11.0 Project Risk Management

11.0 Project Risk ManagementObjectives

Define the characteristics of Risks and Project Risk Management

Appreciate the importance of Project Risk Management knowledge area

Understand the various processes involved in Project Risk Management Understand the relationship amongst various risk management processes.

11.0 Project Risk ManagementWhat do you mean by Risk Management?

Are Project Risk always bad? Is there a possibility of good project risks?

Do you categorize current / past challenges in your project as Risks?

Is there a common understanding of your project objectives and constraints amongst key stakeholders of your project?

How are you communicating project risks to your stake holders? Are they able to take proactive decisions based on your inputs?

11.0 Project Risk ManagementWhat is Risk?Project risk is an uncertain event or condition that, if it occurs, has a positive or a negative effect on the projects objectives

Risk happen in future and its characteristics change over time

Origin of risk is in uncertainties inherent in project attributes like complexity, uniqueness, requirements, assumptions, constraints etc.Leads ToUncertaintyRisk

11.0 Project Risk ManagementA risk event may have one or more causes and, if it occurs, may have one or more effects

Project risk includes both threats to the projects objectives and opportunities to improve upon those objectives CAUSE EVENT EFFECTCause 1Cause 2Cause 3Cause NRisk Event /ConditionQualityTimeScopeCost

11.0 Project Risk ManagementKnown risks are those that have been identified and analyzed and it may be possible to plan for handling them.

Possibility of occurrence of a known risk and its impact on project objective(s) can be influenced, if they are proactively managed.

Specific unknown risks cant be managed proactively hence requires contingency plan to be in place.

A project risk that has occurred can be considered an issue.

11.0 Project Risk ManagementAspects of Risk: Following attributes of risk event should be well understood by persons responsiblefor handling project risks:

Does the uncertain event matter to the project?To whom does it matter?What is the attitude of stakeholder/ organization towards risk event?Only if a uncertain event impacts project objectives it can be termed as risk. Customer/ End user Sponsor Vendor PM, Organization, Project Team Risk Seeker Risk Neutral Risk AverseA certain event is a Non-Risk but it can create possibility of another risk!Is it a certain event or condition?

11.0 Project Risk ManagementFollowing attributes of risk should be well understood by persons responsiblefor handling project risks:

How important it is to respond to the risk event for my project?When is the risk event likely to materialize?Risk events change their characteristics over a period of time. Project team should know temporal characteristics of risk event like: Urgency Frequency Predictability Readiness to respond

Importance of Risk event can be judged based on relative priorities for project constraints it is going to impact like Scope Schedule Cost Quality

11.0 Project Risk Management Types of Risk:Business Risk Chances for a profit or loss associated with any business endeavor.Pure (Insurable) RiskOnly a chance for loss External unpredictable Risk Government, Effects of nature Etc.External Predictable RiskRaw material availability, Business / Financial risk etcLegal RiskLicenses / Patent Rights, Lawsuits, Contractual Failure.

11.0 Project Risk Management Project Risk Management is a creative and constructive endeavor that helps project stakeholders to:

Understand the nature of uncertainties in their project

Develop Integrated view of the project

Leverages common understanding of uncertainty amongst stakeholders for enhancing chances of success and reducing chances of failure

Allows advance preparation for handling Uncertainty with an aim to balancing investment with perceived rewards

Allows better decision making in the face of uncertainty like prioritizing efforts for a new chance request.

11.0 Project Risk ManagementProject Risk Management is the systematic process of planning, identifying, analyzing, monitoring and controlling for handling project risk

Project Risk Management is done with a purpose of:maximizing the possibility and consequences of positive eventsminimizing the probability and consequences of adverse events to project objectives (Note: elimination may not be possible)

It is an proactive investment to enhance chances of project success

Golden Rule: Cost of project risk management should not exceed the potential rewards.

