Body of Knowledge Refresh 2011:
Wednesday 20 April 2011 all day session
Review Group: Risk Management including:
3.5 Risk Management v0.2 preferred version v0.1 preferred version – like ‘proactively managed’ –
didn’t agree with plan and implement risk in v0.2 version
3.5.1 Risk Context
3.5.2 Risk Techniques
Group 1 comments in this colour
Group 2 comments in this colour
General thought: should we be defining/elaborating at the portfolio end first then to project i.e. in
reverse to set macro first – perhaps for consistency top level.
Refresh programme team comment: the question on ordering has been through 2 rounds of
consultation, and it has been widely agreed that the format should be project/programme/portfolio.
General thought: could we either have a pointer to the definition of risk or we believe it is
structurally important to have an APM definition of risk prior to this section. For review purposes
can we also see what will be under the ‘risk’ definition?
Refresh programme team comment: the definitions will be per version 5 unless highlighted
specifically by the authors (which is not the case for ‘risk’).
Group 1 joint responses to question 10:
1. Need rewrite – common to all.
To be rewritten in a structured way and in an appropriate style
2. Revised text changes so much – needs to have 2 catch up reviews – whatever format and at
least one physical review.
3. PRAM guide risk defined at 2 levels
– overall risk
- Individual risks
This is not covered but not consistently reflected in all 3 sections – should be certainly in 3.5
Interested to learn action as a result of this – wants assurance, even if writer has to be
contracted and paid.
3.5 Risk Management
1. Definition of good practice:

‘The knowledge and practices

described are applicable to most
projects most of the time, and
…there is widespread consensus

about their value and usefulness’.
A Guide to the Project
Management Body of Knowledge
(PMBoK®Guide) Third Edition, ©2004
Project Management Institute
Not good practice – not enough detail.
Comments haven’t been looked at – volunteers
are cross as a waste of busy time. Another
author needs to be brought on.
No response received from facilitator
Does the draft reflect good practice?
2. Are they pan-sector?
a. Does the content avoid
industry/sector bias?
b. Is the content scalable
(taking into account the
range of
projects/programmes/portf
olios from small to large,
and the range of
complexity)?
Definition of pan-sector:
Generic, non industry specific content that
can be applied regardless of industry or
sector.
3. Do any key concepts
relating to the
section need to be
added?
a. Definition
b. General section
c. Project content
d. Programme
content
e. Portfolio content

o
o
o
o

















Yes but not good.
Doesn’t show difference between project,
programme and portfolio.
 PMO – only for large organisations and therefore
not scalable.
 Doesn’t align with current practice of
projects/portfolios.
 Programme and portfolio is emergent.
 Not best practice.
 Too difficult for trainers.
 x P30 tools – not scalable.
 Should sit above the PRAM guide albeit PRAM
just about projects.
 A – yes, B – scalability not covered at all. RM
should be tailored to the complexity and
context.
General – for all sections.
All needs a complete rewrite. All 1st draft comments need to be
incorporated.
Concern that the consistency authors need risk expertise. Need a
new author to re-write immediately.
Recommend that a risk specialist sits with consistency authors; this
needs at least 2 consistency reviews.
General should follow on sections.
A. is cumbersome. Could be punchy.
A. wordsmith: 2nd sentence. Choose the right phrase for ‘objectives’
that encapsulates the 3 levels – or objectives defined within each
section and not mention overall definition.
A. Use standing definition in v5 with deletion of term ‘project’.
A. Give definition of risk (from PRAM) then follow on definition of
risk management (but some concerns on definition of risk – not just
event)
B. Should be separate from project section.
B. Has to be generic.
B. Use same structure as programme.
B. Do not use Oxford English Dictionary definitions.
B. Yes good to use generic diagram but use simplified diagram with
thick lines.
B. This diagram doesn’t list programme and portfolio.
B. There is an opportunity to develop a new model to show where
this sits.
B. Show this process applicable to all levels but another level –
macro for programme and portfolio.
B. The process has to be described but put in context of the next
levels.
B. Words like ‘nesting’ ‘emergent’
B. The process has to have a mixture of verb/noun statements – add
Page 2 of 11






























