Dear Abhinav:
That is a great question. The concept of “contingency plan” was a bit ambiguous in the PMBOK4 and the PMBOK5 has further clarified this. Let me share what PMBOK4 and PMBOK5 say about contingency plans:
PMBOK4: The unknown risks, that is the risks that exist but the organization is not aware of, cannot be managed (as they are unknown to the organization). However since the unknown risks exist, a contingency of fallback plan should be in place to handle a situation when an unknown risk occurs. For example due to any reason if the project scope of work changes requiring additional resources we will trigger this “Plan B”.
PMBOK5: The 5th edition clarifies this concept. The PMBOK5 accepts that contingency plans can also be established for known risks. For some risks it is more appropriate to have a contingency plan in place rather than proactively managing them by mitigating, transferring or avoiding. For example if we know that there is a risk that the project scope of work might get changed as a result of a new government regulation that might require additional resources. If this risk, new government regulation impacting the project scope, is known, but the probability of the risk is so low that we do not want to avoid, mitigate or transfer, in this case, rather than accepting the risk, we might create a contingency plan for the risk. However, for a contingency plan, we need to determine and document the conditions that would trigger the contingency plan. I would say this is sort of passive risk management.
Now, coming to your question, if you have finished the Plan Risk Responses process, this means that you have either avoided, mitigated, transferred or accepted all of the known project risks (for PMBOK5 you might have also developed contingency plans for some of the known risks as well). At this stage the residual risks are all those risks that are either still “unknown” or have been deliberately accepted.
So now the Plan Risk Responses process has been completed and we still have residual risks. What shall we do with them? We need to regularly review the project risks during the Monitor and Control Risks process throughout the life of the project. Whenever we will get any additional information we will update the risks register. So practically speaking the choice A will hold in any case.
Regarding the choice B, it will still hold for the “unknown” risks as we do create a contingency plan for the unknown risks. However, the residual risk also include the deliberately accepted risks hence we might not have a contingency plan for the accepted risk. Hence choice A will hold in any case. On the other hand, choice B, which is very appealing as the right answer, will only hold for the unknown risks and not for the deliberately accepted risks.
I must say this is a tricky question. If this question have been presented to me, my initial response would have been the same as yours. Please do share the full question along with the explanation and the source so that we can further analyze this question.
Regards,
Khurram