Download Risk Management for Projects

Risk Management
for
Projects
1
Project Risk Management
Session Agenda

2
Review risk concepts
–
Risk Management Overview and the Risk Management Plan
–
Risk Identification
–
Risk Quantification
–
Risk Response
–
Risk Control

Team exercise

Team exercise readout

Closing items
Project Risk Management
Risk Management Overview
and the Risk Management Plan
3
Project Risk Management
Risk Management Overview

What is risk?
Risk: An uncertain event or condition that, if it occurs, has a positive
or negative effect on a project’s objectives
VENTURE
OUTCOME
(Project)
(Products)
FAVORABLE
UNKNOWNS
(Opportunity)
(Uncertainty)
UNFAVORABLE
(Risks)
4
Project Risk Management
Risk Management Overview
Project Lifecycle
Risk vs. Amount at Stake
I
N
C
R
CONCEPT
DEVELOPMENT
IMPLEMENT
CLOSE
PHASE
PHASE
PHASE
PHASE
$
OPPORTUNITY AND RISK
E
V
A
S
A
PERIOD WHEN
I
HIGHEST RISKS
L
N
ARE INCURRED
U
E
G
PERIOD OF
R
HIGHEST
I
S
5
K
RISK IMPACT
AMOUNT AT STAKE
Project Risk Management
Risk Management Overview

6
What is risk management?
–
Identifying, analyzing, prioritizing, and responding to
risk events
–
Integration of risk management activities into your
other project management functions
–
Developing responses to risk to meet your project
objectives
–
Project risk management is PROACTIVE
Project Risk Management
Risk Management Overview
INTEGRATING RISK WITH OTHER PROJECT MANAGEMENT FUNCTIONS
PROJECT
MANAGEMENT
INTEGRATION
INFORMATION /
SCOPE
COMMUNICATIONS
Expectations
Feasibility
QUALITY
Requirements
Standards
Time Objectives,
Constraints
Life Cycle and
Environment Variables
PROJECT
RISK
Cost Objectives,
Restraints
Ideas, Directives, Data
Exchange Accuracy
Availability
Productivity
HUMAN
RESOURCE
Services, Plant, Materials:
Performance
CONTRACT /
TIME
COST
7
PROCUREMENT
Project Risk Management
Risk Management Overview

Components of the Risk Management Plan
–
–
–
–
–
–
–
–
–
–
8
Methodology
Roles and responsibilities
Budgeting
Timing
Risk categories
Definitions of risk probability and impact
Probability and impact matrix
Stakeholder’s tolerances
Reports
Tracking
Project Risk Management
Risk Management Overview

Results from developing the Risk Management Plan
–
You have a written plan
–
You know what actions you have to do
–
You know who is responsible for what
–
You can track your work
–
You can learn from your risk activities and help others with
their risk
9
Project Risk Management
Risk Management Overview

10
Risks vs Issues
–
Many projects use risk and issue logs. Sometimes the management of
issues and risks can become confusing.
–
The PMBOK definition of an Issue:

A point or matter in question or in dispute, or a point or matter that
is not settled and is under discussion or over which there are
opposing views or disagreements.
–
If you have the freedom to define these items and their logs and the
subsequent management of risks and issues, then great. Handle risks and
issues as you desire. My suggestion is to follow as closely as possible the
PMBOK guidelines.
–
If you are dictated by the company, organization, or management team to
handle risks and issues in a particular manner, then follow these
guidelines. Document in your Project Management Plan, Risk
Management Plan, and or Issue Management Plan how you will handle
risks and issues.
Project Risk Management
Risk Identification
11
Project Risk Management
Risk Identification

Risk in corporate business is typically divided into 2 basic
types

Business Risk: Chances of profit or loss associated with a business
endeavor


12
Business employs a staff of qualified workers to increase profit and reduce
chances of loss
Pure or Insurable Risk: Divided into 4 categories

Direct property: Destruction of property by fire, etc.

