The document outlines the principles and practices of project risk management, emphasizing the importance of anticipating and mitigating risks, which can arise from uncertainties and can affect project objectives. It discusses different approaches to risk management, focusing on proactive strategies for successful project outcomes and the need for systematic frameworks across programs and portfolios. Additionally, it highlights risk monitoring and reporting mechanisms to ensure ongoing assessment and alignment with organizational goals.

1. Project Risk
Management
Shahram Sokhanvar, PhD,
PMP, RMP, MCT, Scrum
Master
Principles and
Practices

2. Increased
Risk
Introduction
 The rising importance of risk management
 More complex markets
 Global markets
 Greater product Complexity
 New businesses
 Increasing competition
 New players
 Regulatory imbalances
Global trends are leading to …

3. What is Risk
 A Risk is characterised by the combination of the probability that a
program or project will experience an undesired event and the
consequences, impact, or severity of the undesired event, were it to occur.
 Risk was defined before as:
 The probability of occurring danger or hazard
 But is now defined as (ISO 31000, 2009):
 Effect of uncertainty on objectives.
 Uncertainties include events (which may or not happen) and
uncertainties caused by a lack of information or ambiguity.
 They could impose both negative and positive impacts on objectives.
 So, they could be threat or opportunity

4. Uncertainty Continuum and Risk

5. The Unknown Unknowns
by Donald Rumsfeld
As we know, There are known knowns,
There are things we know we know.
We also know, There are known unknowns,
That is to say We know there are some things We do not
know.
But there are also unknown unknowns,
The ones we don't know, We don't know.
(Feb. 12, 2002, US Department of Defence news briefing)

6. Risk and Risk Management
 Undertaking a project that promises any sort of reward
almost always entails risk.
 Risk management is a process of anticipating thread
and/or opportunity and minimising their impact. Also, Is a
Comprehensive System that includes:
Creating an appropriate risk management environment,
Maintaining an efficient Risk Measurement,
Mitigating and Monitoring Process,
Establishing an Adequate Internal Control
Arrangement,
Core of the Strategic Management of the Company,

7. Risk Management Principals
7
ISO identifies the following principles of risk management:
Risk management should:
create value - resources expended to mitigate risk should generally
exceed the consequence of inaction, or (as in value engineering), the
gain should exceed the pain
be an integral part of organizational processes
be part of decision making
explicitly address uncertainty and assumptions
be systematic and structured
be based on the best available information
be tailorable
take into account human factors
be transparent and inclusive
be dynamic, iterative and responsive to change
be capable of continual improvement and enhancement
be continually or periodically re-assessed

8. Risk Management Approaches
 Proactive Risk Management:
This approach is the recommended way to manage project
uncertainty and risk through three main elements: Policies,
Methodologies, and Infrastructure. Also it’s known as strategic
risk management which significantly adds value to project
success.
 Reactive Risk Management:
This risk management approach is better known as crisis
management or putting out fires. This type of risk management
almost always negatively affects the project’s schedule, cost, and
quality. In addition, process improvement opportunities are
ignored – fire fighting

9. Risk in Project, Program and
Portfolio Management
 They are inherently risky because they are unique,
constrained, based on assumptions, performed by people
and subject to external influences. Risk includes both
opportunities and threats.
 Risk is defined at two levels for projects, Programs and
portfolios.
 At the detailed level, an individual risk is defined as ‘an uncertain
event or set of circumstances that, should it occur, will have an
effect on achievement of one or more objectives’.
 At the higher level of the project, Program or portfolio, overall risk
is defined as ‘exposure of stakeholders to the consequences of
variation in outcome’ arising from an accumulation of individual
risks together with other sources of uncertainty.

