prm handbook
DESCRIPTION
Risk managementTRANSCRIPT
Project Risk Management Handbook:
A Scalable Approach
Version 1 (June 2012)
Ris
k M
on
ito
rin
g
Risk Response
Qu
alitative
Risk A
nalysis
A LETTER FROM THE CHIEF ENGINEER WelcometothenewCaltransProjectRiskManagementHandbook.Webelievethatthisnewscalableapproachtomanagingprojectriskswillensurethatprojectrisksareknown,communicated,andacceptedastheymovethroughthephasesofprojectdelivery.ItisalsoanimportantelementoftheDepartment’sEnterpriseRiskManagement.AsurveywasconductedaspartofthedevelopmentofthishandbooktodeterminehowprojectriskmanagementwasbeingusedintheDepartmenttomanageprojectrisks.Thesurveyresponsesrevealedthatalthoughprojectriskmanagementisconsideredtobevaluable,manyrespondentsarenotfamiliarwiththecurrentProjectRiskManagementHandbookorhaveneverparticipatedindevelopingariskregister.Withthisinmind,thehandbookhasbeenupdatedwiththefollowingobjectives:
Itissimpleandeasytouse. Itisscalabletoprojectsizeandcomplexity. Itcommunicatesrisksacrossprojectmilestonesandphases. Itteacheshowtomanagerisksproactively. Itintegratesintothecurrentprocessesofprojectdelivery. Itisnotresource‐intensive.
Themanagementofrisksrequiresestablishingandnurturingacultureofriskmanagement.Insuchanenvironment,projectteamsworktogetherthrougheachphaseofprojectdeliverytomanagerisks.Theintentistobringfocustotheunderstandingthattheprojectteamsarenotonlydesigningroads,bridges,drainagesystems,etc.,butaredevelopingplans,specifications,andestimatesforconstructioncontracts.Projectriskmanagementiseveryone’sresponsibility,andthereareaccountabilitycheckpointstoensurethatprojectrisksarebeingmanaged.ThenewProjectRiskManagementHandbook:AScalableApproachisyourguidetoimplementingprojectriskmanagement.Itiswrittenasahandbookforallprojectteammemberstouseduringallphasesofdelivery.Trainingandsubjectmatterexpertsareavailabletohelpprojectteamseffectivelyimplementprojectriskmanagement.ItisourexpectationthatProjectDeliveryDirectivePD‐09istobeimplementedusingtheProjectRiskManagementHandbook:AScalableApproach.Ifyouhaveanyquestionsaboutitorhowtoimplementitforyourproject,pleasecontactyourDistrictRiskManagementCoordinator.BobPieplowActingChiefEngineerActingDeputyDirector,ProjectDelivery
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 1
TABLE OF CONTENTS
PREFACE 2
CHAPTER 1 INTRODUCTION 3 Objectives and Benefits 3 1‐1 What is meant by “Risk” 4 1‐2 The Project Risk Management Process 5 1‐3 Three‐Tiered Scalability 6 1‐4 Organization 8 1‐5 Roles and Responsibilities 9 1‐6 Managing the Risk Register 10 1‐7 Communication in General 10 1‐8
CHAPTER 2 PLANNING PROJECT RISK MANAGEMENT 11 Creating the Project’s Risk Management Plan 11 2‐1 The Project Risk Management Team 11 2‐2 Incorporating Project Risk Management Activities into the Project Schedule 12 2‐3 The First Project Risk Management Meeting 12 2‐4
CHAPTER 3 RISK IDENTIFICATION 13 The Risk Register 13 3‐1 Identifying Project Risks 14 3‐2 Examples of Risk Statements 17 3‐3 Entering Data into the Risk Register 18 3‐4
CHAPTER 4 QUALITATIVE RISK ANALYSIS – LEVEL 1 19 Risk Assessment 19 4‐1 Entering Assessment into Risk Register Columns 19 4‐2
CHAPTER 5 QUALITATIVE RISK ANALYSIS – LEVEL 2 20 Probability and Impact Ratings for Level 2 Projects 20 5‐1 Performing Qualitative Risk Analysis 21 5‐2 Entering Assessments into the Risk Register 21 5‐3
CHAPTER 6 QUANTITATIVE RISK ANALYSIS – LEVEL 3 23 Quantifying the Risks 23 6‐1 Entering Quantifications into the Risk Register 24 6‐2 Producing the Risk Probability Curves 24 6‐3