11. Project Risk Management11.1 Plan Risk Management 11.2 Identify Risks11.3 Perform Qualitative Risk Analysis11.4 Perform Qualitative Risk Analysis 11.5 Plan Risk Responses11.6 Monitor & Control Risks ControllingPlanningProject Risk Management-Processes

11.1 Plan Risk ManagementRisk management planning is a process of deciding how to approach and plan the risk management activities for the project

Careful explicit and early planning enhances the possibility of success of the five other risk management processes

Ensure that the level, type and visibility of the risk management activities commensurate with both the risk and importance of the project to the organization

Risk Management plan does not include the list of actual project risks but only the approaches to risk management activities, where as the risk register includes list of risks, probabilities, impacts and planned responses.Deciding how to approach and risk management activities for a project

11.1 Plan Risk Management1. Project scope statement2. Cost management plan3.Schedule management plan4. Communication management plan5. Enterprise environmental factors6. Organizational process assets1.Planning meetings and analysis

1. Risk management planInputsTools & TechniquesOutputs

11.1 Plan Risk Management5.2Define Scope6.0Project TimeManagement7.0Project Cost Management11.2Identity Risks10.2Plan CommunicationsEnterprise/Organization11.5Plan RiskResponses11.3PerformQualitativeRisk Analysis11.4PerformQuantitativeRisk Analysis11.1Plan RiskManagement4.2Develop ProjectManagementPlan schedule management plan

Cost management plan Communications management plan Organizational process assets Enterprise environmental factors Risk management planProject Risk Management Project scope statement

11.1.1- Project Risk Management-InputProject Scope statement Helps decide appropriate approach for risk management by providing a clear sense regarding projects:Objectives and scope Deliverables Acceptance Criteria Project exclusions, Assumptions and ConstraintsCost Management PlanProvides details of how risk budgets, Contingency and management Reserves will be reported and accessedSchedule Management PlanProvides details of how schedule contingencies will be reported and accessedCommunication Management PlanProvides details of project interactions and sharing of risks and their response related information.

11.1.1- Plan Risk Management-InputEnterprise Environment Factors The attitudes toward risk and the risk tolerance of organizations and people involved in the project will influence the project management planRisk attitudes and tolerances may be expressed in policy statements or revealed in actionsOrganizational Process Assets Organizations may have predefined and approaches to Risk categoriesCommon definitions of concepts and termsRisk statement formats Standard templates Roles and responsibilitiesAuthority levels for decision makingLessons learnedStakeholders Registers.

11.1.2 Plan Risk Management- T & TPlanning Meetings and AnalysisProject team holds planning meetings to develop RM planAttendees includeThe project ManagerSelected project team members and key stakeholders Anyone in the organization involved in managing risk planning and execution activitiesOthers as needed like subject matters expertsThey define and/or reviewHigh level plan for doing RM activities Cost elements and schedule activitiesApproach for handling contingency reservesTemplates for risk categories, definitions of level of risk, probability, impact by type objectives, PI matrix

11.1.2 Plan Risk Management- OutputThe Risk Management (RM) plan describes how risk management will be structured and performed on the project.The RM plan includes the following:Methodology Roles and responsibilitiesBudgetingTiming Risk categories Risk Breakdown Structure (RBS)Definitions of risk probability and impactProbability and impact (PI) Matrix Revised stakeholders tolerancesReporting formats Tracking

11.1.2 Plan Risk Management- OutputProjectTechnical External organizationalProject MgmtRequirementsTechnologyComplexity & InterfacesSubcontractors & SuppliersRegulatory Market Project dependenciesResources Funding Performance & Reliability CommunicationEstimatingPlanning Controlling CustomerQuality Weather Prioritization Risk Breakdown Structure:

11.1.2 Plan Risk Management- OutputImpact Definition:

Project Objectives Very low0.05Low 0.1Moderate 0.2High 0.4Very high0.8Cost Insignificant cost increase < 5% cost increase 5- 10% cost increase10- 20% cost increase> 20% cost increaseScheduleInsignificant Schedule slippageSchedule slippage < 5%Overall project Slippage 5- 10%Overall project Slippage 10- 20%Overall project Slippage> 20%Scope Scope decrease barely noticeableMinor Areas of scope are affectedMajor Areas of scope are affectedScope reduction is unacceptable to the client Project end item is effectively uselessQuality Quality degradation barely Noticeable Only very demanding applications are affectedQuality reduction requires clients approvalQuality reduction unacceptable to the clientProject end item is effectively unstable

Evaluating impact of a Risk on Major project Objectives (ordinal scale or cardinal, non-linear)

11.2 Identify RisksThis involves determining which risks might affect the project and documenting their characteristics.Iterative process performed through out the life of project for:Discovering new risksObserving evolution of already identified risks and their characteristicsIt is important to involve project team in identifying risks so that they can develop and maintain a sense of ownershipOther stakeholders and external experts must be involved as per the needs and importance of the project Risk statements must be expressed in CEE (Cause, Risk Event, Effect) or EE (risk Event, Effect) for consistency and validation of their significanceDetermining which risks might affect the project and documenting their characteristics

