This document discusses project risk management. It defines project risk as an uncertain event or condition that could positively or negatively impact project objectives. The document notes that effective risk management can actually bring a project's finish line closer by reducing uncertainty. It provides examples of risks and discusses how to identify, analyze, plan for, implement, track, and control risks through an iterative risk management process. Managing project risks helps control the project outcome.

1. This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivs 3.0 Unported License.
Project Risk: What & Why
PLAYBOOK LEAN PRODUCT DEVELOPMENT SERIES
PLAYBOOKHQ.co
@PLAYBOOKHQ

2. PLAYBOOK LEAN PRODUCT DEVELOPMENT SERIES
This series is for anyone interested in Lean, Agile and team principles
and how they can be applied in new product development scenarios
to increase innovation, improve delivery times and create engaged,
happy, high-performing teams.
PLAYBOOKHQ.co
@PLAYBOOKHQ

3. Notes:
1. Often, especially in Medical Device companies, there are other definitions of risk which
can be confused with Project Risk. Project Risk is not the same as Patient Risk.
2. Project Risk is traditionally defined as… “An uncertain event or condition that, if it
occurs, has a positive or negative effect on a project’s objectives”. -- PMBOK Guide 4th Edition
a. Project Objectives in traditional terms = Scope, Schedule, Cost, and Quality
b. Project Objectives in economic terms = Schedule, Unit Sales, Sales Price, Unit
Cost, and Project Expenses.
c. Negative effects are referred to as Risks or Threats
d. Positive effects are referred to as Opportunities
3. Examples:
a. Marketing Requirement ‘X’ is going to be difficult to achieve.
b. We don’t have the technology to do ‘X’, and developing it may be very difficult
and time consuming.
c. Part ‘X’ is a long-lead part, and if we don’t complete a correct specification of it
early enough, the schedule will slip
d. … and MANY more…
e. Can you think of some examples? ____________________________________.
4. Why bother?
By managing project risks we better control the outcome of our project.

4. Notes:
1. Consider your project a road you travel to get to the finish line.
a. The finish line is not fixed and you have a lot of control over where it ends up.
b. In general you never know exactly where the finish line is until you get there.
The fundamental question is, “What’s the probability of the finish line being
where you think it is?”. Typically, it is further away than you think.
2. Where the finish line really is depends on a number of factors…
a. The actual amount of Critical Work there is for the Critical Resources (see the
Critical Chain Project Management class for details).
b. The actual amount of Availability the Critical Resources have during the time they
are critical.
c. The amount of Wait Time that can’t be filled by Critical Work (which is usually
very small, surprisingly, especially when you manage risks well, and compress
your schedules well).
d. The unmitigated risks that create more Work and/or more Wait Time.
3. The unmitigated risks that are realized move the finish line farther away, or so it
seems. In reality, the finish line was there already, because…
a. The risks were already there and they have a Probability and an Impact (i.e. Risk
Exposure).
b. The amount of Risk Exposure determines where the finish line probably is.
c. Mitigating a risk doesn’t actually move the finish line farther away. Instead it has
the effect of bringing the finish line closer to you from where it probably is if you
didn’t plan and execute the mitigation.

5. Notes:
As an example, let’s assume we’re working on a 6 month (24 week) project that has a High
risk with an Exposure of 4 weeks.
1. High risk examples…
a. You may not get your Regulatory approval on the first submission.
b. The product might not pass Validation and need to be changed.
2. If we estimate it will take 1 week for the Critical Resources to analyze, plan, and
mitigate the risk, there are two options…
a. Option 1: Do not mitigate the risk and keep the Critical Resources working on the
critical chain.
i.
Doing 1 week of work on the critical chain moves the project 1 week
closer to the end.
ii.
In this case, what is the ROI of doing 1 week of work on the critical
chain? _______________.
b. Option 2: Mitigate the risk which takes 1 week of the Critical Resources’ time.
i.
This would delay the critical chain work 1 week and therefore extend the
project 1 week.
ii.
If you mitigate the risk fully, the finish line gets 4 weeks closer to you.
iii. The net result brings the probable finish line 3 weeks closer to you.
iv. In this case, what is the ROI of doing 1 week of Risk Management?
_______________.

