Complete the last section of your RMP, the Risk Treatment plan

Using the RMP template that you have been using for the last two weeks, work with your supervisor and complete the last section of your RMP – the Risk Treatment Plan by midnight Friday night.

Details of fields in the RMP Risk Treatment plan are described in this week’s seminar

1. Complete the last section of your RMP, the Risk Treatment plan

There are five columns to be completed in the Risk Treatment Plan:

1. Treatment Strategy,
2. Treatment Description,
3. Treatment Resources,
4. Risk owner, and
5. Deadline

A. Treatment Strategy

This is the risk response that you will apply to the risk. You will recall from week 6 that there are only 4 possible risk responses:

Avoidance

Changing the project plan (e.g. the scope statement, the schedule, etc) so that a particular risk can’t happen.

Typically this means removing something from the scope of the project to completely remove the risk, so it is 100% impossible. E.g. you have to produce website that will display on Windows Internet Explorer, Firefox, Chrome and Opera. There is a big risk that Opera will not display it correctly, so you remove “Opera” from the scope statement. Now that risk cannot happen.

Mitigation

Taking action to reduce the likelihood and/or the impact of an identified risk. E.g. there is a risk the project might be late because the team has not much expertise with SharePoint. You can mitigate the risk by providing training to the team and/or contracting a SharePoint specialist.

Transference

Paying someone to take the risk on your behalf (usually outsourcing or purchasing insurance)

Note that to transfer a risk, you must transfer it OUTSIDE the company. You can’t transfer to another team, or transfer by employing experts, because the company still owns all the risks of its employees.

Acceptance

You simply decide that you will accept the consequence of the risk if it occurs. This may be because you think:

• There’s virtually no chance of it happening (e.g. a major earthquake in London), or
• The impact would be negligible,
• It is too expensive to deal with (e.g. the cost of insurance may be more than the impact of the risk event), or
• You simply have no idea what you would do!

When you accept a risk, you don’t have to do anything further. If you try to plan anything for this risk then it becomes a mitigation.

B. Treatment Description

Having selected the strategy, this field is where you enter the details of how this strategy will be implemented.

C. Treatment Resources

People, equipment, budget, etc required for this strategy.

D. Risk Owner

The risk owner is the person responsible for ensuring that the risk strategy is put in place, and is also responsible for checking that the risk is dealt with according to the plan, if the risk occurs. This person may not be the same person who actually treats the risk. For example, the IT Manager may be the risk owner for the risk “Some laptop computers may be offsite and not upgraded”, but it will not be the IT Manger who actually recalls and checks each laptop, that is a task for a technician.

E. Deadline

Enter the date when the strategy has to be finalised (e.g. of the strategy is to buy insurance, then this will be the date that the insurance has to be purchased.

and just answer these questions

CSR Analysis of your project

Examine your project and then answer the following three sets of questions. You will probably need your supervisor to assist you.

The principles:

Principle of institutional legitimacy

Would the technology I develop be welcomed by society?

Principle of public responsibility

Is the benefit greater than the risk?

Principle of managerial discretion

Is my work and behaviour ethical and socially responsible?

The processes:

Environmental assessment

Have I asked the right questions?

Stakeholder management

Have I asked the right questions of the right people?

Issues management

Have I been thorough in thinking this through and prepared as well as I can?

The outcomes:

Social Impacts

Will the software/services I provide work to benefit the company and society?

Social programs

Does the software/services take into account all relevant legislation and compliance requirements?

Social policies

Can I take my knowledge into the community to enhance the reputation of my company and support the community in which my company operates?