Risk Treatment - Revision history

EigilVølund at 18:06, 26 March 2022

2022-03-26T18:06:33Z

← Older revision		Revision as of 18:06, 26 March 2022
Line 124:		Line 124:

	== Annotated Bibliograhpy ==		== Annotated Bibliograhpy ==
	~~'''OBS. This section will be described in more detail later'''~~
	#'''Project Management Institute, Inc. (PMI). (2019). Standard for Risk Management in Portfolios, Programs, and Projects. Project Management Institute, Inc. (PMI).'''		#'''Project Management Institute, Inc. (PMI). (2019). Standard for Risk Management in Portfolios, Programs, and Projects. Project Management Institute, Inc. (PMI).'''
	#:Retrieved from: https://app.knovel.com/hotlink/toc/id:kpSRMPPP01/standard-risk-management/standard-risk-management		#:Retrieved from: https://app.knovel.com/hotlink/toc/id:kpSRMPPP01/standard-risk-management/standard-risk-management

EigilVølund at 18:06, 26 March 2022

2022-03-26T18:06:10Z

← Older revision		Revision as of 18:06, 26 March 2022
Line 21:		Line 21:

	'''Risk Mitigation'''		'''Risk Mitigation'''
	Risk Mitigation involves taking precautious measures that will cause the risk to as little damage as possible, and/or attempt to reduce the probability of occurrence of the risk <ref name=PM/>..		Risk Mitigation involves taking precautious measures that will cause the risk to as little damage as possible, and/or attempt to reduce the probability of occurrence of the risk <ref name=PM/>.

	'''Risk Transfer'''		'''Risk Transfer'''
	Risk transfer can be split into two under categories: sharing and transferring. Where risk sharing is partnering with others to share the responsibility for risks. An example of risk sharing is when an international company partners with a local company. The local company will have some experience and expertise, which reduces risks for the international company. In the event that a risk occurs, the local company will also take a share of the impact, thereby reducing the impact on the international company. The local company will however, also enjoy some of the profits for a successful project.		Risk transfer can be split into two under categories: sharing and transferring. Where risk sharing is partnering with others to share the responsibility for risks. An example of risk sharing is when an international company partners with a local company. The local company will have some experience and expertise, which reduces risks for the international company. In the event that a risk occurs, the local company will also take a share of the impact, thereby reducing the impact on the international company. The local company will however, also enjoy some of the profits for a successful project.
	Risk transferring involves paying a third-party to take the risk away from you, most commonly this is done through insurance <ref name=PM/>..		Risk transferring involves paying a third-party to take the risk away from you, most commonly this is done through insurance <ref name=PM/>.

	'''Risk Acceptance'''		'''Risk Acceptance'''
	If none of the risk reducing measures are possible, there are only two options lefts - accept the risk or close down the project. Accepting a risk does however, not mean not preparing for/analyzing probability, impact etc. It means that the project manager either considers the impact of the risk to be of lower cost than the measures of reducing/eliminating the risk, or that it is impossible to do so. This process will allow for considerations of alternatives and a preparedness of the impact if actually occurs <ref name=PM/>..		If none of the risk reducing measures are possible, there are only two options lefts - accept the risk or close down the project. Accepting a risk does however, not mean not preparing for/analyzing probability, impact etc. It means that the project manager either considers the impact of the risk to be of lower cost than the measures of reducing/eliminating the risk, or that it is impossible to do so. This process will allow for considerations of alternatives and a preparedness of the impact if actually occurs <ref name=PM/>.


