Skip to content

Lab 17 — Risk Response Strategies and Contingency

At a glance

Learning objectives

By the end of this lab you should be able to:

  1. Choose a response strategy for a risk and state precisely what it changes.
  2. Calculate residual exposure after a response, and the cost of achieving it.
  3. Decide whether a response is worth its cost, using arithmetic rather than preference.
  4. Justify a contingency figure to a sponsor who believes risk management is pessimism.

Scenario

This lab uses the Inventory and Supply Chain System from Lab 07: stock levels per item per location across four warehouses, goods in and out, replenishment suggestions, barcode scanning, and a nightly export to the accounting system.

The project is six weeks into a sixteen-week schedule. A risk review has produced six risks. All figures are invented for teaching.

# Risk Probability Impact if it occurs (PKR)
R1 The supplier's stock API enforces rate limits we did not anticipate, so the real-time view falls behind 70% 120,000
R2 Legacy warehouse data is too inconsistent to migrate cleanly, causing rework and manual correction 80% 260,000
R3 The handheld barcode scanners are unavailable in time, so goods-in must be keyed manually 30% 180,000
R4 Only one developer understands the stock-sync engine; their absence stalls the critical path 50% 200,000
R5 Customs documentation rules change mid-project, requiring the export format to be revised 30% 150,000
R6 The cloud region hosting the nightly export is unavailable during go-live week 10% 400,000

Proposed responses, with their cost and their effect on probability and impact:

# Proposed response Response cost (PKR) Probability after Impact after (PKR)
R1 Cache stock data locally and reconcile every minute instead of continuously 30,000 30% 120,000
R2 Profile all four warehouse datasets in week 7, before migration build begins 80,000 40% 150,000
R3 Remove barcode scanning from this release; goods-in is keyed manually, with scanning in phase 2 25,000 5% 180,000
R4 Pair the developer with a second engineer and write the sync design down 25,000 20% 200,000
R5 Accept, with a monthly check of the customs authority's published guidance 0 30% 150,000
R6 Add a contractual availability commitment from the hosting provider and a documented manual export path 40,000 10% 80,000

Constraints:

  • The sponsor has not approved any additional budget for risk responses; the responses must come out of the existing contingency.
  • Unapproved scope is not acceptable — but a documented scope change is, and R3's response is one.
  • The contract with the hosting provider is already signed, though an amendment is possible.

Your role

You are the project manager. The sponsor has said, in a planning meeting, that "risk management is just pessimism with a spreadsheet". Your job in this lab is to produce the arithmetic that answers that remark.

Project information and assumptions

The scenario is part of the example-project library — read the full description there if you want the wider context.

  • Calculate expected exposure as probability × impact. Use the pre-response figures for the baseline and the post-response figures for residual.
  • Response costs are given and are one-off.
  • Assume responses that reduce probability do not also change the impact unless the table says so.
  • Assume the sponsor's comment is a request for evidence, not a refusal.

Tasks

Task 1 — Baseline exposure

Calculate expected exposure for each risk and the total baseline exposure. Rank the risks and state which three dominate the total.

Task 2 — State what each response actually changes

For each of the six responses, state in one sentence:

  1. The strategy it implements — avoid, transfer, mitigate, or accept.
  2. What it changes: probability, impact, or both.
  3. Whether that change is a reduction of the chance or a reduction of the consequence, and why the distinction matters when you explain it to the sponsor.

Two of the six responses deserve particular scrutiny. Identify them, and say what is unusual about each.

Task 3 — Calculate residual exposure

Complete the table:

# Baseline exposure Response cost Residual exposure Exposure avoided Avoided per unit spent

Then total each column.

Task 4 — Decide whether the responses are worth it

Using your totals, answer:

  1. What is the total expected reduction in exposure achieved?
  2. What is the total cost of achieving it?
  3. Is the programme better off? By exactly how much?
  4. Which single response has the best return, and which has the worst? State the ratio for each.
  5. Does the response with the worst ratio deserve to be dropped? Answer carefully — the ratio is not the only criterion.

Task 5 — Set the contingency figure

Two defensible contingency figures exist: the baseline total exposure and the residual total exposure after responses.