6. Implications:
1. Not working on the risk effectively moves the finish line further away from you.
2. Effective Risk Management can actually move the probable finish line closer to you.
3. Risk Management can bring the finish line closer to you more easily than working on the
critical chain prevents it from moving out further (i.e. the ROI is typically better for Risk
Management).
4. This is some of the ‘magic’ of PLAYBOOK Product Development.

7. Questions:
1. How much more time on Risk Management could you have done before it was wasted
time (i.e. worse than moving forward on the critical chain)? _______________.
2.
Would a partial mitigation provide more or less certainty about the location of the finish
line? _______________.
3.
If you don’t mitigate the risk, but you do risk identification and analysis, do you get
more or less certainty about the location of the finish line? _______________.
4.
Is there value in having more certainty (i.e. is it better to have a more realistic
expectation about when you will get to the finish line)? _______________.
5.
Where is the breakeven point when doing Risk Management? _______________.
6.
Is it worth slowing down to try to find ways to bring the end closer to you? _________.
7.
Should we ignore the Low risks or the Low risks on the critical chain? _____________.
8.
What about project planning in general – what is the affect of it? _______________.
9.
When does project planning become a waste of time? _______________.
10. How much time can a non-critical resource do Planning or Risk Management before it
costs you more than it pays you back? _______________.

8. Other Considerations:
1. There is a probability of when the project will be done. It is a function of the risks, and
uncertainty in the Work and Availability of the resources.
2. There are multiple risks. You can’t see them all early enough, or effectively mitigate all
of them, but the more you mitigate, the more certain your end date is, and the closer
you are to it.

9. Other Considerations:
1. There is a probability of when the project will be done. It is a function of the risks, and
uncertainty in the Work and Availability of the resources.
2. There are multiple risks. You can’t see them all early enough, or effectively mitigate all
of them, but the more you mitigate, the more certain your end date is, and the closer
you are to it.

10. Notes:
1. Product Development = information generation & documentation
2. Is the amount of information needed infinite? _______________.
3. When do you know you have 100% of the information you need? _______________.
4. Project Risk Management = deliberate, well-managed information generation

11. Notes:
1. Eliminate as much uncertainty as possible as quickly as possible (i.e. get as much
confidence as quickly as possible).
2. The value of information is directly proportional to the uncertainty of the information.
(see details in the Information Theory class)
3. The value of information is inversely proportional to the amount of time elapsed before
you receive it (i.e. information is worth more earlier than later).
4. The value of the information is maximized by:
a. Learning in high risk areas early.
b. Learning in low risk areas later.
5. The product of Product Development is information, therefore…
Maximize Information Value = Maximize Product Development Value

12. Risk Management Process:
1. Identify
a. Seek out risks before they materialize.
b. Do so frequently, in small batches, starting as early as possible.
c. Establish a Title, Description, and Owner for each risk and mitigation.
2. Analyze
a. Determine decision making information (risk drivers, probability, impact, etc.)
b. Determine if the potential impact and probabilities are high enough to move on
to the ‘Planning’ phase.
3. Plan
a.
b.
c.
d.
Determine and select mitigations.
Identify resources needed and develop the primary tasks.
Develop a risk reduction schedule (i.e. mitigation execution timeline).
Put the mitigations in the project schedule.
4. Implement
a. Execute the mitigations.
b. Review and update decision-making information (see Analyze above).
c. Update the risk reduction schedule and project schedule.
5. Track and Control
a. Review the effectiveness of the mitigations.
b. Reprioritize and re-plan as necessary.
6. Iterate the process (i.e. repeat steps 1-5 again, again and again)

13. Identifying Project Risks:
1. Conduct Risk Identification sessions using typical brainstorming techniques.
a. No judging.
b. Involve representatives and stakeholders from all disciplines and levels.
2. Look for risks in all areas:
a. Technical
b. Cost
c. Schedule
d. Scope
e.
f.
g.
h.
Quality
Manufacturing
Regulatory
Resources
i.
j.
k.
l.
Communication
Supply Chain
Integration
Assumptions
4. Avoid Analysis Paralysis
a. Go until you can’t think of any more.
b. You can always add more later.
5. Put risks in the Risk Register
a. Risk Title describes the risk in a few words.
b. Risk Description describes the risk, both cause and effect, in a sentence or two.
c. Risk Owner is the person accountable for the management of the risk.