	=== Threat vs. opportunity ===		=== Threat vs. opportunity ===
	The term risk entails two different definitions: ''threats'' and ''opportunities''. Where a threat is a risk with a negative outcome and an opportunity is a tisk with a positive outcome. Efficient risk treatment should include planning for both types of risk, and it should be recognized that one is not more important for project success than the other. It has been widely discussed whether the same approaches and measures can be taken towards both types of risk, however they are not qualitatively or quantitatively different, since they both stem from uncertainty. Aligned with the general methods for dealing with typical threats, which are described in the sections above, opportunities have related responses. Instead of avoiding a threat, an identified opportunity should be exploited. Instead of mitigating a threat, an opportunity should be enhanced. Instead of transferring a threat, and opportunity should be shared. Instead of accepting a threat, an opportunity should be ignored. <ref name=opp> Hillson, D. (2001). Effective strategies for exploiting opportunities. Paper presented at Project Management Institute Annual Seminars & Symposium, Nashville, TN. Newtown Square, PA: Project Management Institute, Retrieved from: https://www.pmi.org/learning/library/effective-strategies-exploiting-opportunities-7947 </ref>		The term risk entails two different definitions: ''threats'' and ''opportunities''. Where a threat is a risk with a negative outcome and an opportunity is a tisk with a positive outcome. Efficient risk treatment should include planning for both types of risk, and it should be recognized that one is not more important for project success than the other. It has been widely discussed whether the same approaches and measures can be taken towards both types of risk, however they are not qualitatively or quantitatively different, since they both stem from uncertainty. Aligned with the general methods for dealing with typical threats, which are described in the sections above, opportunities have related responses. Instead of avoiding a threat, an identified opportunity should be exploited. Instead of mitigating a threat, an opportunity should be enhanced. Instead of transferring a threat, and opportunity should be shared. Instead of accepting a threat, an opportunity should be ignored. <ref name=opp> Hillson, D. (2001). Effective strategies for exploiting opportunities. Paper presented at Project Management Institute Annual Seminars & Symposium, Nashville, TN. Newtown Square, PA: Project Management Institute, Retrieved from: https://www.pmi.org/learning/library/effective-strategies-exploiting-opportunities-7947 </ref>.

	== Application ==		== Application ==
Line 127:		Line 127:
	#'''Project Management Institute, Inc. (PMI). (2019). Standard for Risk Management in Portfolios, Programs, and Projects. Project Management Institute, Inc. (PMI).'''		#'''Project Management Institute, Inc. (PMI). (2019). Standard for Risk Management in Portfolios, Programs, and Projects. Project Management Institute, Inc. (PMI).'''
	#:Retrieved from: https://app.knovel.com/hotlink/toc/id:kpSRMPPP01/standard-risk-management/standard-risk-management		#:Retrieved from: https://app.knovel.com/hotlink/toc/id:kpSRMPPP01/standard-risk-management/standard-risk-management
	#*~~fasdfasd~~		#* General standard on project, program and portfolio management. Includes many definitions.
	~~#'''International Organization for Standardization (2020)~~, ~~DS/ISO 21502:2020, Project-, programme~~ and portfolio ~~management - Guidance on project~~ management.~~'''~~
	~~#: Retrieved from: https://sd.ds.dk/Viewer?ProjectNr=M351700&Status=60.60&Inline=true&Page=1&VariantID=~~
	~~#*General standards on risk management. This standard gives brief definition of general risk management terms used in this article, such as risk management and risk treatment~~.
	#'''International Organization for Standardization (2018), DS/ISO 31000:2018, Risk management - Guidelines'''		#'''International Organization for Standardization (2018), DS/ISO 31000:2018, Risk management - Guidelines'''
	#:Retrieved from: https://sd.ds.dk/Viewer?ProjectNr=M296412&Status=60.60&Inline=true&Page=1&VariantID=41		#:Retrieved from: https://sd.ds.dk/Viewer?ProjectNr=M296412&Status=60.60&Inline=true&Page=1&VariantID=41

EigilVølund at 14:40, 26 March 2022

2022-03-26T14:40:09Z

← Older revision		Revision as of 14:40, 26 March 2022
Line 4:		Line 4:
	Although, a general step-by-step risk treatment standard is yet to be defined in detail, some industries have developed some guidelines. This is the case for the cybersecurity industry. The European Union Agency for Cybersecurity has developed a industry specific guideline on application of risk treatment, which can be used as an example for other industries. The example from Enisa is a five step process that includes: ''Identification of Options'', ''Development of Action Plan'', '' Approval of Action Plan'', ''Implementation of Action Plan'' and ''Identification of Residual Risks''.		Although, a general step-by-step risk treatment standard is yet to be defined in detail, some industries have developed some guidelines. This is the case for the cybersecurity industry. The European Union Agency for Cybersecurity has developed a industry specific guideline on application of risk treatment, which can be used as an example for other industries. The example from Enisa is a five step process that includes: ''Identification of Options'', ''Development of Action Plan'', '' Approval of Action Plan'', ''Implementation of Action Plan'' and ''Identification of Residual Risks''.