  1. State both figures.
  2. Choose the one you would request, and justify the choice in three or four sentences.
  3. State the relationship between the response costs (which are spend now) and the contingency figure (which is held in reserve). Do they overlap? Explain.
  4. State what the contingency is not for, and name the separate reserve that covers that.

Task 6 — Handle the two awkward risks

R5 is accepted. Write the justification for accepting it, including the trigger you will check and its cadence. Then state what you would do if the trigger fires.

R3 is mitigated by removing scope. Write the change request entry for it: what is removed, what replaces it, the impact on the release, and who must approve it. Then state what would happen if you simply did not build the barcode support without telling anyone.

Task 7 — Answer the sponsor

Write a reply of no more than 200 words to the remark that "risk management is just pessimism with a spreadsheet". Use at least three numbers from your own work, and make one point about what happens to a project that carries no reserve at all.

Deliverable

  1. The baseline exposure table with the total and the dominant three.
  2. A statement per response of strategy, what changes, and chance versus consequence.
  3. The residual exposure table with avoided-per-unit-spent.
  4. The worth-it analysis with all five answers.
  5. The contingency decision, with both figures and your justification.
  6. The R5 acceptance and the R3 change request.
  7. A 200-word reply to the sponsor.

Hints and guidance

  • Avoid, transfer, mitigate, accept — pick one per risk. "We will monitor it closely" is not a strategy; it is a trigger.
  • Avoidance changes the plan; mitigation changes the probability or impact. R3's response avoids the risk by removing the scope, which is a real and legitimate choice — and it must go through change control.
  • Transfer moves the consequence, not the activity. R6's hosting amendment only transfers if the provider accepts a financial consequence, and you must say what it is.
  • Accept is not neglect. An accepted risk has a trigger and a cadence, or it is simply an unmanaged risk.
  • Contingency and response cost are different money. Response cost is spent now to reduce exposure; contingency is held for what remains.

Self-check criteria

Check How to verify it
Baseline exposures correct 84,000 · 208,000 · 54,000 · 100,000 · 45,000 · 40,000, total 531,000
Each response has one strategy No row has two labels or none
Chance versus consequence is distinguished Each row says which one changed
Residual exposures correct 36,000 · 60,000 · 9,000 · 40,000 · 45,000 · 8,000, total 198,000
Avoided-per-unit-spent shown Exposure avoided ÷ response cost for each row
Contingency choice justified One figure selected, with reasoning, not both
R3 has a change request Scope removal documented, with an approver
Reply uses real numbers At least three figures from the lab appear

Reflection

  1. One response has an infinite return because its cost is zero (R5, acceptance). What does that tell you about the limits of return-on-investment as a way to choose responses?
  2. R2's response costs 80,000 and reduces exposure by far more than that. Why might a project manager still be refused the money?
  3. You reduced exposure from the baseline to the residual. What happened to the risk that the responses themselves are wrong?
  4. Which single assumption in this lab, if false, would most change your contingency figure?
Check your numbers

Baseline exposure

Risk Calculation Exposure
R1 0.70 × 120,000 84,000
R2 0.80 × 260,000 208,000
R3 0.30 × 180,000 54,000
R4 0.50 × 200,000 100,000
R5 0.30 × 150,000 45,000
R6 0.10 × 400,000 40,000
Total 531,000

Residual exposure

Risk Calculation Residual Avoided Cost Avoided per unit spent
R1 0.30 × 120,000 36,000 48,000 30,000 1.60
R2 0.40 × 150,000 60,000 148,000 80,000 1.85
R3 0.05 × 180,000 9,000 45,000 25,000 1.80
R4 0.20 × 200,000 40,000 60,000 25,000 2.40
R5 0.30 × 150,000 45,000 0 0 —
R6 0.10 × 80,000 8,000 32,000 40,000 0.80
Total 198,000 333,000 200,000

Spend 200,000 to reduce expected exposure by 333,000 — a net position 133,000 better off, with roughly 198,000 still held as contingency for what remains.

Full working is in the Advanced labs answer key.

Extension challenge

Rebuild the contingency using a Monte Carlo-style simulation by hand: assign each risk a probability, simulate twelve project outcomes by drawing from the six risks, and record the total cost in each. Then compare your simulated worst case with the deterministic total of all impacts (1,310,000) and explain why a project that budgets for "everything goes wrong" is not being prudent but is instead mis-allocating. State which single risk dominates the tail of your distribution.