LEARN. PRACTICE. GROW.Build a relevant documentary basis
Before the workshop, prepare a small decision pack: change objective, architecture version, applicable contractual conditions, relevant incidents, and assumptions requiring confirmation. A two-year-old rehearsal at one tenth of current volume does not prove current readiness. Record source, date, scope, and limitations for each piece of evidence. If a contract and sales presentation disagree about weekend support, ask the authorized owner to confirm the applicable obligation; do not choose the more convenient wording. In the fictional workshop, the team must deliver a table containing document, supported claim, context difference, and validation owner. This table guides concrete questions before assigning probabilities.
Define limits for each objective
The fictional committee accepts up to 45 minutes of outage and up to 15 thousand of authorized extra cost but requires complete movement reconciliation. These are three different criteria. Savings do not automatically compensate for missing reconciliation, and staying within budget does not establish compliance with the window. State units, measurement method, period, and who can accept exceptions. Also check capacity: willingness to accept cash exposure does not create cash to absorb it. An aggregate score can support comparison but should not conceal a violated mandatory criterion. When stakeholders disagree, make the affected objective visible and seek a decision from the defined authority rather than implicitly voting for the most influential person.
Assign responsibility without inventing authority
Separate risk owner, action owner, and acceptance decision maker. The Linux team may implement a patch; that does not automatically authorize it to accept business interruption above the limit. Define relationships with APS, development, security, and the supplier, including responsibility when the primary person is unavailable. A useful matrix resolves a concrete decision rather than merely filling letters. For each priority risk, describe who maintains assessment, who delivers the response, and who decides residual exposure. Apply the same logic to automation: a tool authorized to recommend ratings does not gain permission to close risks. Retain traceability of human approval and operational boundaries.
Fit participation and cadence to the work
A hybrid project may need review at sprint end, after an architecture change, and before each critical window. A monthly reporting cadence does not require waiting a month for a dependency threatening tomorrow’s delivery. Include people who know the overnight service, receive its files, and manage supplier support, even if they do not design the application. Allow contributions before the sponsor presents a preference and use neutral questions. If teams are penalized for the number of risks identified, they may stop reporting; assess identification and response quality rather than rewarding an empty list.
Deliver a plan that enables decisions
In the final exercise, prepare one page for a middleware change: three objectives, criteria for each, roles, sources, cadence, and escalation. Define what management and APS receive without changing facts between audiences. Management receives exposure, options, and the requested decision; APS receives signals, action, contacts, and execution conditions. Add a review rule when volume, supplier, or architecture changes. Distinguish assessment method from an individual risk: scales and process belong in the plan; the concrete event, its owners, and responses belong in the register. The document becomes useful when another person can apply its criteria to the same evidence and explain the conclusion.
Workshop: apply the three fictional criteria to a 35-minute forecast, additional cost of 12 thousand, and 99.8% reconciliation. The first two comply; complete reconciliation does not. Write the requested decision, missing evidence, and who may decide an exception without assuming that authority.
Common pitfalls
Accepting a green average despite a failed mandatory criterion, importing evidence without context, confusing implementer with decision maker, or encouraging teams to hide risks to improve metrics.
Related topics: Context, appetite, and decision rights · Organize people, cadence, and resources · Identify events, assumptions, and opportunities
The plan should connect objectives with criteria, evidence, roles, and decision timing. Workshop limits are fictional and are neither PMI rules nor bank procedures.
Reference: How much risk is too much risk? Understanding risk appetite · PMI-RMP five-domain ECO, updated-2024 public document