Tasleemat Forms Guide

Project Artifact: Risk Mitigation Action Plan

Document Reference: PMO-04.08.07

This document provides a comprehensive, professional reference to understand the purpose and effective usage of the Risk Mitigation Action Plan in alignment with the Tasleemat framework.

1. What?

A record of one risk and the answer to it. The risk is named as the register carries it, scored as probability times impact, given one of the four treatments, and then planned: the steps, their owners and dates, what they cost, and the score the plan expects to reach.

2. Why?

Because a register on its own only says what might go wrong, and a risk that is listed without an answer is indistinguishable from a risk that is being ignored. This is where the answer becomes a commitment: who does what, by when, at what cost. It is also the only document that lets anyone later tell whether the response worked, because the expected score is written down in advance.

3. When?

Written once the risk has been identified and scored, and revised when the risk changes materially or the treatment is changed. The target score belongs in the first version rather than the last, because a target written after the fact describes what happened rather than committing to anything.

4. Who?

Owned by the person who carries the risk, which is not always the project manager: the risk owner is whoever can actually act on it. The project manager signs because the plan commits project effort, and the PMO lead signs because this is the document the risk audit reads.

Tailoring Tips

• Plan only the risks whose score justifies the effort. A plan for every registered risk spends the same effort on a risk that would have been accepted anyway.
• Give an accepted risk a reason and a name. Acceptance is the one response that is a decision rather than work, so it is the one most often left unrecorded.
• Keep the register's wording. A plan that renames the risk it is answering cannot be joined back to the register, and the two then disagree about what is being managed.

Alignment & Dependencies

1. Pre-requisites & Inputs (Upstream Dependencies)

• Mandatory:
  • Project Charter (PMO-03.01)
  • Assumption Log (PMO-03.03)
  • Project Baselines (Scope/Schedule/Cost)
• Optional / Contextual:
  • AI Governance Plan (PMO-02.02)
  • Procurement Strategy (PMO-04.09.02)

2. Downstream Dependents

• Mandatory:
  • Risk Register (PMO-04.08.02)
  • Risk Reports (PMO-04.08.06)
  • Risk Audits (PMO-06.06)
• Optional / Contextual:
  • Risk Mitigation Action Plan (PMO-04.08.07)
  • Decision Log (PMO-05.02)

5. How?

To accurately complete the Risk Mitigation Action Plan, populate the following sections based on the project context (ensuring reference to parameters.md for the general project variables):

• Risk ID and Title: The identifier and title of the risk exactly as the risk register carries them, so this plan can be joined back to the register. A title written here that differs from the register's is the defect that makes the two documents disagree about what is being planned for.
• Current Risk Score: The probability multiplied by the impact, each on the scale the register uses, with both factors shown rather than only the product. A score given on its own hides the reason for it, and a score whose factors cannot be read back cannot be recalculated when one of them changes.
• Mitigation Strategy: Which of the four treatments the risk is given: avoid, transfer, mitigate, or accept. Accept is a decision that needs a reason, so an accepted risk carries the reason and the name of whoever accepted it.
• Detailed Action Steps: The plan as ordered steps, each with an owner and a date, so that the plan can be read as work rather than as intent. A step with no owner is a wish, and a step with no date is a step that never starts.
• Resource Requirements: What executing the plan costs and who has to be assigned to it: the budget, the people, and the time. Stated so the request can be approved against something, rather than argued in a meeting where no one can check it.
• Target Risk Score: The score the plan is expected to reach, with the assumptions it depends on. A target written without saying which steps deliver it cannot be checked afterwards, which leaves no way to know whether the plan worked.

📥 Associated Templates

• 📄 Printable Template (Markdown)
• 🤖 LLM Generation Prompt
• 📊 Data Structure (JSON)
• 📈 Tabular Data (CSV)

6. Reference Example

A fully completed, gold-standard reference example illustrating this artifact in practice is available:

📖 Completed Example: 04_08_07_Risk_Mitigation_Action_Plan_Example.md

RISK MITIGATION ACTION PLAN - LLM Generation Prompt

SYSTEM INSTRUCTIONS: This document is the detailed instruction set for generating the RISK MITIGATION ACTION PLAN. When asked to populate the template, follow the guidance for each section below to produce the requested content. Refer to parameters.md for the general project variables.

Context and Definition: The commitment of what will be done about one named risk: the treatment it is given, the steps that deliver that treatment, what the steps cost, and the score the project expects to reach once they are done. It is an output of Plan Risk Responses, and it exists so that a risk which has been identified does not stay identified.

Alignment & Dependencies: * Pre-requisites (Inputs): * Mandatory: Project Charter (PMO-03.01), Assumption Log (PMO-03.03), Project Baselines (Scope/Schedule/Cost) * Optional: AI Governance Plan (PMO-02.02), Procurement Strategy (PMO-04.09.02) * Downstream Dependents: * Mandatory: Risk Register (PMO-04.08.02), Risk Reports (PMO-04.08.06), Risk Audits (PMO-06.06) * Optional: Risk Mitigation Action Plan (PMO-04.08.07), Decision Log (PMO-05.02)

Risk Assessment

Risk ID and Title

Instructions: The identifier and title of the risk exactly as the risk register carries them, so this plan can be joined back to the register. A title written here that differs from the register's is the defect that makes the two documents disagree about what is being planned for.

Generated Value: [ Add details... ]

Current Risk Score

Instructions: The probability multiplied by the impact, each on the scale the register uses, with both factors shown rather than only the product. A score given on its own hides the reason for it, and a score whose factors cannot be read back cannot be recalculated when one of them changes.

Generated Value: [ Add details... ]

Mitigation Plan

Mitigation Strategy

Instructions: Which of the four treatments the risk is given: avoid, transfer, mitigate, or accept. Accept is a decision that needs a reason, so an accepted risk carries the reason and the name of whoever accepted it.

Generated Value: [ Add details... ]

Detailed Action Steps

Instructions: The plan as ordered steps, each with an owner and a date, so that the plan can be read as work rather than as intent. A step with no owner is a wish, and a step with no date is a step that never starts.

Generated Value: [ Add details... ]

Resource Requirements

Instructions: What executing the plan costs and who has to be assigned to it: the budget, the people, and the time. Stated so the request can be approved against something, rather than argued in a meeting where no one can check it.

Generated Value: [ Add details... ]

Target Risk Score

Instructions: The score the plan is expected to reach, with the assumptions it depends on. A target written without saying which steps deliver it cannot be checked afterwards, which leaves no way to know whether the plan worked.

Generated Value: [ Add details... ]