2. I. Review risk concepts
– Risk Management Overview and the Risk Management
Plan
– Risk Identification
– Risk Quantification
– Risk Response
– Risk Control
2
3. Risk Management Overview
• What is risk?
Risk: An uncertain event or condition that, if it occurs, has a positive or
negative effect on a project’s objectives
3
VENTURE
(Project)
OUTCOME
(Products)
UNKNOWNS
(Uncertainty)
FAVORABLE
(Opportunity)
UNFAVORABLE
(Risks)
4. Project Risk Management
Risk Management Overview
Project Lifecycle
Risk vs. Amount at Stake
4
$
V
A
L
U
E
I
N
C
R
E
A
S
I
N
G
R
I
S
K
CONCEPT
PHASE
DEVELOPMENT
PHASE
IMPLEMENT
PHASE
CLOSE
PHASE
OPPORTUNITY AND RISK
AMOUNT AT STAKE
PERIOD WHEN
HIGHEST RISKS
ARE INCURRED
PERIOD OF
HIGHEST
RISK IMPACT
5. Project Risk Management
Risk Management Overview
• What is risk management?
– Identifying, analyzing, prioritizing, and
responding to risk events
– Integration of risk management activities into
your other project management functions
– Developing responses to risk to meet your
project objectives
– Project risk management is PROACTIVE
5
6. Project Risk Management
Risk Management Overview
6
PROJECT
MANAGEMENT
INTEGRATION
INFORMATION /
COMMUNICATIONS
HUMAN
RESOURCE
CONTRACT /
PROCUREMENT
SCOPE
QUALITY
TIME
COST
PROJECT
RISK
Life Cycle and
Environment Variables
Expectations
Feasibility
Requirements
Standards
Time Objectives,
Constraints
Cost Objectives,
Restraints
Services, Plant, Materials:
Performance
Availability
Productivity
Ideas, Directives, Data
Exchange Accuracy
INTEGRATING RISK WITH OTHER PROJECT MANAGEMENT FUNCTIONS
7. Project Risk Management
Risk Management Overview
• Components of the Risk Management Plan
Methodology
Roles and responsibilities
Budgeting
Timing
Risk categories
Definitions of risk probability and impact
Probability and impact matrix
Stakeholder’s tolerances
Reports
Tracking
7
8. Project Risk Management
Risk Management Overview
• Results from developing the Risk Management Plan
– You have a written plan
– You know what actions you have to do
– You know who is responsible for what
– You can track your work
– You can learn from your risk activities and help others with
their risk
8
10. Project Risk Management
Risk Identification
• Risk in corporate business is typically divided into 2 basic
types
Business Risk: Chances of profit or loss associated with a business
endeavor
Business employs a staff of qualified workers to increase profit and reduce
chances of loss
Pure or Insurable Risk: Divided into 4 categories
Direct property: Destruction of property by fire, etc.
Indirect property: Extra expenses associated with rental property or loss due to a
business interruption
Liability: Chance of a lawsuit of bodily injury, damages, etc.
Personnel: Injuries to workers (Worker’s Comp)
10
11. Project Risk Management
Risk Identification
• Risk in project management
– Usually not enough attention is paid to risk on projects
– All risks are not independent and frequently the greatest risk on
a project comes from a series of related/integrated events
– Ultimate responsibility of risk management resides with the
project sponsor
– As the project manager representing the sponsor, risk
management becomes a large responsibility for you
11
12. Project Risk Management
Risk Identification
• The process for identifying risk
– Understand the project
– Identify the risk event
– Document the results and take appropriate actions
12
13. Project Risk Management
Risk Identification
• Types of risk
– Technical
– External
– Organizational
– Project Management
Note: These are example types of risk and this list can be modified to
meet the needs of your project
• Developing a project RBS (Risk Breakdown Structure) is an
excellent tool to help identify risks
13
14. Project Risk Management
Risk Identification
PROJECT
RBS
TECHNICAL EXTERNAL ORGANIZATIONAL
PROJECT
MANAGEMENT
REQUIREMENTS
TECHNOLOGY
COMPLEXITY &
INTERFACES
PERFORMANCES
& RELIABILITY
QUALITY
SUBCONTRACTORS
& SUPPLIERS
REGULATORY
MARKET
CUSTOMER
WEATHER
PROJECT
DEPENDENCIES
RESOURCES
FUNDING
PRIORITIZATION
ESTIMATING
PLANNING
CONTROLLING
COMMUNICATIONS
14
The Risk Breakdown Structure (RBS) lists categories
and sub-categories for project risk. The actual
categories will vary across different types of projects.