CHAPTER 7 RISK RESPONSE 27 Risk Response Strategies 27 7‐1 Examples of Risk Responses 28 Responding to Risks 29 Entering Risk Responses into the Risk Register 29 7‐4
CHAPTER 8 RISK MONITORING 30 Risk Review and Updating 30 1‐1 Updating the Risk Register 31 1‐2 Lessons Learned 31 1‐3
CHAPTER 2 COMMUNICATION AND ACCOUNTABILITY 32 Communication and Accountability Checkpoints 32 2‐1 What Happens at a Communication Checkpoint 34 2‐2 What Happens at an Accountability Checkpoint 34 2‐3 What Happens at the Performance Measure Checkpoint 34 2‐4
ACRONYMS AND DEFINITIONS 35 APPENDIX A
RISK MANAGEMENT PLAN TEMPLATE 37 APPENDIX B
RISK REGISTER CERTIFICATION FORM 41 APPENDIX C
PD‐09 PROJECT RISK MANAGEMENT 42 APPENDIX D
PROJECT RISK MANAGEMENT STRUCTURE 47 APPENDIX E
ACKNOWLEDGEMENTS 50 APPENDIX F
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 2
Preface
TheProjectRiskManagementProcess,describedherein,isintendedtoresultintheeffectivemanagementofprojectrisksandopportunitiesduringtheentireprojectlifecycle–fromprojectinceptiontocompletionofconstruction.Theprojectmanager,projectsponsor,andprojectteammembersjointlydevelopariskregisterthatenablesthemtoidentify,assess,quantify,preparearesponseto,monitor,andcontrolprojectrisks.
Thisdocumentprovidesinformationtoprojectmanagersandprojectteamsthatwillhelpwiththeirriskmanagementeffortsinthefollowingways:
Provideaconsistentmethodologyforperformingprojectriskmanagementactivities.
Providetechniquesandtoolsforprojectriskmanagement.
Identifydatarequirementsforriskanalysisinputandoutput.
ProvideinformationonhowprojectriskmanagementfitsintotheoverallprojectmanagementprocessatCaltrans.
Provideguidanceonhowtoproactivelyrespondtorisks.
Projectriskmanagementisascalableactivitycommensuratewiththesizeandcomplexityoftheprojectunderconsideration.Simplerprojectsmayusesimpleanalysis,whereaslargermorecomplexprojectsmayusemorerobustanalysistechniques.
ThisScalableProjectRiskManagementHandbook,whichmayberevisedandupdatedfromtimetotime,isapplicabletoallprojects.Thelevelofprojectriskmanagementdependsonthetotalcostoftheproject,aswellasotherconsiderations(seeChapter1,Section1‐4).
Chapter1givesanoverviewofprojectriskmanagement,thethreelevelsofprojectriskmanagement,andtheprocess,roles,andresponsibilities.
Chapter2isdesignedtohelptheprojectmanagerplantheriskmanagementprocess,formtheprojectriskmanagementteam,andprepareabudgetforprojectriskmanagementactivities.
Chapter3providesinstructionaboutriskidentificationandstartingtheriskregister.Itisapplicabletoallscalabilitylevels.
Proceedtotheriskanalysischapterforthelevelofyourproject:
Level1 Chapter4
Level2 Chapter5
Level3 Chapter6
Chapters7through9arecommontoallprojects.Chapter7detailsriskresponse,andChapter8isaboutriskmonitoring.
Chapter9addressestherequiredcommunicationcheckpointsforallprojectsandexplainstherequiredaccountabilitycheckpointswheredeputiesmustsignoffontheriskregister.ItalsoincludestheRiskManagementPerformanceMeasurerequirements.
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 3
Chapter 1 Introduction
Objectives and Benefits 1‐1
Project Risk Management Objectives
TheProjectRiskManagementHandbookhasbeendesignedto:
Besimpleandeasytouse Bescalabletoprojectsizeandcomplexity Pullcommunicationofrisksacrossprojectmilestonesandphases Activelymanagerisktoenhanceprojectsuccess Integrateintothecurrentprojectdeliveryprocess,and Involveallfunctionalunitsinthemanagementofrisks.
Project Risk Management Values
Identifying,communicating,andmanagingprojectrisksrequiresariskmanagementculture.Thiscultureisdefinedbythevaluesinwhichweoperate.ThefollowingattributesdepictPRMvaluesrequiredforthedevelopmentofasuccessfulriskmanagementculture.
