Comprehensive Overview Of Risk Management


Published on

A comprehensive overview of project risk management. Assumes a familiarity with fundamental concepts of project management.

Comprehensive Overview Of Risk Management

  1. 1. Risk Management Andrew P. Valenti, Principal Consultant Valenti Partners
  2. 2. Risk Management and Product Development <ul><li>The list of Risks: </li></ul><ul><li>Risk management is an integral part of project management </li></ul><ul><li>Product development requires project management </li></ul><ul><li>Therefore, managing risk should be as natural as managing the schedule (but it isn’t) </li></ul>Key Idea + = Risk Management Methodology
  3. 3. What is Risk? <ul><li>Risk is the possibility: </li></ul><ul><li>Of being hurt. A lot of the time, people say risk , but are actually talking about probability , which is how likely something is to happen. To people who have jobs in judging risks, &quot;risk&quot; is not only how likely something bad is to happen, but also how bad it could be. (From Wikipedia). </li></ul><ul><li>That an undesired outcome (or lack of a desired outcome) disrupts your project. </li></ul><ul><li>Risk management is the activity of identifying and controlling undesired project outcomes </li></ul>Definition
  4. 4. What is Risk? <ul><li>When you are dealing with risk there are always uncertainties </li></ul><ul><li>You can narrow, but not eliminate, the uncertainty, by: </li></ul><ul><ul><li>Clarifying the probability </li></ul></ul><ul><ul><li>Understanding the consequences or alternatives </li></ul></ul><ul><ul><li>Determining what drives the risk </li></ul></ul><ul><li>Risk management helps you understand these factors and consistently sway them in your favor </li></ul>The more precisely the position is determined, the less precisely the momentum is known in this instant, and vice versa. --Heisenberg, uncertainty paper, 1927
  5. 5. Risk vs. Issues <ul><li>Events that are certain to occur are issues </li></ul><ul><li>Issues arise while identifying risks, but they proceed on a different action-planning track. </li></ul>Key Idea
  6. 6. Time component <ul><li>For every project risk, there is a time when it no longer exists </li></ul><ul><li>It is important to know when this termination time arrives so the risk can be removed </li></ul><ul><li>In some cases, termination time is distinct, in others it is ongoing. </li></ul><ul><li>Sometimes, the “time component” is manifest as a condition instead of time. </li></ul>Risk always involves the possibility of some kind of loss
  7. 7. Determining a Risk Candidate Candidate Uncertain? Loss Possible? Time Component? Risk Yes Yes Yes Yes No No No Issue No Impact Irresolvable The three components of a risk, which determine our ability to manage it.
  8. 8. Why Companies Fail in Managing Risk <ul><li>Failure to address: </li></ul><ul><li>Cross-functionality </li></ul><ul><li>Pro-activeness </li></ul>
  9. 9. Why Companies Fail in Managing Risk <ul><li>Cross functionality </li></ul><ul><ul><li>Unique, superior, differentiated products </li></ul></ul><ul><ul><li>Strong market orientation </li></ul></ul><ul><ul><li>Sharp, early fact-based product definition </li></ul></ul><ul><ul><li>Solid market & technical research </li></ul></ul><ul><ul><li>Cross-functional teams </li></ul></ul><ul><ul><li>Built on core-strengths </li></ul></ul><ul><ul><li>Market attractiveness </li></ul></ul><ul><ul><li>Quality launch processes </li></ul></ul><ul><ul><li>Technical competence </li></ul></ul>
  10. 10. Why Companies Fail in Managing Risk <ul><li>Proactiveness: </li></ul><ul><li>Wait until late in the project when many risks start occurring </li></ul><ul><li>Let risk management lapse </li></ul><ul><li>“ Eighty percent of success is showing up.” </li></ul><ul><ul><ul><ul><ul><li>-Woody Allen </li></ul></ul></ul></ul></ul>
  11. 11. Why Companies Fail in Managing Risk <ul><li>Wait until late in the project when many risks start occurring: </li></ul><ul><li>Late attention to risks often leads to expensive workarounds </li></ul><ul><li>Late discovery of potential problems precludes solutions that would have been available earlier </li></ul><ul><li>Late surprises are more disruptive to the schedule </li></ul>
  12. 12. Why Companies Fail in Managing Risk <ul><li>Let risk management lapse </li></ul><ul><li>The team does deliver a list of risks, but gets on with the “real” work of the project </li></ul><ul><li>When risks occur, they are just as unprepared, but more embarrassed! </li></ul>
  13. 13. The Antithesis of Risk Management: Firefighting <ul><li>A type of management behavior, often reinforced </li></ul><ul><li>A corporate firefighter is so involved in fighting the last fire that they let the next one smolder </li></ul><ul><li>Then this person pulls the new problem out of the fire and is regarded as a hero </li></ul>
  14. 14. How Much Risk Management? <ul><li>The more risks you identify, analyze, and monitor, the more it will cost. </li></ul><ul><li>Good risk management requires explicit choices and decisions that are reviewed regularly </li></ul><ul><li>Consider each risk in terms of what it can do for you as well as the harm </li></ul><ul><li>Remember: project management is risk management! </li></ul>Hurricane Katrina: Three men use makeshift oars to paddle a damaged boat.