15. Project Risk Management
Risk Identification
• What you need to identify risk
– Product description
– Planning documents
• Project scope statement
• Cost mgt plan
• Schedule mgt plan
• Communications mgt plan
• Enterprise environmental factors
• Stakeholder register
• Quality mgt plan
• Organizational process assets
– Historical Information
• Previous project data
• Expert knowledge
15
16. Project Risk Management
Risk Identification
• In your risk identification meeting
– Validate RBS with core team
– Identify risks by source (RBS)
– Identify risks by level of uncertainty:
Known Known / Unknown Unknown / Unknown
Situation with no
uncertainty
Situation with an
identifiable uncertainty
Situation whose
existence we cannot
imagine
16
17. Project Risk Management
Risk Identification
• Conduct a risk identification meeting
– Gather all relevant data
– Schedule a risk management meeting with your core team members
– Use a structured approach: Brainstorming, Nominal Group Technique, Delphi
Technique, Mind Mapping, Project Lessons Learned
– Focus on identifying risk only
• Schedule risk identification meetings in your project plan
– After certain milestones: Requirements complete, design complete, etc.
• Event driven
– A risk event happens and becomes part of the risk register
17
18. Project Risk Management
Risk Identification
• Brainstorming
– Chose a facilitator (best if other than the project manager)
