Managing Residual and Secondary Risks

Correct Answer: Revise the risk response strategy and update the risk register

The best approach when a risk response strategy is less effective than planned is to revise the strategy and update the risk register. Here's why: A key principle of risk management is continuous monitoring and adaptation. When a strategy isn't working as intended, the proper response is to: 1. Evaluate why it's not effective 2. Develop improvements to the strategy 3. Document the changes in the risk register 4. Implement the revised approach Why other approaches are incorrect: Documenting and proceeding anyway fails to address the underlying problem and could lead to increased project risks. Continuing with an ineffective strategy while only monitoring it is passive and could allow risks to escalate unnecessarily. Escalating to senior management should not be the first response - project managers should first attempt to address issues at their level through strategy revision.

Correct Answer: A secondary risk that requires additional analysis and response planning

A new risk that emerges as a result of implementing a risk response is classified as a secondary risk. Secondary risks are potential threats or opportunities that arise as a direct result of implementing a risk response strategy. These risks need further analysis and planning to manage their potential impacts on the project. Residual risks are those that remain after risk responses are implemented, not new risks from responses. Triggered risks are those that have actually occurred and require the execution of planned responses, not new risks from response actions. Cascading risks refer to a chain reaction of risks, but this is not the correct term for risks that emerge specifically from implementing risk responses.

Correct Answer: These are risks that remain active after planned responses have been implemented

Residual risks are those that continue to exist after all planned risk responses have been implemented. These risks have been actively identified and assessed, but the organization has decided to accept them, either because the cost of further mitigation would exceed the potential benefits, or because some risks simply cannot be eliminated entirely. Here's why other options are incorrect: The option about secondary risks is incorrect because secondary risks are new risks that arise as a direct result of implementing a risk response. They are different from residual risks. The option about fully mitigated risks is incorrect because residual risks, by definition, are NOT fully mitigated - they still exist after response implementation. The option about unplanned consequences is incorrect because this describes unintended side effects of risk responses, not residual risks. These would be more accurately categorized as secondary risks or emergent risks.