Riskdecision‐makingbasedonbalancingprojectvaluessuchascost,schedule,andquality Stewardship Efficiency Teamwork Jointownershipofrisksandresponsibilities Accountability
Benefits to the Project Team
Caltransprojectriskmanagementhelpstheprojectmanagerandtheotherprojectmemberstomanageprojectrisksoverthelifeofeachproject,enlistingthesupportandeffortofallofthefunctionalunitsastheprojectmovesalongthedeliverycycle.Thisincludes:
Betterabilityfortheprojectteamtofocustimeandeffortonhighestratedrisks Ascalableapproach,consistentwithexistingprocesses Enhancedcoordinationandtransparencywithfunctionalunits,whichfacilitatesearly
identificationofcriticalrisks Bridgingoffunctionalstovepipestomaintainfocusonprojectsuccessbyallfunctionalunits Supportoftheprojectmanager’smissionthroughthemanagementaccountabilityprocess
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 4
What is meant by “Risk” 1‐2
Themeaningoftheterm“risk”mustbeunderstoodclearlyforeffectiveprojectriskmanagement.Inthecontextofaproject,weareconcernedaboutpotentialimpactsonprojectobjectivessuchascostandtime.Ageneraldefinitionof“risk”inthiscontextis:
Riskisanuncertaintythatmatters;itcanaffectprojectobjectivesnegativelyorpositively.
Theuncertaintymaybeaboutafutureeventthatmayormaynothappenandtheunknownmagnitudeoftheimpactonprojectobjectivesifitdoeshappen.Thus,a“risk”ischaracterizedbyitsprobabilityofoccurrenceanditsuncertainimpactonprojectobjectives.
Thekindsofrisksappearinginariskregisterareshownbelowbasedonwhentheymightoccurduringthelifecycleofaproject.
Throughouttheprojectlifecycle,afutureeventthatmayoccuratanytimeinaproject’slifecycleisarisk.Ithasaprobabilityofoccurrenceandanuncertainimpactifitdoesoccur.
DuringPlanningandDesign,uncertaintyinthetotalcostestimate,duetouncertainquantitiesandunitpricesisarisk.Inthiscasetheprobabilityis100%(theestimateanditsuncertaintiesexist),andtheuncertaintiesimpacttheprojectcost.
Duringconstruction,aNoticeofPotentialClaim(NOPC)hasaprobabilityofbecomingaContractChangeOrder(CCO)andanuncertaincost/timeimpactifthishappens.ThisriskisretiredfromtheregisteriftheclaimisdismissedorifitisreplacedbyaCCO.
Duringconstruction,aCCOwhichhasoccurred(100%probability)isarisk,butitscost/timeimpactmaybeuncertain.IfthereisanestimateintheCCOLogoftheproject,theuncertaintyisexpressedasarangearoundtheestimate.ThisriskisretiredfromtheregisterwhentheCCOisexecutedwiththecontractor.
Theseexamplesarecollectivelyreferredtoas“risks”inthisHandbook,andwouldallbeincluded,whenapplicable,intheproject’sriskregisterbecausetheycontainuncertaintythataffectsprojectobjectives.
SpecificsaboutidentifyingrisksareinChapter3,includingexamplesofriskstatements.
Riskandissuearetwowordsthatareoftenconfusedwhenitcomestotheirusage.Actuallythereissomedifferencebetweenthem.
Ariskisanuncertaineventthathasaprobabilityassociatedwithit.Anissuedoesnothavethisattribute.Issuesareproblemsrightnowthattheprojectteamhastodosomethingabout.
Thinkofriskmanagementasaproactiveactivity,whileissuemanagementisreactive.
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 5
The Project Risk Management Process 1‐3
The Basic Process
Allapproachestoprojectriskmanagementstrivetomaximizebothefficiencyandeffectiveness.Althoughthedetailsofriskprocessesmaydifferdependingontheproject,riskmanagementhasthreeimportantparts:identification,analysis,andaction.Beforeriskcanbeproperlymanaged,itmustfirstbeidentified,described,understood,andassessed.Analysisisanecessarystep,butitisnotsufficient;itmustbefollowedbyaction.Ariskprocesswhichdoesnotleadtoimplementationofactionstodealwithidentifiedrisksisincompleteanduseless.Theultimateaimistomanagerisk,notsimplytoanalyzeit.
Theprojectriskmanagementprocess(Figure1)isnotdifficult.Itsimplyoffersastructuredwaytothinkaboutriskandhowtodealwithit.Afullprojectriskmanagementendeavorincludestheseprocesses:
1. RiskManagementPlanning–Decidinghowtoapproach,plan,andexecutetheriskmanagementactivitiesforaproject.
2. RiskIdentification–Determiningwhichrisksmightaffecttheprojectanddocumentingtheircharacteristics.
3. QualitativeRiskAnalysis–Prioritizingrisksforsubsequentfurtheranalysisoractionbyassessingandcombiningtheirprobabilityofoccurrenceandimpact.
