DTU ProjectLab - User contributions [en-gb]

Risk Management Overview

2018-02-26T13:30:20Z

JonasHL: /* Limitations and advantages of Risk management (discussion) */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(pV)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.
Visually risks in the red and yellow area, should, if possible, move towards the green area, when mitigations and controls are applied.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:

#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p12).

Project Managers can use these six steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of Risk management (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have allocated more efficiently.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s, which does not take the fast-changing and connected world which projects happens in today into account <ref name="CriticArticle" />.

Second, the ISO 31000 is often criticized for having a narrow scope, for instance, the standard does not include setting objectives, but it does require that objectives are set.
Furthermore, the guidelines provided in the ISO 31000 can be harder to understand and implement in ''Small and Medium-sized Enterprises'' which is why the ISO 31000 SME <ref name="iso31000sme" /> can be an additional standard, which managers need to take into consideration.

Therefore it is vital that risk managers do not blindly follow the ISO 31000, but read material from multiple sources, for instance, the literature listed in section [[#Annotated Bibliography|Annotated Bibliography]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is New Zealand based. They provide business and finance support to over 100.000 members, which is a huge company and therefore must have a lot and specialized knowledge within their field (https://www.charteredaccountantsanz.com/about-us). Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference on the page.
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">Pearson H. "Project Management", ''Pearson Education Limited''. 4th. Edition; 2010.</ref>
<ref name="iso31000sme">ISO. "31000 Risk Management for smes", ''ISO''; 2015. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO. "31000 Risk management — Principles and guidelines", ''International Standard''; 2009. </ref>
<ref name="RiskMatrixPicture">CGE Academy. "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq. "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia. "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">Geraldi J, Thuesen C, Oehmen J. "How to Do Projects". 1st ed. ''Dansk Standard''; 2017.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University. "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey. "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">Aven T. "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability''; 2017.</ref>
<ref name="RisikoRadio">Risko Radio. "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">Reddy C. "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="SamsungArticle">Lopez M. "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">Hotten R. "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">Treanor J. "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">Gonzalez G. "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup. "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">Westland J. ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Annotated Bibliography===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: Maylor H. "Project Management".4th ed. ''Pearson Education Limited''; 2010.
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO. "31000 Risk management — Principles and guidelines". ''International Standard''; 2009.
::The golden standard within risk management, it gives a great overview of definitions and approaches to risk management and is, therefore, a must-read.
*Chapter 11 in Project Management Institute. "A guide to the project management body of knowledge: PMBOK Guide". ''Project Management Institute''; 2000.
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis. "SRA glossary ". ''Committee on Foundations of risk analysis''; 2015. (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
*Jensen JL. "Risk & Return - The Economic Red Phone Explained". ''Springer International Publishing AG''; 2017.
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*Nassim NT, Goldstein DG, Spitznagel MW. "The Six Mistakes Executives Make in Risk Management". ''Harvard Business School Publishing Corporation''. 2009;87(10):123-123
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-26T13:28:50Z

JonasHL: /* Implementing Risk management */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(pV)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.
Visually risks in the red and yellow area, should, if possible, move towards the green area, when mitigations and controls are applied.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:

#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p12).

Project Managers can use these six steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of Risk management (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s, which does not take the fast-changing and connected world which projects happens in today into account <ref name="CriticArticle" />.

Second, the ISO 31000 is often criticized for having a narrow scope, for instance, the standard does not include setting objectives, but it does require that objectives are set.
Furthermore, the guidelines provided in the ISO 31000 can be harder to understand and implement in ''Small and Medium-sized Enterprises'' which is why the ISO 31000 SME <ref name="iso31000sme" /> can be an additional standard, which managers need to take into consideration.

Therefore it is vital that risk managers do not blindly follow the ISO 31000, but read material from multiple sources, for instance, the literature listed in section [[#Annotated Bibliography|Annotated Bibliography]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is New Zealand based. They provide business and finance support to over 100.000 members, which is a huge company and therefore must have a lot and specialized knowledge within their field (https://www.charteredaccountantsanz.com/about-us). Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference on the page.
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">Pearson H. "Project Management", ''Pearson Education Limited''. 4th. Edition; 2010.</ref>
<ref name="iso31000sme">ISO. "31000 Risk Management for smes", ''ISO''; 2015. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO. "31000 Risk management — Principles and guidelines", ''International Standard''; 2009. </ref>
<ref name="RiskMatrixPicture">CGE Academy. "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq. "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia. "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">Geraldi J, Thuesen C, Oehmen J. "How to Do Projects". 1st ed. ''Dansk Standard''; 2017.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University. "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey. "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">Aven T. "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability''; 2017.</ref>
<ref name="RisikoRadio">Risko Radio. "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">Reddy C. "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="SamsungArticle">Lopez M. "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">Hotten R. "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">Treanor J. "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">Gonzalez G. "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup. "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">Westland J. ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Annotated Bibliography===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: Maylor H. "Project Management".4th ed. ''Pearson Education Limited''; 2010.
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO. "31000 Risk management — Principles and guidelines". ''International Standard''; 2009.
::The golden standard within risk management, it gives a great overview of definitions and approaches to risk management and is, therefore, a must-read.
*Chapter 11 in Project Management Institute. "A guide to the project management body of knowledge: PMBOK Guide". ''Project Management Institute''; 2000.
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis. "SRA glossary ". ''Committee on Foundations of risk analysis''; 2015. (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
*Jensen JL. "Risk & Return - The Economic Red Phone Explained". ''Springer International Publishing AG''; 2017.
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*Nassim NT, Goldstein DG, Spitznagel MW. "The Six Mistakes Executives Make in Risk Management". ''Harvard Business School Publishing Corporation''. 2009;87(10):123-123
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-26T13:05:36Z

JonasHL: /* Limitations */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(pV)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.
Visually risks in the red and yellow area, should, if possible, move towards the green area, when mitigations and controls are applied.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:

#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p12).

Project Managers can use these 6 steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of Risk management (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s, which does not take the fast-changing and connected world which projects happens in today into account <ref name="CriticArticle" />.

Second, the ISO 31000 is often criticized for having a narrow scope, for instance, the standard does not include setting objectives, but it does require that objectives are set.
Furthermore, the guidelines provided in the ISO 31000 can be harder to understand and implement in ''Small and Medium-sized Enterprises'' which is why the ISO 31000 SME <ref name="iso31000sme" /> can be an additional standard, which managers need to take into consideration.

Therefore it is vital that risk managers do not blindly follow the ISO 31000, but read material from multiple sources, for instance, the literature listed in section [[#Annotated Bibliography|Annotated Bibliography]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is New Zealand based. They provide business and finance support to over 100.000 members, which is a huge company and therefore must have a lot and specialized knowledge within their field (https://www.charteredaccountantsanz.com/about-us). Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference on the page.
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">Pearson H. "Project Management", ''Pearson Education Limited''. 4th. Edition; 2010.</ref>
<ref name="iso31000sme">ISO. "31000 Risk Management for smes", ''ISO''; 2015. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO. "31000 Risk management — Principles and guidelines", ''International Standard''; 2009. </ref>
<ref name="RiskMatrixPicture">CGE Academy. "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq. "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia. "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">Geraldi J, Thuesen C, Oehmen J. "How to Do Projects". 1st ed. ''Dansk Standard''; 2017.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University. "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey. "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">Aven T. "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability''; 2017.</ref>
<ref name="RisikoRadio">Risko Radio. "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">Reddy C. "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="SamsungArticle">Lopez M. "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">Hotten R. "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">Treanor J. "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">Gonzalez G. "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup. "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">Westland J. ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Annotated Bibliography===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: Maylor H. "Project Management".4th ed. ''Pearson Education Limited''; 2010.
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO. "31000 Risk management — Principles and guidelines". ''International Standard''; 2009.
::The golden standard within risk management, it gives a great overview of definitions and approaches to risk management and is, therefore, a must-read.
*Chapter 11 in Project Management Institute. "A guide to the project management body of knowledge: PMBOK Guide". ''Project Management Institute''; 2000.
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis. "SRA glossary ". ''Committee on Foundations of risk analysis''; 2015. (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
*Jensen JL. "Risk & Return - The Economic Red Phone Explained". ''Springer International Publishing AG''; 2017.
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*Nassim NT, Goldstein DG, Spitznagel MW. "The Six Mistakes Executives Make in Risk Management". ''Harvard Business School Publishing Corporation''. 2009;87(10):123-123
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-26T12:44:24Z

JonasHL: /* Annotated Bibliography */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(pV)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.
Visually risks in the red and yellow area, should, if possible, move towards the green area, when mitigations and controls are applied.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:

#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p12).

Project Managers can use these 6 steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of Risk management (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s, which does not take, the fast-changing and connected world which projects happens in today, in to account <ref name="CriticArticle" />.

Second, the ISO 31000 is often criticized for having a narrow scope, for instance, the standard does not include setting objectives, but it does require that objectives are set.
Furthermore, the guidelines provided in the ISO 31000 can be harder to understand and implement in ''Small and Medium-sized Enterprises'' which is why the ISO 31000 SME <ref name="iso31000sme" /> can be an additional standard, which managers need to take into consideration.

Therefore it is vital that risk managers do not blindly follow the ISO 31000, but read material from multiple sources, for instance, the literature listed in section [[#Annotated Bibliography|Annotated Bibliography]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is New Zealand based. They provide business and finance support to over 100.000 members, which is a huge company and therefore must have a lot and specialized knowledge within their field (https://www.charteredaccountantsanz.com/about-us). Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference on the page.
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">Pearson H. "Project Management", ''Pearson Education Limited''. 4th. Edition; 2010.</ref>
<ref name="iso31000sme">ISO. "31000 Risk Management for smes", ''ISO''; 2015. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO. "31000 Risk management — Principles and guidelines", ''International Standard''; 2009. </ref>
<ref name="RiskMatrixPicture">CGE Academy. "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq. "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia. "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">Geraldi J, Thuesen C, Oehmen J. "How to Do Projects". 1st ed. ''Dansk Standard''; 2017.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University. "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey. "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">Aven T. "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability''; 2017.</ref>
<ref name="RisikoRadio">Risko Radio. "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">Reddy C. "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="SamsungArticle">Lopez M. "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">Hotten R. "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">Treanor J. "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">Gonzalez G. "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup. "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">Westland J. ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Annotated Bibliography===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: Maylor H. "Project Management".4th ed. ''Pearson Education Limited''; 2010.
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO. "31000 Risk management — Principles and guidelines". ''International Standard''; 2009.
::The golden standard within risk management, it gives a great overview of definitions and approaches to risk management and is, therefore, a must-read.
*Chapter 11 in Project Management Institute. "A guide to the project management body of knowledge: PMBOK Guide". ''Project Management Institute''; 2000.
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis. "SRA glossary ". ''Committee on Foundations of risk analysis''; 2015. (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
*Jensen JL. "Risk & Return - The Economic Red Phone Explained". ''Springer International Publishing AG''; 2017.
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*Nassim NT, Goldstein DG, Spitznagel MW. "The Six Mistakes Executives Make in Risk Management". ''Harvard Business School Publishing Corporation''. 2009;87(10):123-123
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-26T12:42:20Z

JonasHL: /* References */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(pV)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.
Visually risks in the red and yellow area, should, if possible, move towards the green area, when mitigations and controls are applied.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:

#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p12).

Project Managers can use these 6 steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of Risk management (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s, which does not take, the fast-changing and connected world which projects happens in today, in to account <ref name="CriticArticle" />.

Second, the ISO 31000 is often criticized for having a narrow scope, for instance, the standard does not include setting objectives, but it does require that objectives are set.
Furthermore, the guidelines provided in the ISO 31000 can be harder to understand and implement in ''Small and Medium-sized Enterprises'' which is why the ISO 31000 SME <ref name="iso31000sme" /> can be an additional standard, which managers need to take into consideration.

Therefore it is vital that risk managers do not blindly follow the ISO 31000, but read material from multiple sources, for instance, the literature listed in section [[#Annotated Bibliography|Annotated Bibliography]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is New Zealand based. They provide business and finance support to over 100.000 members, which is a huge company and therefore must have a lot and specialized knowledge within their field (https://www.charteredaccountantsanz.com/about-us). Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference on the page.
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">Pearson H. "Project Management", ''Pearson Education Limited''. 4th. Edition; 2010.</ref>
<ref name="iso31000sme">ISO. "31000 Risk Management for smes", ''ISO''; 2015. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO. "31000 Risk management — Principles and guidelines", ''International Standard''; 2009. </ref>
<ref name="RiskMatrixPicture">CGE Academy. "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq. "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia. "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">Geraldi J, Thuesen C, Oehmen J. "How to Do Projects". 1st ed. ''Dansk Standard''; 2017.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University. "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey. "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">Aven T. "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability''; 2017.</ref>
<ref name="RisikoRadio">Risko Radio. "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">Reddy C. "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="SamsungArticle">Lopez M. "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">Hotten R. "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">Treanor J. "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">Gonzalez G. "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup. "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">Westland J. ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Annotated Bibliography===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: Maylor H. "Project Management". ''Pearson Education Limited'', 4th. Edition; 2010.
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO. "31000 Risk management — Principles and guidelines". ''International Standard''; 2009.
::The golden standard within risk management, it gives a great overview of definitions and approaches to risk management and is, therefore, a must-read.
*Chapter 11 in Project Management Institute. "A guide to the project management body of knowledge: PMBOK Guide". ''Project Management Institute''; 2000.
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis. "SRA glossary ". ''Committee on Foundations of risk analysis''; 2015. (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
*Jensen JL. "Risk & Return - The Economic Red Phone Explained". ''Springer International Publishing AG''; 2017.
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*Nassim NT, Goldstein DG, Spitznagel MW. "The Six Mistakes Executives Make in Risk Management". ''Harvard Business School Publishing Corporation''. 2009;87(10):123-123
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-26T12:40:07Z

JonasHL: /* References */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(pV)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.
Visually risks in the red and yellow area, should, if possible, move towards the green area, when mitigations and controls are applied.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:

#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p12).

Project Managers can use these 6 steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of Risk management (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s, which does not take, the fast-changing and connected world which projects happens in today, in to account <ref name="CriticArticle" />.

Second, the ISO 31000 is often criticized for having a narrow scope, for instance, the standard does not include setting objectives, but it does require that objectives are set.
Furthermore, the guidelines provided in the ISO 31000 can be harder to understand and implement in ''Small and Medium-sized Enterprises'' which is why the ISO 31000 SME <ref name="iso31000sme" /> can be an additional standard, which managers need to take into consideration.

Therefore it is vital that risk managers do not blindly follow the ISO 31000, but read material from multiple sources, for instance, the literature listed in section [[#Annotated Bibliography|Annotated Bibliography]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is New Zealand based. They provide business and finance support to over 100.000 members, which is a huge company and therefore must have a lot and specialized knowledge within their field (https://www.charteredaccountantsanz.com/about-us). Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference on the page.
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">Pearson H. "Project Management", ''Pearson Education Limited''. 4th. Edition; 2010.</ref>
<ref name="iso31000sme">ISO. "31000 Risk Management for smes", ''ISO''; 2015. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO. "31000 Risk management — Principles and guidelines", ''International Standard''; 2009. </ref>
<ref name="RiskMatrixPicture">CGE Academy. "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq. "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia. "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">Geraldi J, Thuesen C, Oehmen J. "How to Do Projects". ''Dansk Standard''; 2017.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University. "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey. "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">Aven T. "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability''; 2017.</ref>
<ref name="RisikoRadio">Risko Radio. "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">Reddy C. "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="SamsungArticle">Lopez M. "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">Hotten R. "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">Treanor J. "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">Gonzalez G. "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup. "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">Westland J. ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Annotated Bibliography===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: Maylor H. "Project Management". ''Pearson Education Limited'', 4th. Edition; 2010.
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO. "31000 Risk management — Principles and guidelines". ''International Standard''; 2009.
::The golden standard within risk management, it gives a great overview of definitions and approaches to risk management and is, therefore, a must-read.
*Chapter 11 in Project Management Institute. "A guide to the project management body of knowledge: PMBOK Guide". ''Project Management Institute''; 2000.
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis. "SRA glossary ". ''Committee on Foundations of risk analysis''; 2015. (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
*Jensen JL. "Risk & Return - The Economic Red Phone Explained". ''Springer International Publishing AG''; 2017.
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*Nassim NT, Goldstein DG, Spitznagel MW. "The Six Mistakes Executives Make in Risk Management". ''Harvard Business School Publishing Corporation''. 2009;87(10):123-123
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-26T12:37:52Z

JonasHL: /* Annotated Bibliography */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(pV)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.
Visually risks in the red and yellow area, should, if possible, move towards the green area, when mitigations and controls are applied.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:

#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p12).

Project Managers can use these 6 steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of Risk management (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s, which does not take, the fast-changing and connected world which projects happens in today, in to account <ref name="CriticArticle" />.

Second, the ISO 31000 is often criticized for having a narrow scope, for instance, the standard does not include setting objectives, but it does require that objectives are set.
Furthermore, the guidelines provided in the ISO 31000 can be harder to understand and implement in ''Small and Medium-sized Enterprises'' which is why the ISO 31000 SME <ref name="iso31000sme" /> can be an additional standard, which managers need to take into consideration.

Therefore it is vital that risk managers do not blindly follow the ISO 31000, but read material from multiple sources, for instance, the literature listed in section [[#Annotated Bibliography|Annotated Bibliography]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is New Zealand based. They provide business and finance support to over 100.000 members, which is a huge company and therefore must have a lot and specialized knowledge within their field (https://www.charteredaccountantsanz.com/about-us). Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference on the page.
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">Pearson H. "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO. "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO. "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy. "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq. "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia. "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">Geraldi J, Thuesen C, Oehmen J. "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University. "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey. "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">Aven T. "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio. "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">Reddy C. "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="SamsungArticle">Lopez M. "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">Hotten R. "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">Treanor J. "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">Gonzalez G. "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup. "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">Westland J. ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Annotated Bibliography===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: Maylor H. "Project Management". ''Pearson Education Limited'', 4th. Edition; 2010.
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO. "31000 Risk management — Principles and guidelines". ''International Standard''; 2009.
::The golden standard within risk management, it gives a great overview of definitions and approaches to risk management and is, therefore, a must-read.
*Chapter 11 in Project Management Institute. "A guide to the project management body of knowledge: PMBOK Guide". ''Project Management Institute''; 2000.
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis. "SRA glossary ". ''Committee on Foundations of risk analysis''; 2015. (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
*Jensen JL. "Risk & Return - The Economic Red Phone Explained". ''Springer International Publishing AG''; 2017.
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*Nassim NT, Goldstein DG, Spitznagel MW. "The Six Mistakes Executives Make in Risk Management". ''Harvard Business School Publishing Corporation''. 2009;87(10):123-123
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-26T12:35:24Z

JonasHL: /* Annotated Bibliography */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(pV)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.
Visually risks in the red and yellow area, should, if possible, move towards the green area, when mitigations and controls are applied.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:

#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p12).

Project Managers can use these 6 steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of Risk management (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s, which does not take, the fast-changing and connected world which projects happens in today, in to account <ref name="CriticArticle" />.

Second, the ISO 31000 is often criticized for having a narrow scope, for instance, the standard does not include setting objectives, but it does require that objectives are set.
Furthermore, the guidelines provided in the ISO 31000 can be harder to understand and implement in ''Small and Medium-sized Enterprises'' which is why the ISO 31000 SME <ref name="iso31000sme" /> can be an additional standard, which managers need to take into consideration.

Therefore it is vital that risk managers do not blindly follow the ISO 31000, but read material from multiple sources, for instance, the literature listed in section [[#Annotated Bibliography|Annotated Bibliography]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is New Zealand based. They provide business and finance support to over 100.000 members, which is a huge company and therefore must have a lot and specialized knowledge within their field (https://www.charteredaccountantsanz.com/about-us). Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference on the page.
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">Pearson H. "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO. "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO. "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy. "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq. "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia. "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">Geraldi J, Thuesen C, Oehmen J. "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University. "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey. "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">Aven T. "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio. "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">Reddy C. "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="SamsungArticle">Lopez M. "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">Hotten R. "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">Treanor J. "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">Gonzalez G. "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup. "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">Westland J. ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Annotated Bibliography===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: Maylor H. "Project Management", ''Pearson Education Limited'', 4th. Edition; 2010.
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO. "31000 Risk management — Principles and guidelines", ''International Standard''; 2009.
::The golden standard within risk management, it gives a great overview of definitions and approaches to risk management and is, therefore, a must-read.
*Chapter 11 in Project Management Institute. "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute''; 2000.
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis. "SRA glossary ", ''Committee on Foundations of risk analysis''; 2015. (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
*Jensen JL. "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG''; 2017.
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*Nassim NT, Goldstein DG, Spitznagel MW. "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation''. 2009;87(10):123-123
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-26T12:34:16Z

JonasHL: /* Annotated Bibliography */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(pV)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.
Visually risks in the red and yellow area, should, if possible, move towards the green area, when mitigations and controls are applied.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:

#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p12).

