DiPaolo Brittany FPX 5334 4-1
pdf
keyboard_arrow_up
School
Capella University *
*We aren’t endorsed by this school
Course
5334
Subject
Information Systems
Date
Dec 6, 2023
Type
Pages
20
Uploaded by HighnessButterfly11348
Risk Management Plan Project Name: Bausch + Lomb Project Learner Name: Brittany DiPaolo Course Name: FPX5334: Project Risk Assessment and Control Date: November 2, 2023 Table of Contents Sec$on 1 – Introduc$on to the Plan 4 ______________________________________________________________________________
1.1 Benefits of Risk Management 4 _______________________________________________________________________________________
1.2 Project Goals and Objec?ves 4 ________________________________________________________________________________________
1.3 Company Background 4 _____________________________________________________________________________________________
1.4 Risk Iden?fica?on 6 _________________________________________________________________________________________________
Sec$on 2 – Risk Scope, Components, and Value 6 ____________________________________________________________________
2.1 Scope of the Risk Management Plan 6 __________________________________________________________________________________
2.3 Expected Monetary Value 10 _________________________________________________________________________________________
2.4 Determine the Risks 11 ______________________________________________________________________________________________
Risk iden?fica?on techniques involve accessing threats and vulnerabili?es to determine the likelihood of iden?fied threat sources exploi?ng vulnerabili?es and causing one or more adverse events. 11 ___________________________________________________________
Stakeholder interviews, brainstorming, checklists, assump?on analysis, the Delphi technique, and affinity diagrams are some of the tools used for determining risks. 11 ___________________________________________________________________________________________
Stakeholder interviews involve defining specific ques?ons and repea?ng them for every customer. 11 ________________________________
Brainstorming involves gathering team members and other dependent partners and shareholders and holding a brainstorming exercise. 11 _
Checklists involve determining if the company has a risk checklist from past projects and reviewing it. 11 _____________________________
Assump?on analysis involves asking stakeholders to iden?fy their project assump?ons and reviewing them for poten?al risk. 11 __________
The Delphi technique involves a group of experts answering ques?ons to arrive at a group decision. 11 _______________________________
1
The affinity diagram involves brainstorming risks and recording them on a s?cky note. Risks are then sorted into groups or categories and recorded. 11 __________________________________________________________________________________________________________
2.5 Evaluate and Assess the Risks 11 ______________________________________________________________________________________
2.6 Qualita?ve and Quan?ta?ve Processes 11 ______________________________________________________________________________
Sec$on 3 – Risk Analysis and Assessment 12 ________________________________________________________________________
3.1 Major and Minor Risks 12 ____________________________________________________________________________________________
3.2 Risk Probability 14 __________________________________________________________________________________________________
3.3 Risk Matrix Template 14 _____________________________________________________________________________________________
3.4 Risk Data Quality Strategy 15 _________________________________________________________________________________________
3.5 Risk Reviews 15 ____________________________________________________________________________________________________
Risk reviews are a forward-looking technique for monitoring and controlling risk. A risk review helps in modifying the risk response plans and risk management processes to improve the chances of success in the future. It is important to remember that the impact and probability of risk can change over ?me, and therefore, regular review and reevalua?on of the risks is necessary (How to Conduct a Risk, n.d., para. 12). A good cadence for conduc?ng a risk review is shown in the example below. 15 ______________________________________
Sec$on 4 – Correc$ve Ac$on and Monitoring 16 _____________________________________________________________________
4.1 Risk Tolerance 16 ___________________________________________________________________________________________________
4.2 Risk Mi?ga?on 16 __________________________________________________________________________________________________
4.3 Correc?ve Risk Management Strategy 16 _______________________________________________________________________________
4.4 Correc?ve Ac?on Plan 16 ____________________________________________________________________________________________
Sec$on 5 – Postmortem Plan 16 __________________________________________________________________________________
5.1 Results 16 _________________________________________________________________________________________________________
5.2 Follow Up 17 ______________________________________________________________________________________________________
Sec$on 6 – References 17 _______________________________________________________________________________________