4. QuantitativeRiskAnalysis–Analyzingprobabilisticallytheeffectofidentifiedrisksonoverallprojectobjectives.
5. RiskResponse–Developingoptionsandactionstoenhanceopportunitiesandtoreducethreatstoprojectobjectives.
6. RiskMonitoring–Trackingidentifiedrisks,monitoringresidualrisks,identifyingnewrisks,executingriskresponseplans,andevaluatingtheireffectivenessthroughouttheprojectlifecycle.
Atitsfoundation,projectriskmanagementinvolvesaskingandansweringafewsimplequestions:
Whatrisksmightnegatively(threats)orpositively(opportunities)affectachievingtheprojectobjectives?(Riskidentification)
Whichofthesearemostimportant?(Qualitativeriskanalysis)
Howcouldtheseaffecttheoveralloutcomeoftheprojectinprobabilistictermsofcostandschedule?(Quantitativeriskanalysis)
Whatcanbedoneaboutit?(Riskresponse)
Havingtakenaction,howdidtheresponseseffectchange,andwhereistheprojectnow?(Riskmonitoring)
Whoneedstoknowaboutthis?(Communication)
FIGURE 1 – PROJECT RISK MANAGEMENT PROCESS
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 6
Whilethesequestionsarelistedsequentiallyandareusuallyconductedinthisorder,theyareoftencombined,repeatedastheprojectprogresses,ormayevenbeperformedoutofsequence.
Thequestionsconstituteaprocess,showninFigure1,indicatinghowthedifferentelementsofprojectriskmanagementinteractanddescribinghowriskmanagementcanbeimplemented.Theprocesshasacircularformtohighlightthatitisacontinuousprocessthroughoutthelifecycleofaproject.
Thearrowssignifythelogicalflowofinformationbetweentheelementsoftheprocess.Communicationisthecoreofthisprocess.Itisthemeansbywhichalltheinformationflowsandtheprojectteamcontinuouslyevaluatestheconsistencyandreasonablenessofriskassessmentsandtheirunderlyingassumptions.
Three‐Tiered Scalability 1‐4
Arecentanalysisofthetotalcost(capitalandsupport)oftheDepartment’scurrentcontractsrevealedthefollowingbreakdown.Sixty‐sevenpercentofcontractsareunder$5million,30percentareintherangeof$5‐$100million,and3percentareover$100million.Accordingly,threerangeswereselectedforthescalabilitylevelsofProjectRiskManagement.TheriskmanagementrequirementsarelistedinTable1.
TABLE 1 – RISK MANAGEMENT REQUIREMENTS BY SCALABILITY LEVEL
Scalability Level
Estimated Cost (Capital and Support)
Risk Management Requirements
Minor A, Minor B, and other projects less than $1 million
Risk register encouraged
1 Less than $5 million Risk register
2 $5 million to $100 million Risk register with qualitative analysis
3 Greater than $100 million Risk register with quantitative analysis
Therequirementsperscalabilitylevelsareminimumrequirements.TheprojectteammaychoosetoworkatahigherscalabilitylevelthanrequiredorworkatalowerlevelifapprovedbytheSFP.However,theprojectteamshouldconsiderotherfactorstodeterminewhatlevelofriskmanagementeffortisneeded.Thesefactorsmayinclude:
Politicalsensitivity
Thetypeoftheproject
Locationoftheprojectandthecommunityitserves
Durationoftheproject
Stakeholdersoftheproject
Thesponsor’ssensitivitytotheprimaryobjectivesoftheproject(costandschedule).
Anyofthesefactorsmaywarrantemployingahigherscalabilitylevel.
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 7
TheactivitiesforeachScalabilityLevelareshowninTable2.
TABLE 2 – LEVELS OF PROJECT RISK MANAGEMENT SCALABILITY
Risk Management Process
Level 1 Cost to $5 M
Level 2 Cost $5‐100 M
Level 3 Cost over $100 M
Risk Identification Yes Yes Yes
Qualitative Analysis Risk Rating Probability/Impact
Matrix n/a
Quantitative Analysis n/a n/a Yes
Risk Response Yes Yes Yes
Risk Monitoring Yes Yes Yes
Communication Yes Yes Yes
ThelevelsdifferintheQualitativeandQuantitativeAnalysisprocesses.Alllevelsperformtheotherprocesses.Level3quantifiesrisksinprobabilisticforecasttermsofcostandtime,whereasLevels1and2donot.