	~~'''OBS~~. ~~EXPAND abstract on limitations when~~ the ~~section~~ is ~~fully written***'''~~		Efficient risk treatment planning is a difficult task and it has a few limitations. One major limitation is that a risk treatment plan deals with uncertainty, and not matter the level of expertise in planning, it is impossible to be perfectly prepared for all possible risks. Another limitation that is yet to be figured out is poor knowledge sharing within this area of expertise, it is very difficult, as a project manager, to get your hands on standardized guidelines.

	== Big Idea ==		== Big Idea ==
Line 17:		Line 17:
	Although standardization is a difficult task, there are some general methods that can be tailored to the specific risks of a project. Different risk management standards include/describe these method with slight variety, but commonly four methods are mentioned: ''Avoidance'', ''Mitigation'', Transfer'', ''Acceptance'' <ref name=PM> BcCampus Open Education, Adrienne Watt, Project Management, Risk Management Planning, Retrieved from https://opentextbc.ca/projectmanagement/chapter/chapter-16-risk-management-planning-project-management/ </ref>.		Although standardization is a difficult task, there are some general methods that can be tailored to the specific risks of a project. Different risk management standards include/describe these method with slight variety, but commonly four methods are mentioned: ''Avoidance'', ''Mitigation'', Transfer'', ''Acceptance'' <ref name=PM> BcCampus Open Education, Adrienne Watt, Project Management, Risk Management Planning, Retrieved from https://opentextbc.ca/projectmanagement/chapter/chapter-16-risk-management-planning-project-management/ </ref>.

			'''Risk Avoidance'''
	~~====~~ Risk Avoidance ~~====~~
	When utilizing risk avoidance the risk profile of the project is reduced simply by not doing what would likely provoke the risk to occur. This usually involves development of a "back-up strategy" that is more costly, but has a higher chance of success. Examples of effective risk avoidance are; using an older and known technology, instead of a new technology that "promises" better performance or lower cost. Using reliable and known suppliers or vendors, instead of trusting new ones that, again, might promise lower costs or lead times <ref name=PM/>.		When utilizing risk avoidance the risk profile of the project is reduced simply by not doing what would likely provoke the risk to occur. This usually involves development of a "back-up strategy" that is more costly, but has a higher chance of success. Examples of effective risk avoidance are; using an older and known technology, instead of a new technology that "promises" better performance or lower cost. Using reliable and known suppliers or vendors, instead of trusting new ones that, again, might promise lower costs or lead times <ref name=PM/>.

	~~====~~ Risk Mitigation ~~====~~		'''Risk Mitigation'''
	Risk Mitigation involves taking precautious measures that will cause the risk to as little damage as possible <ref name=PM/>..		Risk Mitigation involves taking precautious measures that will cause the risk to as little damage as possible, and/or attempt to reduce the probability of occurrence of the risk <ref name=PM/>..

	~~====~~ Risk Transfer ~~====~~		'''Risk Transfer'''
	Risk transfer can be split into two under categories: sharing and transferring. Where risk sharing is partnering with others to share the responsibility for risks. An example of risk sharing is when an international company partners with a local company. The local company will have some experience and expertise, which reduces risks for the international company. In the event that a risk occurs, the local company will also take a share of the impact, thereby reducing the impact on the international company. The local company will however, also enjoy some of the profits for a successful project.		Risk transfer can be split into two under categories: sharing and transferring. Where risk sharing is partnering with others to share the responsibility for risks. An example of risk sharing is when an international company partners with a local company. The local company will have some experience and expertise, which reduces risks for the international company. In the event that a risk occurs, the local company will also take a share of the impact, thereby reducing the impact on the international company. The local company will however, also enjoy some of the profits for a successful project.
	Risk transferring involves paying a third-party to take the risk away from you, most commonly this is done through insurance <ref name=PM/>..		Risk transferring involves paying a third-party to take the risk away from you, most commonly this is done through insurance <ref name=PM/>..

	~~====~~ Risk Acceptance ~~====~~		'''Risk Acceptance'''
	If none of the risk reducing measures are possible, there are only two options lefts - accept the risk or close down the project. Accepting a risk does however, not mean not preparing for/analyzing probability, impact etc. It means that the project manager either considers the impact of the risk to be of lower cost than the measures of reducing/eliminating the risk, or that it is impossible to do so. This process will allow for considerations of alternatives and a preparedness of the impact if actually occurs <ref name=PM/>..		If none of the risk reducing measures are possible, there are only two options lefts - accept the risk or close down the project. Accepting a risk does however, not mean not preparing for/analyzing probability, impact etc. It means that the project manager either considers the impact of the risk to be of lower cost than the measures of reducing/eliminating the risk, or that it is impossible to do so. This process will allow for considerations of alternatives and a preparedness of the impact if actually occurs <ref name=PM/>..


