Download as PDF, PPTX
![5 of 22
International Standards Organisation
ISO 31000 [2009] Risk Management Principles & Guidelines
ISO IEC 31010 [2009] Risk Management Risk Assessment Techniques
ISO Guide 73 [2009] Risk Management Vocabulary
British Standards
BS 6079-3 [2000] Guide to the Management of Business Related Project Risk
Association for Project Management
PRAM: Project Risk Analysis and Management Guide, 2nd Edition [2010]
Interfacing Risk and Earned Value Management [2008]
Prioritising Project Risks [2008]
Project Management Institute
Practice Standard for Project Risk Management [2009]
The Institute of Risk Management
Publications that primarily deal with enterprise risk management
UK Government
The Orange Book: Management of Risk, Principles and Concepts [2004]
Management of Risk, Guidance for Practitioners, 3rd edition [2010, Axelos]
Ministry of Defence Acquisition System Guidance: Risk Management [v4.2.2]
Risk Management Best Practice Guidance](https://image.slidesharecdn.com/riskmanagement-140714073222-phpapp01/75/Project-Risk-Management-5-2048.jpg)
Uploaded byRussell Taylor BEng CEng FAPM FIET
Project Risk Management
This document discusses risk management for projects and programmes. It defines key risk management terms like known knowns, known unknowns, and unknown unknowns. It explains that risk management involves identifying, assessing, planning for, and implementing responses to significant uncertainties that could impact a project's objectives. The goal is to keep the level of risk exposure within the agreed risk appetite in a cost-effective manner through an iterative process.
More Related Content
Project Risk Management
- 1. 1 of 22 RiskManagement for Projects & Programmes Known knowns Things that we know that we know Known unknowns Things that we know that we don’t know Unknown unknowns Things that we do not know we don’t know ?
- 2. 2 of 22 Whatis Risk? We know that plans are unlikely to be a precise prediction of the future Plans are a model of interconnected tasks believed certain to be required to achieve an objective There are also events which are less than certain, but if they happen, would impact the plan A Risk is a significant but uncertain event that, if it occurs, has an effect on the plan A risk can have detrimental or beneficial effects Threat A risk with a detrimental effect Opportunity A risk with a beneficial effect Patsy, Monty Python and the Holy Grail, 1975
- 3. 3 of 22 Whatis Risk Management? How we act to manage significant uncertainty Uncertain events will always be part of any plan for the future Risk Management is a core PM competence “There are known knowns; there are things that we know that we know. There are known unknowns; that is to say, there are things that we know that we don’t know. But there are also unknown unknowns – there are things that we do not know we don’t know.” Donald Rumsfeld, US Secretary of Defence, 2002 Project Management Planning & Scheduling Risk Management Context & Assumptions significant insignificant Uncertain Events Certain Events
- 4. 4 of 22 Whydo Risk Management? Good Risk Management will Lead to more realistic plans Help to set expectations appropriate to value, risk and complexity Inform bid/no bid decisions Help in selecting the most appropriate contract type Inform PM selection, matching PM competence to value, risk and complexity Help set project level contingencies, rather than task level or a fixed amount Enable greater honesty, openness and understanding Reduce uncertainty by implementing responses to risk Enable simpler, more transparent reporting Reduce stress and reliance on a hero culture Significantly increase the likelihood of meeting time, cost and quality objectives Cautions ! Risk Management will not guarantee meeting time, cost and quality objectives ! If undertaken as a tick box exercise, or only at bid time, the full value will not be realised ! The effort invested should be proportional to value, risk and complexity
- 5. 5 of 22 InternationalStandards Organisation ISO 31000 [2009] Risk Management Principles & Guidelines ISO IEC 31010 [2009] Risk Management Risk Assessment Techniques ISO Guide 73 [2009] Risk Management Vocabulary British Standards BS 6079-3 [2000] Guide to the Management of Business Related Project Risk Association for Project Management PRAM: Project Risk Analysis and Management Guide, 2nd Edition [2010] Interfacing Risk and Earned Value Management [2008] Prioritising Project Risks [2008] Project Management Institute Practice Standard for Project Risk Management [2009] The Institute of Risk Management Publications that primarily deal with enterprise risk management UK Government The Orange Book: Management of Risk, Principles and Concepts [2004] Management of Risk, Guidance for Practitioners, 3rd edition [2010, Axelos] Ministry of Defence Acquisition System Guidance: Risk Management [v4.2.2] Risk Management Best Practice Guidance