Irrespectiveoftheproject’stotalcost,Level3mightbeusedifanyofthefollowingactivitiesarecontemplatedfortheproject:
Validatingtheproject’scontingencyallowance Justifyingandrequestingadditionalcontingencyabove5% Duringconstruction,checkingtheadequacyoftheremainingcontingency Duringconstruction,requestingsupplementalfunds Allocatingrisksofadesign‐buildproject Establishingthebudgetand/orcompletiontargetdatetoadesiredlevelofconfidence
MorecomplexprojectsmightrequestexemptionsdependingontheLevel3probabilisticcost.Level3analysismaybeusedinsupportofrevisionstotheproject’sprogrammingdollaramount.
Need more Contingency?
AccordingtoPD‐04,thereisaprocesstorequestmorecontingency:
"ContingencyApprovalProcess‐‐Whenthe5percentprojectcontingencymustbeincreasedordecreased,theprojectengineermustprepareamemorandumjustifyingtheneedandrequestedpercentageforcontingencies.Afullydevelopedriskmanagementplanwithaquantitativeriskassessmentwouldbeanacceptabledocumenttohelpjustifyanexceptiontothe5percentcontingency."Source:PD‐04ProjectContingenciesandSupplementalWork,AppendixA
AccordingtotheRTLGuide,thememorandumtorequestmorecontingencymusthavetheapprovaloftheDistrictDirector.
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 8
Organization 1‐5
TheProjectRiskManagementTeam(PRMT)isthecoregroupperforming,updating,andreviewingriskmanagementactivitiesunderthedirectionoftheProjectRiskManager(PRM),whohasbeentrainedintheprocesses.ThePRMTwillincludemembersofthePDT,butnotnecessarilyallmembers.ThePRMTriskmanagementmeetingsmaybescheduledtofollowthePDTmeeting.
ThePRMTcomprisesCaltransprojectpersonnelfromDesign,Construction,ProjectManagement,andtheFunctionalUnitsinvolvedintheproject.ThemembersofthePRMTshouldcollectivelyhavealloftheexpertiserequiredtoidentify,assess,andrespondtorisksoftheproject.However,theyshouldnothesitatetodrawontheextensivetalentpoolavailabletotheprojectforassistance.Representativesfromotheragencies,ifany,maybeinvitedtoparticipateatPRMTmeetingstoensurethatallpartiesarefullyinformed,andthusavoidsurprises.
ThePRMTisdirectedbythePRM.TheprojectmanagergenerallyactsasthePRMforLevel1and2projects.
InschedulingPDTmeetings,theprojectmanagershouldindicatewhenriskdiscussionswillbeontheagendasothatPRMTmemberscanplantoattendforriskdiscussionsaswellasotheragendaitems.
Discussing Risks as a Team has Value
Conductingriskmanagementmeetingsasateamhasvalue.Theteamlistenstoitsmembersdiscussrisks,andtheteamcanprovideinputfromdifferentperspectives.Thiscannotoccurinone‐on‐onediscussionsofrisk.Indiscussingrisks,theworkofindividualteammemberscanhaveanimpactontheworkoftherestoftheteam.Listeningtoteammembers,anddiscussingtheirchallenges,providesagreaterlikelihoodthattheimpactofariskwillbeassessedproperly.
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 9
Roles and Responsibilities 1‐6
TABLE 3 –PROJECT RISK MANAGEMENT ROLES AND RESPONSIBILITIES
Role Responsibilities
Project Managers
With input from the Project Development Team (PDT), determine the project’s risk register requirements based on project estimate and complexity, and the need for a written project Risk Management Plan.
Promote and direct risk management for the project.
Request project‐specific changes to minimum risk management requirements.
Populate and maintain the project risk register with risks developed by functional units and the PRMT.
Ensure proactive response to all risks and opportunities that will impact the successful delivery of the project.
Produce risk management reports for sponsors.
Inform Department management about risk management results, major issues, and concerns.
Schedule and conduct project risk meetings.
Monitor and update risks.
Ensure quality of the risk data in the risk register.
Track and monitor the effectiveness of risk response actions.
Elevate issues to district management for resolution as necessary.
Take lead role in obtaining signoffs at accountability check points.
District Risk Management Coordinator
Assist project managers with the implementation of PRM requirements.
Provide expertise, direction, and assistance.
Obtain expert services as needed.
Liaise with Headquarters risk management.
Project Delivery Team Member
Identify and assess risks.
Develop responses to risks.
Document risk response actions and report to project manager for inclusion in risk management updates.
Communicate with project manager about newly‐identified risks, risk assessments, and retirement of risks.
Project Risk Manager
(Generally the project manager for Level 1 and 2 projects)
Promote and direct risk management for the project.
Schedule and conduct project risk meetings.
Perform risk monitoring and updating.
Ensure quality of the risk data in the Risk Register.