6.1 References 17 _____________________________________________________________________________________________________
Templates 18 _________________________________________________________________________________________________
2
Risk Matrix Legend Example 18 __________________________________________________________________________________________
Risk Matrix Example 18 _________________________________________________________________________________________________
Risk Monitoring and Control Example 19 ___________________________________________________________________________________
Cita?ons 20
__________________________________________________________________________________________________________
3
Your preview ends here
Eager to read complete document? Join bartleby learn and gain access to the full version
- Access to all documents
- Unlimited textbook solutions
- 24/7 expert homework help
Section 1 – Introduction to the Plan 1.1 Benefits of Risk Management Effective risk management is a crucial aspect of any project, allowing for efficient handling of project risks, reduction of negative risks, and maximization of potential opportunities. By rating and scoring risks related to staffing, design, budgets, and timelines, project leaders can accurately evaluate potential issues and make informed decisions. The benefits of risk management are numerous, including the ability to rapidly forecast probable issues, avoid catastrophic events, enable growth, stay competitive, improve business processes, and enable better budgeting (Benefits of Risk Management, n.d., paras. 2-12). 1.2 Project Goals and Objectives The project goal and objectives are as follows: - A study team will evaluate the value and risks associated with a no-value-add project. - A feasibility study will be conducted, followed by a design review and evaluation of national and international regulatory compliance. The plan will then be signed off by the project team and senior management. - A realistic project timeline will be created, which will include regulatory clinical trials and filings for devices and pharmaceuticals. - The plan will encompass all pre-product launch testing and training. - The team will adhere to all standardized product development processes, ensuring compliance adherence and quality performance. - Project leaders will follow project management practices and use Microsoft Project program to ensure proper project tracking and management. 1.3 Company Background Bausch + Lomb's website describes the company's mission and vision is to help people see better and live better all over the world.Through unwavering focus rooted in innovation, quality, and craftsmanship, they continue to pursue our lifelong vision of protecting and enhancing the gift of sight through every phase of life (Bausch Lomb, n.d., para. 2). PitchBook, a financial data and software company, reports that as of 2021, Bausch + Lomb employs 12,500 individuals and generated $3,765,000 in revenue. According to PitchBook, the company is headquartered in Laval, Quebec, Canada, and is currently the fourth-largest vision care firm in the United States by sales. Bausch + Lomb is the leading consumer vision care company in India and China. Previously a subsidiary of Bausch Health, the company became a public entity in May 2022. Bausch + Lomb operates in three segments: vision care and consumer (60% of revenue), surgical (20%), and ophthalmic pharmaceuticals (20%). The company is geographically diverse, with 48% of revenue generated in the Americas, 30% in EMEA, and 22% in the Asia-Pacific region (Bausch Lomb General Info, n.d., para. 1). 4
The process begins when a project idea is submitted to the steering team. The team is comprised of senior leadership representatives from marketing, strategy, research, development, engineering, and supply chain. Together, they review all of the ideas and select the most promising ones. In Phase 2, the project is handed over to a study team. This team investigates the project's feasibility, offering a way forward (time and budget) or recommending that the project be dropped. The study team reports back to the steering committee. If approved, the project moves on to Phase 3 - Development/Scale up and then to Phase 4 - Design/
Technology Transfer. During this time, regulatory clinical trials and filling are carried out. The project concludes with a launch at the end of Phase 5. Risks are identified and addressed throughout all stages of the cycle. 5
(Kohli, 2022)
The scope of the project and budget are overseen by the Senior Vice President and Vice Presidents of each business category. Project Directors are in charge of project processes, training, and project management tools. Project Managers determine and negotiate staffing resources and address team performance issues. Finally, project team members provide input on the project by interpreting customer requirements. 