Project Managers can use these 6 steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of Risk management (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s, which does not take, the fast-changing and connected world which projects happens in today, in to account <ref name="CriticArticle" />.

Second, the ISO 31000 is often criticized for having a narrow scope, for instance, the standard does not include setting objectives, but it does require that objectives are set.
Furthermore, the guidelines provided in the ISO 31000 can be harder to understand and implement in ''Small and Medium-sized Enterprises'' which is why the ISO 31000 SME <ref name="iso31000sme" /> can be an additional standard, which managers need to take into consideration.

Therefore it is vital that risk managers do not blindly follow the ISO 31000, but read material from multiple sources, for instance, the literature listed in section [[#Annotated Bibliography|Annotated Bibliography]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is New Zealand based. They provide business and finance support to over 100.000 members, which is a huge company and therefore must have a lot and specialized knowledge within their field (https://www.charteredaccountantsanz.com/about-us). Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference on the page.
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">Pearson H. "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO. "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO. "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy. "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq. "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia. "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">Geraldi J, Thuesen C, Oehmen J. "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University. "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey. "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">Aven T. "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio. "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">Reddy C. "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="SamsungArticle">Lopez M. "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">Hotten R. "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">Treanor J. "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">Gonzalez G. "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup. "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">Westland J. ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Annotated Bibliography===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: Maylor H. "Project Management", ''Pearson Education Limited'', 4th. Edition;2010.
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO. "31000 Risk management — Principles and guidelines", ''International Standard'';2009.
::The golden standard within risk management, it gives a great overview of definitions and approaches to risk management and is, therefore, a must-read.
*Chapter 11 in: Project Management Institute. "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'';2000.
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis. "SRA glossary ", ''Committee on Foundations of risk analysis'';2015. (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
*Jensen JL. "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'';2017.
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*Nassim NT, Goldstein DG, Spitznagel MW. "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009;87(10):123-123)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-26T12:29:18Z

JonasHL: /* Annotated Bibliography */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(pV)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.
Visually risks in the red and yellow area, should, if possible, move towards the green area, when mitigations and controls are applied.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:

#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p12).

Project Managers can use these 6 steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of Risk management (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s, which does not take, the fast-changing and connected world which projects happens in today, in to account <ref name="CriticArticle" />.

Second, the ISO 31000 is often criticized for having a narrow scope, for instance, the standard does not include setting objectives, but it does require that objectives are set.
Furthermore, the guidelines provided in the ISO 31000 can be harder to understand and implement in ''Small and Medium-sized Enterprises'' which is why the ISO 31000 SME <ref name="iso31000sme" /> can be an additional standard, which managers need to take into consideration.

Therefore it is vital that risk managers do not blindly follow the ISO 31000, but read material from multiple sources, for instance, the literature listed in section [[#Annotated Bibliography|Annotated Bibliography]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is New Zealand based. They provide business and finance support to over 100.000 members, which is a huge company and therefore must have a lot and specialized knowledge within their field (https://www.charteredaccountantsanz.com/about-us). Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference on the page.
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">Pearson H. "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO. "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO. "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy. "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq. "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia. "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">Geraldi J, Thuesen C, Oehmen J. "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University. "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey. "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">Aven T. "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio. "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">Reddy C. "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="SamsungArticle">Lopez M. "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">Hotten R. "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">Treanor J. "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">Gonzalez G. "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup. "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">Westland J. ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Annotated Bibliography===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: Maylor H. "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO. "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches to risk management and is, therefore, a must-read.
*Chapter 11 in: Project Management Institute. "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis. "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
*Jensen JL. "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*Nassim NT, Goldstein DG, Spitznagel MW. "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009;87(10):123-123)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-26T12:16:54Z

JonasHL: /* Annotated Bibliography */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(pV)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.
Visually risks in the red and yellow area, should, if possible, move towards the green area, when mitigations and controls are applied.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:

#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p12).

Project Managers can use these 6 steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of Risk management (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s, which does not take, the fast-changing and connected world which projects happens in today, in to account <ref name="CriticArticle" />.

Second, the ISO 31000 is often criticized for having a narrow scope, for instance, the standard does not include setting objectives, but it does require that objectives are set.
Furthermore, the guidelines provided in the ISO 31000 can be harder to understand and implement in ''Small and Medium-sized Enterprises'' which is why the ISO 31000 SME <ref name="iso31000sme" /> can be an additional standard, which managers need to take into consideration.

Therefore it is vital that risk managers do not blindly follow the ISO 31000, but read material from multiple sources, for instance, the literature listed in section [[#Annotated Bibliography|Annotated Bibliography]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is New Zealand based. They provide business and finance support to over 100.000 members, which is a huge company and therefore must have a lot and specialized knowledge within their field (https://www.charteredaccountantsanz.com/about-us). Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference on the page.
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">Pearson H. "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO. "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO. "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy. "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq. "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia. "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">Geraldi J, Thuesen C, Oehmen J. "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University. "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey. "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">Aven T. "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio. "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">Reddy C. "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="SamsungArticle">Lopez M. "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">Hotten R. "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">Treanor J. "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">Gonzalez G. "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup. "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">Westland J. ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Annotated Bibliography===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: Maylor H. "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO. "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches to risk management and is, therefore, a must-read.
*Chapter 11 in: Project Management Institute. "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis. "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
*Jensen JL. "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*Nassim NT, Goldstein DG, Spitznagel MW. "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-26T12:10:34Z

JonasHL: /* References */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(pV)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.
Visually risks in the red and yellow area, should, if possible, move towards the green area, when mitigations and controls are applied.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:

#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p12).

Project Managers can use these 6 steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of Risk management (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s, which does not take, the fast-changing and connected world which projects happens in today, in to account <ref name="CriticArticle" />.

Second, the ISO 31000 is often criticized for having a narrow scope, for instance, the standard does not include setting objectives, but it does require that objectives are set.
Furthermore, the guidelines provided in the ISO 31000 can be harder to understand and implement in ''Small and Medium-sized Enterprises'' which is why the ISO 31000 SME <ref name="iso31000sme" /> can be an additional standard, which managers need to take into consideration.

Therefore it is vital that risk managers do not blindly follow the ISO 31000, but read material from multiple sources, for instance, the literature listed in section [[#Annotated Bibliography|Annotated Bibliography]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is New Zealand based. They provide business and finance support to over 100.000 members, which is a huge company and therefore must have a lot and specialized knowledge within their field (https://www.charteredaccountantsanz.com/about-us). Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference on the page.
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">Pearson H. "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO. "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO. "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy. "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq. "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia. "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">Geraldi J, Thuesen C, Oehmen J. "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University. "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey. "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">Aven T. "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio. "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">Reddy C. "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="SamsungArticle">Lopez M. "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">Hotten R. "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">Treanor J. "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">Gonzalez G. "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup. "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">Westland J. ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Annotated Bibliography===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches to risk management and is, therefore, a must-read.
*Chapter 11 in: Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis, "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
* J. L. Jensen, "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*N.T. Nassim, D.G. Goldstein and M.W. Spitznagel "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-26T12:08:16Z

JonasHL: /* References */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(pV)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.
Visually risks in the red and yellow area, should, if possible, move towards the green area, when mitigations and controls are applied.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:

#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p12).

Project Managers can use these 6 steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of Risk management (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s, which does not take, the fast-changing and connected world which projects happens in today, in to account <ref name="CriticArticle" />.

Second, the ISO 31000 is often criticized for having a narrow scope, for instance, the standard does not include setting objectives, but it does require that objectives are set.
Furthermore, the guidelines provided in the ISO 31000 can be harder to understand and implement in ''Small and Medium-sized Enterprises'' which is why the ISO 31000 SME <ref name="iso31000sme" /> can be an additional standard, which managers need to take into consideration.

Therefore it is vital that risk managers do not blindly follow the ISO 31000, but read material from multiple sources, for instance, the literature listed in section [[#Annotated Bibliography|Annotated Bibliography]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is New Zealand based. They provide business and finance support to over 100.000 members, which is a huge company and therefore must have a lot and specialized knowledge within their field (https://www.charteredaccountantsanz.com/about-us). Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference on the page.
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">Pearson H. "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO, "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy, "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq, "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia, "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">Geraldi J, Thuesen C, Oehmen J. "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University, "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey, "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">Aven T. "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio, "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">Reddy C. "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="SamsungArticle">Lopez M. "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">Hotten R. "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">Treanor J. "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">Gonzalez G. "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup, "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">Westland J. ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Annotated Bibliography===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches to risk management and is, therefore, a must-read.
*Chapter 11 in: Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis, "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
* J. L. Jensen, "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*N.T. Nassim, D.G. Goldstein and M.W. Spitznagel "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-26T11:55:45Z

JonasHL: /* Limitations */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(pV)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.
Visually risks in the red and yellow area, should, if possible, move towards the green area, when mitigations and controls are applied.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:

#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p12).

Project Managers can use these 6 steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of Risk management (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s, which does not take, the fast-changing and connected world which projects happens in today, in to account <ref name="CriticArticle" />.

Second, the ISO 31000 is often criticized for having a narrow scope, for instance, the standard does not include setting objectives, but it does require that objectives are set.
Furthermore, the guidelines provided in the ISO 31000 can be harder to understand and implement in ''Small and Medium-sized Enterprises'' which is why the ISO 31000 SME <ref name="iso31000sme" /> can be an additional standard, which managers need to take into consideration.

Therefore it is vital that risk managers do not blindly follow the ISO 31000, but read material from multiple sources, for instance, the literature listed in section [[#Annotated Bibliography|Annotated Bibliography]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is New Zealand based. They provide business and finance support to over 100.000 members, which is a huge company and therefore must have a lot and specialized knowledge within their field (https://www.charteredaccountantsanz.com/about-us). Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference on the page.
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO, "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy, "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq, "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia, "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">J. Geraldi, C. Thuesen and J. Oehmen, "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University, "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey, "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">T. Aven, "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio, "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">C. Reddy, "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="SamsungArticle">M. Lopez, "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">R. Hotten, "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">J. Treanor, "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">G. GonzalezTreanor, "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup, "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">J. Westland, ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Annotated Bibliography===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches to risk management and is, therefore, a must-read.
*Chapter 11 in: Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis, "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
* J. L. Jensen, "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*N.T. Nassim, D.G. Goldstein and M.W. Spitznagel "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-26T11:55:13Z

JonasHL: /* Further Reading Material */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(pV)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.
Visually risks in the red and yellow area, should, if possible, move towards the green area, when mitigations and controls are applied.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:

#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p12).

Project Managers can use these 6 steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of Risk management (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s, which does not take, the fast-changing and connected world which projects happens in today, in to account <ref name="CriticArticle" />.

Second, the ISO 31000 is often criticized for having a narrow scope, for instance, the standard does not include setting objectives, but it does require that objectives are set.
Furthermore, the guidelines provided in the ISO 31000 can be harder to understand and implement in ''Small and Medium-sized Enterprises'' which is why the ISO 31000 SME <ref name="iso31000sme" /> can be an additional standard, which managers need to take into consideration.

Therefore it is vital that risk managers do not blindly follow the ISO 31000, but read material from multiple sources, for instance, the literature listed in section [[#Further Reading Material|Further Reading Material]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is New Zealand based. They provide business and finance support to over 100.000 members, which is a huge company and therefore must have a lot and specialized knowledge within their field (https://www.charteredaccountantsanz.com/about-us). Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference on the page.
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO, "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy, "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq, "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia, "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">J. Geraldi, C. Thuesen and J. Oehmen, "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University, "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey, "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">T. Aven, "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio, "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">C. Reddy, "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="SamsungArticle">M. Lopez, "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">R. Hotten, "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">J. Treanor, "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">G. GonzalezTreanor, "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup, "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">J. Westland, ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Annotated Bibliography===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches to risk management and is, therefore, a must-read.
*Chapter 11 in: Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis, "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
* J. L. Jensen, "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*N.T. Nassim, D.G. Goldstein and M.W. Spitznagel "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Talk:Risk Management Overview

2018-02-26T11:28:55Z

JonasHL: /* Feedback 2 | Reviewer name: Casper */

==Abstract Feedback==

'''Text clarity''' Text is coherent

'''Language''' Good

'''Description of the tool/theory/concept''' Very thoroughly explained and good momentum

'''Purpose explanation''' Well addressed, perhaps expand on whether or not the Risk Management Process applies more to a specific industry? E.g. Oil and Gas where risk is a serious topic

'''References''' Good references. Look at chapter 11 in PMBOK to include further references related to risk in project management context

'''Relevance of article''' Very relevant but consider to:

<ol>
<li> Ensure that the risk management process concept explanation is embedded in a project management context
<li> Avoid focusing too much on risk management from an organizational/operational perspective, but more project managerial, e.g. don't talk about carrying out a risk assessment for operating an oil rig
<li> Consult chapter 11 in PMBOK for inspiration
<li> Consult with Josef if in doubt as he is very knowledgeable about project risk management
</ol>

==Feedback 1 | Reviewer name: ''Briet''==
===Question 1 · TEXT===
'''Quality of the summary:'''

Does the summary make the key focus, insights and/or contribution of the article clear?

What would you suggest to improve?

===Answer 1===
The abstract is very clear and concise. I like the fact that you mentioned that the article would only focus on the risks/threats and not the opportunities, which makes the direction of the article clear. I would maybe suggest that you move this last sentence higher in the paragraph just to make it transparent from the beginning what direction you are going for.

===Question 2 · TEXT===
'''Structure and logic of the article:'''

Is the argument clear?

Is there a logical flow to the article?

Does one part build upon the other?

Is the article consistent in its argument and free of contradictions?

What would you suggest to improve?

===Answer 2===
There is a great logical flow to the article and it's very well structured. I would maybe suggest that you try to focus more on the risk management from a project management perspective.

===Question 3 · TEXT===
'''Grammar and style:'''

Is the writing free of grammatical and spelling errors?

Is the language precise without unnecessary fill words?

What would you suggest to improve?

===Answer 3===
Very good writing! I noticed some minor spelling errors and few examples of unnecessary fill words. See here below some examples:

"Naturally the Impact/Probability for the inherent risk should be '''grater''' or equal to the ratings in the residual" -> Naturally''',''' the Impact/Probability for the inherent risk should be '''greater''' or equal to the ratings in the residual"

"The treatment of risks can consist of adding additional resources ('''manpower''', budget) into the schedule." -> "The treatment of risks can consist of adding additional resources ('''workforce''', budget) into the schedule."

"The identification of risk is a repeatable process since new risks can change '''through''' its life or new risks are discovered." ->"The identification of risk is a repeatable process since new risks can change its life or new risks are discovered."

"making contracts with service providers or buying '''a''' insurance that covers that risk." -> "making contracts with service providers or buying insurance that covers that risk."

"However identifications are only the first '''step'''" -> "However identifications are only the first '''steps'''"

" however, some '''matrices''' also have a 4. level very high" -> " however, some '''matrixes''' also have a 4. level very high"

"the cost of treating the risk should be evaluated and compared '''whit potentially''' loss by risk." -> "the cost of treating the risk should be evaluated and compared '''with a potential''' loss by risk."

"'''Enventhoug''' risk management naturally" ->"'''Even though''' risk management naturally"

In few cases, you write "a risk" when it's supposed to be just "risk". I would suggest that you look into that.

===Question 4 · TEXT===
'''Figures and tables:'''

Are figures and tables clear?

Do they summarize the key points of the article in a meaningful way?

What would you suggest to improve?

===Answer 4===
The figures are very good and I think they are well described and supported by the text. One idea is to add one extra figure, which you create yourself, in the "Risk Management" section relating to the bullets listed in the "Risk management in different industries" section. Just an idea :)

===Question 5 · TEXT===
'''Interest and relevance:'''

Is the article of high practical and / or academic relevance?

Is it made clear in the article why / how it is relevant?

What would you suggest to improve?

===Answer 5===
The article is practical and relevant. I like that you mentioned some examples to explain further the tool which helps the reader to understand the tool better. I don't have any suggestions for improvements.

===Question 6 · TEXT===
'''Depth of treatment:'''

Is the article interesting for a practitioner or academic to read?

Does it make a significant contribution beyond a cursory web search?

What would you suggest to improve?

===Answer 6===
The article is very interesting! I particularly liked the examples that you mentioned in the "Examples of good and bad risk management" whereas the examples provided more insight into the risk management at well-known companies in regards to both good and bad risk management. I don't have any suggestions for improvements.

===Question 7 · TEXT===
'''Annotated bibliography:'''

Does the article properly cite and acknowledge previous work?

Does it briefly summarize the key references at the end of the article?

Is it based on empirical data instead of opinion?

What would you suggest to improve?

===Answer 7===
The Literature including the references is very good and organized. I don't have any suggestions for improvements. Although, I think '''Literature''' is spelled like this rather than '''Litterature''' :)

==Feedback 2 | Reviewer name: ''Casper''==
===Question 1 · TEXT===
'''Quality of the summary:'''

Does the summary make the key focus, insights and/or contribution of the article clear?

What would you suggest to improve?

===Answer 1===
I like that you clearly state the focus of the article! Yet it would help if it was moved earlier in the abstract of the article.

For example:
Projects are part of a dynamic and fast changeling world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope [1] [2].

This Wiki-article will describe the Risk Management Process, Risk Matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks. At last limitations and advantages of Risk Management will be discussed and a brief overview of other relevant reading material.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

===Question 2 · TEXT===
'''Structure and logic of the article:'''

Is the argument clear?

Is there a logical flow to the article?

Does one part build upon the other?

Is the article consistent in its argument and free of contradictions?

What would you suggest to improve?

===Answer 2===
The flow of the article is good and each part builds upon the other.

===Question 3 · TEXT===
'''Grammar and style:'''

Is the writing free of grammatical and spelling errors?

Is the language precise without unnecessary fill words?

What would you suggest to improve?

===Answer 3===
There is some spelling mistakes throughout the article. I suggest that you try to double check using the spell checker in word, otherwise I can help you with access to grammarly that can assist you in correcting the mistakes. The writing style is good and makes it interesting to read.

===Question 4 · TEXT===
'''Figures and tables:'''

Are figures and tables clear?

Do they summarize the key points of the article in a meaningful way?

What would you suggest to improve?

===Answer 4===
You have done a great job here! I have no further comments on how to improve.

===Question 5 · TEXT===
'''Interest and relevance:'''

Is the article of high practical and / or academic relevance?

Is it made clear in the article why / how it is relevant?

What would you suggest to improve?

===Answer 5===
The article is very relevant for both academics and practitioners.
It is very clear why this subject is relevant reading the article.
I have no further comments on how to improve this article.

===Question 6 · TEXT===
'''Depth of treatment:'''

Is the article interesting for a practitioner or academic to read?

Does it make a significant contribution beyond a cursory web search?

What would you suggest to improve?

===Answer 6===
The article is interesting to read. It makes a significant contribution beyond a websearch, however if it would make sense, it could help the article if you look into describing/investigating if there is any relevant tools or possible ways to reduce the time consumption doing risk management.

===Question 7 · TEXT===
'''Annotated bibliography:'''

Does the article properly cite and acknowledge previous work?

Does it briefly summarize the key references at the end of the article?

Is it based on empirical data instead of opinion?

What would you suggest to improve?

===Answer 7===
Thorough made throughout the article with proper referencing. All the key references are summarised well. The only thing I suggest to improve is the spelling of literature in the headline.

Talk:Risk Management Overview

2018-02-26T11:28:07Z

JonasHL: /* Abstract Feedback */

==Abstract Feedback==

'''Text clarity''' Text is coherent

'''Language''' Good

'''Description of the tool/theory/concept''' Very thoroughly explained and good momentum

'''Purpose explanation''' Well addressed, perhaps expand on whether or not the Risk Management Process applies more to a specific industry? E.g. Oil and Gas where risk is a serious topic

'''References''' Good references. Look at chapter 11 in PMBOK to include further references related to risk in project management context

'''Relevance of article''' Very relevant but consider to:

<ol>
<li> Ensure that the risk management process concept explanation is embedded in a project management context
<li> Avoid focusing too much on risk management from an organizational/operational perspective, but more project managerial, e.g. don't talk about carrying out a risk assessment for operating an oil rig
<li> Consult chapter 11 in PMBOK for inspiration
<li> Consult with Josef if in doubt as he is very knowledgeable about project risk management
</ol>

==Feedback 1 | Reviewer name: ''Briet''==
===Question 1 · TEXT===
'''Quality of the summary:'''

Does the summary make the key focus, insights and/or contribution of the article clear?