Document risk response actions.
Track and monitor the effectiveness of risk response actions.
Report to the project manager on all matters related to risk management.
Compile the lessons learned in the area of risk management.
Produce risk management reports for the project manager.
Populate the project risk register with risks developed by functional areas.
Project Delivery Team Members and Task Managers
Identify and assess risks and determine the risk owners.
Develop responses to risks.
Document risk response actions and report to project managers for inclusion in risk management updates.
Communicate new risks to project managers.
Retire risks.
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 10
Managing the Risk Register 1‐7
Theproject’sprojectriskmanagerfacilitatestheriskmanagementprocess,ensuresthatthePRMTfullyvetstheriskregister,andmakessurethatdisputesareresolved.
Communication with Functional Units
Theprojectmanagerinitiatestheprojectriskmanagementprocessand“owns”ituntiltheprojectiscompleted.TheprojectmanagershouldinvolveallfunctionalunitsandConstructionintheriskmanagementprocessfrominceptiontoprojectcompletion.
Communication and Accountability Checkpoints
Althoughriskscanandshouldbediscussedwithprojectteammembersandmanagementatanytimeduringthecourseofaproject,itisdesirabletohave“checkpoints”toensuretheprojectdoesnotunnecessarilyproceedonacourseofactionthatmaynotbefeasibleandmaybechangedlaterbyadecision‐maker.
ThecommunicationandaccountabilitycheckpointsaredetailedinChapter2.TheyarerelativetotheexistingstandardmilestonesintheCaltransWorkBreakdownStructure.Thelatestriskregisteriscommunicatedateachcheckpoint.Theriskregisteristobeapprovedandsigned‐offbytheDeputiesattheaccountabilitycheckpoints.
Communication in General 1‐8
Communicationandconsultationwithprojectstakeholdersareacrucialfactorinundertakinggoodriskmanagementandinachievingprojectoutcomesthatarebroadlyaccepted.Ithelpseveryonetounderstandtherisksandtrade‐offsthatmustbemadeinaproject.Communicationensuresthatallpartiesarefullyinformed,andthusavoidsunpleasantsurprises.
Regularreportingisanimportantcomponentofcommunication.Reportsonthecurrentstatusofrisksandriskmanagementarerequiredformanagersandotherpartiestounderstandtherisks.Theycomplementothermanagementreportsindevelopingthisunderstanding.Theprojectriskmanagerwillprepareandissueperiodicriskmanagementreportsasrequiredbytheprojectmanager
Toensureaclearaudittrail,theprojectriskmanagerwillensurethattheriskmanagementprocessisdocumentedinsuchawaythatitcanbereviewed,thestructureandassumptionscanbeexamined,andthereasonsforparticularjudgmentsanddecisionscanbeidentified.
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 11
Chapter 2 Planning Project Risk Management
Creating the Project’s Risk Management Plan 2‐1
AwrittenRiskManagementPlanisnotrequiredforallprojects.Itdependsontheprojectsizeandcomplexityandtheamountofriskmanagementeffortthatwillberequired.TheprojectmanagerandthePDTmaydecideifitisnecessary.
TheRiskManagementPlan(RMP)definesthelevelatwhichriskmanagementwillbeperformedfortheprojectandthefrequencyofriskmanagementmeetingsandriskregisterupdates.ItliststhemembersoftheProjectRiskManagementTeambythevariousdisciplinesinvolvedintheprojectandsetsabudgetfortheriskmanagementactivities.TheRMPshouldbecompletedearlyinprojectplanning,sinceitiscrucialtosuccessfullyperformingtheotherprocessesdescribedherein.
AProjectRiskManagementPlantemplateisshowninAppendixBandmaybedownloadedfrom:http://onramp/riskmanagement
Thisstepwillensurethatthelevel,type,andvisibilityofriskmanagementarecommensuratewithboththeriskandimportanceoftheprojecttotheorganization,providesufficientresourcesandtimeforriskmanagementactivities,andestablishanagreed‐uponbasisforevaluatingrisks.
Firststeps:
Determinethescalabilitylevelfortheproject.
Downloadtheriskregisterforthescalabilitylevelfrom:http://onramp/riskmanagement.
Determinethefrequencyofriskmeetingsfortheprojectandtheapplicablecommunicationandaccountabilitycheckpoints.
DecidewhowillbeontheProjectRiskManagementTeam.
Ifsignificanteffortoroutsideconsultantswillbeinvolved,includeestimatesforprojectriskmanagementactivitiesinworkplans.
Ifapplicable,obtainthenecessaryapprovalsforthewrittenRMP.