- 6. 6 of 22 RiskManagement Training Certification Valid Renewal Acquisition Pre-requisite Association for Project Management Risk Certificate Level 1 - - 1 hour multiple choice exam: 60 questions, pass ≥60% Confirms knowledge sufficient to allow contribution to risk management within a project. Can be taken as a 2 day course, cost £1,100 (inc. exam fee). Open exam fee £164 (£146 for APM members). Risk Certificate Level 2 - - 3.25 hour exam: section A, 100 marks; section B, 100 marks, 2 from 4 questions, 2 relate to case study, pass ≥60% Risk Certificate Level 1 knowledge (not certification) Confirms knowledge, understanding and capability, sufficient to undertake project risk management. Can be taken as a 2 day course, cost £1,100 (inc. exam fee). Open exam fee £430 (£310 for APM members). Combined Risk Levels 1 & 2 Open exam fee £558 (£384 for APM members). UK Cabinet Office Axelos M_o_R Foundation - - 1 hour multiple choice exam: 75 questions of which 70 count, pass ≥50% (35/70) Confirms sufficient knowledge and understanding to contribute to the identification, assessment and control of risks across any organization. M_o_R Practitioner 5 years 1hr exam, pass ≥55% 3 hour exam: 4 questions, 20 marks each, open book (specified M_o_R books only), pass ≥50% (40/80) M_o_R Foundation Confirms sufficient understanding of how to apply and tailor M_o_R in a scenario situation. M_o_R Foundation and Practitioner can be taken together in a 5 day course, cost £2,300. Project Management Institute PMI-RMP PMI Risk Management Professional 3 years 30 PDUs over 3 years 3.5 hour multiple choice exam: 170 questions, 150 scoring, 'Modified Angoff Method' to determine pass Degree, 2 years’ project risk management experience and 30 hours formal project risk management training Recognises competence in assessing and identifying project risks, mitigating threats and capitalizing on opportunities, while still possessing a core knowledge and practical application in all areas of project management. 2008 launch, 2,033 credential holders worldwide by 30 April 2013. Certification fee $670 ($520 for PMI members). Project Risk Management is also covered in general PM certifications APM: PFQ, PQ, RPP Axelos (OGC): PRINCE2 PMI: PMP
- 7. 7 of 22 Contextis the environment in which an organisation seeks to achieve its objectives. As the context changes, it may be necessary to adjust the approach to Risk Management. Risk Management principles are the same at all levels – strategic, change & operational. At the strategic level Risk Management is a significant part of corporate governance. How risk is to be managed across an organisation taking into account external factors such as legislation, government policy, market, domain and internal factors such as the organisation’s size, complexity and culture as well as the strategic vision, balance of risk across the organization, conflict resolution, risk appetite and lessons learned, may be described in a Risk Management Strategy. The RMS may be a single document or a number of documents, e.g. Policy, Process and Guidance. Operational Risk Management covers day-to-day business functions such as health & safety, people, information security and business continuity. Change is what projects and programmes deliver. Apply Risk Management through all project delivery phases – in a manner proportional to the value, risk and complexity at each phase. The nature and degree of freedom for responding to risk will change at different project phases, e.g. in the concept phase there will be a greater chance to adjust the scope and set budgets to manage risk. Risk Management Context
- 8. 8 of 22 RiskManagement Process Iterate to keep the Risk Exposure (the impact of risk on objective attainment), within the Risk Appetite (an agreed, acceptable level of risk), in a cost-effective manner. Identify Assess Plan Implement Identify Risks: Experience, Checklist, SWOT, Interviews Categorise Probability & Impact Prioritise Qualitative Quantitative Define Risk Response: Exploit/Avoid, Share/Transfer, Enhance/Mitigate, Realise/Accept Define Contingencies Iterative Implement Review Communicate Manage Stakeholders Lessons Learned