‘initiate process’, ‘identify risks’ and ‘assess risks’.
B. Message – not about ticking the box but more about managing
B. More of risk appetite/risk attitude – needs appropriate emphasis
on softer elements of risk management e.g. people/culture.
B. Refer to v5 – very good.
B. Should align with ISO31000 – use same language.
B. Language is really terrible.
C. can discuss objectives.
C. How generic process applies within a process.
C. Pull out elements of project from generic section.
D. Not apparent that the author understands programme within
APM definition.
D. No business as usual.
D. Need a sentence of amplification to programme definition.
D. Expand what we do in context of programmes for risk.
D. Add strategic risk.
D. Need to show what is different to project risk.
D. Define corporate side of risk (or is this portfolio?)
D. Good to refer to criteria/escalation.
D. Guidance to writer – need to show the scalability impact of
programmes.
D. How does risk link to programme definition – show how it does in
relation to the 4 parts of the definition:
o Write 4 paras to relate to each (related programmes,
business as usual, beneficial change, strategic nature).
o More generic conclusion on elements in para 1
o 1. Governance and 2. scalability (communication) and
reporting 3. Escalation.
o ‘A small number of key conclusions…for example…’
D. Need to amend term ‘risk log’
D. Not all organisations have a PMO – scalability and any reference
to role e.g. risk manager, etc.
E. Risk efficiency – Markovitz.
E. Use same structure as programme – use definition and elaborate
on key elements.
E. BoK group does not like APM definition of portfolio.
E. Has this definition referred to OGC MOP which has been
published? A sound reason in existence – why use this?
E. PMI Portfolio Management Standard – also reference.
E. Use the definition and describe each section in reference to
portfolio risk then draw some conclusions ‘consequently need to
focus on…’value’…’risk efficiency’…’
E. Whatever the portfolio is, have to manage risk – opportunities
and threats.
E. A general conclusion – all these initiatives exist in order to take
appropriate risk safely and management it i.e. because understand
can take appropriate resolution.
E. Author should never use risk when talking about a threat only or
opportunity and vice versa.
The 3 categories need to be clearly interpretation.
Page 3 of 11























E. Need to show massive environmental risks at a portfolio level e.g.
risk at project may not impact but can be significant at portfolio
level.
E. Author hasn’t referred to relationship with programme and
portfolio – only reflects on relationship with project management.
E. Management is more complex.
E. Risk efficiency
E. Risk value (or a subset of efficiency)
E. Portfolio need risk governance escalation/aggregation/delegation.
E. Don’t need examples in text.
E. Don’t refer to roles – PM/PMO/P3O tools.
E. Don’t refer to an organisation wanting to take risk to grow the
organisations objective are whatever item.
Signpost and hyperlinks to relevant sections in external material e.g.
risk management plan (outlining what should be contained within).
General: something to be added on uncertainty and include ‘or
similar’ from PRAM guide foreword bottom of page xxii Peter Simon.
Risk contingency budget governance
Agree with feedback from Nov 2010 re general section recognising
that the bullets are not prioritised and some are slightly duplicated
RM is everyone’s business
Programme: sources of risk which include risk from the projects,
BAU and strategic – not covered sufficiently at present.
Emphasising the differences between project and programmes and
their risk – not covered.
Risks are derived from the scope of the programme
Ownership of risk outlining the differences between project and
programme (single owner!)
Governance and escalation of risk needs to be included
Efficient use of resources across the programme to optimise the
outcome
Programme manager will only proactively manage risks at the
programme level which is not appropriate to delegate to projects or
escalate to strategic management. However the programme
management risk plan must address all risks to the programme.
Portfolio: portfolio RM is similar to programme management but
biased towards strategic risks at board level looking at mission,
strength of vision of that organisation.
Note: definition of portfolio not sufficiently distinctive from
programme definition and is not consistent with current best
practice e.g. OGC
4. Does anything need to be amended and
why?
See above.
No response received from facilitator
5. Have the APM definitions been adhered
to (APM Body of Knowledge 5th edition
glossary)?
No – APM definitions not been adhered to –
question on APM portfolio definition.
Not used on this occasion.
Page 4 of 11
6. Has existing content from 5th edition
been reviewed and
edited/incorporated?
No
Not used on this occasion
7. Have the items in the 1st draft feedback
been referenced in the content?
No
No
8. Have any diagrams or tables used
directly support the content, and have
they been explained or referred to in
the text?