  15. 15. Using Project Risk Models
  16. 16. Introduction <ul><li>The Risk Management methodology depends on the model: </li></ul><ul><li>Helps quantify the magnitude of a risk for comparison purposes </li></ul><ul><li>Points to root causes for risk resolution </li></ul>Credit Risk Model
  17. 17. Risk Models <ul><li>Models: </li></ul><ul><li>Ground us in a common viewpoint so that we can communicate with others </li></ul><ul><li>Form a common basis for analyzing a risk situation </li></ul><ul><li>Provides a systematic way of dealing with risk </li></ul>Key Idea
  18. 18. Standard Risk Model <ul><li>Seven Components: </li></ul><ul><li>Risk Event : The state that triggers a loss </li></ul><ul><li>Risk event driver : Something in the project environment can cause a risk to occur </li></ul><ul><li>Probability of risk event : Likelihood of a risk event </li></ul><ul><li>Impact : Consequence or potential loss </li></ul>
  19. 19. Standard Risk Model <ul><li>Seven Components cont.: </li></ul><ul><li>Impact driver : Something in the project environment can cause an impact </li></ul><ul><li>Probability of impact : Likelihood of an impact, given that the risk occurs </li></ul><ul><li>Total loss : Magnitude of the actual loss accrued when a risk event occurs </li></ul>
  20. 20. The Standard Risk Model Probability of risk event (P e ) Probability of impact (P i ) Risk event driver(s) Impact drivers Risk Event Impact Total loss (L t )
  21. 21. Simple Risk Model Simple Risk Model. Combines the risk event and impact into a single entity along with the risk’s probability of occurrence. Probability of risk event & impact (P e and P i ) Driver(s) Risk event and impact Total loss
  22. 22. The Risk Management Process
  23. 23. The Risk Management Process <ul><li>Overview of the process: </li></ul><ul><li>Identify risks that you could encounter </li></ul><ul><li>Analyze risks to determine drivers, impact, and probability </li></ul><ul><li>Prioritize and map the risks to a short list </li></ul><ul><li>Plan how you will take action </li></ul><ul><li>Monitor progress on a regular basis </li></ul>The Old Mill
  24. 24. Critical information The Five-step Risk Management Process Risk events and impact Drivers, probabilities and total loss Subset of risks to be managed Types of action plans: avoidance, transfer, redundancy and mitigation (prevention, contingency, reserves) Assess status and closure of targeted risks; identify new risks Step 1: Identify risks Step 2: Analyze risks Step 3: Prioritize and map risks Step 4: Resolve risks Step 5: Monitor risks Regular check for new project risks Steps
  25. 25. Step1: Identifying Project Risks <ul><li>Criteria: </li></ul><ul><li>Need a facilitator without a stake in the outcome </li></ul><ul><li>A brainstorming activity: strive for quantity </li></ul><ul><li>Define happening that could occur along with a time component </li></ul><ul><li>Describe the impact </li></ul>Line up
  26. 26. Step 2: Analyzing Risks <ul><li>Criteria: </li></ul><ul><li>Identify drivers for each risk event </li></ul><ul><li>Be as factual as possible </li></ul><ul><li>Identify probabilities for risk and for its impact </li></ul><ul><li>Use historical data whenever possible </li></ul>
  27. 27. Step 2: Analyzing Risks cont. <ul><li>Calculating expected loss: </li></ul><ul><li>Decide on a small set of values for probabilities, e.g. 10, 30, 50, 70, 90% </li></ul><ul><li>Expected loss is the mean loss associated with the risk </li></ul>
  28. 28. Formula for calculating expected loss from its components Probability of risk event (P e ) Probability of risk impact (P i ) Total loss (L t ) Expected loss (L e )    Risk likelihood Total amount of loss if risk occurs Answers question, “How risky is it?”
