:
For example, after executing a risk response plan for a software project, the
residual risk might be that some minor bugs might still exist. The project
manager needs to communicate this to the testing team, so they are prepared to
deal with it.
3. Secondary Risk Examples and Communication:
Continuing the software project example, the secondary risk might be that
fixing those minor bugs could delay the release date. The project manager should
communicate the potential for this delay to the relevant stakeholders, including
the client, so that expectations can be managed appropriately.
III. The Role of Risk Register
The communication can be handled effectively through the risk register, a
document that tracks all potential risks along with their impacts and responses.
Importance of updating it cannot be overstated.
Below is an example of how to structure a risk register:
| Risk ID | Risk Description | Risk Impact | Risk Probability | Risk Category | Risk Response | Residual Risk | Secondary Risk |
|---|---|---|---|---|---|---|---|
| 001 | Delay in critical path activities | High | High | Schedule | Replan | Task not accomplished on time | Additional cost |
IV. Periodic Risk Reviews
Periodic risk reviews provide a platform to discuss the changes in risks,
verify whether the risk responses are effective, and check if any residual or
secondary risks have emerged. It also aids in the updating of risk register and
communication process.
In conclusion, understanding, updating, and communicating residual and secondary
risks is fundamental in risk management. It fosters an environment of transparency
and preparedness, enabling the project team to respond effectively to risks,
thereby enhancing the likelihood of project success.
Answer the Questions in Comment Section
True/False: Residual risks are the risks that remain after all risk response planning has been implemented.
- True
- False
Answer: True
Explanation: This is true because residual risks are those that remain even after risk management strategies have been implemented.
Multiple Select: What are the types of residual risks?
- a. Known residual risks
- b. Unknown residual risks
- c. Controllable residual risks
- d. Uncontrollable residual risks
Answer: a., b.
Explanation: There are two types of residual risks: known residual risks, which are those that have been identified and assessed, and unknown residual risks, which have not been identified or assessed.
Single Select: When should the impact of residual risks be communicated?
- a. Before planning risk management strategies
- b. After planning risk management strategies
- c. During the implementation of risk management strategies
- d. After the completion of the project
Answer: b. After planning risk management strategies
Explanation: The impact of residual risks should be communicated after planning risk management strategies, as the team needs to know what risks still could occur even after plans have been put into place.
True/False: Secondary risks are the direct result of implementing risk response.
- True
- False
Answer: True
Explanation: Secondary risks are indeed risks that arise as a direct result from implementing a risk response.
Single Select: Who must be informed about the impact of residual and secondary risks?
- a. Project Team
- b. Stakeholders
- c. Project Managers
- d. All of the above
Answer: d. All of the above
Explanation: All parties involved in a project, including project teams, stakeholders, and project managers, need to be informed about the impact of residual and secondary risks.
Multiple Select: What techniques can be used to communicate the impact of residual and secondary risks?
- a. Risk register
- b. Risk breakdown structure (RBS)
- c. Project status report
- d. Project budget
Answer: a., b., c.
Explanation: The risk register, Risk breakdown structure (RBS), and project status report are all used to communicate the impact of residual and secondary risks, while the project budget is not.
True/False: It is not necessary to continuously monitor and update the impact of residual and secondary risks.
- True
- False
Answer: False
Explanation: It is essential to continuously monitor and update the impact of residual and secondary risks as they might change or evolve during the project lifecycle.
Single Select: When do secondary risks occur?
- a. Before risk responses are implemented
- b. Before risks are identified
- c. After risk responses are implemented
- d. After project completion
Answer: c. After risk responses are implemented
Explanation: Secondary risks occur as a direct result of implementing risk responses.
Multiple Select: What should be included in the communication about residual and secondary risks?
- a. The likely impact
- b. The cost of mitigation
- c. The likelihood of occurrence
- d. All of the above
Answer: d. All of the above
Explanation: The communication about residual and secondary risks should include their likely impact, the cost of mitigation and their likelihood of occurrence.
True/False: The impact of residual and secondary risks should only be communicated to the project team.
- True
- False
Answer: False
Explanation: Not only the project team but also the stakeholders and project managers should be informed about the impact of residual and secondary risks.
Great post on updating and communicating the impact of residual and secondary risks. Really helpful for my PMI-RMP exam prep!
I appreciate the detailed approach on managing secondary risks. It’s often overlooked in many guides.
Thanks for this informative post! It clarified a lot of doubts I had.
Can someone explain how to quantitatively analyze secondary risks?
Quantitative risk analysis of secondary risks involves simulating potential scenarios using tools like Monte Carlo simulations. This helps in understanding variability and potential impact more precisely.
You’re right. We often use decision tree analysis as well, which helps in visualizing potential outcomes.
This blog was a lifesaver for my study sessions. Thanks!
I think more examples would be helpful to understand the practical application.
Agreed. Practical examples make it easier to relate to the concepts.
Updating the risk register with residual risks seems cumbersome. Any tips?
Using software tools like MS Project or specialized risk management software can streamline this process. Automation is key.
Appreciate the focus on communication. It’s vital to keep all stakeholders informed about residual risks.
Absolutely, transparent communication can significantly reduce the impact of these risks.