– Chose a scribe to capture the risks
– Use a category or categories to start the creativity flowing
– Do not judge or analyze during this effort
– Focus on getting the universe of risks for your project
18
19. Project Risk Management
Risk Identification
• Nominal Group
– Gather the core team for a risk workshop
– Use flip charts or a whiteboard to collect info
– Begin by having each person identify potential areas of risk
– Then within each area have each person write at least 3-5 risk
events
– Repeat until everyone has listed their risks
19
20. Project Risk Management
Risk Identification
• Delphi technique
– Identify a facilitator
– The facilitator then identifies qualified experts to participate
– The facilitator poses questions to the experts individually
– The facilitator then analyzes the results to identify common themes
– The results are then shared with the experts for validation
– The list is then refined and again shared with the panel
– The facilitator the creates a single results document
20
21. Project Risk Management
Risk Identification
• Mind mapping
– Begin with a category of risk in the center represented by a circle
– Major risks for that category are represented by lines connecting
with the circle
– For each major risk identify smaller risks that are part of that risk
– Do not judge or evaluate at this time
– Continue until no more risks can be identified
21
22. 22
22
3 Rules of Project Management
1. Don’t hurt anyone
• People, animals, or the environment
2. Do the right thing
• Follow all legal, regulatory, and compliance rules
• Ethical behavior and honesty are the most important things you
can ever do
• Give credit where credit is due
3. Just deliver, baby!
24. Project Risk Management
Risk Identification
• Identify your risks in a risk register or a risk log
Functional Area Identify the functional business areas
potentially impacted by the risk
Risk Category Cost; External; Schedule; Technical;
Resources; Operational
Risk Description Description of the risk and the impact of it
Date Identified Date the risk was identified
Raised By Who identified the risk
24
25. Project Risk Management
Risk Quantification
• What are the right risks to manage
– Analyzing risks for probability and impact
– Developing a risk profile for your project
– Prioritizing your risks
• When to quantify risks
– Whenever a new risk is created
– An existing risk changes
– Influential factors change
– New information surfaces
– A change is proposed by the sponsor
– Market conditions change
– Significant personnel leave the project
25
26. Project Risk Management
Risk Quantification
• Quantitative Analysis
– Relies on a numeric value
– Uses objective data
– Requires understanding of
probability theory
– Removes some uncertainty
– Should be based on
historical data
– Some examples are:
sensitivity analysis,
expected monetary
analysis, and modeling and
simulation
• Qualitative Analysis
– Uses subjective values:
Green, Amber, Red
– Requires common
understanding of ordinal
ranking system
– May be less precise than
quantitative analysis
– Should be defined in terms
of the parameters of the
project
26
27. Project Risk Management
Risk Quantification
• Probability
– Can be done in a basic approach by developing a simple estimate of the probability that an event will
be late in delivery
• Ed says it is 50% likely this task will be late
• Probability of Event 1 x Probability of Event 2 = Probability
– Can be done in a more complex manner by using weighted averages
• Joe says 35% chance of being late
• Mary says 40% chance of being late
• Ed says 50% chance of being late
• Joe gets twice as much credit because he knows more about the situation
• The probability is: ((2 x 35) + (40) + (50)) / 4 = 40%
– Quantifying risk probability can become quite complex, there are many resources to assist you with
more detailed approaches (books, internet research, multi-day training, consultants).
27
29. Project Risk Management
Risk Quantification
• Assessing Impact (cont.)
– Quality
• Ask yourself the question “What if the project fails to
perform as expected during its operational life?”
• Of all the project objectives, conforming to quality
objectives is the one most remembered
• Therefore, this is one of the most important dimensions
impacting your project
• You can use financial analysis to identify risk for poor
quality by quantifying long term activities that will
impact the product lifecycle for your analysis
29
31. Project Risk Management
Risk Response
• Risk response is:
– Defining steps for responses to opportunities and threats
– Assigning responsibility
– Developing responses for negative risks:
• Avoiding: Changing the project mgt plan to eliminate the
risk. Could involve changing the objective, modifying the
schedule, or reduction in scope.
• Mitigating: A reduction in the probability or impact to the
project. Taking early action to reduce the probability,
adopting less complex processes, or conducting more
tests.
• Transferring: Shifting the risk to a third party for the
management of the risk. Does not eliminate the risk,
could involve insurance, warranties, bonds.
• Insurance: Purchase insurance to reduce/eliminate risk –
an athlete may purchase insurance against injury to
guarantee their income.
31
32. Project Risk Management
Risk Response
• Risk response is:
1.Developing responses for negative risks(cont.):
Accepting: It is possible that the risk cannot be eliminated or managed. Can
be active or passive in approach – a contingency reserve in time, money,
or resources.
2.Developing responses for positives risks or opportunities
• The strategies for managing positive risks are:
Exploit the situation. We will do whatever we can to make sure
the event does happen so we can enjoy the rewards of the event.
Enhance the probability and positive impacts of the event.
Share the ownership with a third party who can better enhance the
situation.
Accept the opportunity, take the advantages provided by the
event, but do not actively pursue the event.
32
33. Project Risk Management
Risk Response
• Consider the following for contingency planning:
The management of a contingency budget
The development of schedule alternatives and work-arounds
Complete emergency responses to deal with major areas of risk
An assessment of project shut-down liabilities
33
35. Project Risk Management
Risk Control
• Actively work your risk register/log
• Update risks as needed (data, new resources, new/changing
requirements)
• Review the log in status calls, set and use due dates for active
contingency plans
• Hold assigned resources accountable for their action items
• Engage sponsor when invoking contingency plans to ensure
they know a risk has happened and the team is actively
working the response plan
35
36. Project Risk Management
Risk Control
Example Log
Risk ID Sequential number assigned
Functional Area Identify the functional business areas potentially impacted by the risk
Risk Category Cost; External; Schedule; Technical; Resources; Operational
Risk Description Description of the risk and the impact of it
Date Identified Date the risk was identified
Raised By Who identified the risk
Date Assigned Date the risk was assigned
Assigned To Who the risk was assigned to
Probability 1, 2, 3, 4
Potential Impact 1, 2, 3, 4
Risk Factor (P*I) Probability * Impact
Positive or Negative Impact Will the potential impact of the risk have a Positive, Negative, Both or Unknown impact if realized?