  29. 29. Step 3: Prioritizing and Mapping Risks <ul><li>Techniques for developing a short list: </li></ul><ul><li>Top 10 List </li></ul><ul><li>Risk map: total loss vs. risk likelihood (P e X P i ) </li></ul><ul><li>Consider catastrophic risks with low probability </li></ul>
  30. 30. Risk likelihood (P e X P i ) - percent Total loss - workdays Threshold line Risk 2 Risk 1 Risk 5 Risk 16 Risk 13 Risk 4 Risk 9 Risk 18 Risk 7 Risk 10 Risk Map showing risks 1, 2, 5, 13, & 16 under active management and five more monitored candidates 5 10 15 20 25 10 30 50 70 90
  31. 31. Step 4: Planning Resolution of Targeted Risks <ul><li>An action plan has: </li></ul><ul><li>An objective </li></ul><ul><li>Means of measuring when the objective has been achieved </li></ul><ul><li>A completion date </li></ul><ul><li>A responsible individual </li></ul><ul><li>Adequate resources allocated to complete the task </li></ul>
  32. 32. Step 5: Monitoring Project Risks <ul><li>Monitoring metrics: </li></ul><ul><li>Expected loss (should be declining) </li></ul><ul><li>Number of risks prevented </li></ul><ul><li>Number of impacts mitigated </li></ul><ul><li>New risks appearing </li></ul>
  33. 33. Factors entering into calculating expected loss, which is the prime criterion for prioritizing risks. Calculate Expected Loss Probability of risk event (P e ) Probability of risk impact (P i ) Total loss (L t ) Expected loss (L e )    Risk likelihood Total amount of loss if risk occurs Answers question, “How risky is it?”
  34. 34. Calculate Expected Loss <ul><li>Example </li></ul><ul><li>Assume 50% chance (probability of risk event) that a tool will be two weeks late (risk event) </li></ul><ul><li>It will delay the next product build by two weeks which has a 70% (probability of impact) chance of delaying the project </li></ul><ul><li>This results in a $500,000 (total loss) lost profit (impact) </li></ul><ul><li>P e = 50%, P i = 70%, L t = $500,000 </li></ul><ul><ul><li>.5 X .7 X $500,000 = $175,000 (expected loss) </li></ul></ul><ul><ul><li>Note: Expected loss is your primary means going forward of comparing and prioritizing various identified risks. </li></ul></ul>
  35. 35. Working with Differing Units and Qualitative Scales <ul><li>If the total loss cannot be expressed numerically: </li></ul><ul><li>Define labels such as “medium”, as specifically as possible by calibrating them </li></ul><ul><li>Construct a calibration table </li></ul><ul><li>Be sure to perform some cross checks </li></ul><ul><li>Alternative approach is to use consequence factors </li></ul>
  36. 36. Calibration values for total loss when using qualitative scales 180 >500,000 >1.20 >15 High 190 150,000-500,000 0.50-1.20 6-15 Medium 205 <150,000 <0.50 1-5 Low 220 0 0 0 None Product performance (throughput, units/minute) Project budget overrun Target product cost overrun Schedule slip (workdays) Total Loss
  37. 37. Summary <ul><li>Risk has many meanings, but we define it in terms of: </li></ul><ul><ul><ul><li>Uncertainty </li></ul></ul></ul><ul><ul><ul><li>Loss </li></ul></ul></ul><ul><ul><ul><li>Time component </li></ul></ul></ul><ul><li>Good project risk management places an emphasis on being both cross functional and proactive </li></ul>
  38. 38. Summary <ul><li>It is the opposite of fire fighting which poses an organizational challenge </li></ul><ul><li>You cannot make risk management perfect; you can reach a point of diminishing returns </li></ul><ul><li>Risks can be positive as well as negative </li></ul>
  39. 39. Summary <ul><li>The Standard Risk Model provides the most effective risk management for the effort expended in using it </li></ul><ul><li>Risk models provide a powerful tool to help visualize and understand risk </li></ul><ul><li>“All models are wrong. Some are useful.” – George Box, Statistician </li></ul>
  40. 40. Summary <ul><li>A five step program: </li></ul><ul><li>Structured brainstorming </li></ul><ul><li>Analyze each risk according to a process to clarify the risks’ threat </li></ul><ul><li>Choose a risk set that you will manage </li></ul><ul><li>Create an action plan </li></ul><ul><li>Ongoing monitoring of risk picture </li></ul>