What would you suggest to improve?

===Answer 1===
The abstract is very clear and concise. I like the fact that you mentioned that the article would only focus on the risks/threats and not the opportunities, which makes the direction of the article clear. I would maybe suggest that you move this last sentence higher in the paragraph just to make it transparent from the beginning what direction you are going for.

===Question 2 · TEXT===
'''Structure and logic of the article:'''

Is the argument clear?

Is there a logical flow to the article?

Does one part build upon the other?

Is the article consistent in its argument and free of contradictions?

What would you suggest to improve?

===Answer 2===
There is a great logical flow to the article and it's very well structured. I would maybe suggest that you try to focus more on the risk management from a project management perspective.

===Question 3 · TEXT===
'''Grammar and style:'''

Is the writing free of grammatical and spelling errors?

Is the language precise without unnecessary fill words?

What would you suggest to improve?

===Answer 3===
Very good writing! I noticed some minor spelling errors and few examples of unnecessary fill words. See here below some examples:

"Naturally the Impact/Probability for the inherent risk should be '''grater''' or equal to the ratings in the residual" -> Naturally''',''' the Impact/Probability for the inherent risk should be '''greater''' or equal to the ratings in the residual"

"The treatment of risks can consist of adding additional resources ('''manpower''', budget) into the schedule." -> "The treatment of risks can consist of adding additional resources ('''workforce''', budget) into the schedule."

"The identification of risk is a repeatable process since new risks can change '''through''' its life or new risks are discovered." ->"The identification of risk is a repeatable process since new risks can change its life or new risks are discovered."

"making contracts with service providers or buying '''a''' insurance that covers that risk." -> "making contracts with service providers or buying insurance that covers that risk."

"However identifications are only the first '''step'''" -> "However identifications are only the first '''steps'''"

" however, some '''matrices''' also have a 4. level very high" -> " however, some '''matrixes''' also have a 4. level very high"

"the cost of treating the risk should be evaluated and compared '''whit potentially''' loss by risk." -> "the cost of treating the risk should be evaluated and compared '''with a potential''' loss by risk."

"'''Enventhoug''' risk management naturally" ->"'''Even though''' risk management naturally"

In few cases, you write "a risk" when it's supposed to be just "risk". I would suggest that you look into that.

===Question 4 · TEXT===
'''Figures and tables:'''

Are figures and tables clear?

Do they summarize the key points of the article in a meaningful way?

What would you suggest to improve?

===Answer 4===
The figures are very good and I think they are well described and supported by the text. One idea is to add one extra figure, which you create yourself, in the "Risk Management" section relating to the bullets listed in the "Risk management in different industries" section. Just an idea :)

===Question 5 · TEXT===
'''Interest and relevance:'''

Is the article of high practical and / or academic relevance?

Is it made clear in the article why / how it is relevant?

What would you suggest to improve?

===Answer 5===
The article is practical and relevant. I like that you mentioned some examples to explain further the tool which helps the reader to understand the tool better. I don't have any suggestions for improvements.

===Question 6 · TEXT===
'''Depth of treatment:'''

Is the article interesting for a practitioner or academic to read?

Does it make a significant contribution beyond a cursory web search?

What would you suggest to improve?

===Answer 6===
The article is very interesting! I particularly liked the examples that you mentioned in the "Examples of good and bad risk management" whereas the examples provided more insight into the risk management at well-known companies in regards to both good and bad risk management. I don't have any suggestions for improvements.

===Question 7 · TEXT===
'''Annotated bibliography:'''

Does the article properly cite and acknowledge previous work?

Does it briefly summarize the key references at the end of the article?

Is it based on empirical data instead of opinion?

What would you suggest to improve?

===Answer 7===
The Literature including the references is very good and organized. I don't have any suggestions for improvements. Although, I think '''Literature''' is spelled like this rather than '''Litterature''' :)

==Feedback 2 | Reviewer name: ''Casper''==
===Question 1 · TEXT===
'''Quality of the summary:'''

Does the summary make the key focus, insights and/or contribution of the article clear?

What would you suggest to improve?

===DONE Answer 1===
I like that you clearly state the focus of the article! Yet it would help if it was moved earlier in the abstract of the article.

For example:
Projects are part of a dynamic and fast changeling world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope [1] [2].

This Wiki-article will describe the Risk Management Process, Risk Matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks. At last limitations and advantages of Risk Management will be discussed and a brief overview of other relevant reading material.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

===Question 2 · TEXT===
'''Structure and logic of the article:'''

Is the argument clear?

Is there a logical flow to the article?

Does one part build upon the other?

Is the article consistent in its argument and free of contradictions?

What would you suggest to improve?

===DONE Answer 2===
The flow of the article is good and each part builds upon the other.

===Question 3 · TEXT===
'''Grammar and style:'''

Is the writing free of grammatical and spelling errors?

Is the language precise without unnecessary fill words?

What would you suggest to improve?

===DONE Answer 3===
There is some spelling mistakes throughout the article. I suggest that you try to double check using the spell checker in word, otherwise I can help you with access to grammarly that can assist you in correcting the mistakes. The writing style is good and makes it interesting to read.

===Question 4 · TEXT===
'''Figures and tables:'''

Are figures and tables clear?

Do they summarize the key points of the article in a meaningful way?

What would you suggest to improve?

===DONE Answer 4===
You have done a great job here! I have no further comments on how to improve.

===Question 5 · TEXT===
'''Interest and relevance:'''

Is the article of high practical and / or academic relevance?

Is it made clear in the article why / how it is relevant?

What would you suggest to improve?

===DONE Answer 5===
The article is very relevant for both academics and practitioners.
It is very clear why this subject is relevant reading the article.
I have no further comments on how to improve this article.

===Question 6 · TEXT===
'''Depth of treatment:'''

Is the article interesting for a practitioner or academic to read?

Does it make a significant contribution beyond a cursory web search?

What would you suggest to improve?

===Answer 6===
The article is interesting to read. It makes a significant contribution beyond a websearch, however if it would make sense, it could help the article if you look into describing/investigating if there is any relevant tools or possible ways to reduce the time consumption doing risk management.

===Question 7 · TEXT===
'''Annotated bibliography:'''

Does the article properly cite and acknowledge previous work?

Does it briefly summarize the key references at the end of the article?

Is it based on empirical data instead of opinion?

What would you suggest to improve?

===DONE Answer 7===
Thorough made throughout the article with proper referencing. All the key references are summarised well. The only thing I suggest to improve is the spelling of literature in the headline.

Talk:Risk Management Overview

2018-02-26T11:27:37Z

JonasHL: /* Feedback 1 | Reviewer name: Briet */

==Abstract Feedback==

'''Text clarity''' Text is coherent

'''Language''' Good

'''Description of the tool/theory/concept''' Very thoroughly explained and good momentum

'''Purpose explanation''' Well addressed, perhaps expand on whether or not the Risk Management Process applies more to a specific industry? E.g. Oil and Gas where risk is a serious topic (DONE)

'''References''' Good references. Look at chapter 11 in PMBOK to include further references related to risk in project management context (DONE)

'''Relevance of article''' Very relevant but consider to:

<ol>
<li> Ensure that the risk management process concept explanation is embedded in a project management context
<li> Avoid focusing too much on risk management from an organizational/operational perspective, but more project managerial, e.g. don't talk about carrying out a risk assessment for operating an oil rig (DONE?)
<li> Consult chapter 11 in PMBOK for inspiration (DONE)
<li> Consult with Josef if in doubt as he is very knowledgeable about project risk management
</ol>

==Feedback 1 | Reviewer name: ''Briet''==
===Question 1 · TEXT===
'''Quality of the summary:'''

Does the summary make the key focus, insights and/or contribution of the article clear?

What would you suggest to improve?

===Answer 1===
The abstract is very clear and concise. I like the fact that you mentioned that the article would only focus on the risks/threats and not the opportunities, which makes the direction of the article clear. I would maybe suggest that you move this last sentence higher in the paragraph just to make it transparent from the beginning what direction you are going for.

===Question 2 · TEXT===
'''Structure and logic of the article:'''

Is the argument clear?

Is there a logical flow to the article?

Does one part build upon the other?

Is the article consistent in its argument and free of contradictions?

What would you suggest to improve?

===Answer 2===
There is a great logical flow to the article and it's very well structured. I would maybe suggest that you try to focus more on the risk management from a project management perspective.

===Question 3 · TEXT===
'''Grammar and style:'''

Is the writing free of grammatical and spelling errors?

Is the language precise without unnecessary fill words?

What would you suggest to improve?

===Answer 3===
Very good writing! I noticed some minor spelling errors and few examples of unnecessary fill words. See here below some examples:

"Naturally the Impact/Probability for the inherent risk should be '''grater''' or equal to the ratings in the residual" -> Naturally''',''' the Impact/Probability for the inherent risk should be '''greater''' or equal to the ratings in the residual"

"The treatment of risks can consist of adding additional resources ('''manpower''', budget) into the schedule." -> "The treatment of risks can consist of adding additional resources ('''workforce''', budget) into the schedule."

"The identification of risk is a repeatable process since new risks can change '''through''' its life or new risks are discovered." ->"The identification of risk is a repeatable process since new risks can change its life or new risks are discovered."

"making contracts with service providers or buying '''a''' insurance that covers that risk." -> "making contracts with service providers or buying insurance that covers that risk."

"However identifications are only the first '''step'''" -> "However identifications are only the first '''steps'''"

" however, some '''matrices''' also have a 4. level very high" -> " however, some '''matrixes''' also have a 4. level very high"

"the cost of treating the risk should be evaluated and compared '''whit potentially''' loss by risk." -> "the cost of treating the risk should be evaluated and compared '''with a potential''' loss by risk."

"'''Enventhoug''' risk management naturally" ->"'''Even though''' risk management naturally"

In few cases, you write "a risk" when it's supposed to be just "risk". I would suggest that you look into that.

===Question 4 · TEXT===
'''Figures and tables:'''

Are figures and tables clear?

Do they summarize the key points of the article in a meaningful way?

What would you suggest to improve?

===Answer 4===
The figures are very good and I think they are well described and supported by the text. One idea is to add one extra figure, which you create yourself, in the "Risk Management" section relating to the bullets listed in the "Risk management in different industries" section. Just an idea :)

===Question 5 · TEXT===
'''Interest and relevance:'''

Is the article of high practical and / or academic relevance?

Is it made clear in the article why / how it is relevant?

What would you suggest to improve?

===Answer 5===
The article is practical and relevant. I like that you mentioned some examples to explain further the tool which helps the reader to understand the tool better. I don't have any suggestions for improvements.

===Question 6 · TEXT===
'''Depth of treatment:'''

Is the article interesting for a practitioner or academic to read?

Does it make a significant contribution beyond a cursory web search?

What would you suggest to improve?

===Answer 6===
The article is very interesting! I particularly liked the examples that you mentioned in the "Examples of good and bad risk management" whereas the examples provided more insight into the risk management at well-known companies in regards to both good and bad risk management. I don't have any suggestions for improvements.

===Question 7 · TEXT===
'''Annotated bibliography:'''

Does the article properly cite and acknowledge previous work?

Does it briefly summarize the key references at the end of the article?

Is it based on empirical data instead of opinion?

What would you suggest to improve?

===Answer 7===
The Literature including the references is very good and organized. I don't have any suggestions for improvements. Although, I think '''Literature''' is spelled like this rather than '''Litterature''' :)

==Feedback 2 | Reviewer name: ''Casper''==
===Question 1 · TEXT===
'''Quality of the summary:'''

Does the summary make the key focus, insights and/or contribution of the article clear?

What would you suggest to improve?

===DONE Answer 1===
I like that you clearly state the focus of the article! Yet it would help if it was moved earlier in the abstract of the article.

For example:
Projects are part of a dynamic and fast changeling world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope [1] [2].

This Wiki-article will describe the Risk Management Process, Risk Matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks. At last limitations and advantages of Risk Management will be discussed and a brief overview of other relevant reading material.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

===Question 2 · TEXT===
'''Structure and logic of the article:'''

Is the argument clear?

Is there a logical flow to the article?

Does one part build upon the other?

Is the article consistent in its argument and free of contradictions?

What would you suggest to improve?

===DONE Answer 2===
The flow of the article is good and each part builds upon the other.

===Question 3 · TEXT===
'''Grammar and style:'''

Is the writing free of grammatical and spelling errors?

Is the language precise without unnecessary fill words?

What would you suggest to improve?

===DONE Answer 3===
There is some spelling mistakes throughout the article. I suggest that you try to double check using the spell checker in word, otherwise I can help you with access to grammarly that can assist you in correcting the mistakes. The writing style is good and makes it interesting to read.

===Question 4 · TEXT===
'''Figures and tables:'''

Are figures and tables clear?

Do they summarize the key points of the article in a meaningful way?

What would you suggest to improve?

===DONE Answer 4===
You have done a great job here! I have no further comments on how to improve.

===Question 5 · TEXT===
'''Interest and relevance:'''

Is the article of high practical and / or academic relevance?

Is it made clear in the article why / how it is relevant?

What would you suggest to improve?

===DONE Answer 5===
The article is very relevant for both academics and practitioners.
It is very clear why this subject is relevant reading the article.
I have no further comments on how to improve this article.

===Question 6 · TEXT===
'''Depth of treatment:'''

Is the article interesting for a practitioner or academic to read?

Does it make a significant contribution beyond a cursory web search?

What would you suggest to improve?

===Answer 6===
The article is interesting to read. It makes a significant contribution beyond a websearch, however if it would make sense, it could help the article if you look into describing/investigating if there is any relevant tools or possible ways to reduce the time consumption doing risk management.

===Question 7 · TEXT===
'''Annotated bibliography:'''

Does the article properly cite and acknowledge previous work?

Does it briefly summarize the key references at the end of the article?

Is it based on empirical data instead of opinion?

What would you suggest to improve?

===DONE Answer 7===
Thorough made throughout the article with proper referencing. All the key references are summarised well. The only thing I suggest to improve is the spelling of literature in the headline.

Talk:Risk Management Overview

2018-02-26T11:26:12Z

JonasHL: /* Answer 1 */

==Abstract Feedback==

'''Text clarity''' Text is coherent

'''Language''' Good

'''Description of the tool/theory/concept''' Very thoroughly explained and good momentum

'''Purpose explanation''' Well addressed, perhaps expand on whether or not the Risk Management Process applies more to a specific industry? E.g. Oil and Gas where risk is a serious topic (DONE)

'''References''' Good references. Look at chapter 11 in PMBOK to include further references related to risk in project management context (DONE)

'''Relevance of article''' Very relevant but consider to:

<ol>
<li> Ensure that the risk management process concept explanation is embedded in a project management context
<li> Avoid focusing too much on risk management from an organizational/operational perspective, but more project managerial, e.g. don't talk about carrying out a risk assessment for operating an oil rig (DONE?)
<li> Consult chapter 11 in PMBOK for inspiration (DONE)
<li> Consult with Josef if in doubt as he is very knowledgeable about project risk management
</ol>

==Feedback 1 | Reviewer name: ''Briet''==
===Question 1 · TEXT===
'''Quality of the summary:'''

Does the summary make the key focus, insights and/or contribution of the article clear?

What would you suggest to improve?

===DONE Answer 1===
The abstract is very clear and concise. I like the fact that you mentioned that the article would only focus on the risks/threats and not the opportunities, which makes the direction of the article clear. I would maybe suggest that you move this last sentence higher in the paragraph just to make it transparent from the beginning what direction you are going for.

===Question 2 · TEXT===
'''Structure and logic of the article:'''

Is the argument clear?

Is there a logical flow to the article?

Does one part build upon the other?

Is the article consistent in its argument and free of contradictions?

What would you suggest to improve?

===DONE Answer 2===
There is a great logical flow to the article and it's very well structured. I would maybe suggest that you try to focus more on the risk management from a project management perspective.

===Question 3 · TEXT===
'''Grammar and style:'''

Is the writing free of grammatical and spelling errors?

Is the language precise without unnecessary fill words?

What would you suggest to improve?

===DONE Answer 3===
Very good writing! I noticed some minor spelling errors and few examples of unnecessary fill words. See here below some examples:

"Naturally the Impact/Probability for the inherent risk should be '''grater''' or equal to the ratings in the residual" -> Naturally''',''' the Impact/Probability for the inherent risk should be '''greater''' or equal to the ratings in the residual"

"The treatment of risks can consist of adding additional resources ('''manpower''', budget) into the schedule." -> "The treatment of risks can consist of adding additional resources ('''workforce''', budget) into the schedule."

"The identification of risk is a repeatable process since new risks can change '''through''' its life or new risks are discovered." ->"The identification of risk is a repeatable process since new risks can change its life or new risks are discovered."

"making contracts with service providers or buying '''a''' insurance that covers that risk." -> "making contracts with service providers or buying insurance that covers that risk."

"However identifications are only the first '''step'''" -> "However identifications are only the first '''steps'''"

" however, some '''matrices''' also have a 4. level very high" -> " however, some '''matrixes''' also have a 4. level very high"

"the cost of treating the risk should be evaluated and compared '''whit potentially''' loss by risk." -> "the cost of treating the risk should be evaluated and compared '''with a potential''' loss by risk."

"'''Enventhoug''' risk management naturally" ->"'''Even though''' risk management naturally"

In few cases, you write "a risk" when it's supposed to be just "risk". I would suggest that you look into that.

===Question 4 · TEXT===
'''Figures and tables:'''

Are figures and tables clear?

Do they summarize the key points of the article in a meaningful way?

What would you suggest to improve?

===Answer 4===
The figures are very good and I think they are well described and supported by the text. One idea is to add one extra figure, which you create yourself, in the "Risk Management" section relating to the bullets listed in the "Risk management in different industries" section. Just an idea :)

===Question 5 · TEXT===
'''Interest and relevance:'''

Is the article of high practical and / or academic relevance?

Is it made clear in the article why / how it is relevant?

What would you suggest to improve?

===DONE Answer 5===
The article is practical and relevant. I like that you mentioned some examples to explain further the tool which helps the reader to understand the tool better. I don't have any suggestions for improvements.

===Question 6 · TEXT===
'''Depth of treatment:'''

Is the article interesting for a practitioner or academic to read?

Does it make a significant contribution beyond a cursory web search?

What would you suggest to improve?

===DONE Answer 6===
The article is very interesting! I particularly liked the examples that you mentioned in the "Examples of good and bad risk management" whereas the examples provided more insight into the risk management at well-known companies in regards to both good and bad risk management. I don't have any suggestions for improvements.

===Question 7 · TEXT===
'''Annotated bibliography:'''

Does the article properly cite and acknowledge previous work?

Does it briefly summarize the key references at the end of the article?

Is it based on empirical data instead of opinion?

What would you suggest to improve?

===DONE Answer 7===
The Literature including the references is very good and organized. I don't have any suggestions for improvements. Although, I think '''Literature''' is spelled like this rather than '''Litterature''' :)

==Feedback 2 | Reviewer name: ''Casper''==
===Question 1 · TEXT===
'''Quality of the summary:'''

Does the summary make the key focus, insights and/or contribution of the article clear?

What would you suggest to improve?

===DONE Answer 1===
I like that you clearly state the focus of the article! Yet it would help if it was moved earlier in the abstract of the article.

For example:
Projects are part of a dynamic and fast changeling world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope [1] [2].

This Wiki-article will describe the Risk Management Process, Risk Matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks. At last limitations and advantages of Risk Management will be discussed and a brief overview of other relevant reading material.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

===Question 2 · TEXT===
'''Structure and logic of the article:'''

Is the argument clear?

Is there a logical flow to the article?

Does one part build upon the other?

Is the article consistent in its argument and free of contradictions?

What would you suggest to improve?

===DONE Answer 2===
The flow of the article is good and each part builds upon the other.

===Question 3 · TEXT===
'''Grammar and style:'''

Is the writing free of grammatical and spelling errors?

Is the language precise without unnecessary fill words?

What would you suggest to improve?

===DONE Answer 3===
There is some spelling mistakes throughout the article. I suggest that you try to double check using the spell checker in word, otherwise I can help you with access to grammarly that can assist you in correcting the mistakes. The writing style is good and makes it interesting to read.

===Question 4 · TEXT===
'''Figures and tables:'''

Are figures and tables clear?

Do they summarize the key points of the article in a meaningful way?

What would you suggest to improve?

===DONE Answer 4===
You have done a great job here! I have no further comments on how to improve.

===Question 5 · TEXT===
'''Interest and relevance:'''

Is the article of high practical and / or academic relevance?

Is it made clear in the article why / how it is relevant?

What would you suggest to improve?

