Tools and techniques for risk identification include:

 Documentation reviews (examines the quality and consistency of the project documents,
along with the requirement)
 Probably the 3 most common, and in this order

 Brainstorming
 Interviewing (aka Expert interviewing)
 Delphi technique
 Root cause analysis
 Checklist analysis
 Assumption Analysis
 Diagramming techniques
 SWOT analysis (Strengths, Weaknesses, Opportunities, and Threats)
 Expert Judgement

There are two levels to risk analysis:

1. Qualitative Analysis
This is the first step. It is a subjective analysis, and usually employs words, such as “low”,
“medium” and “high” rather than numbers, but simple numbers are often used, e.g. 0 to 5 for
ease of understanding. This stage is relatively inexpensive and quick
2. Quantitative Analysis
When you have completed your qualitative analysis, the more important risks may be subjected
to quantitative analysis (more precise numbers, data ranges, and historical information). Often
this step is skipped in industry because it is highly specialized, slow and expensive.

For each risk you should determine:

1. The probability that it will occur,
2. The impact on the project if it does occur,
3. When in the project it is likely to occur, and
4. How often it is likely to occur.

Plan Your Risk Responses

There are Four possible Risk Responses
 Avoidance
 Risk avoidance is a risk response strategy whereby the project team acts to eliminate the
threat or protect the project from its impact. It usually involves changing the project
management plan to eliminate the threat entirely.” (PMBOK guide, Fifth Edition, p343).
  This means changing the project plan (e.g. the scope statement, the schedule, etc) so
that a particular risk can’t happen

 Mitigation

Risk mitigation is a risk response strategy whereby the project team acts to reduce the probability
of occurrence or impact of a risk. It implies a reduction in the probability and/or impact of an
adverse risk to be within acceptable threshold limits.” (PMBOK guide, Fifth Edition, p345).
It means taking action to reduce the likelihood and/or the impact of an identified risk.

 Transference
 “Risk transference is a risk response strategy whereby the project team shifts the impact
of a threat to a third party, together with ownership of the response. Transferring the risk
simply gives another party responsibility for its management—it does not eliminate it.”
(PMBOK guide, Fifth Edition, p343).
 This usually means paying someone to take the risk on your behal

 Acceptance
 Risk acceptance is a risk response strategy whereby the project team decides to
acknowledge the risk and not take any action unless the risk occurs.
 There’s virtually no chance of it happening (e.g. a major earthquake in London), or
 The impact would be negligible,
 It is too expensive to deal with (e.g. the cost of insurance may be more than the impact of
the risk event), or
 You simply have no idea what you would do

Risk Categories Include

 Technical, quality or performance risks - such as reliance on unproven or complex
technology, unrealistic performance goals, changes to technology used or industry standards
during the project.
 External risks - such as changes in the legal or regulatory environment, labour issues,
changing owner priorities, country risk, and weather. Force majeure risks (Also known as
“acts of god”) such as earthquakes, floods, and civil unrest generally require disaster
recovery actions rather than Risk Management.
 Organisational risks - such as cost, time, and scope objectives that are internally
inconsistent, lack of prioritization of projects, inadequacy or interruption of funding, and
resource conflicts with other projects in the organization.
 Environmental risks – pollution, habitat destruction, vibration, and so on.
 Project-management risks – risks caused mainly by the Project Manager or the project
team, such as poor allocation of time and resources, inadequate quality of the project plan,
poor use of project management disciplines.

After analysing the scenario where a threat is identified with one of the platforms but later is
recommended that device which is incompatible to be removed from the project. This truly
reflect that the organization has respond the risk by eliminating all the risk involved in it.
Because it will be best practice to use existing technologies rather than adopt new
techniques mentioned. Also, as mentioned in the scenario that Window Phones only occupy
0.7% of total market so it will be a better idea for focusing on rest of the client than spend
resources on mitigating that risk.