Only 1 in general section. Should possibly
include the OGC diagrams in general section – to
consider – or amend. Fig 1.2 in MOR in relation
to risk.
 Show to reflect ‘nesting’ or
project/programme/portfolio e.g. David’s paper
diagram.
 Would add a lot of clarity in general section.
 Ok but general requires rewriting
9. Are there any other references that could be
 ISO31000
incorporated into the further reading?
 Prince correct abbreviation
a. Does further reading fall into one of  MSP
the following categories:
 MOP
i. Further reading or notes that  PMBoK reference expanded
directly support the content  Take out generic references as overall
ii. A list of further reading for
recommendation and only have risk
the section i.e. further
references.
reading which although not
 Add – IRM Risk Standard 2002
directly used have
 PMI Practice standard for project RM
contributed to the ideas in
2009
the content
 ATOM methodology
iii. More general sources from
 Rewrite and then we’ll review
the management or
technical literature that is
considered to be important
and which are relevant in a
more general sense to the
readership.
b. Have UK (or other relevant)
standards that the content is
compliant with been
referenced?
c. Are further reading items
publicly available?
10. Out of the issues we’ve talked about, which
ones are the most important to you, and why?
Rewrite and listen to feedback
Page 5 of 11
3.5.1 Risk Context

This is the ‘why’. Does this reflect risk management section – this cannot reflect context as RM
section has to be rewritten.
 Parts list – attitude/appetite/environment
 No need for this section – all content should be covered under 3.5 Risk Management or 3.5.2
Risk Techniques.
1. Definition of good practice:
 Not a reflection of good practice
‘The knowledge and practices described
are applicable to most projects most of
the time, and …there is widespread
consensus about their value and
usefulness’.
A Guide to the Project
Management Body of Knowledge
(PMBoK®Guide) Third Edition, ©2004
Project Management Institute
Does the draft reflect good practice?
2. Are they pan-sector?
a. Does the content avoid
industry/sector bias?
b. Is the content scalable (taking into
account the range of
projects/programmes/portfolios
from small to large, and the range
of complexity)?
Definition of pan-sector:
Generic, non industry specific content that can be
applied regardless of industry or sector.
3. Do any key concepts relating to the section
need to be added?
a. Definition
b. General section
c. Project content
d. Programme content
e. Portfolio content

Random assertions – no comment on
industry, sounds engineering specific

New concepts (add these elements to parts
list and defined before discussed):
o All of previous review feedback
o Meet the parts list
o ISO31000 – concept of a RM
framework
o MOR Risk principles
o The ‘why’ of risk
5 ideas are fundamental to understanding
risk.
Give a one line definition of 1. Risk
framework, 2. Risk principles, 3.
Stakeholders.
Revisit in format above
The general section could be not much more
than definition of 5 elements of 1. Attitude,
2. Appetite, 3. Environment, 4. Risk
framework, 5. Risk principles.
Could use large scale diagram as discussed





