Project Risk Management

1. Project Risk Management

2. Project risk is a potential source of deviation from the project plan. Project risks can have negative or positive impact on the project. • Project risks that are negative are called threats. • Project risks that are positive are called opportunities.

3. Attitudes Toward Risk • Clinically depressed people judge risks more accurately than ‘normal’ people do. • ‘Safe as houses’ – real estate will always go up. • ‘Everything will be OK’ • Darwin awards • Other examples?

4. ‘Get ‘r done!’ – No matter what? From Pamela S. Evers, ‘Business and Contract Law’, Cameron School of Business Executive Certificate Program

5. Types of Project Risks 1. Direct Risks to the Success of the Project 2. Other Risks The Iron Triangle Time Cost Scope (Quality) • Health and safety • Environmental • Legal • Others?

6. The Biggest Risk of All

8. Risk Management Process • Risk • Uncertain or chance events that planning can not overcome or control. • Risk Management • A proactive attempt to recognize and manage internal events and external threats that affect the likelihood of a project’s success. • What can go wrong (risk event). • How to minimize the risk event’s impact (consequences). • What can be done before an event occurs (anticipation). • What to do when an event occurs (contingency plans).

9. Risk Management’s Benefits • A proactive rather than reactive approach. • Reduces surprises and negative consequences. • Prepares the project manager to take advantage of appropriate risks. • Provides better control over the future. • Improves chances of reaching project performance objectives within budget and on time.

10. The Risk Management Plan The risk management plan does not detail the planned responses to individual risks within the project-this is purpose of the risk response plan. The risk management plan is responsible for determining: • How risks will be ID • How quantitative and qualitative analysis will be completed • How risk response planning will happen • How risks will be monitored • How ongoing risk management activities will happen throughout the project lifecycle

11. Meeting to create the Risk Management Plan Attendees should include: • Project Manager • Project team leaders • Key stakeholders • Personnel specific to risk management • Others

12. Categories of Risk to Project Success Examples? • Technical, quality or performance risks: People, equipment or technology used on the project are not able to do the job properly • Organizational risks: Unreasonable expectations, misaligned processes, requirements, constraints, inadequate funding or resources, etc. • External risks: Legal and labor issues, regulations, politics, economic shifts, weather • Project management risks: Misallocation or poor management of time and resources, poor understanding of project scope or objectives

13. Preparing for Murphy’s Law • What might cause scope creep or poor quality? • What might cause work to be delayed? • What might cause costs to increase? • What might cause the project to generate ‘negative externalities’? (e.g. health/safety, environment, etc.)

14. Ways to Identify Risks • Brainstorm with team members – using SWOT analysis, Ishikawa cause-and-effect diagrams, flow charts, influence diagrams or other tools • Interview customers, partners, other stakeholders • Use the Delphi technique (anonymous inquiry) • Work ‘backwards’ from effects through proximate causes to root causes – ask ‘why?’ five times. • Identify risks through interviews. • Identify and examine all assumptions!

15. Analyzing Assumptions • Probability: How reliable is the information underlying the assumption – how likely is it to be wrong? • Impact: How badly would the project be affected if the assumption is wrong?

16. Understanding Risks through Assumptions High Medium Priority Risks High Priority Risks Probability Medium Priority Risks Low Priority Risks Low Low High Impact

18. Influence Diagrams

19. Three Ways to Manage Risks High Medium Priority Risks High Priority Risks Probability Medium Priority Risks Low Priority Risks Low Low High Impact

20. Creating a Risk Register • Risks • Potential responses • The root cause of risk • Updates risk categories

21. Qualitative risk analysis Qualifying the risks that have been identified; subjectively

22. Steps in Qualitative Risk Analysis • Identify risks • Prioritize risks by probability and impact • Identify risks that require more analysis • Highlight risks to be addressed first

23. Creating a Risk Register

24. Numerical Risk Register

25. The ‘RAG’ Risk Register

26. Assessing Risks – Key Considerations Update the risk register regularly! • Data precision: How much do we really know about probability and impact? (assumptions!) • Reporting bias: Does the person who generated the information have a reason to under/over estimate probability or impact? • Timing: Is the risk imminent, medium-term or distant? Imminent risks require greater attention.

27. Quantitative Risk Analysis Numerically assessing the probability and impact of identified risks

28. Goals of Quantitative Risk Analysis • Ascertain the likelihood of reaching project success • Ascertain the likelihood of reaching a particular project objective • Determine the risk exposure for the project • Determine the likely amount of contingency reserve needed • Determine the risks with the largest impact • Determine realistic, time, cost, scope targets

29. Inputs for Quantitative Analysis • Risk register • Risk management plan • Cost management plan • Schedule management plan • Organizational process assets

30. Notes on Quantitative Risk Analysis • Risk distribution: Describes relationship between impact and probability: uniform, normal, triangular, beta or logonormal. • Sensitivity analysis: Assesses impact on the project (cost, time, scope/quality) of various risk outcomes • Expected monetary value: Quantifies financial impact of a given risk based on the probability that it will occur. (Value-at-Risk) • Decision trees: Quantifies probabilities in order to determine the best outcome (highest expected value) • Monte-Carlo and other simulations: Use computer algorithms to simulate decision-making in a complex environment.

31. Expected Monetary Value (EMV) • Scenario 1 Total Expected Monetary Value 100% $81,750

32. Expected Monetary Value (EMV) Scenario 2 Total Expected Monetary Value 100% $60,750 which scenario do you choose? Number one, because it has the highest EMV, or $81,750

33. Decision Trees

34. Failure Mode and Effect Analysis (FMEA) • List ways project might fail • Evaluate severity (S) of each failure • Estimate likelihood (L) of each failure occurring • Estimate ability to detect each failure (D) • Calculate Risk Priority Number (RPN) • Sort potential failures by their RPNs

35. Preparing for Risk Response

36. Tools and Techniques for Risk Response Planning • Strategies for negative risks or threats • Strategies for positive risks and opportunities • Strategies for both threats and opportunities • Contingent response strategy

37. Strategies for Negative Risk Examples? • Avoid: Change some element of the project to remove the risk entirely. • Transfer: Move ‘ownership’ of all or part of the risk to a third party. • Mitigate: Take steps in advance to reduce either the impact or the probability of the risk, or both.

38. Strategies for Positive Risk or Opportunities • Exploit: looking for opportunities for positive impacts, you want to make sure it will occur on the project. • Share: similar to transferring, assigning risk to a third party who may be best able to exploit the opportunity. • Enhance: entails watching for and emphasizing risk triggers to assure the organization realizes the benefits.

39. Strategies for Both Threats and opportunities • Acceptance strategy: • Passive acceptance: you make no plans to try and avoid or mitigate the risk, your willing to accept the consequences • Active acceptance: developing contingency reserves to deal with risks should they occur

40. Contingency Reserve Planning • Estimate the percentage probability of each risk occurring • Calculate the dollar value of its impact (negative) • Multiply the two to get the expected value • Add up expected value of all down-side risks • Offset with the expected value of any up-side opportunities • Sum is the recommended contingency reserve.

41. Contingency Reserve Planning What drives the monetary impact of each risk?

42. Four Possible Responses to Every Risk

43. Exercise: Identify the type of risk response strategy (avoid the probability, mitigate the impact, transfer, exploit, enhance the probability, enhance the impact, share, or accept) being described

44. Exercise: Identify the type of risk response strategy (avoid the probability, mitigate the impact, transfer, exploit, enhance the probability, enhance the impact, share, or accept) being described