Risk Response Strategies for Secure Software Development

Vendor Outsourcing for Electrical Wiring Work Packages

Question

Adrian is the project manager of the NHP Project.

In her project there are several work packages that deal with electrical wiring.

Rather than to manage the risk internally she has decided to hire a vendor to complete all work packages that deal with the electrical wiring.

By removing the risk internally to a licensed electrician Adrian feels more comfortable with project team being safe.

What type of risk response has Adrian used in this example?

Answers

Explanations

Click on the arrows to vote for the correct answer

A. B. C. D.

D.

This is an example of transference.

When the risk is transferred to a third party, usually for a fee, it creates a contractual-relationship for the third party to manage the risk on behalf of the performing organization.

Risk response planning is a method of developing options to decrease the amount of threats and make the most of opportunities.

The risk response should be aligned with the consequence of the risk and cost-effectiveness.

This planning documents the processes for managing risk events.

It addresses the owners and their responsibilities, risk identification, results from qualification and quantification processes, budgets and times for responses, and contingency plans.

The various risk response planning techniques are as follows: Risk acceptance: It indicates that the project team has decided not to change the project management plan to deal with a risk, or is unable to identify any other suitable response strategy.

Risk avoidance: It is a technique for a threat, which creates changes to the project management plan that are meant to either eliminate the risk or to protect the project objectives from this impact.

Risk mitigation: It is a list of specific actions being taken to deal with specific risks associated with the threats and seeks to reduce the probability of occurrence or impact of risk below an acceptable threshold.

Risk transference: It is used to shift the impact of a threat to a third party, together with the ownership of the response.

Adrian has used the risk response of "Transference" in this example.

Risk response is the process of determining what actions to take in response to identified risks. It involves identifying, assessing, prioritizing, and addressing risks that may impact a project's objectives. There are four main risk responses: acceptance, avoidance, mitigation, and transference.

In this example, Adrian has decided to hire a vendor to complete all work packages that deal with electrical wiring. By doing so, Adrian is transferring the risk associated with electrical wiring to the vendor. This means that the vendor is responsible for managing and mitigating the risks associated with electrical wiring, and Adrian is no longer directly responsible for these risks.

Transference is a risk response strategy that involves shifting the impact of a risk to a third party. This can be achieved through insurance policies, outsourcing, or other contractual agreements. In this case, Adrian has decided to outsource the electrical wiring work to a licensed electrician, who will assume responsibility for managing the risks associated with that work.

Transference can be an effective risk response strategy, particularly when the risk is outside the organization's control or expertise. By transferring the risk to a third party, the organization can reduce its exposure to the risk and focus on other areas of the project that require attention.

In summary, Adrian has used the risk response of transference by outsourcing the work packages that deal with electrical wiring to a licensed electrician.