Indirect property: Extra expenses associated with rental property or loss due
to a business interruption

Liability: Chance of a lawsuit of bodily injury, damages, etc.

Personnel: Injuries to workers (Worker’s Comp)
Project Risk Management
Risk Identification

Risk in project management
–
Usually not enough attention is paid to risk on projects
–
All risks are not independent and frequently the greatest risk on
a project comes from a series of related/integrated events
–
Ultimate responsibility of risk management resides with the
project sponsor
–
As the project manager representing the sponsor, risk
management becomes a large responsibility for you
13
Project Risk Management
Risk Identification

Risk identification is never done

Risk identification is performed throughout the life of the
project

14
The process for identifying risk
–
Understand the project
–
Identify the risk event
–
Document the results and take appropriate actions
Project Risk Management
Risk Identification

Types of risk
–
Technical
–
External
–
Organizational
–
Project Management
Note: These are example types of risk and this list can be modified to
meet the needs of your project

Developing a project RBS (Risk Breakdown Structure) is
an excellent tool to help identify risks
15
Project Risk Management
Risk Identification
PROJECT
RBS
TECHNICAL
16
EXTERNAL
PROJECT
MANAGEMENT
ORGANIZATIONAL
REQUIREMENTS
SUBCONTRACTORS
& SUPPLIERS
PROJECT
DEPENDENCIES
ESTIMATING
TECHNOLOGY
REGULATORY
RESOURCES
PLANNING
COMPLEXITY &
INTERFACES
MARKET
FUNDING
CONTROLLING
PERFORMANCES
& RELIABILITY
CUSTOMER
PRIORITIZATION
COMMUNICATIONS
QUALITY
WEATHER
The Risk Breakdown Structure (RBS) lists categories
and sub-categories for project risk. The actual
categories will vary across different types of projects.
Project Risk Management
Risk Identification

What you need to identify risk
–
–
Product description
Planning documents








–
Historical Information

17
Project scope statement
Cost mgt plan
Schedule mgt plan
Communications mgt plan
Enterprise environmental factors
Stakeholder register
Quality mgt plan
Organizational process assets

Previous project data
Expert knowledge
Project Risk Management
Risk Identification

In your risk identification meeting
–
Validate RBS with core team
–
Identify risks by source (RBS)
–
Identify risks by level of uncertainty:
Known
Known / Unknown
Situation with no Situation with an
uncertainty
identifiable uncertainty
18
Unknown / Unknown
Situation whose
existence we cannot
imagine
Project Risk Management
Risk Identification

Conduct a risk identification meeting
–
Gather all relevant data
–
Schedule a risk management meeting with your core team members
–
Use a structured approach: Brainstorming, Nominal Group Technique, Delphi
Technique, Mind Mapping, Project Lessons Learned
–

Schedule risk identification meetings in your project plan
–

After certain milestones: Requirements complete, design complete, etc.
Event driven
–
19
Focus on identifying risk only
A risk event happens and becomes part of the risk register
Project Risk Management
Risk Identification

20
Brainstorming
–
Chose a facilitator (best if other than the project manager)
–
Chose a scribe to capture the risks
–
Use a category or categories to start the creativity flowing
–
Do not judge or analyze during this effort
–
Focus on getting the universe of risks for your project
Project Risk Management
Risk Identification

Nominal Group
–
Gather the core team for a risk workshop
–
Use flip charts or a whiteboard to collect info
–
Begin by having each person identify potential areas of risk
–
Then within each area have each person write at least 3-5 risk
events
–
21
Repeat until everyone has listed their risks
Project Risk Management
Risk Identification

Delphi technique
–
Identify a facilitator
–
The facilitator then identifies qualified experts to participate
–
The facilitator poses questions to the experts individually
–
The facilitator then analyzes the results to identify common
themes
22
–
The results are then shared with the experts for validation
–
The list is then refined and again shared with the panel
–
The facilitator the creates a single results document
Project Risk Management
Risk Identification