1.4 Risk Identification In order to effectively identify risks, a comprehensive approach involving both qualitative and quantitative risk analysis must be taken. The quantitative analysis aspect of risk identification involves gathering and analyzing data as well as utilizing expert judgment. It is important to note that risk analysis is an ongoing process that should be conducted throughout the project lifecycle. To ensure thoroughness, all team members should participate in risk identification, and all identified risks should be recorded in the project risk log. Section 2 – Risk Scope, Components, and Value 2.1 Scope of the Risk Management Plan Risk Management Process Project management requires the clear identification of a project's boundaries. This involves determining the deliverable, the delivery timeline, and the party responsible for acceptance, among other factors. By defining the scope, the project team can distinguish what is not in scope and avoid unnecessary planning. For instance, in the case of an indoor wedding, the weather is out-of-scope. In order to reduce overall project risk, a risk management plan must have a well-defined scope that guides planning, scheduling, and budgeting. When customer design change requests are made after the project's commencement, they should be compared with the original scope as defined in the Risk Management Plan. Out-of-scope changes should not be accepted or postponed until the project's conclusion to avoid impacting the schedule and budget. Accepting out-of-scope changes is called scope creep and is the primary reason for project failure. 6
Your preview ends here
Eager to read complete document? Join bartleby learn and gain access to the full version
- Access to all documents
- Unlimited textbook solutions
- 24/7 expert homework help
There are five basic steps to manage risk as shown in the diagram below (Qualtrics // September 12, 2023) 7
The Risk Management Process begins by recognizing and identifying potential risks and recording them in a risk log and a risk breakdown structure. These artifacts are especially useful after project completion. Once the potential problem is identified, the team investigates the possible consequences and mitigations. After analysis, the project is prioritized, and a solution/mitigation is enacted based on priority. After resolution, the risk is monitored to avoid unintended consequences. Scoping Risk In order to effectively manage risks, Professor Georgi Popov of the University of Central Missouri has identified three essential tools and techniques that should be included in a Risk Management Plan. The first tool is to establish risk criteria, which involves defining key elements such as consequences, likelihood, risk levels, risk acceptability, risk treatments, and combined risk. This initial step helps to guide the rest of the process. Once the risk criteria have been established, safety professionals can then make use of various tools such as risk assessment matrices, failure mode and effects analysis, and risk heat maps to further evaluate the potential likelihood and consequences of identified risks and hazards (Setting the Scope and Limits, 2018, para. 4). These evaluations can be conducted through one of three methods: qualitative risk assessment, semi-quantitative risk assessment, or quantitative risk assessment. After the risk assessment has been conducted, the team must determine an acceptable level of risk. This involves taking into account factors such as the organization's objectives, culture, regulatory requirements, and technology. It is crucial that all stakeholders understand and agree on what constitutes an acceptable level of risk. By following these three essential steps, organizations can create a comprehensive and effective Risk Management Plan. Best Practices In order for a project to be successful, it is crucial for the organization to have clear and effective management practices in place, particularly when it comes to risk management. There are several best practices that can be implemented in order to ensure that risks are identified and managed in a timely and effective manner. Firstly, stakeholder involvement is essential. This includes not only employees and managers, but also clients, subcontractors, and unions. Each of these groups has a stake in the success or failure of the project, and understanding their risk tolerances, ability to respond to risk mitigation, and communication needs is vital for effective risk management. Another important element is the creation of a risk culture within the organization. This refers to the beliefs, attitudes, and values that an organization holds with regard to risk. Encouraging risk awareness throughout the organization can help to ensure that risks are identified and managed at all levels. 8
Effective communication is also key to successful risk management. This involves sharing risk identification up and down the corporation, as well as ensuring that all stakeholders are kept informed of any developments or changes with regard to risks. Clear risk management policies are also crucial. These policies should include clearly defined roles and responsibilities, as well as documented procedures for addressing significant risks. An Incident Response Plan and a Business Continuity Plan can provide a framework for action in the event of a risk event. Finally, continuous risk monitoring is an effective way of identifying and responding to risks as they arise. By keeping a close eye on potential risks, organizations can take proactive steps to mitigate or prevent them, thereby minimizing the impact on the project (PMI, 2017). 