14. Overview:
1. Keep all of the potential risks in mind throughout the entire project.
2. The Risk Register is a central repository for all project risks and should be accessible by
all team members.
3. Don’t wait for the next risk identification session to note your risks and communicate
them to the project manager.

15. Notes:
1. A checklist of typical risks can be useful to ensure no risks are missed during the
Identification step.
2. An internal Process Owner should begin developing a standard checklist for all teams to
use.
3. We will review a template checklist during the Identification session.

16. Overview:
1. The goal of this game is to reinforce the value of adopting an active, healthy Project
Risk Management process.
2. Three different companies are modeled and their financial performance evaluated as
they are confronted with 5 different risk scenarios.
3. Each company has a different approach to Project Risk Management:
a. Company A: None
b. Company B: Low-effort
c. Company C: High-effort
4. For each risk scenario, each company’s Plan, Potential Impact, Planned and Unplanned
Costs are described.
5. Each risk has a probability of actually happening for each company. A die is rolled to
determine the outcome. For example, a risk is realized (does happen) if you roll a 1, 2,
3, or 4. The probability of this risk occurring is 4/6 = 67%. If it does happen, the
penalty is a 4 wk. schedule delay and $400K of lost profit (i.e. Unplanned Cost).
6. A score sheet is provided in which players keep track of:
a. Profit dollars lost, both planned and unplanned…
b. Time lost (schedule slip), both planned and unplanned.
7. Be prepared to compare and contrast the performance of each company.

18. Scenario 1
The company is designing a new product and 3 prototype iterations are expected. There’s
a chance that a 4th prototype turn will be needed. Lead times are 4 weeks for the
prototype parts and expense budgets are tight.
Company A (Risk Strategy - None)
1. Plan: Order only the parts needed for each prototype build.
2. Potential Impact: There’s a 67% chance that’ll you’ll need the 4th prototype turn. If
this happens, it will cause a 4 week schedule delay.
3. Planned Schedule Delay/Cost: 0 days/$0
4. Unplanned Schedule Delay/Cost: Roll the die. If you roll a 1, 2, 3, or 4, you incur a
4 week schedule delay and $400K lost profit.
Company B (Risk Strategy – Low effort)
1. Plan: Order extras of all prototype parts with lead times greater than 2 weeks.
2. Potential Impact: There’s a 67% chance you’ll need the 4th prototype turn. If this
happens, it will cause a 2 week schedule delay.
3. Planned Schedule Delay/Cost: 1 day/$50K, where…
$50K = $25K COD + $20K for extra parts+ $5K labor to process and analyze the risk
4. Unplanned Schedule Delay/Cost: Roll the die. If you roll a 1, 2, 3, or 4, you incur a
2 week schedule delay and lose $200K of profit.
Company C (Risk Strategy – High effort)
1. Plan: Do a good job of identifying the big risks and executing the mitigations early to
minimize the risk exposure. Procure plenty of prototype parts during early-stage risk
reduction activities and plan to have enough extras of all parts on-hand for a 4th
prototype if its needed.
2. Potential Impact: There’s still a 15% chance of needing yet another prototype turn
later. If this happens, it will cause a 2 week schedule delay.
3. Planned Schedule Delay/Cost: 4 days/$120K, where…
$120K = $80K COD + $20K for extra parts+ $20K labor to process and analyze the risk
4. Unplanned Schedule Delay/Cost: Roll the die. If you roll a 1, you incur a 2 week
schedule delay and lose $200K of profit.

