All who are working in Software Industry know that Risk Management is vital part of the Software Quality too. Even for non-IT industry Risk management is equally important, as the Risk might have high impact on the cost, quality, delivery, people and other areas.
But when I read about this topic (as I already searched a lot for this) I am not able to satisfy myself with the information. I have some questions and doubts related to this topic.
- Some link says that Risk Management should be part of Test Plan and some lays emphasis on it inclusion in Project Plan, I think it is not right to write same risk at two places and tracking them down at two different locations will increase effort. So, which plan should actually contain Risk Management, or it should be completely a separate document?
Multiple times I hear about the term Risk Mitigation and Risk Contingency plans, during Risk Management.
- What actually Risk Mitigation and Contingency are (few examples will really be helpful for me)?
- Sometimes, I found that only Mitigation plan is more used and known to persons, but not enough information is there on Contingency plan. Why is that so?
- Whose responsibility is to define Mitigation and Contingency plan? As in our project anybody goes to the Risk register and write something in it. But there should be some industry level standards on who should define which plan. What are those standards and guidelines?
- Most of the time, the person defining the Risk also covers the Risk in the Mitigation plan. I think this should not be allowed. Do you agree?
- Both Risk Management and Incident Management are same or different? If different then what line differentiates between them?