Managing Successful Programmes (MSP) provides 8 responses to programme-level risks. These are split into two different types: responses to threats, and responses to opportunities. Let’s look at each in turn.
Responses to Threats
Reduction
This response reduces the probability of the programme-level risk occurring, or the impact it has if it does occur. Remember, a risk is something that hasn’t happened yet. The Reduction response seeks to minimise the chance that it will negatively impact the programme.
Removal
This response tries to remove the risk completely. This is the same Removal response as you would consider with a project-level risk. At programme level this action is normally something like changing the programme’s scope, changing a supplier, or changing the sequence of projects or tasks.
Transfer
This is where a third party takes ownership of the threat and it is they who mitigate against the risk occurring. Again, this is another one you will have come across at project level. At programme level, you can’t transfer the risk to another internal department. It’s still company money at stake at the end of the day, so you can only use the Transfer response when moving the risk outside of the organisation. A typical action for the programme manager would be to set up an insurance policy, for example.
Retention
This response is where the programme team agree to keep the threat of the risk. This may happen where it is makes financial sense to do nothing rather than spend a lot on mitigating actions. However, the Retention response should always be a conscious decision, not the default because the programme team forgot to do any active risk management. Remember to keep monitoring the risk if you choose this option, in case it changes or in case it becomes more economical to act in a different way.
Share
This is something that you wouldn’t necessarily do at project level, but at programme level it becomes an appropriate risk response. With large contracts you have the option to split the risk sharing through contract terms. For example, you may agree to split the pain if the risk occurs, but split any benefit if it doesn’t. Risk sharing clauses are becoming more common in contracts, so the Share response could be something worth considering, especially in software development or construction programmes.
Responses to Opportunities
An opportunity is a positive risk. Project managers have ignored positive risks for too long, tending to only focus on all the bad things that can happen on projects. It’s even more important on programmes to look for opportunities, and then learn how to capitalise on them if they occur.
Realisation
This response involves identifying an opportunity and acting on it. For example, if the programme identifies that a small change could result in finishing a project early, investigate the benefits that this would bring and consider adopting the Realisation response to make that opportunity happen. Opportunities differ from threats in that you actively want them to happen, rather than actively mitigating against them.
Enhancement
This response looks at how you get the best out of an opportunity once you have found it. It can be hard to find, realise and then enhance an opportunity (harder than mitigating against a threat in some cases) but at programme level it really is worth trying to eke out all the potential benefits.
Exploitation
This response involves making changes to the programme in order to gain benefits without changing the programme’s objectives or specification. For example, the programme manager could consider changing the scope or the main supplier. A supplier who offers better payment terms or a discount would provide a benefit to the programme as a whole, while making sure that the original specifications are met.