7. RISK MANAGEMENT  

7.1 General principles 

Risk management in the ERA_FABRIC project has the overall objective of assuring: ∙ timely execution of project tasks, milestone achievements and reporting delivery, 

∙ avoidance of defaulting situations by early identification of risks and proposal for their  mitigation; 

having in mind that timely awareness and consequent reactions to potential problems are  crucial for a smooth project implementation. 

The approach to risk management consists of the following five steps: 

1. risk identification, the main goal of this step is to uncover risks before they actually  arise; 
2. risk assessment, risks identified in the previous step are assessed taking into  account the probability of occurrence and the level of severity; 
3. potential risk treatments, for each identified and assessed risk, possible risk  treatments are proposed; 
4. detailed risk management plan, risk management plan consists of a description of  risks, assessment and treatment procedures, risk indicators, appropriate mitigation  measures and respective responsible persons; 
5. risk reviewing and continuous evaluation, risk management plan is reviewed  along the entire course of the project. 

Is assumed that Project management will include a continuous monitoring of risks (of both  internal and external origin) focusing on all factors that are critical to the success of the  project. The risk management plan starts form the preliminary analysis carried out during the  project proposal elaboration and included in Part A at the “ List of Critical risks” paragraph. 

7.2 Risk identification procedures 

Risks should be reported by any partner as soon as detected: the earliest a risk is detected  the easiest will be minimizing its impact. 

Partners are invited to submit risks anytime using the Risks Identification Table that will be  available in the internal collaboration platform containing the following information fields: 

• • Nature: this field indicates which type of category the risk belongs to. One or more of  the following categories must be selected:
    
    • Formalisation: risks related to a bad definition of requirements, bad  interpretation of data and / or a lack of inclusion of experts and reference  entities;
    • External: risks related to external inputs, data, technologies, introduction of  new laws of European or national scope, governance framework. Legal  issues will be classified under this category;
    • Organizational: risks related to general workflow of the project;
    • Technical: risks related to technical aspects of the project such as expected  inputs for a certain work package needed earlier than defined in the project  schedule.
  • Description of the risk: this field is used to establish the border conditions of the  risk. Partner has to explain in detail: the risk origin, the trigger for the risk to become  a reality and the risk that the Project is facing;
  • Affected WPs: WPs affected by the possibility of the risk to happen; ∙ Observation period: estimation of the time span in which the risk may arise; 
  • Likelihood: a quantitative evaluation of the probability of the risk to concretize during  the Project; 
  • Severity / Impact: a quantitative evaluation of the effect of the risk on the Project  should it happen; 
  • Risk factor: a comprehensive quantification, both in terms of likelihood and impact,  of the importance of the risk for the Project management; 
  • Proposed mitigation action: this field is used to define the proposal of actions to be  undertaken in order to mitigate the probability of occurrence of the risk and its  eventual impact. 

The Risk report must be submitted to Coordinator and Affected WPLs.

7.3 Risk analysis procedures 

After the submission of the risk, Affected WPLs (involving TL if considered relevant) are  asked to place comments on the risk submitted, especially about the quantification of the  likelihood and impact. The quantification of project risks is performed considering the most  likely outcome scenario for all identified risks. This procedure encompasses the definition of  values for:  

• • Likelihood measurement: this measurement describes the perception of the  probability that the selected risk affects the project in an estimated amount of time  (observation period). This information will be used by the relevant WPL and the  Project Coordinator for prioritizing the actions that will help to mitigate the risk.  Possible values of this field are:
    • 5. CERTAIN: is affecting / will affect the project;
    • 4. PROBABLE: not certain, but is likely to affect the project.
    • 3. POSSIBLE: could affect the project 
    • 2. UNLIKELY: will probably not affect the project
    • 1. VERY UNLIKELY: virtually certain not to affect the project.

• • •  
  • Severity/Impact Measurement: this measurement describes the perception of the  impact if the risk were realised. Possible values of this field are:  
  • 5. EXTREME Catastrophic effect – the majority of targets will not be met  across the project;
  • 4. MAJOR relevant effect on project performance –-critical targets will be  missed;
  • 3. MODERATE Moderate effect on project performance – local performance  targets will be missed;
  • 2. MINOR Minor effect on project performance – limited effect on targets;
  • 1. NEGLIGIBLE Insignificant effect.<
    •  
• Risk factor: the result of multiplying Likelihood and Severity gives as result a number  from 0 to 25 (Risk factor) that enables to prioritize the risk importance. 

7.4 Risk management procedures 

This part of the process of risk management is aimed at defining and put in place a risk  management plan containing appropriate measures to avoid, mitigate or accept the risks.  

Three possible policies can be applied in order to deal with risks: 

• Avoid the risk: some risks may be avoided with an adjustment to the project  schedule or approach; 
• Mitigate the risk: the majority of risks will need a mitigation action to manage them  and try to minimize their impact in the project development. If this strategy is chosen,  then it is necessary to define and describe the mitigation action for managing that  risk. That implies making considerations and detailing when those actions will be  executed and by which partner(s). 
• Accept the risk: a very small number of risks will be accepted. The acceptance of a  risk means that all the actions that can be applied to minimize the impact are more  expensive in time and resources that accepting the consequences of that risk. 

The risk mitigation strategy with specific tasks must be managed as any other project task.  This includes securing the resources, assignment to individual project team members,  motivating the involved project team members, overseeing and controlling the execution of the tasks and finally measuring and reporting the progress of risk mitigation. A mitigation  plan foresees the description of:  

• actions;
• time schedule of that actions;
• responsible partners for those actions, ie identify a leader to manage the risk. 

The final definition of the risk management plan will be made by the risk management board,  that is defined, according to the relevance of the Risk Factor as follows:

If Risk factor is lower than 5: Coordinator and Affected WPL 
For Risk factor between 5 and 9: WPLs Board 
For Risk factor between 10 and 25: Steering Committee 
The risk log is handled by Task 1.3 Leader: UNIST.