2.2 Risk Management Plan Components A risk management plan comprises various unique components that are not limited to the following: Risk strategy, Roles and Responsibility Matrix, Risk Categories, Definitions, Presumptions, Risk Breakdown Structure (RBS), Risk Impact Matrix, Budget, Cost and Schedule, Identify Risks, Perform Qualitative Risk Analysis, Perform Quantitative Risk Analysis, Plan Risk Responses, Implement Risk Responses, and Monitor Risks. These components help in identifying, analyzing, prioritizing, and addressing risks in a project. The Definitions component provides a clear understanding of the terms used in the plan, while the Presumptions component highlights the core assumptions made by the team or project manager. The Risk Breakdown Structure (RBS) component details project risks by category, and the Risk Impact Matrix is a decision-making tool that helps manage risk priority and effort. The Cost and Schedule component analyzes the project schedule and resource allocation required for project completion. The Identify Risks component involves identifying individual project risks and documenting their characteristics. The Perform Qualitative and Quantitative Risk Analysis components prioritize individual project risks for further analysis or action and numerically analyze the combined effect of identified individual project risks and other sources of uncertainty in the overall project objective (Usmani, 2021). The Plan Risk Responses component involves developing options, selecting strategies, and agreeing on actions to address overall project risk exposure and treat individual project risks. The Implement Risk Responses component involves implementing agreed-
upon risk response plans, while the Monitor Risks component involves tracking identified risks, identifying and analyzing new risks, and evaluating risk process effectiveness throughout the project. Finally, the Plan Risk Management component defines how to conduct risk management activities for a project. By incorporating these components in a risk management plan, project managers can minimize the negative impact of risks and increase the chances of project success. 9
Your preview ends here
Eager to read complete document? Join bartleby learn and gain access to the full version
- Access to all documents
- Unlimited textbook solutions
- 24/7 expert homework help
2.3 Expected Monetary Value Project managers use Expected Monetary Value (EMV) as a quantitative risk analysis technique to compare and quantify projects. This technique relies on specific numbers and quantities to perform calculations. Using high-level approximations like high, medium, and low is not sufficient. As a three-step process, the EMV formula requires determining the probability of an outcome, the monetary value or impact of the outcome, and multiplying them to calculate the EMV. If the risk mitigation has multiple possible outcomes, calculate the EMV for each outcome and add them together to get the overall EMV. In most cases, a positive EMV is worth pursuing. When choosing between multiple options, compare the overall monetary value for each potential scenario to determine the best option. There are three risk elements that a project manager must consider: cost, schedule, and quality/performance. Risk identification is critical at the beginning of a project when uncertainty is high, and there are a lot of unknown project details. Issues of time and budget are easy to underestimate. The best risk determination practices include starting early in the project, conducting frequent risk evaluations on a set schedule (weekly), and repeating the process during change control and major milestones. Additional risks can be determined for agile projects during sprint planning, release planning, daily standup meetings, and prior to each sprint. 10
2.4 Determine the Risks Risk identification techniques involve accessing threats and vulnerabilities to determine the likelihood of identified threat sources exploiting vulnerabilities and causing one or more adverse events. Stakeholder interviews, brainstorming, checklists, assumption analysis, the Delphi technique, and affinity diagrams are some of the tools used for determining risks. Stakeholder interviews involve defining specific questions and repeating them for every customer. Brainstorming involves gathering team members and other dependent partners and shareholders and holding a brainstorming exercise. Checklists involve determining if the company has a risk checklist from past projects and reviewing it. Assumption analysis involves asking stakeholders to identify their project assumptions and reviewing them for potential risk. The Delphi technique involves a group of experts answering questions to arrive at a group decision. The affinity diagram involves brainstorming risks and recording them on a sticky note. Risks are then sorted into groups or categories and recorded. 2.5 Evaluate and Assess the Risks A Risk Breakdown Structure (RBS) is a graphical representation that breaks down a project's risks into higher-level categories and sub-levels. It's a useful tool that rolls up all the risk details of a project, making it easier for executive management to have a higher-
level view of the project status. In most cases, a work breakdown structure has three levels, which include project level, work package, and task level. 2.6 Qualitative and Quantitative Processes When it comes to risk analysis, the project team can apply qualitative or quantitative risk analysis techniques. Qualitative risk analysis involves measuring risks' severity based on impact, likelihood, and precision. Risk impact is measured on a scale of 1-5, and likelihood is measured as low, medium, or high. 11