19. Scenario 2
A plastic injection molded part is being designed. It tightly integrates with several other
parts including a PCBA in a space-constrained, hand-held package. Several parts have a
4 week lead time. Because of the tight integration, any changes to the plastic injection
molded part have a good chance of requiring changes to other parts.
Company A (Risk Strategy - None)
1. Plan: Involve the supplier later when the part design is ‘finished’.
2. Potential Impact: There’s a 67% chance that significant changes will be needed when
the supplier sees it. If this happens, it will cause a 4 week schedule delay.
3. Planned Schedule Delay/Cost: 0 days/$0
4. Unplanned Schedule Delay/Cost: Roll the die. If you roll a 1, 2, 3, or 4, you incur a
4 week delay and lose $400K of profit.
Company B (Risk Strategy - Low-effort)
1. Plan: Show the part once to the supplier when its 75% ‘finished’. Some problems will
likely be identified and fixed early.
2. Potential Impact: There’s a 33% chance that significant changes will be needed when
the design is ‘finished’. If this happens, it will cause a 4 week schedule delay.
3. Planned Schedule Delay/Cost: 1 day/$25K, where…
$25K = $20K COD + $5K labor to process and analyze the risk
4. Unplanned Schedule Delay/Cost: Roll the die. If you roll a 1 or 2, you incur a 4
week schedule delay and lose $400K of profit.
Company C (Risk Strategy - High-effort)
1. Plan: Show the part to the supplier early and show them any changes you make every
couple of weeks until its ‘finished’.
2. Potential Impact: There’s a 1% chance or less that any changes will be needed.
3. Planned Schedule Delay/Cost: 3 days/$100K
$100K = $60K COD + $20K labor to process and analyze the risk + $20K to pay the
supplier to dedicate time to the interim design reviews
4. Unplanned Schedule Delay/Cost: None, the risk has been successfully mitigated
with no remaining exposure.

20. Scenario 3
Due to an urgent need to begin performance testing on the product, the full Test
Procedure (TP) may be skipped when testing on the next prototype build. Some things
have changed in the product recently and there’s a good chance the Test Procedure will
fail. The next build is a Validation build and failures in the Test Procedure will likely delay
Validation 1-3 weeks.
Company A (Risk Strategy - None)
1. Plan: Do nothing.
2. Potential Impact: There’s a 67% chance a problem will be missed that will cause a
failure of the Test Procedure during Validation. If this happens, it will cause a 2 week
schedule delay.
3. Planned Schedule Delay/Cost: 0 days/$0
4. Unplanned Schedule Delay/Cost: Roll the die. If you roll a 1, 2, 3, or 4, you incur a
2 week delay and lose $200K of profit.
Company B (Risk Strategy - Low-effort)
1. Plan: Execute the Test Procedure on one unit after testing of the prototype build is
complete. Because the unit will be used, the test may not be a true representation of
the actual performance.
2. Potential Impact: There’s a 33% chance a problem will be missed that will cause a
failure of the Test Procedure during Validation. If this happens, it will cause a 2 week
schedule delay.
3. Planned Schedule Delay/Cost: 0 days/$5K, where…
$5K = labor to analyze and process the risk
4. Unplanned Schedule Delay/Cost = Roll the die. If you roll a 1 or 2, you incur a 2
week delay and lose $200K of profit.
Company C (Risk Strategy - High-effort)
1. Plan: Execute the full Test Procedure on all prototype units prior to forwarding the
units for Validation testing.
2. Potential Impact: There’s a 1% chance or less a problem will be missed that will
cause a failure of the Test Procedure during Validation.
3. Planned Schedule Delay/Cost: 1 day/$50K, where…
$50K = $25K COD + $25K labor to process and analyze the risk
4. Unplanned Schedule Delay/Cost = None, the risk has been successfully mitigated
with no remaining exposure.