Mind mapping
–
Begin with a category of risk in the center represented by a circle
–
Major risks for that category are represented by lines connecting
with the circle
23
–
For each major risk identify smaller risks that are part of that risk
–
Do not judge or evaluate at this time
–
Continue until no more risks can be identified
Project Risk Management
Risk Quantification
24
Project Risk Management
Risk Identification

25
Identify your risks in a risk register or a risk log
Functional Area
Identify the functional business areas
potentially impacted by the risk
Risk Category
Cost; External; Schedule; Technical;
Resources; Operational
Risk Description
Description of the risk and the impact of it
Date Identified
Date the risk was identified
Raised By
Who identified the risk
Project Risk Management
Risk Quantification

What are the right risks to manage
–
–
–

When to quantify risks
–
–
–
–
–
–
–
26
Analyzing risks for probability and impact
Developing a risk profile for your project
Prioritizing your risks
Whenever a new risk is created
An existing risk changes
Influential factors change
New information surfaces
A change is proposed by the sponsor
Market conditions change
Significant personnel leave the project
Project Risk Management
Risk Quantification

Quantitative Analysis
–
–
–
–
–
–
27
Relies on a numeric value
Uses objective data
Requires understanding of
probability theory
Removes some uncertainty
Should be based on
historical data
Some examples are:
sensitivity analysis,
expected monetary
analysis, and modeling and
simulation

Qualitative Analysis
–
Uses subjective values:
Green, Amber, Red
–
Requires common
understanding of ordinal
ranking system
–
May be less precise than
quantitative analysis
–
Should be defined in terms
of the parameters of the
project
Project Risk Management
Risk Quantification
28
Project Risk Management
Risk Quantification

Probability
–
Can be done in a basic approach by developing a simple estimate of the probability that an
event will be late in delivery
–
–

Ed says it is 50% likely this task will be late

Probability of Event 1 x Probability of Event 2 = Probability
Can be done in a more complex manner by using weighted averages

Joe says 35% chance of being late

Mary says 40% chance of being late

Ed says 50% chance of being late

Joe gets twice as much credit because he knows more about the situation

The probability is: ((2 x 35) + (40) + (50)) / 4 = 40%
Quantifying risk probability can become quite complex, there are many resources to assist
you with more detailed approaches (books, internet research, multi-day training,
29
consultants).
Project Risk Management
Risk Quantification

Assessing Impact
–
Schedule Tools:



–
Cost tools:





30
Network analysis (relationships, durations, critical path(s),
near critical paths, hard constraints)
Resources (availability, competency, productivity)
Estimates (accuracy, source, method)

WBS
Requirement definition
Estimating methodologies
Expected monetary value
Decision trees
Financial analysis
Project Risk Management
Risk Quantification

Assessing Impact (cont.)
–
31
Quality

Ask yourself the question “What if the project fails to
perform as expected during its operational life?”

Of all the project objectives, conforming to quality objectives
is the one most remembered

Therefore, this is one of the most important dimensions
impacting your project

You can use financial analysis to identify risk for poor quality
by quantifying long term activities that will impact the
product lifecycle for your analysis
Project Risk Management
Risk Response
32
Project Risk Management
Risk Response

33
Risk response is:
– Defining steps for responses to opportunities and threats
– Assigning responsibility
– Developing responses for negative risks:
 Avoiding: Changing the project mgt plan to eliminate the risk.
Could involve changing the objective, modifying the
schedule, or reduction in scope.
 Mitigating: A reduction in the probability or impact to the
project. Taking early action to reduce the probability,
adopting less complex processes, or conducting more tests.
 Transferring: Shifting the risk to a third party for the
management of the risk. Does not eliminate the risk, could
involve insurance, warranties, bonds.
 Insurance: Purchase insurance to reduce/eliminate risk – an
athlete may purchase insurance against injury to guarantee
their income.
Project Risk Management
Risk Response