The Project Risk Management Team 2‐2
TheProjectRiskManagementTeam(PRMT)isthecoregroupperforming,updating,andreviewingriskmanagementactivitiesunderthedirectionoftheprojectriskmanager.ThePRMTwillincludemembersofthePDT,butnotnecessarilyallmembers.
ThePDTmaynotcontinueregularmeetingsafterRTL.EmphasizethatthePRMTisexpectedtostaytogethertomanagerisksuntilprojectcompletion.
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 12
Incorporating Project Risk Management Activities into the Project Schedule 2‐3
Theprojectschedule(workplan)shouldincorporatethefollowing:
Datesforprojectriskmanagementmeetings
Timetoallowteammemberstoprepareforreviewoftheriskregisterandriskresponses
Milestonesforcommunicationandaccountabilitycheckpoints(seeChapter2)
The First Project Risk Management Meeting 2‐4
ThefirsttimethatthePRMTmeets,theprojectmanagershouldbrieftheteamaboutthefollowing:
Theimportanceandobjectivesoftheprojectriskmanagementprocess
Theprocessitself
Therolesandresponsibilities
Theriskregister
Thecommunicationandaccountabilitycheckpoints
Riskmanagementactivitiesintheprojectschedule
Timechargecodesforriskmanagementactivities
Theexpectationthatriskwillbemanaged,documented,andreported
Atthisfirstmeeting,elicitrisksfromtheteammembers.IfworkingtoLevel2scalability,determinetheimpactandprobabilitydefinitionssothattheteamhasthesameunderstandingofthemeaningoftheworddescriptions.(SeeTable5onpage20forguidance.)
ThePDTmayincludeexternalstakeholdersandagenciesinadditiontoCaltranspersonnel.AtPDTmeetings,afterregularPDTbusinessisconcluded,thePRMTmembersfromthePDTcanremaintoconductaprojectriskmanagementmeeting.
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 13
Chapter 3 Risk Identification
Riskidentificationdetermineswhatmighthappenthatcouldaffecttheobjectivesoftheprojectandhowthosethingsmighthappen.Itproducesadeliverable—theprojectriskregister–thatdocumentstherisksandtheircharacteristics.Theriskregisterissubsequentlyamendedbythequalitativeorquantitativeriskanalysis,riskresponse,andriskmonitoringprocesses.Riskidentificationisaniterativeprocessbecausenewrisksmaybecomeknownastheprojectprogressesthroughitslifecycle,previously‐identifiedrisksmaydropout,andotherrisksmaybeupdated.
“Risk” Includes Threats and Opportunities
Theconceptofriskcanincludepositiveandnegativeimpacts.Thismeansthattheword“risk”canbeusedtodescribeuncertaintiesthat,iftheyoccurred,wouldhaveanegativeorharmfuleffect.Thesamewordcanalsodescribeuncertaintiesthat,iftheyoccurred,wouldbehelpful.Inshort,therearetwosidestorisk:threatsandopportunities.
Projectsindesignhavethegreatestpotentialforopportunitiesbecausetheprojectisstillopentochanges.Riskreductionandavoidanceareopportunities,asarevalueanalyses,constructabilityreviews,andinnovationsindesign,constructionmethods,andmaterials.
Onceaprojectentersconstruction,theprojectobjectives(scope,time,andcost)arefixedcontractually,soopportunitiestosavemoneyandtimearefewer.Anychangesmustbemadeusingacontractchangeorder(CCO),andonlyanegativeCCOsuchasoneresultingfromaValueEngineeringChangeProposalbythecontractorwouldstillaffordanopportunitytosavemoneyandtime.Otherwise,CCOsaddcostand/ortimetotheproject.So,theriskmanagementfocusduringconstructionisonreducingoreliminatingrisks.
The Risk Register 3‐1
What it is
Ariskregisterisatoolthatprojectteamscanusetoaddressanddocumentprojectrisksthroughouttheprojectlifecycle.Itisalivingdocument–acomprehensivelistingofrisksandthemannerinwhichtheyarebeingaddressedaspartoftheprojectriskmanagementprocess.Theriskregisterismaintainedaspartoftheprojectfilethatalsoincludesinformationrelatedtouncertaintiesinthecostestimateandschedule.
Riskregistertemplatesforeachscalabilitylevelcanbedownloadedfrom:http://onramp/riskmanagement
Why use it
Anewprojectteamisformedforeveryprojectanddisbandedwhentheprojectiscomplete.Althoughnotdesirable,projectteammemberssometimeschange,andtheprojectexperienceschangeoverthecourseoftheproject.Communicationamongprojectteammembersabouttheprojectobjectives,costs,risks,etc.,isvital.Theriskregistercommunicatesprojectrisksandhelpstheteammembersunderstandthestatusoftherisksasaprojectmovesfrominceptiontowardcompletion.