- 9. 9 of 22 Identify,Assess, Plan, Implement Identify: What could happen Identify & List Risks: Experience, Checklist, SWOT, PESTLE, Interviews, Questionnaires Categorise: By project phase, system element, or other suitable risk event source breakdown Assess: Understand consequences Qualitative assessment: Probability of the risk occurring and the size of the Impact on objectives Prioritise: Rank the risks – focus on those with highest probability and impact Timing: Understand when the risk may occur Quantitative analysis: modelling, confidence levels, sensitivity Plan: Define appropriate responses Exploit/Avoid, Share/Transfer, Enhance/Mitigate Define Contingencies Ignore, Realise/Accept Residual Risk: Risk that remains after taking enhancement/mitigation measures Secondary Risk: Risk that arises as a result of taking enhancement/mitigation measures Implement: Monitor and control the risks Review: Risk triggers, responses, add new risks, close dead risks & release risk pot Communicate: Key risks Manage Stakeholders
- 10. 10 of 22 Plan:Define appropriate responses Allocate ownership to manage risk optimally Insure (internally by pooling or externally) Reduce the uncertainty – if cost effective to do so Fall-back, should the risk occur/not occur despite mitigation/enhancement Risk or Residual Risk after enhancement/mitigation May also choose to treat as Risks and define a response etc. Share/Transfer: Enhance/Mitigate: Contingencies: Realise/Accept: Secondary Risk: Planning & Scheduling Change Scope Opportunities Threats AvoidExploit AcceptRealise Log / Monitor MitigateEnhance TransferShare Contingency Impact and/or Probability Impact and/or Probability Residual Risk Ignore Residual Risk Specification Partners PBS, WBS Supplierse.g. Requirements Contingency Secondary Risk Secondary Risk
- 11. 11 of 22 QualitativeAssessment Rank Risks by assessing risk probabilities and impacts having first adjusted to suit the project Probability Impact Diagram Mapping risks helps to decide where best to focus risk management effort. Contingency Setting A Risk Register can calculate the total Contingency based on the entered data. This figure is at best a guide and must be subject to discussion. Probability VH VH Probability H H M M L L VL VL VL L M H VH VH H M L VL Negative Impact Positive Impact Threats Opportunities Focus effort on Key Risks Very Low Low Medium High Very High Schedule Impact < 2 weeks 2 weeks to < 1 month 1 to < 2 months 2 to < 4 months > 4 months Cost Impact < 1% 1% to < 2% 2% to < 4% 4% to < 8% > 8% Performance Impact Minor impact in a secondary aspect Multiple impacts in a secondary aspect Minor impacts in one key aspect Major impact in one key aspect Major impact in multiple key aspects Probability < 10% 10% to < 25% 25% to < 50% 50% to < 75% > 75%
- 12. 12 of 22 Bias,Concurrency & Estimation Uncertainty Optimism Bias can make assumptions too positive, perhaps as a result of making a plan fit fixed targets. Cognitive Bias is where personal past experience unscientifically skews estimates. Plan dates and costs are often optimistic if estimation uncertainty is not considered. Plans generally feature concurrent tasks with minimal float. Task effort estimates frequently use expert judgement, often given as single point, or deterministic, estimates. The more concurrent tasks, the greater the impact on the project when, as is likely, some tasks finish later than estimated. Deterministic outcomes often have a very low probability. Range estimates are more realistic, with 3 points (minimum, most likely, maximum) advised. Key project dates and costs then also become ranges along with a probability. Typical plan analysis: Yellow line is the probability of achieving the Deterministic Cost
- 13. 13 of 22 FundingEstimation Uncertainty & Selective 4 Point Estimating ‘Most Likely’ means equally probable of being under or over, but estimates often have a negative bias such that most likely (ML) is not 50% probable. To avoid this negative bias, 4 points are recommended*, 3 point plus probability of the ‘most likely’ – just for the tasks that most impact the project, found by sensitivity analysis, as doing this for all tasks is typically not worthwhile. Min ML P=50% Max The business Risk Appetite can inform what probability to use across the business, e.g.: 10% Team Target (likely risks do not occur) 50% Best Estimate (as many risks occur as not) 90% ‘Safe’ Estimate (several unlikely major risks occur) One strategy is to use the cost difference between the project cost for the probability chosen according to the business Risk Appetite and the deterministic project cost as the main element of a ‘project risk pot’ to handle estimation uncertainty. Rewarding using as little of this risk pot as possible, whilst recognising that a proportion is likely to be required, encourages behaviour that enhances results whilst recognising uncertainty and setting realistic expectations. 4 Point Estimates * See separate presentation, “Estimation for Projects & Programmes” Caution Don’t confuse uncertainty with a lack of knowledge. Large ranges generally indicate guessing – experience is required to estimate rather than guess.