Documentation reviewsInformation gathering techniques Checklist analysis Assumptions analysisDiagramming techniquesSWOT analysisExpert judgment11.2 Identify RisksRisk management planActivity cost estimatesActivity duration estimatesScope baselineStakeholders registerCost management planSchedule management planQuality management planProject documents Enterprise environmental factorsOrganizational process assets InputsTools & Techniques

1. Risk registerOutputs

11.2.1 Identify RisksEnterprise /Organization ProjectDocuments6.3Create WBS7.0Project Cost Management6.0Project TimeManagement6.4EstimateActivity Duration7.1Estimate Costs8.1Plan Quality 10.1Identify Stakeholder11.2Identify Risks11.1Plan RiskManagement7.1Estimate Costs8.1Plan Quality 12.1Procurements 11.5Plan RiskAnalysis 11.6Monitor andControl Risks11.3Perform QualitativeRisk Analysis 11.4Perform QuantitativeRisk Analysis Project Risk Management Risk management plan Risk register Organizational process assets Enterprise environmental factors Project documents stakeholder register Quality management plan schedule management plan Cost management plan Scope baseline Activity duration estimates Activity cost estimates

11.2.1 Identify Risks- InputRisk Management PlanRoles & Responsibilities Provision for risk management activities in the budget and schedule Categories of risk Activity Cost EstimatesLikely cost to complete schedule activities ideally expressed as rangeBigger the range , higher is the degree of riskActivity Duration EstimatesLikely duration for completing schedule activities ideally expressed as range Bigger the range, higher is the degree of riskScope BaselineDeliverables, WBS, Project assumptions etc. are source of risksUncertainty in WBS (at micro and macro level) and project assumptions should be evaluated for identifying risk

11.2.1-Identify Risks- InputStakeholders RegisterProvides human sources of project risks for identifying risks like:Information about stakeholders, their key requirements and their attitude towards likely project surprisesCustomers perspective captured explicitly formally or informally Cost Management PlanProvides insight into project specific cost management practices/ approach Schedule Management PlanProvides insight into project schedule management practices / approach Quality Management PlanProvides insight into project specific quality management practices/ approach.

11.2.1- Identify Risks - InputProject Documents Assumptions LogWork Performance ReportsEarned Value ReportsNetwork DiagramsBaselinesAny other inputs for identifying risksEnterprise Environmental FactorsPublished information, including commercial databasesAcademic s studies Published checklistsBenchmarking Other industry studiesRisk attitudesOrganizational Process AssetsProject files, including actual dataOrganizational and project process controlsRisk statement templatesLessons Learned.

11.2.2 Identify Risks- T & TDocumentation reviewsStructured review of plans, assumptions, previous project files, contracts and other information Quality of plans and consistency between plans and actual project requirements are validatedInformation gathering techniquesBrainstorming Goal to obtain a comprehensive list of risks that can be addressed qualitatively and quantitatively Categories of Risk like RBS can be used as a framework . The session could be free form or may use mass interviewing techniques like nominal group techniqueDelphi TechniqueTo reach a consensus of experts on project risks anonymously to reduce bias.Facilitator uses a questionnaire to solicit ideas about the important projects risks.The response are summarized and recirculated to the experts for further comments.

11.2.2 Identify Risks T & TInformation gathering techniques (cont)Interviewing Interviewing experienced project participants, stakeholders or subject matter expertsRoot cause analysis This is an inquiry into the essential causes of a projects risks. It sharpens the focus of project risk management team to address underlying causes to develop preventive actions.Checklist Analysis Can be developed based on historical information. Should itemize all types of possible risks and present it in a form of checklist and should be reviewed routinelyAssumptions Analysis Every project is conceived and developed based on a set of hypotheses, scenarios, or assumptionsAssumptions analysis identifies risks to the project from inaccuracy, inconsistency, or incompleteness of assumptions.