===DONE Answer 5===
The article is very relevant for both academics and practitioners.
It is very clear why this subject is relevant reading the article.
I have no further comments on how to improve this article.

===Question 6 · TEXT===
'''Depth of treatment:'''

Is the article interesting for a practitioner or academic to read?

Does it make a significant contribution beyond a cursory web search?

What would you suggest to improve?

===Answer 6===
The article is interesting to read. It makes a significant contribution beyond a websearch, however if it would make sense, it could help the article if you look into describing/investigating if there is any relevant tools or possible ways to reduce the time consumption doing risk management.

===Question 7 · TEXT===
'''Annotated bibliography:'''

Does the article properly cite and acknowledge previous work?

Does it briefly summarize the key references at the end of the article?

Is it based on empirical data instead of opinion?

What would you suggest to improve?

===DONE Answer 7===
Thorough made throughout the article with proper referencing. All the key references are summarised well. The only thing I suggest to improve is the spelling of literature in the headline.

Risk Management Overview

2018-02-26T11:25:18Z

JonasHL: /* Conclusion */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(pV)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.
Visually risks in the red and yellow area, should, if possible, move towards the green area, when mitigations and controls are applied.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:

#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p12).

Project Managers can use these 6 steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of Risk management (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s, which does not take, the fast-changing and connected world which projects happens in today, in to account <ref name="CriticArticle" />.

Second, the ISO 31000 is often criticized for having a narrow scope, for instance, the standard does not include setting objectives, but it does require that objectives are set.
Furthermore, the guidelines provided in the ISO 31000 can be harder to understand and implement in ''Small and Medium-sized Enterprises'' which is why the ISO 31000 SME <ref name="iso31000sme" /> can be an additional standard, which managers need to take into consideration.

Therefore it is vital that risk managers do not blindly follow the ISO 31000, but read material from multiple sources, for instance, the literature listed in section [[#Further Reading Material|Further Reading Material]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is New Zealand based. They provide business and finance support to over 100.000 members, which is a huge company and therefore must have a lot and specialized knowledge within their field (https://www.charteredaccountantsanz.com/about-us). Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference on the page.
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO, "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy, "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq, "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia, "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">J. Geraldi, C. Thuesen and J. Oehmen, "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University, "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey, "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">T. Aven, "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio, "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">C. Reddy, "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="SamsungArticle">M. Lopez, "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">R. Hotten, "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">J. Treanor, "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">G. GonzalezTreanor, "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup, "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">J. Westland, ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Further Reading Material===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches to risk management and is, therefore, a must-read.
*Chapter 11 in: Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis, "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
* J. L. Jensen, "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*N.T. Nassim, D.G. Goldstein and M.W. Spitznagel "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-26T11:25:02Z

JonasHL: /* Implementing Risk management */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(pV)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.
Visually risks in the red and yellow area, should, if possible, move towards the green area, when mitigations and controls are applied.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:

#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p12).

Project Managers can use these 6 steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of Risk management (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s, which does not take, the fast-changing and connected world which projects happens in today, in to account <ref name="CriticArticle" />.

Second, the ISO 31000 is often criticized for having a narrow scope, for instance, the standard does not include setting objectives, but it does require that objectives are set.
Furthermore, the guidelines provided in the ISO 31000 can be harder to understand and implement in ''Small and Medium-sized Enterprises'' which is why the ISO 31000 SME <ref name="iso31000sme" /> can be an additional standard, which managers need to take into consideration.

Therefore it is vital that risk managers do not blindly follow the ISO 31000, but read material from multiple sources, for instance, the literature listed in section [[#Further Reading Material|Further Reading Material]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p.232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is New Zealand based. They provide business and finance support to over 100.000 members, which is a huge company and therefore must have a lot and specialized knowledge within their field (https://www.charteredaccountantsanz.com/about-us). Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference on the page.
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO, "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy, "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq, "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia, "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">J. Geraldi, C. Thuesen and J. Oehmen, "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University, "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey, "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">T. Aven, "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio, "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">C. Reddy, "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="SamsungArticle">M. Lopez, "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">R. Hotten, "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">J. Treanor, "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">G. GonzalezTreanor, "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup, "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">J. Westland, ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Further Reading Material===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches to risk management and is, therefore, a must-read.
*Chapter 11 in: Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis, "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
* J. L. Jensen, "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*N.T. Nassim, D.G. Goldstein and M.W. Spitznagel "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-26T11:24:43Z

JonasHL: /* Risk Management Process (RMP) */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(pV)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.
Visually risks in the red and yellow area, should, if possible, move towards the green area, when mitigations and controls are applied.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:

#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p.12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p.12).

Project Managers can use these 6 steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of Risk management (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s, which does not take, the fast-changing and connected world which projects happens in today, in to account <ref name="CriticArticle" />.

Second, the ISO 31000 is often criticized for having a narrow scope, for instance, the standard does not include setting objectives, but it does require that objectives are set.
Furthermore, the guidelines provided in the ISO 31000 can be harder to understand and implement in ''Small and Medium-sized Enterprises'' which is why the ISO 31000 SME <ref name="iso31000sme" /> can be an additional standard, which managers need to take into consideration.

Therefore it is vital that risk managers do not blindly follow the ISO 31000, but read material from multiple sources, for instance, the literature listed in section [[#Further Reading Material|Further Reading Material]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p.232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is New Zealand based. They provide business and finance support to over 100.000 members, which is a huge company and therefore must have a lot and specialized knowledge within their field (https://www.charteredaccountantsanz.com/about-us). Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference on the page.
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO, "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy, "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq, "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia, "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">J. Geraldi, C. Thuesen and J. Oehmen, "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University, "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey, "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">T. Aven, "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio, "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">C. Reddy, "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="SamsungArticle">M. Lopez, "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">R. Hotten, "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">J. Treanor, "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">G. GonzalezTreanor, "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup, "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">J. Westland, ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Further Reading Material===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches to risk management and is, therefore, a must-read.
*Chapter 11 in: Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis, "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
* J. L. Jensen, "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*N.T. Nassim, D.G. Goldstein and M.W. Spitznagel "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-26T11:24:22Z

JonasHL: /* Introduction */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(pV)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.
Visually risks in the red and yellow area, should, if possible, move towards the green area, when mitigations and controls are applied.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p.138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p.142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:

#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p.12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p.12).

Project Managers can use these 6 steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of Risk management (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s, which does not take, the fast-changing and connected world which projects happens in today, in to account <ref name="CriticArticle" />.

Second, the ISO 31000 is often criticized for having a narrow scope, for instance, the standard does not include setting objectives, but it does require that objectives are set.
Furthermore, the guidelines provided in the ISO 31000 can be harder to understand and implement in ''Small and Medium-sized Enterprises'' which is why the ISO 31000 SME <ref name="iso31000sme" /> can be an additional standard, which managers need to take into consideration.

Therefore it is vital that risk managers do not blindly follow the ISO 31000, but read material from multiple sources, for instance, the literature listed in section [[#Further Reading Material|Further Reading Material]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p.232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is New Zealand based. They provide business and finance support to over 100.000 members, which is a huge company and therefore must have a lot and specialized knowledge within their field (https://www.charteredaccountantsanz.com/about-us). Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference on the page.
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO, "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy, "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq, "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia, "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">J. Geraldi, C. Thuesen and J. Oehmen, "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University, "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey, "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">T. Aven, "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio, "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">C. Reddy, "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="SamsungArticle">M. Lopez, "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">R. Hotten, "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">J. Treanor, "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">G. GonzalezTreanor, "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup, "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">J. Westland, ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Further Reading Material===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches to risk management and is, therefore, a must-read.
*Chapter 11 in: Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis, "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
* J. L. Jensen, "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*N.T. Nassim, D.G. Goldstein and M.W. Spitznagel "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-26T11:23:48Z

JonasHL: /* Risk definition */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(pV)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p.223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.
Visually risks in the red and yellow area, should, if possible, move towards the green area, when mitigations and controls are applied.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p.138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p.142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:

#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p.12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p.12).

Project Managers can use these 6 steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of Risk management (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s, which does not take, the fast-changing and connected world which projects happens in today, in to account <ref name="CriticArticle" />.

Second, the ISO 31000 is often criticized for having a narrow scope, for instance, the standard does not include setting objectives, but it does require that objectives are set.
Furthermore, the guidelines provided in the ISO 31000 can be harder to understand and implement in ''Small and Medium-sized Enterprises'' which is why the ISO 31000 SME <ref name="iso31000sme" /> can be an additional standard, which managers need to take into consideration.

Therefore it is vital that risk managers do not blindly follow the ISO 31000, but read material from multiple sources, for instance, the literature listed in section [[#Further Reading Material|Further Reading Material]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p.232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is New Zealand based. They provide business and finance support to over 100.000 members, which is a huge company and therefore must have a lot and specialized knowledge within their field (https://www.charteredaccountantsanz.com/about-us). Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference on the page.
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO, "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy, "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq, "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia, "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">J. Geraldi, C. Thuesen and J. Oehmen, "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University, "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey, "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">T. Aven, "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio, "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">C. Reddy, "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="SamsungArticle">M. Lopez, "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">R. Hotten, "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">J. Treanor, "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">G. GonzalezTreanor, "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup, "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">J. Westland, ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Further Reading Material===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches to risk management and is, therefore, a must-read.
*Chapter 11 in: Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis, "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
* J. L. Jensen, "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*N.T. Nassim, D.G. Goldstein and M.W. Spitznagel "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-26T11:22:55Z

JonasHL: /* Limitations */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(p.V)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p.4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p.4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p.219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p.223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.
Visually risks in the red and yellow area, should, if possible, move towards the green area, when mitigations and controls are applied.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p.138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p.142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:

#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p.12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p.12).

Project Managers can use these 6 steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of Risk management (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s, which does not take, the fast-changing and connected world which projects happens in today, in to account <ref name="CriticArticle" />.

Second, the ISO 31000 is often criticized for having a narrow scope, for instance, the standard does not include setting objectives, but it does require that objectives are set.
Furthermore, the guidelines provided in the ISO 31000 can be harder to understand and implement in ''Small and Medium-sized Enterprises'' which is why the ISO 31000 SME <ref name="iso31000sme" /> can be an additional standard, which managers need to take into consideration.

Therefore it is vital that risk managers do not blindly follow the ISO 31000, but read material from multiple sources, for instance, the literature listed in section [[#Further Reading Material|Further Reading Material]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p.232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is New Zealand based. They provide business and finance support to over 100.000 members, which is a huge company and therefore must have a lot and specialized knowledge within their field (https://www.charteredaccountantsanz.com/about-us). Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference on the page.
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO, "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy, "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq, "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia, "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">J. Geraldi, C. Thuesen and J. Oehmen, "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University, "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey, "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">T. Aven, "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio, "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">C. Reddy, "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="SamsungArticle">M. Lopez, "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">R. Hotten, "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">J. Treanor, "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">G. GonzalezTreanor, "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup, "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">J. Westland, ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Further Reading Material===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches to risk management and is, therefore, a must-read.
*Chapter 11 in: Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis, "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
* J. L. Jensen, "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*N.T. Nassim, D.G. Goldstein and M.W. Spitznagel "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-26T11:18:25Z

JonasHL: /* Limitations */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(p.V)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p.4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p.4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p.219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p.223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.
Visually risks in the red and yellow area, should, if possible, move towards the green area, when mitigations and controls are applied.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p.138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p.142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:

#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p.12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p.12).

Project Managers can use these 6 steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of Risk management (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s, which does not take, the fast-changing and connected world which projects happens in today, in to account <ref name="CriticArticle" />.

Second, the ISO 31000 is often criticized for having a narrow scope, for instance, the standard does not include setting objectives, but it does require that objectives are set.
Furthermore, the guidelines provided in the ISO 31000 can be harder to understand and implement in ''Small and Medium-sized Enterprises'' which is why the ISO 31000 SME <ref name="iso31000sme" /> can be an additional standard, which managers need to take into consideration.

Therefore it is vital that risk managers don't blindly follow the ISO 31000, but read material from multiple sources, for instance, the SRA glossary or material listed in section [[#Further Reading Material|Further Reading Material]].

OLD XXX
Second, a significant proportion of management researchers and analysts agrees on risk captures two dimensions:
# something is at stake (health and lives, the environment and material assets)
# uncertainties.
Above-mentioned can be conceptualized, measured and described in a more and understandable way than the ISO 31000, for instance, the SRA glossary <ref name="CriticArticle" />.
This claim is backed up in the ISO 31000 SME, which states: The ISO 31000 "''provides generic guidelines, it is not intended to promote uniformity of risk management across organizations.''" <ref name="iso31000sme" />.
Therefore it is vital that risk managers don't blindly follow the ISO 31000, but read material from multiple sources, for instance, the SRA glossary or material listed in section [[#Further Reading Material|Further Reading Material]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p.232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is New Zealand based. They provide business and finance support to over 100.000 members, which is a huge company and therefore must have a lot and specialized knowledge within their field (https://www.charteredaccountantsanz.com/about-us). Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference on the page.
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO, "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy, "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq, "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia, "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">J. Geraldi, C. Thuesen and J. Oehmen, "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University, "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey, "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">T. Aven, "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio, "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">C. Reddy, "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="SamsungArticle">M. Lopez, "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">R. Hotten, "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">J. Treanor, "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">G. GonzalezTreanor, "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup, "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">J. Westland, ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Further Reading Material===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches to risk management and is, therefore, a must-read.
*Chapter 11 in: Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis, "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
* J. L. Jensen, "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*N.T. Nassim, D.G. Goldstein and M.W. Spitznagel "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-26T10:20:35Z

JonasHL: /* Limitations */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(p.V)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p.4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p.4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p.219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p.223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.
Visually risks in the red and yellow area, should, if possible, move towards the green area, when mitigations and controls are applied.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p.138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p.142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:

#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p.12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p.12).

Project Managers can use these 6 steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of Risk management (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s, which does not take, the fast-changing and connected world which projects happens in today, in to account <ref name="CriticArticle" />.

Second, a significant proportion of management researchers and analysts agrees on risk captures two dimensions:
# something is at stake (health and lives, the environment and material assets)
# uncertainties.
Above-mentioned can be conceptualized, measured and described in a more and understandable way than the ISO 31000, for instance, the SRA glossary <ref name="CriticArticle" />.
This claim is backed up in the ISO 31000 SME, which states: The ISO 31000 "''provides generic guidelines, it is not intended to promote uniformity of risk management across organizations.''" <ref name="iso31000sme" />.
Therefore it is vital that risk managers don't blindly follow the ISO 31000, but read material from multiple sources, for instance, the SRA glossary or material listed in section [[#Further Reading Material|Further Reading Material]].

OLD XXX
Second, a significant proportion of management researchers and analysts agrees on risk captures two dimensions:
# something is at stake (health and lives, the environment and material assets)
# uncertainties.
Above-mentioned can be conceptualized, measured and described in a more and understandable way than the ISO 31000, for instance, the SRA glossary <ref name="CriticArticle" />.
This claim is backed up in the ISO 31000 SME, which states: The ISO 31000 "''provides generic guidelines, it is not intended to promote uniformity of risk management across organizations.''" <ref name="iso31000sme" />.
Therefore it is vital that risk managers don't blindly follow the ISO 31000, but read material from multiple sources, for instance, the SRA glossary or material listed in section [[#Further Reading Material|Further Reading Material]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p.232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is New Zealand based. They provide business and finance support to over 100.000 members, which is a huge company and therefore must have a lot and specialized knowledge within their field (https://www.charteredaccountantsanz.com/about-us). Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference on the page.
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO, "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy, "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq, "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia, "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">J. Geraldi, C. Thuesen and J. Oehmen, "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University, "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey, "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">T. Aven, "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio, "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">C. Reddy, "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="SamsungArticle">M. Lopez, "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">R. Hotten, "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">J. Treanor, "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">G. GonzalezTreanor, "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup, "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">J. Westland, ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Further Reading Material===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches to risk management and is, therefore, a must-read.
*Chapter 11 in: Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis, "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
* J. L. Jensen, "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*N.T. Nassim, D.G. Goldstein and M.W. Spitznagel "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-26T10:06:55Z

JonasHL: /* Risk matrix */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(p.V)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p.4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p.4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p.219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p.223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.
Visually risks in the red and yellow area, should, if possible, move towards the green area, when mitigations and controls are applied.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p.138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p.142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:

#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p.12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p.12).

Project Managers can use these 6 steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of Risk management (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s, which does not take, the fast-changing and connected world which projects happens in today, in to account <ref name="CriticArticle" />.

Second, a significant proportion of management researchers and analysts agrees on risk captures two dimensions:
# something is at stake (health and lives, the environment and material assets)
# uncertainties.
Above-mentioned can be conceptualized, measured and described in a more and understandable way than the ISO 31000, for instance, the SRA glossary <ref name="CriticArticle" />.
This claim is backed up in the ISO 31000 SME, which states: The ISO 31000 "''provides generic guidelines, it is not intended to promote uniformity of risk management across organizations.''" <ref name="iso31000sme" />.
Therefore it is vital that risk managers don't blindly follow the ISO 31000, but read material from multiple sources, for instance, the SRA glossary or material listed in section [[#Further Reading Material|Further Reading Material]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p.232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is New Zealand based. They provide business and finance support to over 100.000 members, which is a huge company and therefore must have a lot and specialized knowledge within their field (https://www.charteredaccountantsanz.com/about-us). Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference on the page.
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO, "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy, "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq, "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia, "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">J. Geraldi, C. Thuesen and J. Oehmen, "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University, "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey, "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">T. Aven, "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio, "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">C. Reddy, "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="SamsungArticle">M. Lopez, "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">R. Hotten, "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">J. Treanor, "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">G. GonzalezTreanor, "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup, "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">J. Westland, ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Further Reading Material===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches to risk management and is, therefore, a must-read.
*Chapter 11 in: Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis, "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
* J. L. Jensen, "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*N.T. Nassim, D.G. Goldstein and M.W. Spitznagel "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-26T09:56:32Z

JonasHL: /* Abstract */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(p.V)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p.4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p.4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p.219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p.223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p.138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p.142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:

#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p.12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p.12).

Project Managers can use these 6 steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of Risk management (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s, which does not take, the fast-changing and connected world which projects happens in today, in to account <ref name="CriticArticle" />.

Second, a significant proportion of management researchers and analysts agrees on risk captures two dimensions:
# something is at stake (health and lives, the environment and material assets)
# uncertainties.
Above-mentioned can be conceptualized, measured and described in a more and understandable way than the ISO 31000, for instance, the SRA glossary <ref name="CriticArticle" />.
This claim is backed up in the ISO 31000 SME, which states: The ISO 31000 "''provides generic guidelines, it is not intended to promote uniformity of risk management across organizations.''" <ref name="iso31000sme" />.
Therefore it is vital that risk managers don't blindly follow the ISO 31000, but read material from multiple sources, for instance, the SRA glossary or material listed in section [[#Further Reading Material|Further Reading Material]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p.232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is New Zealand based. They provide business and finance support to over 100.000 members, which is a huge company and therefore must have a lot and specialized knowledge within their field (https://www.charteredaccountantsanz.com/about-us). Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference on the page.
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO, "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy, "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq, "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia, "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">J. Geraldi, C. Thuesen and J. Oehmen, "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University, "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey, "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">T. Aven, "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio, "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">C. Reddy, "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="SamsungArticle">M. Lopez, "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">R. Hotten, "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">J. Treanor, "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">G. GonzalezTreanor, "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup, "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">J. Westland, ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Further Reading Material===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches to risk management and is, therefore, a must-read.
*Chapter 11 in: Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis, "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
* J. L. Jensen, "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*N.T. Nassim, D.G. Goldstein and M.W. Spitznagel "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-26T09:49:11Z

JonasHL: /* Further Reading Material */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(p.V)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p.4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p.4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p.219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p.223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p.138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p.142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:

#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p.12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p.12).

Project Managers can use these 6 steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of Risk management (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s, which does not take, the fast-changing and connected world which projects happens in today, in to account <ref name="CriticArticle" />.