34
Risk response is:
– Developing responses for negative risks(cont.):
 Accepting: It is possible that the risk cannot be eliminated or
managed. Can be active or passive in approach – a
contingency reserve in time, money, or resources.
– Developing responses for positives risks or opportunities
 The strategies for managing positive risks are:
– Exploit the situation. We will do whatever we can to
make sure the event does happen so we can enjoy the
rewards of the event.
– Enhance the probability and positive impacts of the
event.
– Share the ownership with a third party who can better
enhance the situation.
– Accept the opportunity, take the advantages provided by
the event, but do not actively pursue the event.
Project Risk Management
Risk Response




Approach response development from a project wide
perspective
Consider related risks
Stay within your project scope on your responses
Consider the following for contingency planning:
–
–
–
–
35
The management of a contingency budget
The development of schedule alternatives and work-arounds
Complete emergency responses to deal with major areas of risk
An assessment of project shut-down liabilities
Project Risk Management
Risk Control
36
Project Risk Management
Risk Control
37

Actively work your risk register/log

Update risks as needed (data, new resources,
new/changing requirements)

Review the log in status calls, set and use due dates for
active contingency plans

Hold assigned resources accountable for their action
items

Engage sponsor when invoking contingency plans to
ensure they know a risk has happened and the team is
actively working the response plan
Project Risk Management
Risk Control
Example Log
38
Risk ID
Sequential number assigned
Functional Area
Identify the functional business areas potentially impacted by the risk
Risk Category
Cost; External; Schedule; Technical; Resources; Operational
Risk Description
Description of the risk and the impact of it
Date Identified
Date the risk was identified
Raised By
Who identified the risk
Date Assigned
Date the risk was assigned
Assigned To
Who the risk was assigned to
Probability
1, 2, 3, 4
Potential Impact
1, 2, 3, 4
Risk Factor (P*I)
Probability * Impact
Positive or Negative Impact
Will the potential impact of the risk have a Positive, Negative, Both or Unknown impact if realized?
Response Category
Acceptance; Mitigation; Transfer; Avoidance
Status/Comments
Status of risk and update/comments about it
Trigger
Preliminary event that will indicate the risk is about to take place
Proposed/Actual Resolution
Risk Response plan
Contingency Plan
Alternate Plan if Risk Response fails
Project Risk Management
Small Team Exercise
39
Project Risk Management
Small Team Exercise




40
Your task, should you choose to accept it, and you must,
is to develop a risk plan for your project
The group will break into 3-5 person teams to work on
their project
There are 2 projects, a construction project and a new
product development effort
You will develop your risk plan, then the similar project
teams will get together (all the construction teams in one
group and all the product development teams in another)
and develop a summary of what happened, then each
large project group will present to the whole class their
experiences
Project Risk Management
Small Team Exercise

Product Development Project
–
–
–
–
–
41
This is a telecommunications product
The team will develop and deploy a new feature to be used on
your home or work phone called “Phone Buzz”
There is an estimated customer base of 6M consumer users and
1M business users across the 50 states
Revenue for the consumer base is estimated to be $720M per
year and revenue for the business segment is estimated at
$180M per year.
The base telecommunications technology for the application is
proven, but must be combined with a new technology that has
never been utilized on the current telecommunications system
architecture
Project Risk Management
Small Team Exercise

Product Development Project (cont.)
–
–
The VP of Marketing is planning on announcing the new
product at the industry’s largest trade show in 6 months
The budget for the project is currently set at:



–
–
Initial estimates are 12 – 18 months to complete the project
The project has been approved to start, and the following
assets have been developed



42
$ 25M for technology
$ 1M for business project costs
$ 5M for marketing

High level business requirements
A preliminary technical feasibility assessment
Secondary market research has been performed
The sponsor and initial core team have been identified
Project Risk Management
Small Team Exercise

Product Development Project (cont.)
–
Core team members


43
Required
–
Business Project Manager
–
Technical Project Manager
–
Project Sponsor
Optional
–
Operations Manager
–
Training Project Manager
Project Risk Management
Small Team Exercise

