INFO6007 Chap.8 Risk Analysis, Ownership and Responses
Risk Analysis, Ownership and Responses
This chapter writes actionable cause event effect risk statements, analyses probability and impact, chooses responses and monitors triggers. Qualitative scores help prioritise attention, while quantitative techniques such as expected monetary value compare financial exposure. A risk register remains useful only when owners can act before triggers and update residual exposure as the project changes.
Identification draws on workshops, interviews, assumptions, lessons and project documents so technical, commercial, schedule, security and adoption uncertainty become visible. Probability and impact matrices support judgement but do not replace urgency, proximity, interdependence or data quality. Threats may be avoided, mitigated, transferred or accepted; opportunities may be exploited, enhanced, shared or accepted.
Each response needs action, owner, timing and an observable trigger. Expected monetary value multiplies probability by impact and supports comparison without predicting an exact outcome. Monitoring checks response completion, residual and secondary risk, assumptions and whether an uncertain risk has become a current issue requiring immediate action.
What this chapter covers
- 01
Risk identification techniques
- 02
Cause event effect statements
- 03
Qualitative probability and impact
- 04
Expected monetary value
- 05
Threat and opportunity responses
- 06
Owners and triggers
- 07
Monitoring and residual risk
- 08
Write a specific cause, uncertain event and objective impact before assigning probability and consequence ratings
- 09
Separate inherent exposure from expected residual exposure after the planned response has been implemented
- 10
Use expected monetary value to compare quantified alternatives while acknowledging risk appetite, tail severity and non-financial harm
- 11
Assign a risk owner with authority over exposure and an action owner for each response commitment
- 12
Define an observable trigger, due date and contingency so monitoring detects when assumptions fail or risk becomes an issue
- 13
Review secondary risks created by the response and update exposure whenever project assumptions materially change
Worked example · free
Control a certification dependency
- +1Write the cause event effect statement.
- +1Assess probability and impact.
- +1Begin evidence review early as mitigation.
- +1Set a dated evidence trigger.
- +1Assign owners and retain residual risk.
Key terms
- Risk owner
- The person accountable for monitoring a risk and ensuring the agreed response is carried out.
- Risk trigger
- An observable condition that signals response or escalation should begin.
- Expected monetary value
- Probability multiplied by financial impact, with threats represented as negative values and opportunities as positive.
Risk Analysis, Ownership and Responses FAQ
How do I write a useful risk statement?
Write the cause, the uncertain event and the effect on a project objective. This structure supports analysis, response design, ownership and monitoring more effectively than a vague category.
Is a risk matrix enough for prioritisation?
No. Probability and impact scores support discussion, but urgency, proximity, interdependence, data quality and the ability to act can change the proper management response priority.
When does a risk become an issue?
A risk is uncertain. Once the event has occurred, it becomes an issue requiring immediate action, current impact assessment, escalation where necessary and connected baseline updates.
Exam move
Rewrite every vague risk label into cause, uncertain event and effect on an objective. Use workshops, interviews, assumptions, lessons and document review to find different uncertainty, then avoid an unowned catalogue by grouping only where common action makes sense. Analyse probability and impact, but also consider urgency, proximity, interdependence, data quality and ability to act.
A matrix supports judgement rather than making the response automatically. Practise threat responses precisely: avoid removes the source or exposure, mitigate reduces probability or impact, transfer reallocates consequence while accountability often remains, and accept deliberately monitors without more preventive work. Add opportunity responses such as exploit, enhance, share and accept.
Every response needs an owner, action, due point, trigger and residual-risk view. Record secondary risks created by the response. For quantitative work, multiply probability by impact with threats negative and opportunities positive. Explain that expected monetary value helps compare uncertain choices or analyse reserve; it does not predict that the average amount will occur.
Build one decision tree with mutually exclusive options and check probabilities before calculating. Distinguish risk from issue: a risk remains uncertain, while an issue has occurred and requires current action and impact assessment. Review the register when assumptions change, milestones approach, responses complete or new information arrives.
Connect material risks to contingency, schedule, procurement, quality and governance. On the notes sheet, keep the cause-event-effect structure, response families and EMV sign rule. In a case answer, write the risk clearly, justify analysis, choose a response that changes exposure before the trigger, assign ownership and state what remains. This demonstrates control rather than merely naming a risk category.
Working through Risk Analysis, Ownership and Responses in INFO6007? Sia is AskSia’s AI Project Management tutor — ask any INFO6007 Risk Analysis, Ownership and Responses question and get a clear, step-by-step explanation grounded in how INFO6007 is taught and assessed. Read this chapter free, then take your hardest questions to Sia.