Risk Management: Interactive Learning Session

1. Risk Management: Interactive Learning Session Welcome PMI-MN! March 8 Jeffrey Thaler, PMP

2. Brief Introductions • Turn to a neighbor you don’t know and introduce yourself • Level of expertise with Project Risk Management • Expert • Practitioner • Beginner • Risk? Are we talking the board game?

3. BACKGROUND • All of us have an understanding of “risk”, and our own personal sense of when risk is “too high”. • Is driving a car too “high risk” • Is my “organizational” definition different than your personal one?

4. GOAL • Learn how to use risk management more effectively through a lecturette and case study. Write down at least 2 new ideas you will use at work or at home! • Meet other project managers who can help you as you put this into practice. Share your 2+ new ideas with them before you leave today.

5. Know this guy?

6. Titanic! Over Confidence. • “I cannot imagine any condition which would cause a ship to founder. I cannot conceive of any vital disaster happening to this vessel. Modern shipbuilding has gone beyond that.” - Captain Edward Smith • “God himself could not sink this ship!” –Titanic Crewmember

7. What happened to them?

8. Fukushima! Fear… • March 12, 2011: Tsunami disaster • Oct 12, 2012: Tokyo Electric Power Company admits for the first time that it had failed to take stronger measures to prevent disasters for fear of inviting lawsuits or protests.

9. Anyone remember the Tacoma Narrows Bridge? (1940) • https://www.youtube.com/watch?v=XggxeuFDaDU

10. Forgetting Lessons… (from Washington State Dept of Transportation) • Engineering profession “forgot” that wind creates vertical movement

11. Are we smarter now? Or does this strike too close to home?

12. Or maybe these are closer to home… I had a developer who wrote great code, but he never was able to meet a deadline. “A friend” decided to save significant money on a kitchen remodel by managing it himself, and using multiple vendors. The granite installers shattered the cabinets, then were not able to install the sink which was broken. Electrician and plumber showed up with nothing to do, and there was no running water…

13. Risk Management • What is risk? • An “uncertain event or condition that, if it occurs, will have an effect on the project” • What is the difference between a risk and an issue?

14. History of Risk Management • Started in insurance, growth began with Edward Lloyd’s coffee house in London (1688). • Marine Insurance, expanded to things like death by gin-drinking. • Modern risk management: after WWII • Insurance (insurance portfolios, then other financial uncertainties). • Reliability/Safety engineering (started with military equipment, then nuclear power).

15. Risk Management (PMBOK) • Plan Risk Management • Identify Risks • Perform Qualitative Risk Analysis • Perform Quantitative Risk Analysis • Plan Risk Responses • Control Risks

16. Proactive Risk Management • Encourage ongoing, proactive (not reactive) risk management. Planning for risks and identifying potential risks up front, and managing them to minimize how many turn issues – and those that do have less project impact.

17. Risk Management Planning • Risk Management Plan • Methodology • Roles and Responsibilities • Budgeting • Timing • Scoring and Interpretation • Thresholds/Contingencies/Fallback plans • Reporting Formats • Tracking • Part of the Project/Program Management Plan. Example: https://wiki.state.ma.us/confluence/download/attachments/69894234/Risk+Management+Plan+SAMPLE.pdf

18. Risk Identification • Process of transforming uncertainties about a project into distinct risks that may be described and measured • Risks cannot be assessed until identified • Start your project “Risk Register” • Central question -- what can go wrong with this program, set of projects, project, activity, or task?

19. Methods of Risk Identification • Lessons Learned from past or other projects (we aren’t always smarter now…bridge collapses) • Brainstorming • Interviewing experts (don’t get over confident…Titanic) • Assumption Analysis • Diagramming Techniques • Cause-and-Effect, Process Chart, Influence Diagram • Good risk definition is clear, concise, and also lists the risk trigger

20. Methods of Risk Identification

21. Group Exercise • With your tablemates: • What are some general risk categories for the types of projects that you manage personally or professionally? (cost, technical, etc) • What are some examples of risks that may fall in these categories, and what are potential contributors to these risks (unrealistic expectations, new technology, etc)?

22. Qualitative Risk Analysis • Techniques • Risk Probability and Impact (can be matrix) • Project Assumption Testing (assumption stability, consequences) • Data Precision Ranking (data accuracy) • Outputs • Overall Project Risk Ranking • List of Prioritized Risks

23. Medium High High Low Medium High Low Low Medium Probability Impact Matrix I Low Medium High P High Medium Low Or, multiply PxI values, and decide thresholds.

24. Risk Marketing!!What’s the probability and impact for outdated security?

25. Quantitative Risk Analysis • More mathematical/in-depth analysis of risk on the project. • In practice, generally done in collaboration with qualitative risk analysis. • Decision tree/Expected Monetary Value or more complicated Simulations.

26. Decision Tree Arrive on-timep=.7 Result 1 $1M Option 1 Arrive 1-10 days late p=.3 Decision Vendor 1 Result 2 $500k Purchase hardware Option 2 Multiply p x ($ value for your project) to find the Expected Monetary Value.

27. Risk Response Planning • Avoidance • Change plan to eliminate risk • Transference • Insurance, subcontract. • Mitigation • Proactive planning to make things less complex, prototypes, study, etc. • Acceptance • Active acceptance – develop contingency plan • Passive acceptance – deal with it when it occurs

28. Controlling Risk • Executing your Plan, effectively responding to risks as they arise, and controlling the risks on your project SO THEY DON’T BECOME ISSUES and you stay out of the news!