Page 6 of 11















previously in 3.5 RM.
C. Need to structure as/add concepts.
C. Write specific detail for project under each
of the previously defined headings.
C. PESTLE – in general and in
project/programme/portfolio equally
C. Anything applicable to projects under
context?
C. Constraints – more applicable to projects.
Don’t want to brainstorm a new list – author
to rewrite.
D. very good to generic RM 3.5 higher level.
D. However current style is messy.
D. Writer to consider using in programme
RM section.
D. Advice to writer:
o Writer to use 5 previously defined
headings for programme specific
clarification for risk context.
o Para 6 is good on standards but
sounds too engineering sector
specific.
o Author needs to abstract up the
level – in terms of standards.
o Should governance be considered or
discussed under principles.
o Boundaries – difficult to ascertain
what they are for programme and
portfolio (parameters).
o Refer to term here – a parameter
e.g. benefits
o The boundaries of what is at risk – in
a project it is much clearer – not so
in a programme e.g. often risk
registers include elements that are
corporate risks or project risks –
need ownership and boundary of
programme risk: abstract vs. focus
D. Risk ownership should be a heading. This
needs to go back into overview 3.5
E. Dislike opening sentence ‘macro shocks’
otherwise like what is written
E. Major changes within the macro
environment – major focus of portfolio RM.
E. Writer to use 5 headings in relation to
portfolio.
E. Ok to use PESTLE ‘can be extended’ but
this could be interpreted as PESTLE not
applicable to project and programme which
it is.
E. Para 2 – ok but author has forgotten about
Page 7 of 11
4. Does anything need to be amended and
why?
5. Have the APM definitions been adhered to
(APM Body of Knowledge 5th edition
glossary)?
programmes ‘of change projects’
See above




APM definitions – don’t use Oxford English
Dictionary definition.
Operational risk – a definition – use earlier
on in 3.5 section.
Could also have definitions higher in the
book e.g. in context 1.2
Have the following in glossary or define in
this section (available in PRAM)
o Risk criteria
o Risk threshold
o Risk tolerance
o Risk exposure
o Risk appetite
o Risk attitude
6. Has existing content from 5th edition been
reviewed and edited/incorporated?
No – a new section
7. Have the items in the 1st draft feedback
been referenced in the content?
No feedback
8. Have any diagrams or tables used directly
support the content, and have they been
explained or referred to in the text?
n/a – no diagrams
9. Are there any other references that
could be incorporated into the further
reading?
a. Does further reading fall into one
of the following categories:
i. Further reading or notes
that directly support the
content
ii. A list of further reading
for the section i.e.
further reading which
although not directly
used have contributed to
the ideas in the content
iii. More general sources
from the management or
technical literature that
is considered to be
important and which are
relevant in a more
general sense to the
Idea to add references to key headings – group
references under headings:
 Attitude
o David Hillson, Understand and
Managing Risk Attitude
 Appetite
o AIRMIC report 2008
o IRM report 2011
 Environment
o MOR
o ISO31000
o IRM risk standard
 Principles and framework
o IRM risk standard
o MOR
o ISO31000
Page 8 of 11
readership.
b. Have UK (or other
relevant) standards
that the content is
compliant with been
referenced?
c. Are further reading
items publicly
available?
10. Out of the issues we’ve talked about, which
ones are the most important to you, and
why?
3.5.2
Risk Techniques
This section should just have a definition and general section as all tools and techniques could be
applied within project, programme and portfolio.
1. Definition of good practice:
Not great.
‘The knowledge and practices described
are applicable to most projects most of
the time, and …there is widespread
consensus about their value and
usefulness’.
A Guide to the Project
Management Body of Knowledge
(PMBoK®Guide) Third Edition, ©2004
Project Management Institute
Does the draft reflect good practice?
2. Are they pan-sector?
A. Ok
a. Does the content avoid
B. Scalability not covered at all. RM should
industry/sector bias?
be tailored to the complexity and
b. Is the content scalable (taking into
context.
account the range of
projects/programmes/portfolios
from small to large, and the range
of complexity)?
Definition of pan-sector:
Generic, non industry specific content that can be
applied regardless of industry or sector.
3. Do any key
 (bold indicates suggested headings to be used to structure the sections)
concepts
 Good layout but stylistically no definition followed by explanation –
relating to the
loose authoring.
section need to
 It is a list which is partial. Don’t want to give a full list of techniques.
be added?
 Advice to author: should go to process and give types of techniques
Page 9 of 11
a. Definition
b. General
section
c. Project
content
d. Programme
content
e. Portfolio
content