On the other hand, quantitative risk analysis converts the impact of a risk into numerical terms, which can be used to determine the cost and time impacts on the project. The quantitative risk analysis can be broken down into two types: absolute and relative risk. Absolute risk is the odds of something happening over a stated period, while relative risk compares the odds of a risk in two different groups. To evaluate quantitative risk, the team can use Monte Carlo simulation, sensitivity analysis, decision tree analysis, or expected monetary analysis. Other methods for determining risk and contingencies include heuristic methods, probability distribution methods, mathematical modeling, and interdependency models. Heuristic methods use expert techniques to estimate contingency, while probability distribution methods base calculation on predefined statistical distributions. Mathematical modeling methods use theoretical mathematical models, and interdependency models use logical and resource-constrained dependencies between activities to determine contingency. Empirical methods, also known as benchmarking, use historical projects to identify risk factors that drive contingency. Section 3 – Risk Analysis and Assessment 3.1 Major and Minor Risks Project risk analysis is a crucial process that helps to identify and evaluate potential risks associated with a project. In this process, both major and minor risks are identified, and appropriate measures are taken to mitigate them. Major risks are those that have a high probability of occurrence and a significant impact on the project's objectives. These risks require the involvement of the entire project team, as determined by the organizational risk monitoring process. The major risk types can be classified into four categories: scope risk, schedule risk, resource risk, and technology risk. Scope risks are related to uncertain events or conditions associated with the project's scope. These risks can be mitigated by documenting project requirements, setting up a change control process, creating a clear project schedule, and verifying project scope with stakeholders and team members. 12
Your preview ends here
Eager to read complete document? Join bartleby learn and gain access to the full version
- Access to all documents
- Unlimited textbook solutions
- 24/7 expert homework help
(Chai, 2021) Schedule risks pertain to the probability of failing to meet project deadlines. Mitigating schedule risks involves limiting the number of critical paths, and dependencies, and beginning risky activities early in the project. Resource risks refer to the possibility of project failure due to resource shortages. These risks can be mitigated by estimating resource requirements early, cross-training and backfill/
rotation, and anticipating and creating backup plans for other resource needs. Technology risks are potential technology breakdowns that might disrupt business. These risks can be mitigated by improving IT security, securing servers and networks, using viruses and firewalls to prevent intrusion, updating software, offsite backup, and securing passwords. Finally, minor risks are those that have a low probability of occurrence and/or a low impact and are informally monitored without the need for a formal contingency plan. Examples of minor risks include design flaws and omissions, project scope and required changes, starting issues such as poor performance, and materials and equipment delays. 13
3.2 Risk Probability When it comes to risk management, it is important to understand that risks can be classified into two groups: internal risks that are under the control of the company or project team, and external risks that are beyond their control. Examples of risk categories include design risks, organizational risks, project management risks, development risks, external risks, fiscal policies, natural disasters, political instability, economic impacts such as inflation, interest rates, and exchange rates, and global competition. The probability of any of these risks occurring is referred to as risk probability. Risk probability can be evaluated through two common methods: qualitative probabilities and quantitative probabilities. Qualitative probabilities are educated guesses that are made using modeling systems, while quantitative probabilities rely on data and statistics to determine the likelihood of a risk occurring. 3.3 Risk Matrix Template Risk assessment is a critical step in the risk management process. For example, a probability and impact risks assessment for external project constraints can be derived from feedback provided by project participants and contractors based on their experience and opinions. The risk analysis tool compares the likelihood of a risk occurring with its potential impact on the project. 14
3.4 Risk Data Quality Strategy To ensure that data quality is not compromised during the risk assessment process, a risk data quality assessment (RDQA) strategy is employed to evaluate the level or degree to which the data is at risk. The RDQA assesses the data by determining if it is credible, of acceptable quality, accurate, and understood correctly. Failure to perform this step can lead to an incorrect analysis that increases the risk to the project. To evaluate data quality, the project manager asks four questions: Is the data credible? Is the data of high quality? Is the data and/or information accurate? There are four main risk categories to consider in a RDQA. These categories are areas that could potentially go wrong during the planning, implementation, or post-project stages. Each category should be considered in terms of its impact on cost, staffing, inventory, timeline, and reception from customers. The four main risk categories are technical risks (related to software, hardware, or documentation), external risks (such as natural disasters and geopolitical events), organizational risks (related to company structure and culture), and project management risks (related to the culture, interpersonal dynamics, and morale of the project team). 3.5 Risk Reviews Risk reviews are a forward-looking technique for monitoring and controlling risk. A risk review helps in modifying the risk response plans and risk management processes to improve the chances of success in the future. It is important to remember that the impact and probability of risk can change over time, and therefore, regular review and reevaluation of the risks is necessary (How to Conduct a Risk, n.d., para. 12). A good cadence for conducting a risk review is shown in the example below. 15