21. Scenario 4
A new-to-the-company process, manufacturing software validations, are now required.
Experience with this process is very low and once the software validation activities begin,
they may become much longer than expected or planned. Currently there are 4 weeks
planned, but it could easily grow to 8 weeks or more.
Company A (Risk Strategy – None)
1. Plan: No proactive planning or learning takes place.
2. Potential Impact: There’s a 67% chance the schedule will slip 4 weeks when we start
the software validation process.
3. Planned Schedule Delay/Cost: 0 days/$0
4. Unplanned Schedule Delay/Cost: Roll the die. If you roll a 1, 2, 3, or 4, you incur a
4 week delay and lose $400K of profit.
Company B (Risk Strategy - Low-effort)
1. Plan: Get software validation training by the process owner.
2. Potential Impact: There’s a 33% chance the time required for software validation will
take longer than planned. If this happens, it will cause a 4 week schedule delay.
3. Planned Schedule Delay/Cost: 1 day/$25K, where…
$25K = $20K COD + $5K labor to process and analyze the risk
4. Unplanned Schedule Delay/Cost: Roll the die. If you roll a 1 or 2, you incur a 4
week schedule delay and lose $400K of profit.
Company C (Risk Strategy - High-effort)
1. Plan: Get software validation training by the process owner and discuss with others
going through the process to hear what they have learned. Risk-assess the software
validations to identify which ones are most likely to be problematic and get help from
the process owner on the riskier ones.
2. Potential Impact: There’s a 1% chance or less the schedule will slip.
3. Planned Schedule Delay/Cost: 3 days/$80K, where…
$80K = $60K COD + $20K labor to process and analyze the risk
4. Unplanned Schedule Delay/Cost: None, the risk has been successfully mitigated
with no remaining exposure.

22. Scenario 5
An important feature of a new product is new-to-the-company and new-to-the-customer.
There is some potential that the feature, as-designed, doesn’t meet the customer’s need.
If so, sales will be lost.
Company A (Risk Strategy - None)
1. Plan: No feedback is solicited from customers (or it is acquired too late to make any
changes).
2. Potential Impact: There’s a 67% chance customers will be dissatisfied with the
feature design. If they are, 10% of our forecasted sales ($400K) will be lost.
3. Planned Schedule Delay/Cost: 0 days/$0
4. Unplanned Schedule Delay/Cost: Roll the die. If you roll a 1, 2, 3, or 4, you incur a
4 week schedule delay and lose $400K of profit.
Company B (Risk Strategy - Low-effort)
1. Plan: Marketing gets customer feedback once, mid-way through the project.
Customers identify some changes that we have time to incorporate. They may also
identify some items which can’t be fixed without slipping schedule.
2. Potential Impact: There’s a 33% chance that a 10% sales loss ($400K) will still occur
with the unfixed items. Since this is performed by Marketing, and they are not on the
critical chain, there’s no delay to schedule, therefore no cost of delay.
3. Planned Schedule Delay/Cost: 0 days/$25K, where…
$25K = $20K for prototypes + $5K labor to process and analyze the risk
4. Unplanned Schedule Delay/Cost: Roll the die. If you roll a 1 or 2, you lose $400K of
profit due to the 10% reduction in sales.
Company C (Risk Strategy - High-effort)
1. Plan: Get customer feedback 3 times throughout the project: early, middle, and late.
2. Potential Impact: There’s a 15% chance of a 5% sales loss ($200K).
3. Planned Schedule Delay/Cost: 0 days/$80K, where…
$80K = $60K for prototypes + $20K labor to process and analyze the risk
4. Unplanned Schedule Delay/Cost: Roll the die. If you roll a 1, you lose $200K of
profit due to the 5% reduction in sales.

23. Notes:
1. Which company had the longest schedule upfront?
2. Which company had the longest schedule in the end?
3. Which company would you like to work for?
4. Which company is the most stable?
5. Do you think some managers think some of this is a waste of time?
6. What happens if they do?
7. How do you stay a Company C?

24. Notes:

25. Key Takeaways
• Project Risk Management helps us better
understand the amount and type of uncertainty
in our project.
• When done on a regular, frequent cadence,
throughout the project, Project Risk Management
improves project outcomes.
• And is most likely well worth the investment
• Mitigations should be included in the top-level
project schedule.
PLAYBOOKHQ.co
@PLAYBOOKHQ

26. THANK YOU!
PLAYBOOKHQ.co
@PLAYBOOKHQ
PLAYBOOKHQ.co
@PLAYBOOKHQ