	=== Threat vs. opportunity ===		=== Threat vs. opportunity ===
			The term risk entails two different definitions: ''threats'' and ''opportunities''. Where a threat is a risk with a negative outcome and an opportunity is a tisk with a positive outcome. Efficient risk treatment should include planning for both types of risk, and it should be recognized that one is not more important for project success than the other. It has been widely discussed whether the same approaches and measures can be taken towards both types of risk, however they are not qualitatively or quantitatively different, since they both stem from uncertainty. Aligned with the general methods for dealing with typical threats, which are described in the sections above, opportunities have related responses. Instead of avoiding a threat, an identified opportunity should be exploited. Instead of mitigating a threat, an opportunity should be enhanced. Instead of transferring a threat, and opportunity should be shared. Instead of accepting a threat, an opportunity should be ignored. <ref name=opp> Hillson, D. (2001). Effective strategies for exploiting opportunities. Paper presented at Project Management Institute Annual Seminars & Symposium, Nashville, TN. Newtown Square, PA: Project Management Institute, Retrieved from: https://www.pmi.org/learning/library/effective-strategies-exploiting-opportunities-7947 </ref>

	== Application ==		== Application ==
Line 107:		Line 106:
	Residual risks are risks that have not been covered by the risk management planning and implementation. These include unforeseen risks, untreated risks and risks that evolve from risk management itself, that have not been handled. Even if the risk have been purposely left, it is important to define and document it in as much detail as possible, so that all decision makers in the organization are informed of it. Although, the risk is residual at a certain point of time during the project, it might become necessary to handle it at another time. Without proper preparation the consequences of a former residual risk can be increasingly larger, while it might even have been avoided completely <ref name=enisa/>.		Residual risks are risks that have not been covered by the risk management planning and implementation. These include unforeseen risks, untreated risks and risks that evolve from risk management itself, that have not been handled. Even if the risk have been purposely left, it is important to define and document it in as much detail as possible, so that all decision makers in the organization are informed of it. Although, the risk is residual at a certain point of time during the project, it might become necessary to handle it at another time. Without proper preparation the consequences of a former residual risk can be increasingly larger, while it might even have been avoided completely <ref name=enisa/>.

	=== Comparison of ENISA template with ~~PMI Standards and ISO 31000~~ ===		=== Comparison of ENISA template with general standards ===

			The ENISA template gives a very generic overview of how to create a risk treatment plan. In fact there are many similarities between the ENISA approach to a treatment plan, and how the general risk management process are, as shown in '''''Figure 1'''''. First step in both processes is to identify which risks needs to be handled, then evaluate and analyze how these risks can be treated, and finally develop an attack plan and implement it. From this perspective the ENISA template does not differ from much from the risk management definitions given in the DSI and PMI standards on project mangement.

	~~The international standards for~~

	== Limitations ==		== Limitations ==
Line 137:		Line 137:
	#:Available at: https://www.enisa.europa.eu/topics/threat-risk-management/risk-management/current-risk/risk-management-inventory/rm-process/risk-treatment		#:Available at: https://www.enisa.europa.eu/topics/threat-risk-management/risk-management/current-risk/risk-management-inventory/rm-process/risk-treatment
	#*This website provides a detailed guideline on the application of a risk treatment plan in the cybersecurity industry. It is used throughout this article as an example of a generalized progression on implementation of risk treatment in any organization and/or indunstry.		#*This website provides a detailed guideline on the application of a risk treatment plan in the cybersecurity industry. It is used throughout this article as an example of a generalized progression on implementation of risk treatment in any organization and/or indunstry.
			#'''Project Management Institute (2001), Effective Strategies for Exploring Opportunities.
			#:Retrieved from: https://www.pmi.org/learning/library/effective-strategies-exploiting-opportunities-7947
			#* This article provides detailed insight in how to deal with opportunities compared to threats, which are usually the risks that are focused on.