29. Controlling Risk • Remember to put your laces in the right direction!

30. Case study • Before we transition, any questions?

31. CASE STUDY • For those who like the questions first 1a. Make a list of all the risks on Daf’s 2 projects 1b. For each risk, note what you anticipate are the risk probabilities, impacts, and resulting exposures. 1c. For each risk, note what might be an acceptable target date for resolution, as well as possible trigger events for that risk. 2. Would you view each of Daf’s projects overall as “high”, “medium”, or “low risk”, and why? How did you define high and low risk? 3. If you were given the opportunity to manage one or both of these projects would you accept it? Why or why not? 4. If you were in Daf’s shoes what would you do next?

32. Case Study: characters Siri Al • Serial entrepreneur, moved here to focus on healthcare opportunities after selling 2 companies he owned in Silicon Valley. • Vision: fill a gap Google Health left by providing a medical records storage solution for large customers using high tech algorithms. New company is Health HealthHealth!, which has developed its “secret sauce”: a magical application which fills in any missing medical record information using a database/language called Hadoop with a huge amount of data he licenses which is mined somewhere offshore.

33. Case Study: characters Daf. E Duk • Avid weightlifter with numerous local medals, he feels that makes him a perfect fit to work in healthcare. • Newly hired PM, previously worked as PM at a gun manufacturer where risk management wasn’t practiced. • Will manage two projects: one is focused on understanding and optimizing current customers’ experience with Health! Health! Health! in order to ensure their experience is as intuitive as possible, the second is a marketing project to create a consistent brand for Health! Health! Health!.

34. Case Study: characters Mark • Personal friend of Siri Al’s and a wealthy business partner. • Rumor has it that he was named a business analyst so he could feel like he was involved, but really to keep him from doing bigger damage to Health HealthHealth!

35. Case Study: characters Sharon • Brilliant analyst who has been critical to making many recent projects at Health HealthHealth! successful. • Everyone wants her on their project, so she is pulled in many directions

36. Health Health Health! • Risk Management Policy from SharePoint site defines 3 kinds of risks:

37. Health Health Health! • Risk Management Policy explains that exposure of each risk can be found by multiplying the probability of the risk occurring (from 0 to 100%) by the impact (from 0 to 10) on the risk register. Risks receiving an exposure greater than or equal to 5 are considered high exposure risks and are automatically considered Risks to Escalate.

38. Health Health Health! • Work with Daf to apply this to an example of some of Health Health Health!’s key employees being split between multiple projects. Probability of 50% to that risk occurring (or 0.5), with an impact of 8 to the project if it were to occur. • Risk exposure score? • Automatically considered a Risk to Escalate? • Would you consider this a Risk to Escalate if this was on your project?

39. Health Health Health! • What happens when a risk actually happens?” This is called an _______. There are several systematic ways to know that a risk has occurred: • Target date for resolution passes with the risk still open, • A specific trigger event has occurred that triggered the risk to occur, or • A plan for the risk occurring is used.

40. CASE STUDY • With your tablemates: 1a. Make a list of all the risks on Daf’s 2 projects 1b. For each risk, note what you anticipate are the risk probabilities, impacts, and resulting exposures. 1c. For each risk, note what might be an acceptable target date for resolution, as well as possible trigger events for that risk. 2. Would you view each of Daf’s projects overall as “high”, “medium”, or “low risk”, and why? How did you define high and low risk? 3. If you were given the opportunity to manage one or both of these projects would you accept it? Why or why not? 4. If you were in Daf’s shoes what would you do next?

41. CASE STUDY • Daf’s first project (to understand and optimize current customer’s experience) had kicked off 2 months ago, unfortunately the previous project manager had a nervous breakdown trying to understand all of Health Health Health’s technology so he wasn’t there to do a transition. From what Daf could gather, a team had been assembled consisting of 2 shared business analysts, Mark and Sharon. Unfortunately Sharon was pulled in so many directions, the first time Daf found availability on her calendar was a half hour at 5:30 in a month and a half. Daf fortunately found a project charter and numerous other documents on an unorganized shared drive, to his surprise he could also access it from home without any login credentials! He wondered if it would be better placed on the internal SharePoint site, but he had minimal work experience with SharePoint. Daf ran into Mark (his second analyst) reading the Wall Street Journal in the break room, and Mark shared that there were 3 great customers who just raved about Health Health Health! that were part of this project! However it had been a lot of work getting their time commitments (two were given product and support discounts over the next year to incentivize the involvement) which helped ensure they attended all calls even on short notice, however he didn’t remember any of their contact information. He said he might have a voicemail from one of them asking if the project had been completed. • Daf’s second project was to create a consistent Health! Health! Health! brand). Daf had learned about branding from his current personal trainer who had created a logo which was now a well recognized image; prior to that Daf thought branding was what his grandfather did to his cows. Daf was told he would have to put together a business case to get funding for this project; he was well versed in business cases from the gun manufacturer. Daf was also told that funding had gotten very tight as several programs were running well over budget, and that one of the four people on the funding approval board thought that there were no issues with the current lack of branding, and that another person from the funding board ran a branding consulting firm on the side.

42. Continuing the conversation • Did you get at least 2 new ideas today that you will use at work or at home? • After the case study, share these with someone at your table who can help you as you put this into practice, and take down their contact info in case you need help, or if they need your assistance.

43. Thank you • I don’t have an active Twitter, Snapchat, or IM account of any kind • However I own a phone and respond to emails, let me know if you have any questions or feedback. • jefftpmp@yahoo.com, 952-393-HELP

44. APPENDIX

45. Sample Risk Register