Second, a significant proportion of management researchers and analysts agrees on risk captures two dimensions:
# something is at stake (health and lives, the environment and material assets)
# uncertainties.
Above-mentioned can be conceptualized, measured and described in a more and understandable way than the ISO 31000, for instance, the SRA glossary <ref name="CriticArticle" />.
This claim is backed up in the ISO 31000 SME, which states: The ISO 31000 "''provides generic guidelines, it is not intended to promote uniformity of risk management across organizations.''" <ref name="iso31000sme" />.
Therefore it is vital that risk managers don't blindly follow the ISO 31000, but read material from multiple sources, for instance, the SRA glossary or material listed in section [[#Further Reading Material|Further Reading Material]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p.232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is New Zealand based. They provide business and finance support to over 100.000 members, which is a huge company and therefore must have a lot and specialized knowledge within their field (https://www.charteredaccountantsanz.com/about-us). Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference on the page.
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO, "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy, "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq, "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia, "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">J. Geraldi, C. Thuesen and J. Oehmen, "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University, "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey, "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">T. Aven, "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio, "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">C. Reddy, "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="SamsungArticle">M. Lopez, "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">R. Hotten, "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">J. Treanor, "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">G. GonzalezTreanor, "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup, "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">J. Westland, ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Further Reading Material===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches to risk management and is, therefore, a must-read.
*Chapter 11 in: Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis, "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
* J. L. Jensen, "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*N.T. Nassim, D.G. Goldstein and M.W. Spitznagel "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-26T09:44:36Z

JonasHL: /* References Credibility */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(p.V)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p.4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p.4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p.219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p.223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p.138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p.142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:

#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p.12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p.12).

Project Managers can use these 6 steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of Risk management (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s, which does not take, the fast-changing and connected world which projects happens in today, in to account <ref name="CriticArticle" />.

Second, a significant proportion of management researchers and analysts agrees on risk captures two dimensions:
# something is at stake (health and lives, the environment and material assets)
# uncertainties.
Above-mentioned can be conceptualized, measured and described in a more and understandable way than the ISO 31000, for instance, the SRA glossary <ref name="CriticArticle" />.
This claim is backed up in the ISO 31000 SME, which states: The ISO 31000 "''provides generic guidelines, it is not intended to promote uniformity of risk management across organizations.''" <ref name="iso31000sme" />.
Therefore it is vital that risk managers don't blindly follow the ISO 31000, but read material from multiple sources, for instance, the SRA glossary or material listed in section [[#Further Reading Material|Further Reading Material]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p.232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is New Zealand based. They provide business and finance support to over 100.000 members, which is a huge company and therefore must have a lot and specialized knowledge within their field (https://www.charteredaccountantsanz.com/about-us). Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference on the page.
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO, "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy, "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq, "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia, "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">J. Geraldi, C. Thuesen and J. Oehmen, "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University, "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey, "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">T. Aven, "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio, "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">C. Reddy, "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="SamsungArticle">M. Lopez, "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">R. Hotten, "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">J. Treanor, "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">G. GonzalezTreanor, "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup, "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">J. Westland, ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Further Reading Material===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches within risk management and is there for a must read.
*Chapter 11 in: Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis, "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
* J. L. Jensen, "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*N.T. Nassim, D.G. Goldstein and M.W. Spitznagel "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-26T09:44:06Z

JonasHL: /* References Credibility */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(p.V)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p.4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p.4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p.219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p.223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p.138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p.142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:

#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p.12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p.12).

Project Managers can use these 6 steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of Risk management (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s, which does not take, the fast-changing and connected world which projects happens in today, in to account <ref name="CriticArticle" />.

Second, a significant proportion of management researchers and analysts agrees on risk captures two dimensions:
# something is at stake (health and lives, the environment and material assets)
# uncertainties.
Above-mentioned can be conceptualized, measured and described in a more and understandable way than the ISO 31000, for instance, the SRA glossary <ref name="CriticArticle" />.
This claim is backed up in the ISO 31000 SME, which states: The ISO 31000 "''provides generic guidelines, it is not intended to promote uniformity of risk management across organizations.''" <ref name="iso31000sme" />.
Therefore it is vital that risk managers don't blindly follow the ISO 31000, but read material from multiple sources, for instance, the SRA glossary or material listed in section [[#Further Reading Material|Further Reading Material]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p.232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is New Zealand based. They provide business and finance support to over 100.000 members, which is a huge company and therefore must have a lot and specialized knowledge within their field (https://www.charteredaccountantsanz.com/about-us). Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference, on the page.
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO, "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy, "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq, "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia, "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">J. Geraldi, C. Thuesen and J. Oehmen, "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University, "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey, "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">T. Aven, "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio, "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">C. Reddy, "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="SamsungArticle">M. Lopez, "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">R. Hotten, "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">J. Treanor, "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">G. GonzalezTreanor, "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup, "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">J. Westland, ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Further Reading Material===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches within risk management and is there for a must read.
*Chapter 11 in: Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis, "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
* J. L. Jensen, "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*N.T. Nassim, D.G. Goldstein and M.W. Spitznagel "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-26T09:42:12Z

JonasHL: /* References Credibility */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(p.V)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p.4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p.4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p.219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p.223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p.138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p.142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:

#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p.12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p.12).

Project Managers can use these 6 steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of Risk management (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s, which does not take, the fast-changing and connected world which projects happens in today, in to account <ref name="CriticArticle" />.

Second, a significant proportion of management researchers and analysts agrees on risk captures two dimensions:
# something is at stake (health and lives, the environment and material assets)
# uncertainties.
Above-mentioned can be conceptualized, measured and described in a more and understandable way than the ISO 31000, for instance, the SRA glossary <ref name="CriticArticle" />.
This claim is backed up in the ISO 31000 SME, which states: The ISO 31000 "''provides generic guidelines, it is not intended to promote uniformity of risk management across organizations.''" <ref name="iso31000sme" />.
Therefore it is vital that risk managers don't blindly follow the ISO 31000, but read material from multiple sources, for instance, the SRA glossary or material listed in section [[#Further Reading Material|Further Reading Material]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p.232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is New Zealand based. They provide business and finance support to over 100.000 members, which is a huge company and therefore must have a lot and specialized knowledge within their field. Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference , on the page. (https://www.charteredaccountantsanz.com/about-us)
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO, "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy, "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq, "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia, "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">J. Geraldi, C. Thuesen and J. Oehmen, "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University, "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey, "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">T. Aven, "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio, "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">C. Reddy, "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="SamsungArticle">M. Lopez, "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">R. Hotten, "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">J. Treanor, "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">G. GonzalezTreanor, "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup, "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">J. Westland, ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Further Reading Material===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches within risk management and is there for a must read.
*Chapter 11 in: Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis, "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
* J. L. Jensen, "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*N.T. Nassim, D.G. Goldstein and M.W. Spitznagel "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-26T09:40:34Z

JonasHL: /* Literature */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(p.V)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p.4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p.4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p.219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p.223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p.138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p.142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:

#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p.12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p.12).

Project Managers can use these 6 steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of Risk management (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s, which does not take, the fast-changing and connected world which projects happens in today, in to account <ref name="CriticArticle" />.

Second, a significant proportion of management researchers and analysts agrees on risk captures two dimensions:
# something is at stake (health and lives, the environment and material assets)
# uncertainties.
Above-mentioned can be conceptualized, measured and described in a more and understandable way than the ISO 31000, for instance, the SRA glossary <ref name="CriticArticle" />.
This claim is backed up in the ISO 31000 SME, which states: The ISO 31000 "''provides generic guidelines, it is not intended to promote uniformity of risk management across organizations.''" <ref name="iso31000sme" />.
Therefore it is vital that risk managers don't blindly follow the ISO 31000, but read material from multiple sources, for instance, the SRA glossary or material listed in section [[#Further Reading Material|Further Reading Material]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p.232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is New Zealand based. They provide business and finance support to over 100.000 members. They are a huge company and therefore must have a lot and specialized knowledge within their field. Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference , on the page. (https://www.charteredaccountantsanz.com/about-us)
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO, "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy, "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq, "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia, "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">J. Geraldi, C. Thuesen and J. Oehmen, "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University, "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey, "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">T. Aven, "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio, "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">C. Reddy, "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="SamsungArticle">M. Lopez, "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">R. Hotten, "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">J. Treanor, "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">G. GonzalezTreanor, "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup, "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">J. Westland, ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Further Reading Material===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches within risk management and is there for a must read.
*Chapter 11 in: Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis, "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
* J. L. Jensen, "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*N.T. Nassim, D.G. Goldstein and M.W. Spitznagel "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-25T16:25:46Z

JonasHL: /* References */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(p.V)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p.4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p.4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p.219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p.223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p.138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p.142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:

#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p.12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p.12).

Project Managers can use these 6 steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of Risk management (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s, which does not take, the fast-changing and connected world which projects happens in today, in to account <ref name="CriticArticle" />.

Second, a significant proportion of management researchers and analysts agrees on risk captures two dimensions:
# something is at stake (health and lives, the environment and material assets)
# uncertainties.
Above-mentioned can be conceptualized, measured and described in a more and understandable way than the ISO 31000, for instance, the SRA glossary <ref name="CriticArticle" />.
This claim is backed up in the ISO 31000 SME, which states: The ISO 31000 "''provides generic guidelines, it is not intended to promote uniformity of risk management across organizations.''" <ref name="iso31000sme" />.
Therefore it is vital that risk managers don't blindly follow the ISO 31000, but read material from multiple sources, for instance, the SRA glossary or material listed in section [[#Further Reading Material|Further Reading Material]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p.232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is a New Zealand based, they provide business and finance support to over 100.000 members. They are a huge company and therefore must have a lot and specialized knowledge within their field. Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference , on the page. (https://www.charteredaccountantsanz.com/about-us)
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO, "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy, "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq, "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia, "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">J. Geraldi, C. Thuesen and J. Oehmen, "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University, "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey, "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">T. Aven, "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio, "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">C. Reddy, "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="SamsungArticle">M. Lopez, "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">R. Hotten, "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">J. Treanor, "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">G. GonzalezTreanor, "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup, "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">J. Westland, ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Further Reading Material===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches within risk management and is there for a must read.
*Chapter 11 in: Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis, "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
* J. L. Jensen, "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*N.T. Nassim, D.G. Goldstein and M.W. Spitznagel "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-25T16:23:01Z

JonasHL: /* Just my notes - will be deleted xxx */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(p.V)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p.4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p.4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p.219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p.223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p.138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p.142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:

#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p.12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p.12).

Project Managers can use these 6 steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of Risk management (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s, which does not take, the fast-changing and connected world which projects happens in today, in to account <ref name="CriticArticle" />.

Second, a significant proportion of management researchers and analysts agrees on risk captures two dimensions:
# something is at stake (health and lives, the environment and material assets)
# uncertainties.
Above-mentioned can be conceptualized, measured and described in a more and understandable way than the ISO 31000, for instance, the SRA glossary <ref name="CriticArticle" />.
This claim is backed up in the ISO 31000 SME, which states: The ISO 31000 "''provides generic guidelines, it is not intended to promote uniformity of risk management across organizations.''" <ref name="iso31000sme" />.
Therefore it is vital that risk managers don't blindly follow the ISO 31000, but read material from multiple sources, for instance, the SRA glossary or material listed in section [[#Further Reading Material|Further Reading Material]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p.232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is a New Zealand based, they provide business and finance support to over 100.000 members. They are a huge company and therefore must have a lot and specialized knowledge within their field. Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference , on the page. (https://www.charteredaccountantsanz.com/about-us)
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO, "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy, "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq, "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia, "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">J. Geraldi, C. Thuesen and J. Oehmen, "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University, "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey, "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">T. Aven, "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio, "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">C. Reddy, "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="PMBOK">Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000):.</ref>
<ref name="SamsungArticle">M. Lopez, "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">R. Hotten, "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">J. Treanor, "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">G. GonzalezTreanor, "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup, "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">J. Westland, ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Further Reading Material===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches within risk management and is there for a must read.
*Chapter 11 in: Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis, "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
* J. L. Jensen, "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*N.T. Nassim, D.G. Goldstein and M.W. Spitznagel "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-25T16:22:31Z

JonasHL: /* Limitations and advantages of RMP (discussion) */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(p.V)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p.4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p.4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p.219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p.223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p.138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p.142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:

#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p.12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p.12).

Project Managers can use these 6 steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of Risk management (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s, which does not take, the fast-changing and connected world which projects happens in today, in to account <ref name="CriticArticle" />.

Second, a significant proportion of management researchers and analysts agrees on risk captures two dimensions:
# something is at stake (health and lives, the environment and material assets)
# uncertainties.
Above-mentioned can be conceptualized, measured and described in a more and understandable way than the ISO 31000, for instance, the SRA glossary <ref name="CriticArticle" />.
This claim is backed up in the ISO 31000 SME, which states: The ISO 31000 "''provides generic guidelines, it is not intended to promote uniformity of risk management across organizations.''" <ref name="iso31000sme" />.
Therefore it is vital that risk managers don't blindly follow the ISO 31000, but read material from multiple sources, for instance, the SRA glossary or material listed in section [[#Further Reading Material|Further Reading Material]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p.232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

== Just my notes - will be deleted xxx ==
*Even though risk management indisputably is beneficial, most managers use the ISO 31000 standard, which has some critical flaws.
ARTA diagrams are included for risk treatment and control????? XXX
Implementation of risk management xxxxxx
xxx Project management context - Here the risk management process will be put into a project management context. xxx

Risk management is an important tool to use in project management, even-though risk management is only estimates of potential future situations. Risk identification helps the manager get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.

Risk management is highly important discipline and is therefore present in most projects. <ref name="iso31000" /> NoGET MED GOAL XXX

*Slides from fist lecture.
*Write something about project in all sections ex: treat risk/control
*"Implementation risk management (step by step guide)"
*An example of a risk register can be seen here : xxxx

'''Implementing risk management according to ISO 31000''' <ref name="iso31000" />''':'''
*define the appropriate timing and strategy for implementing the framework;
*apply the risk management policy and process to the organizational processes;

*comply with legal and regulatory requirements;

*ensure that decision making, including the development and setting of objectives, is aligned with the
outcomes of risk management processes;

*hold information and training sessions; and
*communicate and consult with stakeholders to ensure that its risk management framework remains
appropriate.

''x''{{sup|2}}

Ref test xxx .. <ref name="AdvantageDisadvantage" />{{rp|pages=22-27}}
test test <ref name="PMBOK" />{{rp|needed=y|date=February 2018}}

<ref name="PMBOK" /> "#page=N'

{{r|PMBOK|p=56}}

{{rp|89}}
2

ref test <ref name="PMBOK" />(p.2)

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is a New Zealand based, they provide business and finance support to over 100.000 members. They are a huge company and therefore must have a lot and specialized knowledge within their field. Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference , on the page. (https://www.charteredaccountantsanz.com/about-us)
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO, "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy, "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq, "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia, "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">J. Geraldi, C. Thuesen and J. Oehmen, "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University, "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey, "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">T. Aven, "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio, "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">C. Reddy, "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="PMBOK">Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000):.</ref>
<ref name="SamsungArticle">M. Lopez, "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">R. Hotten, "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">J. Treanor, "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">G. GonzalezTreanor, "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup, "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">J. Westland, ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Further Reading Material===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches within risk management and is there for a must read.
*Chapter 11 in: Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis, "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
* J. L. Jensen, "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*N.T. Nassim, D.G. Goldstein and M.W. Spitznagel "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-25T16:21:06Z

JonasHL: /* Limitations */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(p.V)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p.4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p.4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p.219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p.223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p.138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p.142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:

#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p.12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p.12).

Project Managers can use these 6 steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of RMP (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s, which does not take, the fast-changing and connected world which projects happens in today, in to account <ref name="CriticArticle" />.

Second, a significant proportion of management researchers and analysts agrees on risk captures two dimensions:
# something is at stake (health and lives, the environment and material assets)
# uncertainties.
Above-mentioned can be conceptualized, measured and described in a more and understandable way than the ISO 31000, for instance, the SRA glossary <ref name="CriticArticle" />.
This claim is backed up in the ISO 31000 SME, which states: The ISO 31000 "''provides generic guidelines, it is not intended to promote uniformity of risk management across organizations.''" <ref name="iso31000sme" />.
Therefore it is vital that risk managers don't blindly follow the ISO 31000, but read material from multiple sources, for instance, the SRA glossary or material listed in section [[#Further Reading Material|Further Reading Material]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p.232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

== Just my notes - will be deleted xxx ==
*Even though risk management indisputably is beneficial, most managers use the ISO 31000 standard, which has some critical flaws.
ARTA diagrams are included for risk treatment and control????? XXX
Implementation of risk management xxxxxx
xxx Project management context - Here the risk management process will be put into a project management context. xxx

Risk management is an important tool to use in project management, even-though risk management is only estimates of potential future situations. Risk identification helps the manager get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.

Risk management is highly important discipline and is therefore present in most projects. <ref name="iso31000" /> NoGET MED GOAL XXX

*Slides from fist lecture.
*Write something about project in all sections ex: treat risk/control
*"Implementation risk management (step by step guide)"
*An example of a risk register can be seen here : xxxx

'''Implementing risk management according to ISO 31000''' <ref name="iso31000" />''':'''
*define the appropriate timing and strategy for implementing the framework;
*apply the risk management policy and process to the organizational processes;

*comply with legal and regulatory requirements;

*ensure that decision making, including the development and setting of objectives, is aligned with the
outcomes of risk management processes;

*hold information and training sessions; and
*communicate and consult with stakeholders to ensure that its risk management framework remains
appropriate.

''x''{{sup|2}}

Ref test xxx .. <ref name="AdvantageDisadvantage" />{{rp|pages=22-27}}
test test <ref name="PMBOK" />{{rp|needed=y|date=February 2018}}

<ref name="PMBOK" /> "#page=N'

{{r|PMBOK|p=56}}

{{rp|89}}
2

ref test <ref name="PMBOK" />(p.2)

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is a New Zealand based, they provide business and finance support to over 100.000 members. They are a huge company and therefore must have a lot and specialized knowledge within their field. Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference , on the page. (https://www.charteredaccountantsanz.com/about-us)
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO, "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy, "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq, "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia, "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">J. Geraldi, C. Thuesen and J. Oehmen, "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University, "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey, "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">T. Aven, "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio, "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">C. Reddy, "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="PMBOK">Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000):.</ref>
<ref name="SamsungArticle">M. Lopez, "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">R. Hotten, "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">J. Treanor, "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">G. GonzalezTreanor, "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup, "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">J. Westland, ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Further Reading Material===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches within risk management and is there for a must read.
*Chapter 11 in: Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis, "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
* J. L. Jensen, "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*N.T. Nassim, D.G. Goldstein and M.W. Spitznagel "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-25T16:12:22Z

JonasHL: /* Limitations */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(p.V)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p.4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p.4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p.219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p.223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p.138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p.142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:

#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p.12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p.12).

Project Managers can use these 6 steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of RMP (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s, which does not take the fast-changing and connected world which projects happens in today <ref name="CriticArticle" />.

Second, a significant proportion of management researchers and analysts agrees on risk captures two dimensions:
# something is at stake (health and lives, the environment and material assets)
# uncertainties.
Above-mentioned can be conceptualized, measured and described in a more and understandable way than the ISO 31000, for instance, the SRA glossary <ref name="CriticArticle" />.
This claim is backed up in the ISO 31000 SME, which states: The ISO 31000 "''provides generic guidelines, it is not intended to promote uniformity of risk management across organizations.''" <ref name="iso31000sme" />.
Therefore it is vital that risk managers don't blindly follow the ISO 31000, but read material from multiple sources, for instance, the SRA glossary or material listed in section [[#Further Reading Material|Further Reading Material]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p.232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

== Just my notes - will be deleted xxx ==
*Even though risk management indisputably is beneficial, most managers use the ISO 31000 standard, which has some critical flaws.
ARTA diagrams are included for risk treatment and control????? XXX
Implementation of risk management xxxxxx
xxx Project management context - Here the risk management process will be put into a project management context. xxx

Risk management is an important tool to use in project management, even-though risk management is only estimates of potential future situations. Risk identification helps the manager get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.

Risk management is highly important discipline and is therefore present in most projects. <ref name="iso31000" /> NoGET MED GOAL XXX

*Slides from fist lecture.
*Write something about project in all sections ex: treat risk/control
*"Implementation risk management (step by step guide)"
*An example of a risk register can be seen here : xxxx

'''Implementing risk management according to ISO 31000''' <ref name="iso31000" />''':'''
*define the appropriate timing and strategy for implementing the framework;
*apply the risk management policy and process to the organizational processes;

*comply with legal and regulatory requirements;

*ensure that decision making, including the development and setting of objectives, is aligned with the
outcomes of risk management processes;

*hold information and training sessions; and
*communicate and consult with stakeholders to ensure that its risk management framework remains
appropriate.

