IRIS & @RISK

1. IRIS & @RISK

2. Presentation Overview The Challenges (Colin Wheeler, Istria Ltd) • Background • The Challenge: Aligning Quantitative and Qualitative Techniques • Our Solution: IRIS Software • Client Benefits The Implementation

3. About Istria • Established in 1985 • 20 years experience in project risk management • Provides Consultancy, Software and Training Solutions • IRIS (Istria Risk & Issue Support) Software developed in 2004-5 to embed the Istria Risk Management Method • Alignment of Qualitative and Quantitative Risk Management Techniques • Clients Include:

4. The Challenge • IRIS Software featured best in class qualitative risk management techniques • Dynamic risk matrices • Automated email triggers • Link to MS Project • Full suite of customisable reports • Project Managers frequently use inaccurate or misleading quantitative techniques • “Finger in the air” estimates of impact • Multiplication of Probability x Impact Assessment • These lead to problems establishing • Discrete values for probability; and • Precise impact assessments for cost, time or performance Combining robust statistical analysis with the leading edge qualitative techniques would generate enormous benefits for clients

5. Our Solution (1) Organisational Hierarchy The software is designed to manage risks across an entire organisation, or specific departments, programmes or projects The hierarchy is tailored to the client organisation on implementation of the tool. The front screen allows navigation to any level in the hierarchy. In this example, strategic planning (corporate level) and programme level are used, but additional levels can be added A full help guide is also available

6. Our Solution (2)Dynamic Risk Matrix The risk matrix provides an instant snapshot of the high priority risks for the organisation. Separate risk matrices are available for each project, along with an overall enterprise wide risk matrix Icons illustrate how the status of the risk has changed during the period Clicking on the icon displays the full Risk Action Plan for that risk (see next page) Clicking the Risk ID displays the risk description only

7. Our Solution (3)Risk Action Plan & Impact Assessment The risk action plan contains the detailed information for each risk. The probability and impact of each risk is assessed, and each risk is allocated a risk owner. The next review date has a default setting (e.g. 28 days) but can be overwritten. Emails are sent to the risk owner when action is required (e.g. 3 days in advance) and to the programme manager if action is overdue Parameters for the impact of risks are tailored for each level of the hierarchy

8. Our Solution (4)Monte Carlo Simulations Palisade’s @Risk statistical analysis package is embedded within the IRIS software. The impact assessments from the Risk Action Plan provide three data points (Best Case, Worst Case, Most Likely Scenarios). @Risk generates thousands of iterations in a few seconds to provide statistical confidence on the risk exposure level. The relative cost/benefit of risk mitigating activity can then be ascertained Risk Exposure Reduction Costs of Risk Mitigating Activity Statistical Confidence Level

9. 0.75 0.65 Creating the Analytical Model This risk will have occurred in this iteration Monte Carlo analysis tool generates two random numbers Probability High 2nd - Risk Random Number 1st- Iteration Random Number i.e. no risks will occur with P < 65% 50% The simulation consists of 1,000 iterations and the sum of the impacts is shown as a Cumulative Probability Curve showing Risk Exposure Medium 20% Low

10. 0.75 0.65 BC €0 ML €10,000 WC €100,000 Impact Range in Cost (or Time) Creating the Analytical Model This risk will have occurred in this iteration Probability High 2nd - Risk Random Number 1st- Iteration Random Number i.e. no risks will occur with P < 65% 50% Medium 20% Low

11. Aligning Qualitative & Quantitative Techniques Step 1: New risk identified and added to the Risk Matrix Step 2: Quantitative Impact Limits standardise assessments of High, Medium, Low Step 3: Three point estimates are auto-populated. Can over-write Best Case & Worst Case, but Most Likely must be within parameters Step 4: @RISK engine runs statistical analysis to quantify overall risk exposure. Target values provide a cost benefit analysis of risk mitigating activity. Can prioritise activity based on Risk Reduction Ratio (RRR)

12. Benefits of the Approach Istria developed the IRIS software to embed best practice risk management techniques into a single user-friendly application. Utilise best practice quantitative and qualitative techniques Instant visibility of high priority risks through Risk Matrix Quantified cost-benefit analysis of Risk Mitigation Activity Integration with other Project Management Tools Automated Email Triggers to help embed Risk Management Secure Audit Trail for Internal & External Assurance

13. Strategic Alignment Strategic Objectives Success Criteria Strategic Risks Strategic Risk Mitigating Actions Programmes Operational Project Objectives Projects Success Criteria Project Risks Actions Risk Mitigating

14. Istria’s Risk Management Approach Determine Risk Management Structure Risk & Issue Identification Management Reporting Evaluation & Planning Risk Action Plans Management & Control

15. Project Scope Maintenance Food Suppliers • Identify the scope and boundaries of responsibility • Obtain agreement Business Agreement Organisation ACME Catering Risk Register Scopes H&S Executive

16. . Risk Identification • Use the cause effect diagram to identify the future and current problems that will prevent the successful completion of the success criteria. • Lack of Staff (numbers, availability, skills) • Technical problems • Requirements definition problems • Tools • Scoping • Operational requirements • Operational problems • Contractual problems

17. People Suppliers Availability Timeliness Numbers Food Quality Skills Provides food to an acceptable standard Cooking Utensils Plan to prepare food Success criteria Storage (Refrigerators) Equipment Process Cause/Effect Diagrams

18. Risk Index

19. Risk Matrix

20. Links to MS Project

21. Risk Quantification Data

22. Risk Data sheet

23. Risk Exposure

24. Target Risk Exposure

25. Where Next? • Need to exploit the functionality of @RISK (RDK)