11.2.2- Identify Risks T & TDiagramming Techniques Causes and effect diagrams (fishbone diagram),Systems or process flow chart (shows interaction between various elements) andInfluence diagram (graphical representation of relationship between variables and outcomes)SWOT AnalysisExamines Projects / organizations Strengths, weaknesses, Opportunities and ThreatsRecognized project strengths helps to identify opportunities Recognized project weaknesses helps to identify threatsExperts JudgmentBased on their area of expertise or previous experience, experts help identify possible risks

11.2.3 Identify Risks - outputRisk RegisterThe preparation of the risk register begins in the risk identification processUltimately this contains the outcomes of the other risk management processes as they are conductedThis contains the following information List of identified risksList of potential responsesRoot causes of riskUpdated risk categories

11.3 Perform Qualitative Risk Analysis Qualitative Risk Analysis includes methods for prioritizing the identified risks for further action, such as Quantitative Risk Analysis or Risk Response PlanningOrganizations can improve the projects performance effectively by focusing on high priority risksQualitative Risk Analysis assesses the priority of identified risks using their probability of occurring, the corresponding impact on project objectives if the risks do occur, as well as other factors such as the time frame and risk tolerance of the project constraints of cost, schedule, scope and quality Perform qualitative analysis of risks & conditions to prioritize their effects on project objectives

11.3 Perform Qualitative Risk AnalysisRisk registerRisk management planProject scope statementOrganizational process assetsInputsRisk probability and impact assessment Probability and impact matrix Risk data quality assessment Risk categorization Risk urgency assessmentExpert judgment Tools & Techniques

1.Risk register updatesOutputs

11.3 Perform Qualitative Risk Analysis5.2Define Scope11.1Plan Risk Management11.2Identify Risks11.3Perform QualitativeRisk AnalysisEnterprises/ OrganizationProject Risk Management Project scope statement Organizational process assets Risk register updates Risk register Risk management plan

11.3.1Perform Qualitative Risk Analysis - InputsRisk RegisterKey is the listing of identified risks Risk Management PlanKey elements of risk management plan for qualitative risk analysis includeRoles and ResponsibilitiesRisk categories Definition of probability and impactPl matrixRevised Stake holder risk tolerancesProject Scope statement Projects of a common or recurrent type tend to have more well-understood Risks.Projects using state of the art or first-of-its-kind technology, and highly complexProjects, tend to have more uncertainty.Organizational Process AssetsData about risks on past projects and the lessons learned knowledge base.

11.3.2 Perform Qualitative Risk Analysis - T &TRisk Probability and Impact Assessment:Risk probability assessment investigates the likelihood that each specific risk will occurRisk impact assessment investigates the potential effect on a project objectives such as time, cost, scope or quality, including both ve and +ve effectProbability and impact is assessed for each identified risk

Risks can be assessed Interviews or meetings with experts, team membersExpert judgmentOrganizations databaseSome times risks with obviously low ratings of probability and impact will not be rated. But will be included on a watch list for future monitoring.

11.3.2 Perform Qualitative Risk Analysis T & TPI Matrix:Evaluation of each risks importance and hence the priority for attention is typically decidedConducted using a look-up table or a probability and impact matrix.This leads to rating the risks as low, moderate or high priority based on their risk score.

Threats:High priority-priority action and aggressive response strategyLow risk- Proactive management actionOpportunities:High priority offer greatest benefit, target firstLow risk- should be monitored.

11.3.2 Perform Qualitative Risk Analysis T & TEvaluating impact of a Risk on Major project Objectives (ordinal scale or cardinal, non-linear)

Project Objectives Very low0.05Low 0.1Moderate 0.2High 0.4Very high0.8Cost Insignificant cost increase < 5% cost increase 5- 10% cost increase10- 20% cost increase> 20% cost increaseScheduleInsignificant Schedule slippageSchedule slippage < 5%Overall project Slippage 5- 10%Overall project Slippage 10- 20%Overall project Slippage> 20%Scope Scope decrease barely noticeableMinor Areas of scope are affectedMajor Areas of scope are affectedScope reduction is unacceptable to the client Project end item is effectively uselessQuality Quality degradation barely Noticeable Only very demanding applications are affectedQuality reduction requires clients approvalQuality reduction unacceptable to the clientProject end item is effectively unstable

11.3.2 Perform Qualitative Risk Analysis T & THigh Likely to cause significant disruption to schedule, increase in cost, or Degradation of performance- even with special supplier emphasis and close customer monitoringModerate Has potential to cause disruption as above- special supplier Emphasis and close customer monitoring, however, will probablyOvercome difficultiesLowHas little potential to cause disruption to schedule, increase in cost, orDegradation of performance- normal supplier effort and normal customerMonitoring will probably overcome difficulties.

**