Construction Project
–
–
This project will develop a combined residential and commercial
community in southern Louisiana, the community will be called
“Southern Comfort”
Planned activities are:





300 Residential Condos (Targeted sales price $100K to $150K each)
100 Residential Homes (Targeted sales price $350K to $500K each)
A small office complex (50,000 sq. ft.)
2 convenience stores, each with a gas station
4 recreational areas:
–
–
–
44
2 open space areas: Also used for youth soccer and football
1 area with tennis courts and basketball courts
1 area with 6-8 baseball/softball fields
Project Risk Management
Small Team Exercise

Construction Project (cont.)
–
The current project budget is $47M, targeting 3 years to
complete the entire effort
Unit Type
Quantity
Sq. Ft (tot)
Cost
Cost per Unit
Condos
300
360,000
21,600,000
72,000
Houses
100
200,000
18,000,000
180,000
Commercial
1
50,000
6,500,000
6,500,000
Stores
2
8,000
1,040,000
520,000
Fields
4
100,000
25,000
47,240,000
45
Project Risk Management
Small Team Exercise

Construction Project (cont.)
–
So far the following has happened:

The land has been purchased

The property is located next to a protected wildlife area and had wonderful
views and access to good shopping and restaurants
46

35 condos have been built or are in progress

10 homes have been built or are in progress

The zoning for the commercial lots has not yet been completed
Project Risk Management
Small Team Exercise

Construction Project (cont.)
–
Core team members


47
Required
–
Business Project Manager
–
Construction Project Manager
–
Project Sponsor
Optional
–
Sales Manager
–
Supplier/Materials Project Manager
Project Risk Management
Small Team Exercise

Your assignment, as the new Business Project Manager is to:
–
–
–
–
–
–
–
–
Develop a Risk Management Plan
Develop an RBS
Conduct a Risk Identification meeting
After the identification meeting is complete, quantify your risks
Develop risk responses for your significant risks
Prepare a summary sheet on your findings to share with the other small
teams in your project type
Develop a summary sheet with the similar projects to present to the
entire class
Notes:


48
Each small team will call for 2 reviews, one for their Risk Management Plan
and one for their Risk Register once they complete their risk responses from
the facilitator
Updates to the project information will be provided during the exercise
Project Risk Management
Small Team Exercise

Conclusions
–
–
–
–
–
–
49
What worked well?
What did not work so well?
What happened during the process that you found
interesting?
How well were you able to manage your risk?
What would you do differently?
Is there anything you would now do differently on
your project based on this experience?
Project Risk Management
Conclusion
Conclusion
50
Project Risk Management
Conclusion

51
Risk management requires:
–
Planning
–
Structure
–
Analysis
–
Creativity
–
Constant attention
–
Flexibility
–
Communications, communications, communications!!
Project Risk Management
Conclusion (cont.)



The PMBOK has a lot of great reference materials to
assist you with your Risk Management planning activities
Whatever you do, just do SOMETHING to address risk on
your projects – and do it in a structured manner
If your company/organization does not have templates or
a process in place, develop your own tools.
–
–
52
Use the PMBOK for ideas on the approach and build a risk
register in Excel.
A tab in Excel identifying your “plan” and another tab with the
Risk Register will work much better than nothing.
Project Risk Management
Conclusion (cont.)

Program Risk Management
–
–
–
–
Project risk management principles can be applied to
programs
Use of an RBS will be helpful for programs
Project risks will roll up to the program
Program risks will take on a more global nature in
addition to the project risks within the program

–
53
External events, company profits, legal/compliance issues,
political issues, company strategies
Communication with your sponsors is even more
critical on programs than on projects
Project Risk Management
References
54
Project Risk Management
References

PMBOK Fifth Edition

Book – “Project and Program Risk Management”,
R. Max Wideman

PMI Seminar – “Managing Risk on Projects”,
Jimmie West
55