''x''{{sup|2}}

Ref test xxx .. <ref name="AdvantageDisadvantage" />{{rp|pages=22-27}}
test test <ref name="PMBOK" />{{rp|needed=y|date=February 2018}}

<ref name="PMBOK" /> "#page=N'

{{r|PMBOK|p=56}}

{{rp|89}}
2

ref test <ref name="PMBOK" />(p.2)

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is a New Zealand based, they provide business and finance support to over 100.000 members. They are a huge company and therefore must have a lot and specialized knowledge within their field. Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference , on the page. (https://www.charteredaccountantsanz.com/about-us)
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO, "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy, "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq, "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia, "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">J. Geraldi, C. Thuesen and J. Oehmen, "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University, "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey, "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">T. Aven, "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio, "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">C. Reddy, "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="PMBOK">Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000):.</ref>
<ref name="SamsungArticle">M. Lopez, "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">R. Hotten, "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">J. Treanor, "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">G. GonzalezTreanor, "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup, "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">J. Westland, ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Further Reading Material===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches within risk management and is there for a must read.
*Chapter 11 in: Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis, "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
* J. L. Jensen, "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*N.T. Nassim, D.G. Goldstein and M.W. Spitznagel "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-25T16:03:42Z

JonasHL: /* Implementing Risk management */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(p.V)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p.4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p.4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p.219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p.223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p.138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p.142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:

#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p.12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p.12).

Project Managers can use these 6 steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of RMP (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s <ref name="CriticArticle" />.

Second, a significant proportion of management researchers and analysts agrees on risk captures two dimensions:
# something is at stake (health and lives, the environment and material assets)
# uncertainties.
Above-mentioned can be conceptualized, measured and described in a more and understandable way than the ISO 31000, for instance, the SRA glossary <ref name="CriticArticle" />.
This claim is backed up in the ISO 31000 SME, which states: The ISO 31000 "''provides generic guidelines, it is not intended to promote uniformity of risk management across organizations.''" <ref name="iso31000sme" />.
Therefore it is vital that risk managers don't blindly follow the ISO 31000, but read material from multiple sources, for instance, the SRA glossary or material listed in section [[#Further Reading Material|Further Reading Material]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p.232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

== Just my notes - will be deleted xxx ==
*Even though risk management indisputably is beneficial, most managers use the ISO 31000 standard, which has some critical flaws.
ARTA diagrams are included for risk treatment and control????? XXX
Implementation of risk management xxxxxx
xxx Project management context - Here the risk management process will be put into a project management context. xxx

Risk management is an important tool to use in project management, even-though risk management is only estimates of potential future situations. Risk identification helps the manager get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.

Risk management is highly important discipline and is therefore present in most projects. <ref name="iso31000" /> NoGET MED GOAL XXX

*Slides from fist lecture.
*Write something about project in all sections ex: treat risk/control
*"Implementation risk management (step by step guide)"
*An example of a risk register can be seen here : xxxx

'''Implementing risk management according to ISO 31000''' <ref name="iso31000" />''':'''
*define the appropriate timing and strategy for implementing the framework;
*apply the risk management policy and process to the organizational processes;

*comply with legal and regulatory requirements;

*ensure that decision making, including the development and setting of objectives, is aligned with the
outcomes of risk management processes;

*hold information and training sessions; and
*communicate and consult with stakeholders to ensure that its risk management framework remains
appropriate.

''x''{{sup|2}}

Ref test xxx .. <ref name="AdvantageDisadvantage" />{{rp|pages=22-27}}
test test <ref name="PMBOK" />{{rp|needed=y|date=February 2018}}

<ref name="PMBOK" /> "#page=N'

{{r|PMBOK|p=56}}

{{rp|89}}
2

ref test <ref name="PMBOK" />(p.2)

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is a New Zealand based, they provide business and finance support to over 100.000 members. They are a huge company and therefore must have a lot and specialized knowledge within their field. Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference , on the page. (https://www.charteredaccountantsanz.com/about-us)
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO, "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy, "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq, "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia, "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">J. Geraldi, C. Thuesen and J. Oehmen, "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University, "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey, "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">T. Aven, "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio, "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">C. Reddy, "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="PMBOK">Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000):.</ref>
<ref name="SamsungArticle">M. Lopez, "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">R. Hotten, "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">J. Treanor, "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">G. GonzalezTreanor, "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup, "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">J. Westland, ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Further Reading Material===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches within risk management and is there for a must read.
*Chapter 11 in: Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis, "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
* J. L. Jensen, "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*N.T. Nassim, D.G. Goldstein and M.W. Spitznagel "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-25T16:03:30Z

JonasHL: /* Implementing Risk management */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(p.V)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p.4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p.4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p.219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p.223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p.138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p.142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:
#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p.12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p.12).

Project Managers can use these 6 steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of RMP (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s <ref name="CriticArticle" />.

Second, a significant proportion of management researchers and analysts agrees on risk captures two dimensions:
# something is at stake (health and lives, the environment and material assets)
# uncertainties.
Above-mentioned can be conceptualized, measured and described in a more and understandable way than the ISO 31000, for instance, the SRA glossary <ref name="CriticArticle" />.
This claim is backed up in the ISO 31000 SME, which states: The ISO 31000 "''provides generic guidelines, it is not intended to promote uniformity of risk management across organizations.''" <ref name="iso31000sme" />.
Therefore it is vital that risk managers don't blindly follow the ISO 31000, but read material from multiple sources, for instance, the SRA glossary or material listed in section [[#Further Reading Material|Further Reading Material]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p.232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

== Just my notes - will be deleted xxx ==
*Even though risk management indisputably is beneficial, most managers use the ISO 31000 standard, which has some critical flaws.
ARTA diagrams are included for risk treatment and control????? XXX
Implementation of risk management xxxxxx
xxx Project management context - Here the risk management process will be put into a project management context. xxx

Risk management is an important tool to use in project management, even-though risk management is only estimates of potential future situations. Risk identification helps the manager get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.

Risk management is highly important discipline and is therefore present in most projects. <ref name="iso31000" /> NoGET MED GOAL XXX

*Slides from fist lecture.
*Write something about project in all sections ex: treat risk/control
*"Implementation risk management (step by step guide)"
*An example of a risk register can be seen here : xxxx

'''Implementing risk management according to ISO 31000''' <ref name="iso31000" />''':'''
*define the appropriate timing and strategy for implementing the framework;
*apply the risk management policy and process to the organizational processes;

*comply with legal and regulatory requirements;

*ensure that decision making, including the development and setting of objectives, is aligned with the
outcomes of risk management processes;

*hold information and training sessions; and
*communicate and consult with stakeholders to ensure that its risk management framework remains
appropriate.

''x''{{sup|2}}

Ref test xxx .. <ref name="AdvantageDisadvantage" />{{rp|pages=22-27}}
test test <ref name="PMBOK" />{{rp|needed=y|date=February 2018}}

<ref name="PMBOK" /> "#page=N'

{{r|PMBOK|p=56}}

{{rp|89}}
2

ref test <ref name="PMBOK" />(p.2)

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is a New Zealand based, they provide business and finance support to over 100.000 members. They are a huge company and therefore must have a lot and specialized knowledge within their field. Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference , on the page. (https://www.charteredaccountantsanz.com/about-us)
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO, "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy, "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq, "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia, "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">J. Geraldi, C. Thuesen and J. Oehmen, "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University, "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey, "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">T. Aven, "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio, "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">C. Reddy, "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="PMBOK">Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000):.</ref>
<ref name="SamsungArticle">M. Lopez, "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">R. Hotten, "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">J. Treanor, "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">G. GonzalezTreanor, "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup, "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">J. Westland, ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Further Reading Material===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches within risk management and is there for a must read.
*Chapter 11 in: Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis, "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
* J. L. Jensen, "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*N.T. Nassim, D.G. Goldstein and M.W. Spitznagel "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-25T16:03:17Z

JonasHL: /* Implementing Risk management */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(p.V)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p.4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p.4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p.219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p.223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p.138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p.142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:
#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p.12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p.12).

Project Managers can use these 6 steps to implement risk management into their projects. Since projects are different, variations in the implementation can occur. However, these steps are a good guideline.

== Limitations and advantages of RMP (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s <ref name="CriticArticle" />.

Second, a significant proportion of management researchers and analysts agrees on risk captures two dimensions:
# something is at stake (health and lives, the environment and material assets)
# uncertainties.
Above-mentioned can be conceptualized, measured and described in a more and understandable way than the ISO 31000, for instance, the SRA glossary <ref name="CriticArticle" />.
This claim is backed up in the ISO 31000 SME, which states: The ISO 31000 "''provides generic guidelines, it is not intended to promote uniformity of risk management across organizations.''" <ref name="iso31000sme" />.
Therefore it is vital that risk managers don't blindly follow the ISO 31000, but read material from multiple sources, for instance, the SRA glossary or material listed in section [[#Further Reading Material|Further Reading Material]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p.232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

== Just my notes - will be deleted xxx ==
*Even though risk management indisputably is beneficial, most managers use the ISO 31000 standard, which has some critical flaws.
ARTA diagrams are included for risk treatment and control????? XXX
Implementation of risk management xxxxxx
xxx Project management context - Here the risk management process will be put into a project management context. xxx

Risk management is an important tool to use in project management, even-though risk management is only estimates of potential future situations. Risk identification helps the manager get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.

Risk management is highly important discipline and is therefore present in most projects. <ref name="iso31000" /> NoGET MED GOAL XXX

*Slides from fist lecture.
*Write something about project in all sections ex: treat risk/control
*"Implementation risk management (step by step guide)"
*An example of a risk register can be seen here : xxxx

'''Implementing risk management according to ISO 31000''' <ref name="iso31000" />''':'''
*define the appropriate timing and strategy for implementing the framework;
*apply the risk management policy and process to the organizational processes;

*comply with legal and regulatory requirements;

*ensure that decision making, including the development and setting of objectives, is aligned with the
outcomes of risk management processes;

*hold information and training sessions; and
*communicate and consult with stakeholders to ensure that its risk management framework remains
appropriate.

''x''{{sup|2}}

Ref test xxx .. <ref name="AdvantageDisadvantage" />{{rp|pages=22-27}}
test test <ref name="PMBOK" />{{rp|needed=y|date=February 2018}}

<ref name="PMBOK" /> "#page=N'

{{r|PMBOK|p=56}}

{{rp|89}}
2

ref test <ref name="PMBOK" />(p.2)

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is a New Zealand based, they provide business and finance support to over 100.000 members. They are a huge company and therefore must have a lot and specialized knowledge within their field. Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference , on the page. (https://www.charteredaccountantsanz.com/about-us)
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO, "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy, "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq, "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia, "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">J. Geraldi, C. Thuesen and J. Oehmen, "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University, "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey, "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">T. Aven, "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio, "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">C. Reddy, "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="PMBOK">Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000):.</ref>
<ref name="SamsungArticle">M. Lopez, "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">R. Hotten, "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">J. Treanor, "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">G. GonzalezTreanor, "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup, "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">J. Westland, ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Further Reading Material===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches within risk management and is there for a must read.
*Chapter 11 in: Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis, "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
* J. L. Jensen, "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*N.T. Nassim, D.G. Goldstein and M.W. Spitznagel "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-25T15:55:57Z

JonasHL: /* Implementing Risk management */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(p.V)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p.4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p.4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p.219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p.223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p.138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p.142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:
#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p.12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p.12).

Project Managers can use these 6 steps to implement risk management into their projects.

== Limitations and advantages of RMP (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s <ref name="CriticArticle" />.

Second, a significant proportion of management researchers and analysts agrees on risk captures two dimensions:
# something is at stake (health and lives, the environment and material assets)
# uncertainties.
Above-mentioned can be conceptualized, measured and described in a more and understandable way than the ISO 31000, for instance, the SRA glossary <ref name="CriticArticle" />.
This claim is backed up in the ISO 31000 SME, which states: The ISO 31000 "''provides generic guidelines, it is not intended to promote uniformity of risk management across organizations.''" <ref name="iso31000sme" />.
Therefore it is vital that risk managers don't blindly follow the ISO 31000, but read material from multiple sources, for instance, the SRA glossary or material listed in section [[#Further Reading Material|Further Reading Material]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p.232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

== Just my notes - will be deleted xxx ==
*Even though risk management indisputably is beneficial, most managers use the ISO 31000 standard, which has some critical flaws.
ARTA diagrams are included for risk treatment and control????? XXX
Implementation of risk management xxxxxx
xxx Project management context - Here the risk management process will be put into a project management context. xxx

Risk management is an important tool to use in project management, even-though risk management is only estimates of potential future situations. Risk identification helps the manager get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.

Risk management is highly important discipline and is therefore present in most projects. <ref name="iso31000" /> NoGET MED GOAL XXX

*Slides from fist lecture.
*Write something about project in all sections ex: treat risk/control
*"Implementation risk management (step by step guide)"
*An example of a risk register can be seen here : xxxx

'''Implementing risk management according to ISO 31000''' <ref name="iso31000" />''':'''
*define the appropriate timing and strategy for implementing the framework;
*apply the risk management policy and process to the organizational processes;

*comply with legal and regulatory requirements;

*ensure that decision making, including the development and setting of objectives, is aligned with the
outcomes of risk management processes;

*hold information and training sessions; and
*communicate and consult with stakeholders to ensure that its risk management framework remains
appropriate.

''x''{{sup|2}}

Ref test xxx .. <ref name="AdvantageDisadvantage" />{{rp|pages=22-27}}
test test <ref name="PMBOK" />{{rp|needed=y|date=February 2018}}

<ref name="PMBOK" /> "#page=N'

{{r|PMBOK|p=56}}

{{rp|89}}
2

ref test <ref name="PMBOK" />(p.2)

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is a New Zealand based, they provide business and finance support to over 100.000 members. They are a huge company and therefore must have a lot and specialized knowledge within their field. Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference , on the page. (https://www.charteredaccountantsanz.com/about-us)
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO, "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy, "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq, "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia, "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">J. Geraldi, C. Thuesen and J. Oehmen, "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University, "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey, "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">T. Aven, "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio, "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">C. Reddy, "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="PMBOK">Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000):.</ref>
<ref name="SamsungArticle">M. Lopez, "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">R. Hotten, "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">J. Treanor, "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">G. GonzalezTreanor, "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup, "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">J. Westland, ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Further Reading Material===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches within risk management and is there for a must read.
*Chapter 11 in: Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis, "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
* J. L. Jensen, "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*N.T. Nassim, D.G. Goldstein and M.W. Spitznagel "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-25T15:52:02Z

JonasHL: /* Implementing Risk management */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(p.V)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p.4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p.4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p.219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p.223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p.138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p.142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:
#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p.12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p.12)..

== Limitations and advantages of RMP (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s <ref name="CriticArticle" />.

Second, a significant proportion of management researchers and analysts agrees on risk captures two dimensions:
# something is at stake (health and lives, the environment and material assets)
# uncertainties.
Above-mentioned can be conceptualized, measured and described in a more and understandable way than the ISO 31000, for instance, the SRA glossary <ref name="CriticArticle" />.
This claim is backed up in the ISO 31000 SME, which states: The ISO 31000 "''provides generic guidelines, it is not intended to promote uniformity of risk management across organizations.''" <ref name="iso31000sme" />.
Therefore it is vital that risk managers don't blindly follow the ISO 31000, but read material from multiple sources, for instance, the SRA glossary or material listed in section [[#Further Reading Material|Further Reading Material]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p.232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

== Just my notes - will be deleted xxx ==
*Even though risk management indisputably is beneficial, most managers use the ISO 31000 standard, which has some critical flaws.
ARTA diagrams are included for risk treatment and control????? XXX
Implementation of risk management xxxxxx
xxx Project management context - Here the risk management process will be put into a project management context. xxx

Risk management is an important tool to use in project management, even-though risk management is only estimates of potential future situations. Risk identification helps the manager get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.

Risk management is highly important discipline and is therefore present in most projects. <ref name="iso31000" /> NoGET MED GOAL XXX

*Slides from fist lecture.
*Write something about project in all sections ex: treat risk/control
*"Implementation risk management (step by step guide)"
*An example of a risk register can be seen here : xxxx

'''Implementing risk management according to ISO 31000''' <ref name="iso31000" />''':'''
*define the appropriate timing and strategy for implementing the framework;
*apply the risk management policy and process to the organizational processes;

*comply with legal and regulatory requirements;

*ensure that decision making, including the development and setting of objectives, is aligned with the
outcomes of risk management processes;

*hold information and training sessions; and
*communicate and consult with stakeholders to ensure that its risk management framework remains
appropriate.

''x''{{sup|2}}

Ref test xxx .. <ref name="AdvantageDisadvantage" />{{rp|pages=22-27}}
test test <ref name="PMBOK" />{{rp|needed=y|date=February 2018}}

<ref name="PMBOK" /> "#page=N'

{{r|PMBOK|p=56}}

{{rp|89}}
2

ref test <ref name="PMBOK" />(p.2)

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is a New Zealand based, they provide business and finance support to over 100.000 members. They are a huge company and therefore must have a lot and specialized knowledge within their field. Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference , on the page. (https://www.charteredaccountantsanz.com/about-us)
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO, "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy, "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq, "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia, "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">J. Geraldi, C. Thuesen and J. Oehmen, "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University, "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey, "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">T. Aven, "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio, "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">C. Reddy, "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="PMBOK">Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000):.</ref>
<ref name="SamsungArticle">M. Lopez, "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">R. Hotten, "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">J. Treanor, "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">G. GonzalezTreanor, "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup, "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">J. Westland, ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Further Reading Material===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches within risk management and is there for a must read.
*Chapter 11 in: Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis, "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
* J. L. Jensen, "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*N.T. Nassim, D.G. Goldstein and M.W. Spitznagel "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-25T15:51:24Z

JonasHL: /* Implementing Risk management */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(p.V)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p.4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p.4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p.219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p.223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p.138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p.142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:
#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p.12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="ProjectManager" /><ref name="iso31000" />(p.12)..

Furthermore, the ISO 31000 provides some additional steps to take into consideration <ref name="iso31000" />:
*The first step should be initiated at the right timing.
*Legal and regulatory requirements should be kept.
*Information of training sessions should be held.
*Communicate with stakeholders to ensure that the framework remains appropriate <ref name="iso31000" />(p.12).

== Limitations and advantages of RMP (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s <ref name="CriticArticle" />.

Second, a significant proportion of management researchers and analysts agrees on risk captures two dimensions:
# something is at stake (health and lives, the environment and material assets)
# uncertainties.
Above-mentioned can be conceptualized, measured and described in a more and understandable way than the ISO 31000, for instance, the SRA glossary <ref name="CriticArticle" />.
This claim is backed up in the ISO 31000 SME, which states: The ISO 31000 "''provides generic guidelines, it is not intended to promote uniformity of risk management across organizations.''" <ref name="iso31000sme" />.
Therefore it is vital that risk managers don't blindly follow the ISO 31000, but read material from multiple sources, for instance, the SRA glossary or material listed in section [[#Further Reading Material|Further Reading Material]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p.232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

== Just my notes - will be deleted xxx ==
*Even though risk management indisputably is beneficial, most managers use the ISO 31000 standard, which has some critical flaws.
ARTA diagrams are included for risk treatment and control????? XXX
Implementation of risk management xxxxxx
xxx Project management context - Here the risk management process will be put into a project management context. xxx

Risk management is an important tool to use in project management, even-though risk management is only estimates of potential future situations. Risk identification helps the manager get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.

Risk management is highly important discipline and is therefore present in most projects. <ref name="iso31000" /> NoGET MED GOAL XXX

*Slides from fist lecture.
*Write something about project in all sections ex: treat risk/control
*"Implementation risk management (step by step guide)"
*An example of a risk register can be seen here : xxxx

'''Implementing risk management according to ISO 31000''' <ref name="iso31000" />''':'''
*define the appropriate timing and strategy for implementing the framework;
*apply the risk management policy and process to the organizational processes;

*comply with legal and regulatory requirements;

*ensure that decision making, including the development and setting of objectives, is aligned with the
outcomes of risk management processes;

*hold information and training sessions; and
*communicate and consult with stakeholders to ensure that its risk management framework remains
appropriate.

''x''{{sup|2}}

Ref test xxx .. <ref name="AdvantageDisadvantage" />{{rp|pages=22-27}}
test test <ref name="PMBOK" />{{rp|needed=y|date=February 2018}}

<ref name="PMBOK" /> "#page=N'

{{r|PMBOK|p=56}}

{{rp|89}}
2

ref test <ref name="PMBOK" />(p.2)

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is a New Zealand based, they provide business and finance support to over 100.000 members. They are a huge company and therefore must have a lot and specialized knowledge within their field. Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference , on the page. (https://www.charteredaccountantsanz.com/about-us)
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO, "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy, "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq, "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia, "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">J. Geraldi, C. Thuesen and J. Oehmen, "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University, "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey, "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">T. Aven, "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio, "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">C. Reddy, "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="PMBOK">Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000):.</ref>
<ref name="SamsungArticle">M. Lopez, "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">R. Hotten, "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">J. Treanor, "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">G. GonzalezTreanor, "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup, "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">J. Westland, ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Further Reading Material===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches within risk management and is there for a must read.
*Chapter 11 in: Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis, "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
* J. L. Jensen, "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*N.T. Nassim, D.G. Goldstein and M.W. Spitznagel "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-25T15:50:55Z

JonasHL: /* Implementing Risk management */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(p.V)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p.4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p.4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p.219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p.223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p.138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p.142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:
#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p.12).
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier<ref name="iso31000" />(p.12)..

