SKIL90004 Chap.6 Risk Analysis and Response
Risk Analysis and Response
Risk management turns uncertainty into an owned and reviewable control. This chapter writes cause-event-impact statements, uses project-defined likelihood and consequence categories, distinguishes inherent from residual exposure and matches threats with avoidance, mitigation, transfer or acceptance. It also separates mitigation from contingency and keeps ethics, triggers, ownership and response effectiveness visible.
A response must change the exposure named in the risk statement; a label alone does not reduce probability or consequence. Residual exposure is reassessed from evidence rather than lowered because an action was assigned. Observable triggers connect uncertainty with contingency, while realised events move into issue management.
Reviews preserve assumptions, secondary risks, response cost, tolerance and the authority accepting what remains.
What this chapter covers
- 01
Risk statements
- 02
Identification techniques
- 03
Likelihood and consequence
- 04
Qualitative matrices
- 05
Inherent and residual exposure
- 06
Response strategies
- 07
Contingency triggers
- 08
Risk review
Worked example · free
Respond to a temperature-control risk
- 1Write the cause, uncertain event and project impact.
- 1Assess likelihood and consequence using defined project categories.
- 1Mitigate with logging and a hand-off check, while retaining a replacement contingency.
- 1Assign an owner, observable trigger and review cadence.
Key terms
- Risk statement
- A Risk statement links a cause, uncertain event and effect on a project objective.
- Risk matrix
- A Risk matrix compares likelihood and consequence using categories defined for the project or organisation.
- Risk owner
- A Risk owner is accountable for monitoring exposure and coordinating the agreed response.
- Residual risk
- Residual risk is the exposure expected to remain after the response operates.
- Contingency plan
- A Contingency plan defines action taken when a specified trigger shows that an event has occurred or is imminent.
- Risk tolerance
- Risk tolerance describes the exposure an authority is prepared to accept within defined conditions.
Risk Analysis and Response FAQ
How should a project risk be written?
Use a cause-event-impact statement. Name the condition creating uncertainty, what may happen and which objective would be affected. This wording suggests evidence, ownership and possible responses.
Is a coloured risk matrix universal?
No. The captured workshop stresses project or organisation definitions. Likelihood, consequence and response thresholds need explicit meaning; colour alone does not establish a universal numerical risk value.
What is the difference between mitigation and contingency?
Mitigation acts before the event to reduce likelihood or consequence. Contingency is the planned action taken when a trigger shows that the event has occurred or is about to occur.
Exam move
Write five risks from fresh scientific scenarios and refuse vague category labels. For each, define evidence for likelihood and consequence, choose a response that changes the named exposure, assign an owner and write a trigger. Review what remains after the response and whether the action creates a secondary risk. Begin by rewriting categories into cause-event-impact statements.
Replace equipment risk with a condition about shared calibrated equipment, an uncertain loss of access and a consequence for a validation milestone. Replace stakeholder risk with a specific approval or adoption event and its effect. Score only after defining the likelihood and consequence categories for the project. Record the evidence behind each judgement and the confidence attached to it.
Compare a historical frequency, an expert estimate and a supplier promise so you learn to state evidence quality rather than hiding it behind a colour. Select response strategies by mechanism. Avoidance removes the exposure from the chosen plan. Mitigation reduces probability or consequence. Transfer moves some responsibility or financial effect but may leave operational delay.
Acceptance keeps exposure within tolerance and still needs monitoring or contingency where appropriate. For each mitigation, explain exactly what changes. A data logger may improve detection and response time without reducing the physical probability of an excursion. Write inherent and residual assessments separately, and do not lower the second merely because an action appears in the register.
Add an owner, completion date, observable trigger and review date. Distinguish mitigation from contingency by timing: the first acts before the event, while the second activates at a trigger. Convert a realised event into an issue and revise forward-looking risks rather than continuing to score an event that has already occurred. Check ethics and tolerance where consequences affect people or scientific validity.
End practice by testing whether the response cost, secondary risks and residual exposure remain acceptable. A complete recommendation names the uncertainty, evidence, chosen mechanism, owner, trigger, contingency and approving authority. Run a weekly review simulation. Introduce one new risk, one changed assumption, one completed response and one realised issue.
Decide which entries are rescored, escalated, closed or transferred. Demand evidence before closure and preserve lessons about which triggers gave enough warning. This exercise shows that the register is a decision system that changes with the project, not a static list prepared for approval.
Working through Risk Analysis and Response in SKIL90004? Sia is AskSia’s AI Project Management tutor — ask any SKIL90004 Risk Analysis and Response question and get a clear, step-by-step explanation grounded in how SKIL90004 is taught and assessed. Read this chapter free, then take your hardest questions to Sia.