	== References ==		== References ==
	<references/>		<references/>

EigilVølund at 14:19, 6 March 2022

2022-03-06T14:19:37Z

← Older revision		Revision as of 14:19, 6 March 2022
Line 32:		Line 32:


	Threat vs. opportunity		=== Threat vs. opportunity ===

EigilVølund at 13:37, 6 March 2022

2022-03-06T13:37:02Z

@@ Line 13: / Line 13: @@
 === Risk Treatment ===
-Risk treatment is the vital final step, that helps the project manager efficiently and quickly handle the risks identified earlier in the risk management process. The objective in risk treatment is to have a detailed step-by-step action plan for as many imaginable future risks as possible. Since projects come in variations of an unlimited number, their purpose and challenges vary to the same degree. This variation makes standardization of the risk treatment process almost impossible, when the process needs to be tailored to the specific project and its risks <ref name=ISO31/>.
+Risk treatment is the vital final step, that helps the project manager efficiently and quickly handle the risks identified earlier in the risk management process if they occur. The objective in risk treatment is to have a detailed step-by-step action plan for as many imaginable future risks as possible or at least the ones that are the most probable or damaging. Since projects come in variations of an unlimited number, their purpose and challenges vary to the same degree. This variation makes standardization of the risk treatment process almost impossible, when the process needs to be tailored to the specific project and its risks <ref name=ISO31/>.
 Threat vs. opportunity

EigilVølund at 21:54, 20 February 2022

2022-02-20T21:54:05Z

← Older revision		Revision as of 21:54, 20 February 2022
Line 26:		Line 26:
	<ref name=enisa> ENISA, European Union Agency for Cybersecurity. Threat and risk management, Risk Treatment.		<ref name=enisa> ENISA, European Union Agency for Cybersecurity. Threat and risk management, Risk Treatment.
	https://www.enisa.europa.eu/topics/threat-risk-management/risk-management/current-risk/risk-management-inventory/rm-process/risk-treatment </ref>.		https://www.enisa.europa.eu/topics/threat-risk-management/risk-management/current-risk/risk-management-inventory/rm-process/risk-treatment </ref>.

	~~(ENISA)~~

	''The following segments will generalize and elaborate on the template created for cybersecurity, such as it can be used as a standardized guide for risk management and risk treatment in general project management.''		''The following segments will generalize and elaborate on the template created for cybersecurity, such as it can be used as a standardized guide for risk management and risk treatment in general project management.''

EigilVølund at 21:52, 20 February 2022

2022-02-20T21:52:25Z

Show changes

EigilVølund at 20:20, 20 February 2022

2022-02-20T20:20:59Z

← Older revision		Revision as of 20:20, 20 February 2022
Line 19:		Line 19:

	The progression template includes five sections: ''Identification of Options'', ''Development of Action Plan'', '' Approval of Action Plan'', ''Implementation of Action Plan'' and ''Identification of Residual Risks''. (ENISA)		The progression template includes five sections: ''Identification of Options'', ''Development of Action Plan'', '' Approval of Action Plan'', ''Implementation of Action Plan'' and ''Identification of Residual Risks''. (ENISA)

			''The following segments will generalize and elaborate on the template created for cybersecurity, such as it can be used as a standardized guide for risk management and risk treatment in general project management.''

	=== Identification of Options ===		=== Identification of Options ===
Line 75:		Line 77:
	* A written commitment to the policy by top level managers		* A written commitment to the policy by top level managers

			If published to internal and external stakeholders to the organization, a such policy, will not only create overview of the plan, accountability, resource allocation etc. but also demonstrate commitment from the top level management.

			Although, top level management ultimately is responsible for managing risks in the organization, all staff have responsibilities in their own areas. Successful risk management at personnel level can be achieved with systematic performance measurements and reporting.

	=== Identification of Residual Risk ===		=== Identification of Residual Risk ===

			Residual risks are risks that have not been covered by the risk management planning and implementation. These include unforeseen risks, untreated risks and risks that evolve from risk management itself, that have not been handled. Even if the risk have been purposely left, it is important to define and document it in as much detail as possible, so that all decision makers in the organization are informed of it. Although, the risk is residual at a certain point of time during the project, it might become necessary to handle it at another time. Without proper preparation the consequences of a former residual risk can be increasingly larger, while it might even have been avoided completely.