10. Levels of Project Management

11. Risk and Project Lifecycles

12.  Established in 1910s at Commonwealth level to
 collecting revenue
 administering the goods and services tax (GST)
 governing a range of programs to benefits the community
 administering Australia’s superannuation system
 Managing the Australian Business Register
 More than 25000 employee across the Australia
 More than 415,800 ($M) tax revenue in 2014 (26 % of GDP)
 A PMO with more than 50 person supports more than 500 projects and
programs per year to maintain and develop their taxation systems
 A Portfolio Called : Reinventing the ATO
Risk Management in Australian Taxation Office

13.  A program Called : ATO Project Management has been defined to
develop the Project and program Management System to :
 Develop a organisational wide “Project and Program Management
Methodology Using MSP, PRINCE and PMBOK
 Deploy and Customise an Enterprise Project Management System (MS
SharePoint and Project Server 2013)
 Develop a Project Risk Management Methodology
 Develop a integrated Project Financial management system
 Develop a organisational wide Business Intelligence
 Retire the previous systems and applications in order to develop an
integrated project management system
 KPMG, Accenture and SMS Technology were chosen
Risk Management in Australian Taxation Office

14. Risks and Issues in Project
 Risk – an event that may occur and cause negative/positive impact
 Issue – an event that has occurred and is causing impact
What do we do about Risks and Issues?
 “Calling them out early” – proactively identify and assess risks/issues
 “Acting upon them” – determine and implement planned actions
 “Keeping them under control” – monitor and report progress
How are Risks and Issues reported?
 Risks and Issues are reported at various levels, to establish visibility and
addressed:
 Within a Team
 Across the Project , or
 Across the Phase or Program

15. Project Risk Management
 Risk management at project level is most often focused on
individual risks that, should they occur, will affect the project’s
objectives. It is, however, also important for the project manager
to understand the overall risk exposure of the project, so that
this can be reported to the project sponsor and other
stakeholders.
 Risk management must be closely aligned to schedule
management. Cost, time and resource estimates should always
take risks into account.
 The project manager is accountable for ensuring that risk
management takes place. Depending on the size and complexity
of the project, a specialist risk manager may be appointed to
oversee and facilitate the risk management process.

16. Program Risk Management
 The Program will establish a common framework and standards for risk
management across the Program. This will enable comparison of risk,
reduce the time taken to initiate management processes at project level,
and help identify interdependencies between risks across the Program.
The common framework will be set out in the Program risk management
plan.
 Program risk management is made up of two distinct areas of focus:
 project risk escalation and aggregation;
 wider business risk and risks to benefit achievement.
 Program risk management addresses any individual risks at project level
that, if realised, will have a wider impact. Project risks that cannot be
effectively managed within projects In addition, related or common risks
within individual projects may combine or aggregate to have an effect at
Program level, in which case they also need to be escalated.

17.  Risks at portfolio level are often of such scale that they may have
significant impact on the ability of the organisation to operate. Portfolio
risk management will focus on two areas:
 risks escalated from projects or Programs and from areas of day-to-
day business;
 risks that impact upon the objectives of the portfolio and the host
organisation.
 Project and Program risks that cannot be effectively managed at their
originating level may be escalated to the portfolio for responses
unavailable at project or Program level.
 The consideration of risk efficiency is of particular importance to portfolio
risk management. The principles of risk efficiency have been established
in financial portfolios for many years. They are equally relevant to
portfolios of projects and Programs.
Portfolio Risk Management

18. Risk Categories in Project

19. General Risk Management Cycle
Step 4 : RiskStep 4 : Risk
MonitoringMonitoring
 Change Control
Management
Step 1: RiskStep 1: Risk
IdentificationIdentification
To Recognise
Hazard/Opportunity
Step 3 : RiskStep 3 : Risk
HandlingHandling
To Develop Risk Response
plan
Step 2 : RiskStep 2 : Risk
AnalysisAnalysis
 To Assess Risk
Probability and Impact

20. Tools for identifying risk
 Checklists (e.g., Boehm’s top ten risk list)
 Frameworks (e.g., McFarlan’s framework)
 Questionnaires (e.g., Barki, Rivard – IT industry, and
Talbot survey – Health Service)

21. Score Probability
0 Highly unlikely (1% or less)
1 Very unlikely (1% - 24%)
2 Unlikely (25% - 49%)
3 Likely (50% - 74%)
4 Very likely (75% -94%)
5 Highly likely (95% or more)
Scale of Probability

22. Evaluation of Impact
Score Impact
0 Ignorable
1 Unimportant
2 Less important
3 Important
4 Very important/serious
5 Catastrophic/critical