- 14. 14 of 22 RiskManagement for Projects & Programmes Strategy (Need) Contingency Opportunities Enhancement Tasks Secondary Risks Product Breakdown Structure Work Breakdown Structure Work Packages & Tasks Estimates Zero Risk (Deterministic) Cost INFORM Inform / Offset Threats Mitigation Tasks Programme & Project Set-up INFORM Project Delivery Process, PDP Risk Register Tool, RRT Risk Management Strategy, RMS Risk Management Plan, RMP Held at Board level: Project, Programme or Business Held at Project & Programme level If cost effective Contingency Project Risk Pot Estimation Uncertainty
- 15. 15 of 22 RiskManagement Strategy How risk is to be managed across an organisation, the corporate strategy & policy. Generally an in-feed for a programme or project but may also be defined at this level, possibly as a flow- down from an organisation RMS. Risk Management Plan How risk will be managed in a programme or project, tailored to that programme or project, i.e. how the Risk Management Strategy will be delivered. Risk Management Documents & Tools Risk Register Tool Central repository for Risk Events, i.e. risk data • Opportunity & Threat Log and Analysis • Risk Owner • Risk Response & Cost Estimation • Probability Impact Diagram, PID • Risk Triggers & Timing • Classification marking • Internal Only option • Baselines & Risk History graphing • Contingency Estimation • Risk Exposure calculation Quantitative Analysis Tools Quantitative Analysis (uncertainty and probabilistic modelling – Monte Carlo analysis) is best done using purpose built tools, e.g. @Risk, or integrated scheduling and risk management tools, e.g. Oracle Primavera Risk Analysis or Safran Risk.
- 16. 16 of 22 KeepPeople Safe HSE: Health, Safety and Environment Do a Risk Assessment to expose potential hazards EN ISO 14121-1 is a useful guide in defining potential hazards Consider the whole lifecycle: hazards may differ from one phase to the next Plan actions to deal with the hazards identified and reduce to an acceptable level the probability of harm to the team and other stakeholders There may be tasks and costs arising from the risk assessment: include these in planning
- 17. 17 of 22 RiskAssessment provides scientific advice on potential threats, often the basis for making decisions to address these threats via Risk Management. Europe separates the roles of Risk Assessor and Risk Manager in law to make clear the distinction between science and politics. Risk Assessment is concerned with preventing harm to people The Health and Safety Executive in the UK defines Risk as the chance, high or low, of somebody being harmed by a hazard, and how serious the harm could be. Risk Management is minimising the impact of threats and maximising the benefit of opportunities Risk Assessment actions are aimed at reducing the potential harm to zero, or at least to acceptable levels by taking reasonably practicable measures – balancing the level of risk against the measures needed to control the real risk in terms of money, time or trouble. Action need not be taken if it would be grossly disproportionate to the level of risk. Risk Assessment is an excellent, essential and in most countries mandatory method for understanding and reducing potential harm to people. However, Risk Assessment is not a substitute for Risk Management, e.g. there is no concept of up-side risk in Risk Assessment since there is no 'harm' in up-side risk. Risk Management and Risk Assessment
- 18. 18 of 22 RiskManagement: Test Strategy Unit Test on a PC Regression Test via a simulator automated on commit automated on commit get code coverage System Test the whole system Continuous Integration doing real things where possible probably involves people Field Trial Interoperability Test Site / Final Acceptance Test System Test Integration Test Bring-up Test Subsystem Production Test Subsystem Test Module Test Unit Test Low Level Tests Integration Level Tests System Level Tests Optional System Level Tests (required in some domains) Compliance Test System Production Test FPGA On-Board Test Design TestProduction Test
