Level 4: Managed Process

All documented processes are utilized for most projects. Management is actively engaged in organization wide risk management. Risk systems are fully integrated with time, cost, and resource systems. Staff members are mandated to comply with the organizational risk management processes and procedures.

Risk Management Planning

Risk planning and risk management are mandatory for all projects. The level of detail required is tailored to the size and type of project and also the organizational environment.

Expert judgment and project archives are used to develop risk management plans.

Individual risk management plans are integrated with program and portfolio risk planning.

Risk Identification

All documented processes are utilized. Hie risk identification process is fully integrated with cost management and time management processes and with the PMO. A conscious effort is made to identify total project risks within individual projects and integrated risks found in relevant programs and portfolios. In other words, risks are identified with the organization and project or program in mind.

Qualitative Risk Analysis

All documented processes are utilized. Hie qualitative analysis of risk includes information about potential impacts on cost management, time management, finance and accounting systems, and strategic planning processes. Risks are evaluated for their effects on the project and their potential effects on the organization.

Quantitative Risk Analysis

All documented processes are being utilized. Hie risk quantification process is fully integrated with cost management, schedule management, finance and accounting, strategic planning, and the PMO. Risk quantification considers the risks from other projects and other parts of the organization. Risks are evaluated for their effects on the project and their potential effects on the organization.

Hie organization has established criteria to measure the effectiveness of its risk management program. Risk models and risk modeling software is typically used for strategic and complex projects.

Risk Response Planning

All documented processes are utilized. Hie risk response development process is fully integrated with cost management, time management, finance and accounting systems, strategic planning processes, and the PMO.

Risk Response Implementation

The risk response results are fully integrated with cost management, schedule management, finance/accounting, and strategic planning processes.

Risk Monitoring

All processes are documented and utilized. Tire risk control system is integrated with the organization’s other control systems, monitoring programs, and cost and time management programs. The organization is collecting historical information such as common risk items and risk triggers and organizing the information in the historical database.

Adaptive/Agile Environments

Ownership—Ownership is evident and managed in cross dependent agile teams.

Reviews—Tire organization is using team performance data to improve risk management.

Level 5: Optimizing Process

Improvement processes are utilized to ensure projects are measured and managed continuously against value-based performance metrics. Lessons learned are regularly examined and used to improve documented processes. Projects are managed with consideration of how similar projects performed in the past.

Risk Management Planning

Value and improvement are key considerations when developing risk management plans. The plans include provisions for measuring the derived value of risk management. Lessons learned related to planning processes are recorded, disseminated, and used to improve practices.

Risk Identification

A process is in place to continuously improve risk identification by identifying all risks as completely and as early as possible.

Lessons learned are captured and used to improve risk identification activities. Risk identification involves identifying organizational priorities for projects. The priority designator is linked to management decisions and gives project teams the ability to set priorities for their risk concerns.

Qualitative Risk Analysis

A process is in place to continuously improve the risk response development process and devise risk management plans.

Lessons learned are captured and used to improve the development of strategies for identifying risks.

Quantitative Risk Analysis

A process is in place to continuously improve risk responses and develop risk management plans. Lessons learned are captured and used to improve the identification and handling of risks. Use of project reserves is included in the determination of project efficiency and effectiveness. A process for tracking the use of project reserves supports management decisions during project execution.

Risk Response Planning

A process for tracking the use of project reserves is in place and supports management decisions during project execution. Project reserves are included in determinations of project efficiency and effectiveness. Lessons learned are captured and used to improve methods for identifying risk/opportunity strategies.

Risk Response Implementation

Lessons learned are gathered and used to improve risk response activities like any other project management process.

Risk Monitoring

A process is in place to continuously improve the risk control process. A documented process utilizing risk assessments and current risk status data aids management decisions during project execution. Lessons learned are captured and used to improve the monitoring and control efforts. Risk assessments are incorporated and included in determinations of project efficiency and effectiveness.

Adaptive/Agile Environments

Ownership—The organization continually improves risk management through lesson learned and performance measures.

Reviews—Tire organization continually improves Risk Reviews through lesson learned and performance measures.