Furthermore, the ISO 31000 provides some additional steps to take into consideration <ref name="iso31000" />:
*The first step should be initiated at the right timing.
*Legal and regulatory requirements should be kept.
*Information of training sessions should be held.
*Communicate with stakeholders to ensure that the framework remains appropriate <ref name="iso31000" />(p.12).

== Limitations and advantages of RMP (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s <ref name="CriticArticle" />.

Second, a significant proportion of management researchers and analysts agrees on risk captures two dimensions:
# something is at stake (health and lives, the environment and material assets)
# uncertainties.
Above-mentioned can be conceptualized, measured and described in a more and understandable way than the ISO 31000, for instance, the SRA glossary <ref name="CriticArticle" />.
This claim is backed up in the ISO 31000 SME, which states: The ISO 31000 "''provides generic guidelines, it is not intended to promote uniformity of risk management across organizations.''" <ref name="iso31000sme" />.
Therefore it is vital that risk managers don't blindly follow the ISO 31000, but read material from multiple sources, for instance, the SRA glossary or material listed in section [[#Further Reading Material|Further Reading Material]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p.232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

== Just my notes - will be deleted xxx ==
*Even though risk management indisputably is beneficial, most managers use the ISO 31000 standard, which has some critical flaws.
ARTA diagrams are included for risk treatment and control????? XXX
Implementation of risk management xxxxxx
xxx Project management context - Here the risk management process will be put into a project management context. xxx

Risk management is an important tool to use in project management, even-though risk management is only estimates of potential future situations. Risk identification helps the manager get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.

Risk management is highly important discipline and is therefore present in most projects. <ref name="iso31000" /> NoGET MED GOAL XXX

*Slides from fist lecture.
*Write something about project in all sections ex: treat risk/control
*"Implementation risk management (step by step guide)"
*An example of a risk register can be seen here : xxxx

'''Implementing risk management according to ISO 31000''' <ref name="iso31000" />''':'''
*define the appropriate timing and strategy for implementing the framework;
*apply the risk management policy and process to the organizational processes;

*comply with legal and regulatory requirements;

*ensure that decision making, including the development and setting of objectives, is aligned with the
outcomes of risk management processes;

*hold information and training sessions; and
*communicate and consult with stakeholders to ensure that its risk management framework remains
appropriate.

''x''{{sup|2}}

Ref test xxx .. <ref name="AdvantageDisadvantage" />{{rp|pages=22-27}}
test test <ref name="PMBOK" />{{rp|needed=y|date=February 2018}}

<ref name="PMBOK" /> "#page=N'

{{r|PMBOK|p=56}}

{{rp|89}}
2

ref test <ref name="PMBOK" />(p.2)

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is a New Zealand based, they provide business and finance support to over 100.000 members. They are a huge company and therefore must have a lot and specialized knowledge within their field. Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference , on the page. (https://www.charteredaccountantsanz.com/about-us)
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO, "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy, "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq, "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia, "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">J. Geraldi, C. Thuesen and J. Oehmen, "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University, "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey, "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">T. Aven, "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio, "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">C. Reddy, "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="PMBOK">Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000):.</ref>
<ref name="SamsungArticle">M. Lopez, "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">R. Hotten, "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">J. Treanor, "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">G. GonzalezTreanor, "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup, "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">J. Westland, ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Further Reading Material===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches within risk management and is there for a must read.
*Chapter 11 in: Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis, "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
* J. L. Jensen, "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*N.T. Nassim, D.G. Goldstein and M.W. Spitznagel "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-25T15:50:05Z

JonasHL: /* Implementing Risk management */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(p.V)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p.4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p.4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p.219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p.223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p.138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p.142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:
#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables<ref name="ProjectManager" /> <ref name="iso31000" />(p.12)
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier.

Furthermore, the ISO 31000 provides some additional steps to take into consideration <ref name="iso31000" />:
*The first step should be initiated at the right timing.
*Legal and regulatory requirements should be kept.
*Information of training sessions should be held.
*Communicate with stakeholders to ensure that the framework remains appropriate <ref name="iso31000" />(p.12).

== Limitations and advantages of RMP (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s <ref name="CriticArticle" />.

Second, a significant proportion of management researchers and analysts agrees on risk captures two dimensions:
# something is at stake (health and lives, the environment and material assets)
# uncertainties.
Above-mentioned can be conceptualized, measured and described in a more and understandable way than the ISO 31000, for instance, the SRA glossary <ref name="CriticArticle" />.
This claim is backed up in the ISO 31000 SME, which states: The ISO 31000 "''provides generic guidelines, it is not intended to promote uniformity of risk management across organizations.''" <ref name="iso31000sme" />.
Therefore it is vital that risk managers don't blindly follow the ISO 31000, but read material from multiple sources, for instance, the SRA glossary or material listed in section [[#Further Reading Material|Further Reading Material]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p.232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

== Just my notes - will be deleted xxx ==
*Even though risk management indisputably is beneficial, most managers use the ISO 31000 standard, which has some critical flaws.
ARTA diagrams are included for risk treatment and control????? XXX
Implementation of risk management xxxxxx
xxx Project management context - Here the risk management process will be put into a project management context. xxx

Risk management is an important tool to use in project management, even-though risk management is only estimates of potential future situations. Risk identification helps the manager get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.

Risk management is highly important discipline and is therefore present in most projects. <ref name="iso31000" /> NoGET MED GOAL XXX

*Slides from fist lecture.
*Write something about project in all sections ex: treat risk/control
*"Implementation risk management (step by step guide)"
*An example of a risk register can be seen here : xxxx

'''Implementing risk management according to ISO 31000''' <ref name="iso31000" />''':'''
*define the appropriate timing and strategy for implementing the framework;
*apply the risk management policy and process to the organizational processes;

*comply with legal and regulatory requirements;

*ensure that decision making, including the development and setting of objectives, is aligned with the
outcomes of risk management processes;

*hold information and training sessions; and
*communicate and consult with stakeholders to ensure that its risk management framework remains
appropriate.

''x''{{sup|2}}

Ref test xxx .. <ref name="AdvantageDisadvantage" />{{rp|pages=22-27}}
test test <ref name="PMBOK" />{{rp|needed=y|date=February 2018}}

<ref name="PMBOK" /> "#page=N'

{{r|PMBOK|p=56}}

{{rp|89}}
2

ref test <ref name="PMBOK" />(p.2)

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is a New Zealand based, they provide business and finance support to over 100.000 members. They are a huge company and therefore must have a lot and specialized knowledge within their field. Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference , on the page. (https://www.charteredaccountantsanz.com/about-us)
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO, "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy, "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq, "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia, "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">J. Geraldi, C. Thuesen and J. Oehmen, "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University, "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey, "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">T. Aven, "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio, "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">C. Reddy, "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="PMBOK">Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000):.</ref>
<ref name="SamsungArticle">M. Lopez, "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">R. Hotten, "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">J. Treanor, "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">G. GonzalezTreanor, "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup, "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">J. Westland, ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Further Reading Material===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches within risk management and is there for a must read.
*Chapter 11 in: Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis, "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
* J. L. Jensen, "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*N.T. Nassim, D.G. Goldstein and M.W. Spitznagel "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-25T15:47:21Z

JonasHL: /* Implementing Risk management */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(p.V)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p.4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p.4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p.219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p.223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p.138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p.142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following steps <ref name="ProjectManager" />:
#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables.
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier.

Furthermore, the ISO 31000 provides some additional steps to take into consideration <ref name="iso31000" />:
*The first step should be initiated at the right timing.
*Legal and regulatory requirements should be kept.
*Information of training sessions should be held.
*Communicate with stakeholders to ensure that the framework remains appropriate <ref name="iso31000" />(p.12).

== Limitations and advantages of RMP (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s <ref name="CriticArticle" />.

Second, a significant proportion of management researchers and analysts agrees on risk captures two dimensions:
# something is at stake (health and lives, the environment and material assets)
# uncertainties.
Above-mentioned can be conceptualized, measured and described in a more and understandable way than the ISO 31000, for instance, the SRA glossary <ref name="CriticArticle" />.
This claim is backed up in the ISO 31000 SME, which states: The ISO 31000 "''provides generic guidelines, it is not intended to promote uniformity of risk management across organizations.''" <ref name="iso31000sme" />.
Therefore it is vital that risk managers don't blindly follow the ISO 31000, but read material from multiple sources, for instance, the SRA glossary or material listed in section [[#Further Reading Material|Further Reading Material]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p.232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

== Just my notes - will be deleted xxx ==
*Even though risk management indisputably is beneficial, most managers use the ISO 31000 standard, which has some critical flaws.
ARTA diagrams are included for risk treatment and control????? XXX
Implementation of risk management xxxxxx
xxx Project management context - Here the risk management process will be put into a project management context. xxx

Risk management is an important tool to use in project management, even-though risk management is only estimates of potential future situations. Risk identification helps the manager get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.

Risk management is highly important discipline and is therefore present in most projects. <ref name="iso31000" /> NoGET MED GOAL XXX

*Slides from fist lecture.
*Write something about project in all sections ex: treat risk/control
*"Implementation risk management (step by step guide)"
*An example of a risk register can be seen here : xxxx

'''Implementing risk management according to ISO 31000''' <ref name="iso31000" />''':'''
*define the appropriate timing and strategy for implementing the framework;
*apply the risk management policy and process to the organizational processes;

*comply with legal and regulatory requirements;

*ensure that decision making, including the development and setting of objectives, is aligned with the
outcomes of risk management processes;

*hold information and training sessions; and
*communicate and consult with stakeholders to ensure that its risk management framework remains
appropriate.

''x''{{sup|2}}

Ref test xxx .. <ref name="AdvantageDisadvantage" />{{rp|pages=22-27}}
test test <ref name="PMBOK" />{{rp|needed=y|date=February 2018}}

<ref name="PMBOK" /> "#page=N'

{{r|PMBOK|p=56}}

{{rp|89}}
2

ref test <ref name="PMBOK" />(p.2)

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is a New Zealand based, they provide business and finance support to over 100.000 members. They are a huge company and therefore must have a lot and specialized knowledge within their field. Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference , on the page. (https://www.charteredaccountantsanz.com/about-us)
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO, "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy, "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq, "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia, "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">J. Geraldi, C. Thuesen and J. Oehmen, "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University, "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey, "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">T. Aven, "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio, "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">C. Reddy, "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="PMBOK">Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000):.</ref>
<ref name="SamsungArticle">M. Lopez, "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">R. Hotten, "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">J. Treanor, "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">G. GonzalezTreanor, "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup, "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">J. Westland, ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Further Reading Material===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches within risk management and is there for a must read.
*Chapter 11 in: Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis, "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
* J. L. Jensen, "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*N.T. Nassim, D.G. Goldstein and M.W. Spitznagel "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-25T15:40:59Z

JonasHL: /* Further Reading Material */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(p.V)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p.4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p.4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p.219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p.223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p.138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p.142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following 7 steps <ref name="ProjectManager" />:
#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables.
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier.

Furthermore, the ISO 31000 provides some additional steps to take into consideration <ref name="iso31000" />:
*The first step should be initiated at the right timing.
*Legal and regulatory requirements should be kept.
*Information of training sessions should be held.
*Communicate with stakeholders to ensure that the framework remains appropriate <ref name="iso31000" />(p.12).

== Limitations and advantages of RMP (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s <ref name="CriticArticle" />.

Second, a significant proportion of management researchers and analysts agrees on risk captures two dimensions:
# something is at stake (health and lives, the environment and material assets)
# uncertainties.
Above-mentioned can be conceptualized, measured and described in a more and understandable way than the ISO 31000, for instance, the SRA glossary <ref name="CriticArticle" />.
This claim is backed up in the ISO 31000 SME, which states: The ISO 31000 "''provides generic guidelines, it is not intended to promote uniformity of risk management across organizations.''" <ref name="iso31000sme" />.
Therefore it is vital that risk managers don't blindly follow the ISO 31000, but read material from multiple sources, for instance, the SRA glossary or material listed in section [[#Further Reading Material|Further Reading Material]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p.232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

== Just my notes - will be deleted xxx ==
*Even though risk management indisputably is beneficial, most managers use the ISO 31000 standard, which has some critical flaws.
ARTA diagrams are included for risk treatment and control????? XXX
Implementation of risk management xxxxxx
xxx Project management context - Here the risk management process will be put into a project management context. xxx

Risk management is an important tool to use in project management, even-though risk management is only estimates of potential future situations. Risk identification helps the manager get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.

Risk management is highly important discipline and is therefore present in most projects. <ref name="iso31000" /> NoGET MED GOAL XXX

*Slides from fist lecture.
*Write something about project in all sections ex: treat risk/control
*"Implementation risk management (step by step guide)"
*An example of a risk register can be seen here : xxxx

'''Implementing risk management according to ISO 31000''' <ref name="iso31000" />''':'''
*define the appropriate timing and strategy for implementing the framework;
*apply the risk management policy and process to the organizational processes;

*comply with legal and regulatory requirements;

*ensure that decision making, including the development and setting of objectives, is aligned with the
outcomes of risk management processes;

*hold information and training sessions; and
*communicate and consult with stakeholders to ensure that its risk management framework remains
appropriate.

''x''{{sup|2}}

Ref test xxx .. <ref name="AdvantageDisadvantage" />{{rp|pages=22-27}}
test test <ref name="PMBOK" />{{rp|needed=y|date=February 2018}}

<ref name="PMBOK" /> "#page=N'

{{r|PMBOK|p=56}}

{{rp|89}}
2

ref test <ref name="PMBOK" />(p.2)

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is a New Zealand based, they provide business and finance support to over 100.000 members. They are a huge company and therefore must have a lot and specialized knowledge within their field. Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference , on the page. (https://www.charteredaccountantsanz.com/about-us)
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO, "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy, "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq, "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia, "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">J. Geraldi, C. Thuesen and J. Oehmen, "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University, "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey, "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">T. Aven, "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio, "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">C. Reddy, "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="PMBOK">Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000):.</ref>
<ref name="SamsungArticle">M. Lopez, "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">R. Hotten, "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">J. Treanor, "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">G. GonzalezTreanor, "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup, "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">J. Westland, ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Further Reading Material===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[#https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches within risk management and is there for a must read.
*Chapter 11 in: Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis, "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
* J. L. Jensen, "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*N.T. Nassim, D.G. Goldstein and M.W. Spitznagel "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.

Risk Management Overview

2018-02-25T15:40:47Z

JonasHL: /* Further Reading Material */

==Abstract==
Projects are part of a dynamic and fast-changing world. Therefore there is a degree of uncertainty and unpredictability in projects. In order to minimize uncertainties and unforeseeable events related to a project, risks are identified and managed throughout the project lifecycle. A risk is an uncertain event that can have e negative effect on one or more objects in a project such as time, cost, performance or scope <ref name="HowToDoProjects" /> <ref name="iso31000" />.

In order to control and manage risks, the Risk Management Process (RMP) is used. RMP is divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''. However, RMP is a continuous process, which happens throughout the lifecycle of a project. <ref name="iso31000" /> <ref name="RMGeorgUni" />

The different natures of risks can be categorized with D. Rumsfeld's Unknown-Knowns and assessed with the risk matrix (both residual- & inherent risk). When treating a risk, the risk managers can choose to ''Avoid'', ''Reduce'', ''Share'' or ''Accept'' the risk. The risks can be monitored by using a risk register, where risks and countermeasures can be mapped.

Risk management is an essential tool to use in project management and helps managers get an overview of potential obstacles that can occur or prevent a team from achieving their goals.
Risk management is a highly importent discipline and should be present in all projects, however, its importance is often neglected. <ref name="iso31000" /> <ref name="RisikoRadio" />

This Wiki-article will describe the risk management Process, Risk matrix, Rumsfeld's Unknown-Knowns, inherent- and residual risks.
At last limitations and advantages of risk management will be discussed and a brief overview of other relevant reading material is given.

Please note that this article only covers the risk (threat) management of a project and does not look into opportunities management (risks with a positive effect).

==Introduction==

=== Risk definition ===
Risk can be defined as follows: "''Risk is an uncertain event or condition that if occurs, has a positive or negative effect on one or more project objectives such as time, cost and quality, or effect of uncertainty on objectives''"
All activities in an organization involve risks. These risks can be managed by identifying them, analyzing them and then evaluating whether the risk should be modified by risk treatment in order to satisfy the organization's risk criteria.
During this process, risk managers communicate with stakeholders and monitor the risk. The controls are modified to ensure that the amount of risk treatment is minimized. <ref name="iso31000" />(p.V)

Risk identification is the "''process of finding, recognizing and describing risks''" <ref name="iso31000" />(p.4). Risk identification involves the identification of risk sources, event, causes and potential consequences. The identification can involve historical data, theoretical analysis, expert opinions, and stakeholder needs <ref name="iso31000" />(p.4).

However identification is only the first step, managers also need to analyze the risk to the most significant ones can be dealt with on an ongoing basis <ref name="PMBogen" />(p.219).

=== Rumsfeld's Unknown-Knowns ===
The different nature of risks can be categorized with former US Defense Secretary, Donald Rumsfeld's definition. Rumsfeld categorizes risks as the following <ref name="KnownKnownsWiki" /> :

*''Known-Knowns'' describes the things we know we know. An example could be the fact that we know that there are some risks in every project or maybe learning's from a previous project.
*''Known-Unknowns'' describes the things we know are uncertain. For example, the delays because of a third party fail to deliver on deadline or human errors administration wise or misunderstandings.
*''Unknown-Unknowns'' describes the things that we in no way could have seen or expected. This could be a sudden death, war or terrorist attack.
*''Unknown-Knowns'' describes the things we should have known, but we for various reason (mostly complexity) don't. An example could be when a terrorist attack happens on American solid, to some extent, this is an Unknown-Known for the CIA <ref name="PMBogen" />(pp.219-220).

=== Risk matrix ===
[[File:Risk_matrix_Pic.png|right|thumb|500px|Risk matrix <ref name="RiskMatrixPicture" />]]
When the risk elements to be managed is identified, the next step is to ensure that either the likelihood is reduced or the impact of that activity occurring.

The risk matrix is one of the most used tools for risk evaluation.
The matrix can be used to determine the size of a risk & whether or not a risk is sufficiently controlled.

The risk-matrix is compiled of two dimensions Probability (also called likelihood) and Impact (also called severity). Likelihood is the measure of how likely a given event is, and impact is the effect the risk can do.
The combination of these two dimensions gives a collective risk rating in the matrix.
Usually, the risk-matrix consists of 3 different risk ratings: Low (Acceptable), Medium and high (Not acceptable), however, some matrixes also have a 4. level very high <ref name="RiskMatrixPicture" />.

The horizontal and vertical scale can have different values or tags, however, in this case, both impact and probability have a scale from 1-5.
An example of a risk rating could have a probability of 3 (possible), and an impact of 2 (Minor) would have a collective risk ration of medium <ref name="PMBogen" />(p.223).

The numeric scale of 1-5 can be hard for managers to visualize and use, therefore more subjective values like unlikely and likely is often used, as seen in the table below.

{| class="wikitable" style="margin-left: auto; margin-right: auto; border: none;"
|+ Objectively description of numeric scale
! Scale (1-5)
! Probability (Subjective values)
! Impact (Subjective values)
|-
| 1
| Highly unlikely
| No impact
|-
| 2
| Unlikely
| Minor
|-
| 3
| Possible
| Medium
|-
| 4
| Likely
| Major
|-
| 5
| Very likely
| Extensive
|}

It is important to notice that the risk matrix is only used to rank risks, and not as a decision tool itself. How to treat the individual risk the matrix does not answer - other tools and analysis should be used for this (see section [[#Treat risks/Control|Treat risks/Control]]). The tool, however, can be used to prioritize and categorize the risks, so the risks with the highest rating can be dealt with first and so forth.

=== Residual - & Inherent risks ===
Identified risks can be categorized into two different categories, depending on, if controls fail or not.
The residual risk is the identified risk as it is today, with the controls in place.
An example could be the risk of "financial loss if the bank is robbed", however, we have a control in place and hired security people.
The inherent risk is the risk we face if the controls for the residual risk fail. For instance, all the security people get food poisoning, and the bank's protection is therefore gone.
Naturally the Impact/Probability for the inherent risk should be greater or equal to the ratings in the residual <ref name="iso31000" /> <ref name="ResidualInherent" />.