23. Risk Severity Matrix
User
backlash
Hardware
mal-
functioning
Interface
problems
System
freezing

24. Risk Response Strategies
 Strategies for Threats (risks)
 Avoid : Don’t do the project or the part of the project,
 Transfer : Making another party responsible for the risk,
 Mitigate : Reducing the probability or impact, making it smaller,
 Strategies for opportunities
 Exploit : Doing everything to make sure the event happens,
 Share : Sharing the risk,
 Enhance : Increasing the probability of the occurrence of risks,
 Strategies For both
 accept : Do nothing – If it happens, it happens!
 Contingency plan is a must response
 Managing Residual risk (secondary risk)

25. Contingency Plan and Business
Continuity Management
 “……..is an alternative plan that will be used if a possible foreseen
risk event becomes a reality” C. Gray & E. Larson
 In project management, a contingency plan is a part of the project
management plan and it describes every action that you will take if
the risk is about to happen or has happened.
 Fallback plan is implemented when the contingency plan fails or is
not fully effective. In other words, you can say that the fallback
plan is generally made for residual risks

26. Risk Monitoring
 Should be done periodically
(e.g., when certain milestones are reached, at the end
of project phases, at steering committee meetings, etc.)
 Useful to regularly assess and update project risk
exposure
 Senior management should be involved in
 monitoring and should be aware of exposures
 Listen to the project group

27. Project or Program Risks/Issues Process
Identify and raise
Risk/Issue via
JIRA
Assess Risk/Issue
Complete&
appropriate?
Amend/revise as
appropriate
No
Phase or Stream
/
Status&progress
of Risk/Issue
tracked at weekly
Program Risks&
Issues Meeting
Yes
Program Level
Risk/Issue
Risk/Issue
resolved?
Status&progress
of Risk/Issue
discussed and
tracked as part of
Escalation Items
to Sponsors
Yes
Program Level
Risk/Issue
Assignee
Discuss&
establish Agreed
Action as
mitigation/
resolution with
Assignee
Undertake Agreed
Action and update
Progress Notes
Yes
Requires
escalation?
No
Resolve Risk/
Close Risk/Issue
in Project Server
Risk/Issue
Reporter
Inform Phase/
Stream
Coordinator of a
potential Program
Risk/Issue
in Project Server

28. Project Life Cycle
Concept Planning Execution Termination
Time

29. KEY
Other
Projects
Start
Conceive
Design
Plan
Allocate
Execute
Deliver
Review
Support
Abort
Primary Progression flow
Primary feedback loops
Secondary feedback loops
Tertiary feedback loops

30. Stage of
PLC
Define
Project
focus Identify Structure Ownership Estimate Evaluate Plan Manage
Conceive
Design
Plan
Allocate
Execute
Deliver
review
Support
Project Life Cycle and RM Steps

31. Ten Steps to Manage Risk in PLC

32. Ten Steps to Manage Risk in PLC

33. Sample RMP Matrix
Risk Item Description of
Risk
Impact
(technical,
schedule,
cost, quality
Severity
(high,
medium ,
low)
Contingency plan Ranking
Testing Critical function
needed by new
system may be
overlooked if
not tested
properly
Technical High Formal testing plan
Test plan
Test cases
Testing schedule
Method to log test
results
5
Termination
, if
applicable
Project
termination
needs to be done
earl as not lose
money and time
Cost/
Quality
Low Enough research
should have been
done to terminate
the project before
it got to far
1

34. Managing Risk in Project Server

35. Project Site Features in
Project Server

37. 37
 A successful project manager is a successful risk manager,
 Prepare the organization through improving Risk Culture,
 Manage Training and Development in Risk,
 Build up a Learning Organization,
 Develop the Risk Management System with following capabilities
 Centralized Risk Register that eliminates disconnected spreadsheets
 Built-in Accountability Management clearly assigns mitigation actions
and timeframes increasing an organization’s risk-bearing capacity
 Executive Dashboards with key performance indicators deliver visibility
to high priority risks that could impact project cost, schedule or technical
performance
 Automated Alerts Engine that notifies project managers early to avoid
surprises
 Workflow management that guides each risk through its lifecycle
ensuring that nothing falls through the cracks
Summary