Response Category Acceptance; Mitigation; Transfer; Avoidance
Status/Comments Status of risk and update/comments about it
Trigger Preliminary event that will indicate the risk is about to take place
Proposed/Actual Resolution Risk Response plan
Contingency Plan Alternate Plan if Risk Response fails 36
38. Project Risk Management
Small Team Exercise
• Your task, should you choose to accept it, and you must, is to
develop a risk plan for your project
• The group will break into 3-5 person teams to work on their
project
• There are 2 projects, a construction project and a new product
development effort
• You will develop your risk plan, then the similar project teams
will get together (all the construction teams in one group and
all the product development teams in another) and develop a
summary of what happened, then each large project group will
present to the whole class their experiences
38
39. Project Risk Management
Small Team Exercise
• Product Development Project
– This is a telecommunications product
– The team will develop and deploy a new feature to be used on your
home or work phone called “Phone Buzz”
– There is an estimated customer base of 6M consumer users and 1M
business users across the 50 states
– Revenue for the consumer base is estimated to be $720M per year
and revenue for the business segment is estimated at $180M per year.
– The base telecommunications technology for the application is proven,
but must be combined with a new technology that has never been
utilized on the current telecommunications system architecture
39
40. 40
Project Risk Management
Small Team Exercise
Product Development Project (cont.)
– The VP of Marketing is planning on announcing the new
product at the industry’s largest trade show in 6 months
– The budget for the project is currently set at:
$ 25M for technology
$ 1M for business project costs
$ 5M for marketing
– Initial estimates are 12 – 18 months to complete the project
– The project has been approved to start, and the following
assets have been developed
High level business requirements
A preliminary technical feasibility assessment
Secondary market research has been performed
The sponsor and initial core team have been identified
41. Project Risk Management
Small Team Exercise
• Product Development Project (cont.)
– Core team members
• Required
– Business Project Manager
– Technical Project Manager
– Project Sponsor
• Optional
– Operations Manager
– Training Project Manager
41
42. Project Risk Management
Small Team Exercise
• Construction Project
– This project will develop a combined residential and commercial
community in southern Louisiana, the community will be called
“Southern Comfort”
– Planned activities are:
• 300 Residential Condos (Targeted sales price $100K to $150K each)
• 100 Residential Homes (Targeted sales price $350K to $500K each)
• A small office complex (50,000 sq. ft.)
• 2 convenience stores, each with a gas station
• 4 recreational areas:
– 2 open space areas: Also used for youth soccer and football
– 1 area with tennis courts and basketball courts
– 1 area with 6-8 baseball/softball fields
42
43. Project Risk Management
Small Team Exercise
• Construction Project (cont.)
– The current project budget is $47M, targeting 3 years to
complete the entire effort
Unit Type Quantity Sq. Ft (tot) Cost Cost per Unit
Condos 300 360,000 21,600,000 72,000
Houses 100 200,000 18,000,000 180,000
Commercial 1 50,000 6,500,000 6,500,000
Stores 2 8,000 1,040,000 520,000
Fields 4 100,000 25,000
47,240,000
43
44. Project Risk Management
Small Team Exercise
• Construction Project (cont.)
– So far the following has happened:
• The land has been purchased
• The property is located next to a protected wildlife area and had wonderful views
and access to good shopping and restaurants
• 35 condos have been built or are in progress
• 10 homes have been built or are in progress
• The zoning for the commercial lots has not yet been completed
44
45. Project Risk Management
Small Team Exercise
• Construction Project (cont.)
– Core team members
• Required
– Business Project Manager
– Construction Project Manager
– Project Sponsor
• Optional
– Sales Manager
– Supplier/Materials Project Manager
45
46. Project Risk Management
Small Team Exercise
• Your assignment, as the new Business Project Manager is to:
– Develop a Risk Management Plan
– Develop an RBS
– Conduct a Risk Identification meeting
– After the identification meeting is complete, quantify your risks
– Develop risk responses for your significant risks
– Prepare a summary sheet on your findings to share with the other small teams
in your project type
– Develop a summary sheet with the similar projects to present to the entire
class
– Notes:
• Each small team will call for 2 reviews, one for their Risk Management Plan and one
for their Risk Register once they complete their risk responses from the facilitator
• Updates to the project information will be provided during the exercise
46