- 19. 19 of 22 Priorto ‘Identify’ describe the project and goals of Risk Management for your project (often described in the Risk Management Plan). Then the project team can raise specific project risks. The danger of not doing this is that the risks identified may be generic and that this is carried throughout Risk Management for the project, significantly devaluing Risk Management. Risk descriptions need to be understandable outside the project, without further explanation. Risks should be accurately defined and as specific as possible. Avoid listing an effect rather than the risk leading to the effect. It may help to think in terms of cause, then risk arising from this cause, then the effect(s) of the risk. Probability and impact are often guesses and contain cognitive bias so it can be helpful to consider the relative risk scores rather than the absolute in deciding which risks to actively manage. Risk Management is more than just keeping a Risk Register. The Risk Register is only a tool to note the risks, our responses and to help with decision making. Completing the actions arising add the real value. Appropriate review frequency depends on project scale and phase. At some phases, weekly review may be worthwhile; at other phases, monthly may be sufficient. Practical Risk Management: Hints & Tips I
- 20. 20 of 22 Experienceis needed to judge the appropriate Risk Management effort, but investing more in managing risk than the cost if all the risks occur clearly makes no sense. The Risk Management process can be gone through in a few minutes for many risks, so the effort required need not be high. The effort level should not however be limited simply by a lack of competence (i.e. knowledge & experience) of those undertaking Risk Management. The number of risks typically identified depends on the project value and complexity; usually more than 10, less than 100. How many of the identified risk are selected for managing is an experienced based judgement; but very rarely all, except perhaps for a strategic Risk Register. Risk Assessments commonly involve a reassessment of the impact after the risk responses have been undertaken, since it is vital that we can see that potential harm to people has indeed been reduced to an acceptable level by our actions. This is much less common in Risk Management in projects and programmes where there’s often little value in this sort of reassessment. It can be difficult for many people to consider threats and opportunities concurrently – e.g. we don’t talk about the ‘risk’ of a beneficial event occurring in normal life. So it may help to consider threats and opportunities separately rather than concurrently when identifying risks. Practical Risk Management: Hints & Tips II
- 21. 21 of 22 Summary Mostprojects and programmes have to deal with risk, this presentation summarises best practice for visible, repeatable and consistent risk management. Whilst best practice guidance offers no single definition, it is broadly aligned. Some level of risk is not only inevitable, but desirable for success. Project Risk Management is a core PM competence and should be practiced on all projects and programmes, in a manner appropriate to the value, complexity and risk. Projects which do not undertake Risk Management are more likely to fail. Estimation uncertainty alone can reduce the probability of on-time delivery to less than 10%. Risk Management has many benefits, not least being a higher likelihood of delivery to time and budget.
- 22. 22 of 22 AuthorProfile In my board role I led a team of 22 Project Managers and 5 Quality Engineers, and ensured Roke’s £79m project portfolio delivered better than budget profit. I set-up and ran a virtual PMO and created REP, the Roke Engineering Process, also managing the engineering tools to support it. After 4 years as an electronics engineer for Siemens, achieving Chartered Engineer, I moved into project management for 14 years, at Siemens and Roke Manor Research. Successfully delivering Roke’s most challenging whole lifecycle product developments on time and under budget led to a role as Director and board member for 6 years. In 2013 I returned to hands-on project management as Programme Director at Cambridge Consultants, founder member of the Cambridge Science Park. Creator of the APM corporate accredited PM Excellence Programme, I chaired a quarterly PM forum to share best practice and built a supportive PM community. I coached seven PMs to RPP, five to PQ, and all passed APMP. These investments in PM professionalism led to a turn-around and annual improvement in project results across a 400 project portfolio and delivered an above budget performance in five consecutive years with profits totalling £7.9m above budget. Passionate advocate of PM professionalism, Fellow of the APM and the IET and author of articles published in Project and PM Today. Professional Development Winning Project Work Planning Estimating Risk Management Earned Value Management Change Control Stakeholder Management 3 Steps to Professional Project Management: Case Study ProjectManagementTopics