== Risk Management Process (RMP) ==
[[File:IAMC.jpg|right|thumb|500px|Risk Management Process <ref name="RMPPic" />]]
The Risk Management Process can be divided into four main categories ''Identify risks'', ''Assess risks'', ''Treat risks'' and ''Monitor risks''.
=== Identify risks ===
The first process is "''Identify risks''", here potential risk events and their characteristics that can have a negative effect on the project is identified. The ''identification of risk'' is a repeatable process since risks can change or new risks are discovered, throughout the project's lifecycle. The identification process can consist of a variety of different stakeholders, project management team, experts, senior managers, etc.

=== Assess risks ===
The second process is "''Assess risks''", which is used to measure and prioritize risks. In the ''assessment of risks'' the probability of each risk occurring & the corresponding impact for the project, if the risk does occur. The probability and impact are then used to prioritize the risks. This process is also repetitive throughout the project. The [[#Risk matrix|Risk matrix]], as described earlier, can be used for accessing the risks.

=== Treat risks/Control ===
The third process is "''Treat risks''", here actions to reduce risks, are developed and determined. The ''treatment of risks'' can consist of adding additional resources (manpower, budget) into the schedule. However, the treatment should be customized to fit the individual risk and be as realistic and cost-effective as possible. The process also includes measures to avoid, mitigate or deflect the risk. Another possibility is to develop contingency plans which can be used if the risk occurs <ref name="HowToDoProjects" />(p.138).

''Risk Treatment'' consists of a range of options for mitigating the risk, assessing options, and preparations for implementing action plans. As mentioned earlier (in section [[#Risk matrix|Risk matrix]]) the highest risks should be addressed first and so on and forth. Of course, the cost of treating the risk should be evaluated and compared with a potential loss by risk.
Depending on the type and nature of the risk, the following options are available <ref name="TreatRisks" />:
*Avoid - The risk is avoided by stopping to proceed with the activity that introduced the risk. Instead, an alternative activity that still meets business objectives is chosen or a less risky approach or process.
*Reduce - The likelihood or effect of the risk is reduced to an acceptable level. However in regards to time and expense, it is desirable to eliminate the risk <ref name="PMBogen" />.
*Share or Transfer - The risk is transferred away from the risk-owner. For instance by outsourcing the activities that the risk is tied to, making contracts with service providers or buying insurance that covers that risk.
*Accept - The risk is simply accepted, risks with very low impact and likelihood can often be accepted. A risk can also be accepted if the cost of the treatment outweighs the benefit. By accepting the risk no further action is taken to treat the risk, the risk is of cause still monitored and evaluated on an ongoing basis, due to potential changes <ref name="TreatRisks" />.

=== Monitor risks ===
The fourth process is "''Monitor risks''", here actions to track and monitor risks are developed. One of the most common approaches to risk monitoring is to use a risk register, which is initiated at the start of a project and continually reviewed and updated. A risk register should as a minimum contain the following information:
*Risk identification number (Used for identification of risks)
*Risk Owner (Should be clearly defined and registered in the risk register)
*Description of Risk (Makes it easier to communicate risk)
*Results of assessment (Probability/Impact) and assessment date
*Mitigating Actions (Actions to address the risk)
*Date for next risk review <ref name="RMPPic" />.

It is important to note that risks should be monitored, reviewed and controlled on an ongoing base. The controlling of risks is done by continuous tracking of identified risks while identifying and analyzing new risks.
Risks and the effectiveness of controls and mitigations should be evaluated throughout the project life cycle <ref name="RMGeorgUni" />(p.142).

== Risk management ==
=== Risk management in different industries ===
Risk management is relevant for all industries. However, the degree of importance and impact can vary a lot.
Risk management is highly essential in sectors like finance/banks, Formula One, drilling oil & gas or space programs. Where big money can be lost, reputations ruined or even lives lost.
Risk management is especially important in the following areas:
*Construction
*Medical procedures
*Disaster and terrorism management
*Tech companies
*Oil and gas
*Financial
*Large government projects
*Pharmaceutical sector
The parameters used to measure the impact can also vary a lot. For an R&D project, the impact measurements could be delays, financial and mistakes while a bank could use reputational, regulatory, and financial scales to measure the impact. The space program could be an operational risk such as the risk of burning up when astronauts are reentering the atmosphere. While financial institutions could loose reputation or customers if they have a security breach, like hacking or transferring the wrong amount of money from one customer to another.

====Examples of good and bad risk management====

'''Bad:'''
*''Volkswagen - Dieselgate'': In 2015 it was discovered that car manufacturer VW was cheating in emissions test, which made their cars seem more eco-friendly. This act resulted in a recall which costed around 6.7 billion euro and resulted in the company posting its first quarterly loss in 15 years. <ref name="VWArticle" />
*''Samsung - Galaxy Note 7 smartphone explosions'': When Samsung launched Galaxy Note 7 in August 2017, there was a fatal error with the batteries which caused them to explode, and Samsung was forced to recall 2 million devices with an estimated cost of 5.3 billion USD. <ref name="SamsungArticle" />
*''Deutsche Bank -Fined 14 billion USD'': Deutsche Bank was fined 14 billion USD, by the US for misselling mortgage securities in the US. The bank selected mortgages, packed them into bonds (RMBS) and sold on to investors.<ref name="DBArticle" />

'''Good:'''
*''NASA - mission planning and real-time mission operations'': NASA is known for having a lot of risks in their projects, and have managed to excel in risk management.
*''Formula One racing'' - Is high-performance racer sport, where safety and risk management is taken very seriously. Resulting in a 20-year streak with no fatal incidents, until October 2014 <ref name="FOneArticle" />. Former Formula One driver Jackie Stewart did even say: "''There is no doubt that Formula One has the best risk management of any sport and any industry in the world''"<ref name="FOneQoute" />

== Implementing Risk management ==
[[File:ReducingRisk.jpg|right|thumb|500px|Steps in implementing Risk management <ref name="ProjectManager" />]]
The steps to implementing risk management can be divided into the following 7 steps <ref name="ProjectManager" />:
#'''Start right''' - It is important to have a clear and precise definition of what the project outcome should be, along with project vision, objectives, scope, and deliverables.
#'''Accountable''' - Involve the whole team and share responsibilities among team members.
#'''Identify''' - Start with identifying the risks (step 1-2 in the [[#Risk Management Process (RMP)|Risk Management Process (RMP)]])
#'''Risk plan''' - The actions to counter risks is planned and mapped (step 3 in RMP)
#'''Monitor''' - The identified risks are monitored and tracked (Step 4 in RMP)
#'''Transparency''' - Is about communication, being clear and straight up with stakeholders, bosses and employees, which will make the project easier.

Furthermore, the ISO 31000 provides some additional steps to take into consideration <ref name="iso31000" />:
*The first step should be initiated at the right timing.
*Legal and regulatory requirements should be kept.
*Information of training sessions should be held.
*Communicate with stakeholders to ensure that the framework remains appropriate <ref name="iso31000" />(p.12).

== Limitations and advantages of RMP (discussion) ==

=== Advantages ===
By having an effective and structured risk management system, organizations will get the following benefits:
*Increased ability to deliver projects on time, since there will be fewer surprises.
*Better use of resources.
*Overview of risks and losses.
*Better quality data for decision making.
*Budgets are less relying on guesswork.

There are many more benefits of good risk management than just the ones listed here, but this is some of the important ones for organizations.
Risk management helps organization overview and control risks and therefore make better decisions. Risk management is therefore highly relevant and should be implemented and used in organizations.

=== Limitations ===
Risk management has an array of advantages. However, risk management also has some limitations:
*No matter how much preparation is done, accidents and unforeseen events will always happen.
*Risk management will not delay or remove all risks.
*It can be used as decision support, but not as a decision tool.
*Risk management uses a lot of time, to gather information, it has information and can be difficult to implement. <ref name="AdvantageDisadvantage" />

Risk Management Process is concerned with managing the identified and quantified risks & mitigations and does not tackle other types of uncertainty like the cost to develop a new prototype or if customers will buy the product <ref name="HowToDoProjects" />(pp.134-135).
Furthermore, a lot of time and resources can potentially be spent on prioritizing and assessing, risks that are not likely to occur, which will divert resources that could have been spent more effectively.

''' ISO 31000 '''

The ISO 31000 is probably the most used risk management standard. However, it has some flaws, which managers need to take into consideration.

First, a considerable amount of scientific literature arguing for the ISO 31000 is outdated since it uses ideas of risk assessment and characterization as used in the 1970s and 1980s <ref name="CriticArticle" />.

Second, a significant proportion of management researchers and analysts agrees on risk captures two dimensions:
# something is at stake (health and lives, the environment and material assets)
# uncertainties.
Above-mentioned can be conceptualized, measured and described in a more and understandable way than the ISO 31000, for instance, the SRA glossary <ref name="CriticArticle" />.
This claim is backed up in the ISO 31000 SME, which states: The ISO 31000 "''provides generic guidelines, it is not intended to promote uniformity of risk management across organizations.''" <ref name="iso31000sme" />.
Therefore it is vital that risk managers don't blindly follow the ISO 31000, but read material from multiple sources, for instance, the SRA glossary or material listed in section [[#Further Reading Material|Further Reading Material]].

== Conclusion ==

There will always be risks in projects, and how they are managed will have a large impact on the success of a project <ref name="PMBogen" />(p.232).

Bad or no risk management can lead to immense losses and complications, whereas great risk management will lead to better decision making, quality, and budgets for projects.
Naturally, risk management has some limitations such as its time consumption and the missing ability to remove all delays/risks.

The RMP helps manages to get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.
It is important that managers use risk management, and spent time on improving and develop the risk management programme of companies.

Even though risk management naturally is a more integrated and important discipline in some industries, it is recommended that it is used at least to some degree throughout all projects and companies.

== Just my notes - will be deleted xxx ==
*Even though risk management indisputably is beneficial, most managers use the ISO 31000 standard, which has some critical flaws.
ARTA diagrams are included for risk treatment and control????? XXX
Implementation of risk management xxxxxx
xxx Project management context - Here the risk management process will be put into a project management context. xxx

Risk management is an important tool to use in project management, even-though risk management is only estimates of potential future situations. Risk identification helps the manager get an overview of potential obstacles that can occur or prevent the team from achieving their goals. By identifying the risks, managers can map them and initiate appropriate measurements to counter them.

Risk management is highly important discipline and is therefore present in most projects. <ref name="iso31000" /> NoGET MED GOAL XXX

*Slides from fist lecture.
*Write something about project in all sections ex: treat risk/control
*"Implementation risk management (step by step guide)"
*An example of a risk register can be seen here : xxxx

'''Implementing risk management according to ISO 31000''' <ref name="iso31000" />''':'''
*define the appropriate timing and strategy for implementing the framework;
*apply the risk management policy and process to the organizational processes;

*comply with legal and regulatory requirements;

*ensure that decision making, including the development and setting of objectives, is aligned with the
outcomes of risk management processes;

*hold information and training sessions; and
*communicate and consult with stakeholders to ensure that its risk management framework remains
appropriate.

''x''{{sup|2}}

Ref test xxx .. <ref name="AdvantageDisadvantage" />{{rp|pages=22-27}}
test test <ref name="PMBOK" />{{rp|needed=y|date=February 2018}}

<ref name="PMBOK" /> "#page=N'

{{r|PMBOK|p=56}}

{{rp|89}}
2

ref test <ref name="PMBOK" />(p.2)

==Literature==
===References Credibility===
This section contains a brief discussion of the used online sources credibility. This is done to ensure transparency and provide a high-quality list of sourcing which the reader can follow up on.
*<ref name="RMGeorgUni" />: Is written by the ''Office of risk management'' at Georgetown University and can, therefore, be seen as an academically valid source.
*<ref name="RisikoRadio" />: Is a podcast produced by a Danish radio called ''Risiko Radio'', which specialize in risk. However this podcast is in Danish, which can be problematic, the interviewed author J.L. Jensen, also argues for this in his book ''Redefining Risk & Return - The Economic Red Phone Explained'' (ISBN 978-3-319-41368-6).
*<ref name="KnownKnownsWiki" />: ''Wikipedia'' is often criticised for is reliability since everybody can edit the pages. However, since this source is used in combination with the book Project Management by H. Pearson <ref name="PMBogen" /> and since this article is a Wikipedia itself, this is not a huge issue. Last modified 02-02-2018
*<ref name="RiskMatrixPicture" />: Is written by ''CGE Academy'' which is a information site created by the company ''CGE - Risk Management Solutions''. ''CGE'' is a multinational company which specializes in risk management solutions. The company has over 10.000 end users and a 21% growth over the last five years, and it is fair to say that ''CGE'' is a reliable source considering Risk Management. (https://www.cgerisk.com/about-us/) Last modified 24-07-2017
*<ref name="ResidualInherent" />: ''Nasdaq BWise'' is a global company which helps streamline risk management activities, furthermore the information from their webpage was compared with information from the ISO 31000 <ref name="iso31000" />. (http://www.bwise.com/about) Last modified 29-09-2015
*<ref name="RMPPic" />: ''Procurement Journey'' is a webpage written by the Schottish Government (http://www.gov.scot/About) and can be seen as a credible source. Last modified 2016
*<ref name="TreatRisks" />: Is written by ''Chartered Accountants'', which is a New Zealand based, they provide business and finance support to over 100.000 members. They are a huge company and therefore must have a lot and specialized knowledge within their field. Furthermore the ISO 31000 <ref name="iso31000" /> is used as a reference , on the page. (https://www.charteredaccountantsanz.com/about-us)
*<ref name="ProjectManager" /> Is written by the CEO of "Projectmanager.com, which is a company that produces Project Management software. The company has more than 10.000 users, including NASA, VOLVO, and UN (https://www.projectmanager.com/). The webpage can be seen as credible. However information from webpage is used in combination with information from the ISO 31000 <ref name="iso31000" />.
*<ref name="AdvantageDisadvantage" /> Is an article published on the business site Wisestep, which can be seen as a credible source. The article was last modified/published 12-02-2018.

However, a more general critic of the use of online source could be based on the following:
#Information available on the Internet is not regulated for quality or accuracy.
#Almost anyone can publish anything they wish on the internet.
#The information on a given webpage can change over time.
#The information can be outdated.
#Information can be twisted to reflect a person or companies interests.

As earlier stated the used online sources are relatively credible (point 1-2). When considering the change and outdatedness (point 3-4), the webpages was last edited between 29-09-2015 and 02-02-2018, which is relatively new and relevant.
Since all the internet pages used are on a factual and information level, and not analytical the risk of exposure to company interests are minimal (point 5).
In conclusion, the used internet pages are credible sources.

===References===
<references>

<ref name="PMBogen">H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010):.</ref>
<ref name="iso31000sme">ISO, "31000 Risk Management for smes", ''ISO'', (2015):. https://www.iso.org/iso/iso_31000_for_smes.pdf, Visited 07-02-2018</ref>
<ref name="iso31000">ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009):. </ref>
<ref name="RiskMatrixPicture">CGE Academy, "Risk matrices", https://www.cgerisk.com/knowledgebase/Risk_matrices, Visited 05-02-2018</ref>
<ref name="ResidualInherent">Nasdaq, "Assessing Risks: Inherent or Residual", http://www.bwise.com/blog/assessing-risks-inherent-or-residual/obj5382859, Visited 08-02-2018</ref>
<ref name="KnownKnownsWiki">Wikipedia, "There are known knowns", https://en.wikipedia.org/wiki/There_are_known_knowns, Visited 03-02-2018</ref>
<ref name="HowToDoProjects">J. Geraldi, C. Thuesen and J. Oehmen, "How to Do Projects", ''Dansk Standard'', (2017):.</ref>
<ref name="TreatRisks">Chartered Accountants, "Treat Risks", https://survey.charteredaccountantsanz.com/risk_management/midsize-firms/treat.aspx, Visited 09-02-2018</ref>
<ref name="RMGeorgUni">Georgetown University, "Risk Management Overview", https://riskmanagement.georgetown.edu/overview, Visited 10-02-2018</ref>
<ref name="RMPPic">Procurement Journey, "Risk Management Process", https://www.procurementjourney.scot/risk-management-process, Visited 10-02-2018</ref>
<ref name="CriticArticle">T. Aven, "The flaws of the ISO 31000 conceptualisation of risk", ''Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability'', 5 (2017):.</ref>
<ref name="RisikoRadio">Risko Radio, "Episode 027: Hvad er en Risikoejer? Interview med Jesper Lyng Jensen", https://podtail.com/da/podcast/risiko-radio/episode-027-hvad-er-en-risikoejer-interview-med-je/, Visited 13-02-2018</ref>
<ref name="AdvantageDisadvantage">C. Reddy, "Advantage and Disadvantage of Risk Management" (published: 12/02-2018), ''Wisestep'', https://content.wisestep.com/advantage-disadvantage-risk-management/, Visited 13-02-2018</ref>
<ref name="PMBOK">Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000):.</ref>
<ref name="SamsungArticle">M. Lopez, "Samsung Explains Note 7 Battery Explosions, And Turns Crisis Into Opportunity" (published: 22/01-2017), ''Forbes'', https://www.forbes.com/sites/maribellopez/2017/01/22/samsung-reveals-cause-of-note-7-issue-turns-crisis-into-opportunity/#9a47e4b24f12, Visited 15-02-2018</ref>
<ref name="VWArticle">R. Hotten, "Volkswagen: The scandal explained" (published: 10/12-2015), ''BBC'', http://www.bbc.com/news/business-34324772, Visited 15-02-2018</ref>
<ref name="DBArticle">J. Treanor, "The $14bn Deutsche Bank fine – all you need to know" (published: 06/09-2016), ''The Guardian'', https://www.theguardian.com/business/2016/sep/16/deutsche-bank-14bn-dollar-fine-doj-q-and-a, Visited 15-02-2018</ref>
<ref name="FOneArticle">G. GonzalezTreanor, "Formula One risk management strives to prevent racing deaths after tragedies" (published: 16/10-2017), ''Business Insurance'', http://www.businessinsurance.com/article/00010101/NEWS06/912316546/Formula-One-risk-management-strives-to-prevent-racing-deaths-after-tragedies, Visited 15-02-2018</ref>
<ref name="FOneQoute">vGroup, "DFA Launch", http://www.vgroupinternational.com/news-and-media/latest-news/dfa-launch, Visited 15-02-2018</ref>

<ref name="ProjectManager">J. Westland, ProjectManager.com, "What Is Project Risk and Why Should You Care?", https://www.projectmanager.com/blog/what-is-project-risk-and-why-should-you-care, Visited 23-02-2018</ref>
</references>

===Further Reading Material===

'''Wikipedia articles'''

*[[Risk management]]

*[[Risk and Opportunities Management]]

*[[W:https://en.wikipedia.org/wiki/There_are_known_knowns|There are known knowns]]

*[[Risk Management in Renewable Energy Projects]]

*[[Risk Register]]

*[[Impact vs. Probability]]

*[[Unknown unknowns]]

*[[Risk identification]]

*[[Including Risk Management in Construction Projects]]

*[[#ISO_31000|ISO 31000]]

'''Books'''
*Chapter 10 in: H. Pearson, "Project Management", ''Pearson Education Limited'', 4th. Edition (2010)
::This chapter is about Risk & Opportunities Management and describes: ''risk matrix, Rumsfeld's Known-unknowns, qualitative and quantitative approaches, sensitivity analysis, PERT technique'' and ''Monte Carlo simulation''.
*ISO, "31000 Risk management — Principles and guidelines", ''International Standard'', (2009)
::The golden standard within risk management, it gives a great overview of definitions and approaches within risk management and is there for a must read.
*Chapter 11 in: Project Management Institute, "A guide to the project management body of knowledge: PMBOK Guide", ''Project Management Institute'', (2000)
::This chapter is about Project Risk Management and describes: ''risk Management Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning'' and ''Risk Monitoring and Control.
*Committee on Foundations of risk analysis, "SRA glossary ", ''Committee on Foundations of risk analysis'', (2015) (Link: http://www.sra.org/sites/default/files/pdf/SRA-glossary-approved22june2015-x.pdf)
::The SRA is similar to the ISO 31000, in the way it gives an overview of definitions and approaches to risk management.
* J. L. Jensen, "Risk & Return - The Economic Red Phone Explained", ''Springer International Publishing AG'' (2017)
::This book attempt to re-define objective risk, and addresses the critical factor of defining a risk owner. It argues for defining risk owner at the lowest possible management level, and the importance of proper risk management.

'''Articles'''
*N.T. Nassim, D.G. Goldstein and M.W. Spitznagel "The Six Mistakes Executives Make in Risk Management", ''Harvard Business School Publishing Corporation'' (2009)
::This article outlines some of the general mistakes managers make when doing risk management, and have some great arguments which managers should take into consideration.