Your preview ends here
Eager to read complete document? Join bartleby learn and gain access to the full version
- Access to all documents
- Unlimited textbook solutions
- 24/7 expert homework help
Section 4 – Corrective Action and Monitoring 4.1 Risk Tolerance Evaluate the organizational and departmental tolerance for risk. •
Discuss the di
ff
erent risk tolerances within the organization.) 4.2 Risk Mitigation Identify risk mitigation approaches in support of the project. •
How will you implement the mitigation approaches? •
Have you identified specific triggers to initiate mitigation? 4.3 Corrective Risk Management Strategy Describe your strategy for corrective risk management. •
Explain whether you will use auditing, strategic planning, or another type. •
Describe the corrective action process and responsibilities. •
Will you be performing a risk postmortem? If not, why not?) 4.4 Corrective Action Plan Assess corrective plan procedures in support of the project. •
Is your documentation available to others? •
Is it reviewed by the team or others? Section 5 – Postmortem Plan 5.1 Results Identify and describe how results data will be collected and reviewed to determine corrective actions. •
Did your postmortem results lead to any concrete changes? Explain. 16
5.2 Follow Up Evaluate the organization's view of risk management and approach, resulting from project outcomes. •
Did this project change the organization's approach and management of risk? Describe the impact of postmortem results on the organization. Recommend corrective plan procedures to e
ff
ectively manage risk. •
What recommendations would you make for future risk management projects? •
What resources did you use to support your assertions? Section 6 – References 6.1 References Include a minimum of two references in APA style. 17
Templates You may delete this section once you have copied the tables as directed above. Risk Matrix Legend Example If you wish, you may color code risk in addition to using the indicators of high, very high, and so forth. A usual color scheme is green, yellow, orange, red. Risk Matrix Example The risk matrix is a graphical representation of the identified risks and their evaluation in terms of probability (likelihood) of occurrence and impact on project success factors (costs, time, quality) if they should occur. The definitions of risk probability and impact levels are specific to the selected project and reflect risk appetite and thresholds. •
Risk #: Numerical number of risk. •
Risk: Provide a description of the risk (i.e. Weather impacts – storm season). •
Probability: Defines the likelihood that risk will occur (i.e. H, M, L). •
Impact:
Defines the level of impact to project success factors (time, costs, quality) (i.e., H, M, L). Probability Level
Criteria
Code
Impact Level
Very High (VH)
90%
Very High (VH)
Catastrophic
High (H)
< 89% x > 80%
High (H)
Critical
Medium (M)
< 79% x > 70%
Medium (M)
Marginal
Low (L)
< 69%
Low (L)
No Impact
Probability Level
Criteria
Code
Impact Level
18
Your preview ends here
Eager to read complete document? Join bartleby learn and gain access to the full version
- Access to all documents
- Unlimited textbook solutions
- 24/7 expert homework help
•
Response to Risk:
Avoid, mitigate, transfer and accept. •
Action Plan:
A detailed explanation of the steps for risk mitigation(s). •
Person Responsible: Who will manage the mitigation strategy? •
Status: Status of mitigation process. Risk Monitoring and Control Example Risk #
Risk
Probability
Impact
Response to Risk
Action Plan
Person Responsible
Status
Continue Review and Action Plan
Owner
Time Estimate
Monitoring Process [Define monitoring process of current and new risks] Review [Define stages or timeframes for specific types of review]
Reporting [provide types of communication channels and deliverables]
19
Citations Kohli, S. (2022, June 29). 5 stages of the Product Development Lifecycle
. Jam by Sam. https://jambysam.com/5-stages-of-the-product-
development-lifecycle/
Lomb Company Profile: Stock Performance & earnings - pitchbook. (n.d.). https://pitchbook.com/profiles/company/10341-73
MSG Management Study Guide
. 5 Functions of Management: Planning, Organizing, Staffing, Directing and Controlling. (n.d.). https://www.managementstudyguide.com/management_functions.htm
Qualtrics // September 12. (2023, June 28). How to use analytics for risk management
. Qualtrics. https://www.qualtrics.com/blog/risk-management-analytics/
Usmani, F., (2022, October 7). Expected monetary value (EMV): A guide with examples
. Home Page. https://pmstudycircle.com/
expected-monetary-value-emv/
Chai, W. (2021, May 28). What is change control?
. Disaster Recovery. https://www.techtarget.com/searchdisasterrecovery/definition/
change-control
Hall, H. (2022, August 14). How to conduct a risk audit and a risk review
. Project Risk Coach. https://projectriskcoach.com/conduct-
a-risk-audit-and-risk-review/
20