			=== Comparison of ENISA template with PMI Standards ===
	~~== Limitations ==~~


	=== Comparison of ENISA ~~model~~ with PMI Standards ===

	However, the Project Management Institute has created some sub-categories under risk treatment, that can help a project manager in the process. The placement of a certain risk in a certain sub-category of risk treatment, is dependent on the analysis and evaluation made earlier. The four most important sub-categories are as follows: ''Avoidance'', ''Reduction'', ''Transfer'', ''Acceptance'' (PMI 31000).		However, the Project Management Institute has created some sub-categories under risk treatment, that can help a project manager in the process. The placement of a certain risk in a certain sub-category of risk treatment, is dependent on the analysis and evaluation made earlier. The four most important sub-categories are as follows: ''Avoidance'', ''Reduction'', ''Transfer'', ''Acceptance'' (PMI 31000).
Line 99:		Line 100:
	;Acceptance		;Acceptance
	:The risk is accepted. Examples where this choice is viable include when a risk is impossible to eliminate or when it is more costly to prepare for/eliminate the risk than the effect it would have. It could also simply be because the risk is considered a part of the total project risk.		:The risk is accepted. Examples where this choice is viable include when a risk is impossible to eliminate or when it is more costly to prepare for/eliminate the risk than the effect it would have. It could also simply be because the risk is considered a part of the total project risk.

			== Limitations ==
			Risk management in general is a project managers best attempt at foreseeing the future. A risk treatment plan is a project manager trying to foresee the future and plan on how to tackle every imaginable problem.
			It is impossible for a risk treatment plan to be 100% accurate, and this might be its biggest limitation. Although, it can be helpful and increase project success by decreasing its uncertainty, it can be a huge project in itself to set up a well made risk treatment plan. On top of the practical difficulty, it is also best suited for large organizations, since it most likely will be a costly affair to identify the potential risks, as well as create and implement action plans. For a smaller organization it is probably more cost effective to handle most risks head-on when they arise, and only plan for the most damaging or probable risks if any.

			Another limitation is poor public knowledge on risk treatment. Risk management is a well defined and standardized process, however the last step - risk treatment - is not. The available public resources on risk treatment are either very specific or very briefly described, such as in ISO 21502, ISO 31000 and the PMI standards.




	== Annotated Bibliograhpy ==		== Annotated Bibliograhpy ==

EigilVølund at 19:31, 20 February 2022

2022-02-20T19:31:28Z

@@ Line 54: / Line 54: @@
 === Approval of Action Plan ===
 === Identification of Residual Risk ===
@@ Line 65: / Line 84: @@
-=== Comparison of ENISA model with PMI Standards
+=== Comparison of ENISA model with PMI Standards ===
 However, the Project Management Institute has created some sub-categories under risk treatment, that can help a project manager in the process. The placement of a certain risk in a certain sub-category of risk treatment, is dependent on the analysis and evaluation made earlier. The four most important sub-categories are as follows: ''Avoidance'', ''Reduction'', ''Transfer'', ''Acceptance'' (PMI 31000).

EigilVølund at 17:26, 20 February 2022

2022-02-20T17:26:29Z

← Older revision		Revision as of 17:26, 20 February 2022
Line 61:		Line 61:



			== Limitations ==


			=== Comparison of ENISA model with PMI Standards

	However, the Project Management Institute has created some sub-categories under risk treatment, that can help a project manager in the process. The placement of a certain risk in a certain sub-category of risk treatment, is dependent on the analysis and evaluation made earlier. The four most important sub-categories are as follows: ''Avoidance'', ''Reduction'', ''Transfer'', ''Acceptance'' (PMI 31000).		However, the Project Management Institute has created some sub-categories under risk treatment, that can help a project manager in the process. The placement of a certain risk in a certain sub-category of risk treatment, is dependent on the analysis and evaluation made earlier. The four most important sub-categories are as follows: ''Avoidance'', ''Reduction'', ''Transfer'', ''Acceptance'' (PMI 31000).
Line 75:		Line 80:
	;Acceptance		;Acceptance
	:The risk is accepted. Examples where this choice is viable include when a risk is impossible to eliminate or when it is more costly to prepare for/eliminate the risk than the effect it would have. It could also simply be because the risk is considered a part of the total project risk.		:The risk is accepted. Examples where this choice is viable include when a risk is impossible to eliminate or when it is more costly to prepare for/eliminate the risk than the effect it would have. It could also simply be because the risk is considered a part of the total project risk.

	~~== Limitations ==~~

	== Annotated Bibliograhpy ==		== Annotated Bibliograhpy ==