4. Does anything
need to be
amended and
why?
















(generic) or give reference to PRAM guide/PMI practice standard/MOR.
Process dia – addition of structure techniques. Not just process
techniques – also structuring techniques e.g.
1. Structure
2. Scope
3. Content
4. Context
And address for all 3 levels for structuring techniques.
Definition: delete the bit of tools – add techniques for RM not just the
process, ‘improving risk management’ (rewrite).
General: add bit to use tools appropriate to support requirement.
Risk culture and process – what risk culture improvement techniques
Culture could be another heading under context
Definition: add ‘to enable informed decision making’
During initiation phase of any project/programme/portfolio, the tools
and techniques to be employed will be selected with guidance on how
they will be used at each stage of the RM process.
From 1st draft feedback only consider general observations and general
section – delete the rest of the feedback.
Techniques are useless without supportive, transparent and honest
organisational culture.
Risk responses explain the variety of options available and risk
management reports using any of these techniques should be tailored
for the audience.
Delete all of techniques listed in text and refer to advice above
Add contingency and management reserve (consider) a technique (not a
class of technique)
Different ways of doing this
Communication techniques
Project: collaborative risk management – changing in contracting
relationships today. This is an additional class of technique. Where risk is
contracted out and how to manage across the contractual boundary. E.g.
contractual techniques.
Depending on the type of contract will determine technique to be used
to manage the rest together.
Programme: also contractual techniques. Writer could add contractual
techniques to generic section but exclude under portfolio.
Need to add first draft comments.
New techniques.
Structuring – add explicit structuring techniques.
For the new programme techniques there are no authoritative lists –
offer an example.
Distinction between implicit and explicit. Author to take a judgement on
whether to add first draft comments list.
Feasibility, design and operation not necessarily seen as best practice –
refer to MSP. All these stages are not best practice.
Portfolio: structure is classes of techniques – anything specific to
portfolio.
Refer to 1st draft comments – an indicative list
Has author looked at techniques in MOP?
Page 10 of 11
 Don’t need to add Monte Carlo/decision trees, etc.
 Para 3 – concept of risk efficiency – very relevant to portfolio.
 Diagram is wrong – risk efficient frontier diagram PRAM Appendix A.
 References: PRAM appendix A.
 Appendix B MOR 2010
 PMI Practice Standard Appendix D
 MOP – check if level of techniques that relevant
 Not ISO30100
 This is a generic recommendation for BoK.
No responses received from facilitator
5. Have the APM definitions been adhered to
Common glossary – have definitions been
th
(APM Body of Knowledge 5 edition
compared?
glossary)?
A hierarchy – APM, OGC and ISO definition guide
73 (standards), PMO.
n/a – as sent back for rewrite and have used the
feedback as the basis for our discussion.
th
6. Has existing content from 5 edition been
n/a – as sent back for rewrite and have used the
reviewed and edited/incorporated?
feedback as the basis for our discussion.
7. Have the items in the 1st draft feedback
been referenced in the content?
8. Have any diagrams or tables used directly
support the content, and have they been
explained or referred to in the text?
No – see comments above
n/a – as sent back for rewrite and have used the
feedback as the basis for our discussion.
See above comment on diagram
n/a – as sent back for rewrite and have used the
feedback as the basis for our discussion.
9. Are there any other references that could be incorporated
into the further reading?
a. Does further reading fall into one of the following
categories:
i. Further reading or notes that directly support
the content
ii. A list of further reading for the section i.e.
further reading which although not directly
used have contributed to the ideas in the
content
iii. More general sources from the management
or technical literature that is considered to be
important and which are relevant in a more
general sense to the readership.
b. Have UK (or other relevant) standards that
the content is compliant with been
referenced?
c. Are further reading items publicly
available?
10. Out of the issues we’ve talked about, which
ones are the most important to you, and
why?
See recommendations above
Nothing to add at present
Needs to be rewritten and then we’ll review
Page 11 of 11