Blog

Residual risk

The Risk Register add-on for JIRA lets you differentiate between inherent risk levels and residual risk levels. In this post, we'll see how you can get residual risk to display in your risk matrix.

"Residual risk is the risk left over after you’ve implemented a risk treatment option. It’s the risk remaining after you’ve reduced the risk, removed the source of the risk, modified the consequences, changed the probabilities, transferred the risk, or retained the risk."
-- Plain English ISO 31000 2009 Risk Management Dictionary

Risk analysis

Let's start with a hypothetical risk. As you can see in the screen-shot below, the risk has been analyzed; that is, we've recorded the impact and probability, and the add-on has calculated the exposure as High. So far, we've recorded only the inherent risk: the risk that exists before any treatment is applied.

Risk treatment

Suppose that we know of a way to reduce the level of risk we're exposed to here. We can't reduce the probability of key staff leaving, since it's already considered unlikely; but maybe we can reduce the impact by spreading the specialized knowledge of those key staff throughout our project team. We'll ask our key staff to give weekly seminars, in which their peers will learn about relevant topics. That's a risk treatment that we can record. We click the 'Treat' button, and fill in the treatment form that appears:

The Residual Impact and Residual Probability fields are included on the treatment form. By default, they have the values that we provided earlier in the Impact and Probability fields. We leave the Residual Probability as 'Unlikely', but we change the Residual Impact to 'Moderate' because we figure that our 'Sandwich Seminars' will help soften the blow we'd suffer from the loss of our key people.

The Risk Register add-on automatically calculates the Residual Exposure, and shows it on the Issue View page:

As a result of our mitigation plan, the risk left over is now Medium. Win! Let's look at the risk matrix. The easiest way to get there from the View Issue page, is to click the link under 'Risk information', which appears in the right-hand sidebar.

Viewing Original risk and Residual risk on the matrix

The 'Risks' project tab appears, showing the original (inherent) risks in a matrix. You can see that our sample risk (ABC-2) appears in the top-left cell. Note that we've selected 'Keys' for the "CELL FORMAT" so that you can distinguish ABC-2 from the other risks in that cell. 

Now we click the dropdown menu labelled "EXPOSURE BASIS", selecting 'Residual Risk'. Now we see that our sample risk appears in a new location in the matrix.

Including matrices on the dashboard

What if we want to see the original risk and the residual risk matrices side-by-side, for the sake of easy comparison. To do that, we'll need to add two risk matrices to a JIRA dashboard. For this exercise, I've created a new private dashboard called 'Risky Dash', and I've added the Risk Matrix gadget to both the left-hand column and the right-hand column. The two matrices can be configured separately, as shown below.

We've specified 'Original risk' for the left-hand matrix, and 'Residual risk' for the right-hand matrix. We click 'Save' for each of our matrix gadgets, and boom! the effectiveness of our treatment plan is immediately obvious.

Specifying residual risk on the Edit Issue screen

If you forgot to change the Residual Impact and Residual Probability values on the Treatment screen, or you need to change those values over time, you can re-visit them on the Edit screen for your risk.

Summary

Residual risk tracking is an important aspect of a good risk management process. The Risk Register add-on for JIRA maps both original (inherent) risk and residual risk onto the risk matrix, making it easy to see the effects of your treatment plans.