Managersshouldviewtheriskregisterasamanagementtoolthroughareviewandupdatingprocessthatidentifies,assesses,manages,andreducesriskstoacceptablelevels.
Mo
nit
ori
ng
& C
on
tro
l
Response
Planning
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 14
When to use it
Ariskregisterisrequiredtobepreparedinconjunctionwiththefirstpublishedcostandscheduleestimateofaproject(atthePIDphase).Thereafter,afullreviewandupdateoftheriskregistershouldbeundertakenatthebeginningofeachsubsequentphaseoftheproject.Theregisterwillbeupdatedatleastquarterlyduringtheconstructionphaseoftheproject.
How to use it
Ariskregisterisbestusedasalivingdocumentthroughouttheproject’sentirelifecycle,fromPIDthroughconstruction,torecordtheevolutionofprojectrisks.Thereisnoprescriptionforhowextensiveaproject’sriskregistershouldbe.Theprojectteamdecidesthemostbeneficialuseoftheriskregister,withtheobjectiveofminimizingtheriskimpact.
Resolving Disputes
Successfulimplementationofariskmitigationmeasureisoneofthemostimportantaspectsofprojectriskmanagement.WhenPRMTmembersareatoddsonwhetherornotthesemeasurescanbeimplemented,thedisputeshouldbeelevatedtoassistinitsresolution.TheteamshouldhaveaDisputeResolutionLadder(DRL)thatoutlineswhenandhowdisputeswillbeelevatedandsubsequentlyresolved.TheDRLshouldbecreatedintheinitialPRMTmeetingandusedthroughoutthelifeoftheproject.
Disputesshouldbeelevatedonceallrelevantinformationisknown,andagreementisnotreachedoradecisioncannotbemade.
Example Dispute Resolution Ladder
PM facilitates resolution and elevation
If unresolved among PRMT members Elevate to Functional Manager(s)
If unresolved by Functional Manager(s) Elevate to Deputies
ItisimportanttonotethatthedisputemayberesolvedbytheDepartmentacceptingtheriskandnotimplementingthemitigationmeasure.
Identifying Project Risks 3‐2
Thefirsttimethatriskmanagementisappliedtoaproject,theprojectriskmanagerconvenesthePRMTtoidentifyandassessrisks.Riskidentificationdocumentsrisksthatmightaffecttheprojectandtheircharacteristicsofprobabilityandimpact.
Acommonchallengeinriskidentificationisavoidingconfusionbetweencausesofrisk,genuinerisks,andtheeffectsofrisks.Ariskmayhaveoneormorecausesand,ifitoccurs,oneormoreeffects.
Causesaredefiniteeventsorsetsofcircumstanceswhichexistintheprojectoritsenvironment,andwhichgiverisetouncertainty.Examplesincludetheneedtouseanunprovennewtechnology,thelackofskilledpersonnel,orthefactthattheorganizationhasneverdoneasimilarprojectbefore.Causesthemselvesarenotuncertainsincethey
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 15
arefactsorrequirements,sotheyarenotthemainfocusoftheriskmanagementprocess.
Risksareuncertaintieswhich,iftheyoccur,wouldaffecttheprojectobjectiveseithernegatively(threats)orpositively(opportunities).Examplesincludethepossibilitythatplannedcompletiontargetsmightnotbemet,escalationratesmightfluctuate,orthechancethatrequirementsmaybemisunderstood.Theseuncertaintiesshouldbemanagedproactivelythroughtheriskmanagementprocess.
Effectsareunplannedvariationsfromprojectobjectives,eitherpositiveornegative,whichwouldariseasaresultofrisksoccurring.Examplesincludeearlymilestonecompletion,exceedingtheauthorizedbudget,orfailingtomeetagreedqualitytargets.Effectsarecontingentevents,unplannedpotentialfuturevariationswhichwillnotoccurunlessriskshappen.Aseffectsdonotyetexist,andtheymayneverexist,theycannotbemanageddirectlythroughtheriskmanagementprocess.
Includingcausesoreffectsinalistofidentifiedrisksobscuresgenuinerisks,whichmaynotreceivetheappropriatedegreeofattentiontheydeserve.Onewaytoclearlyseparaterisksfromtheircausesandeffectsistouseadescriptionwithrequiredelementstoprovideathree‐partstructured“riskstatement”:“Asaresultof<definitecause>,<uncertainevent>mayoccur,whichwouldleadto<effectonobjective(s)>.”
Examplesinclude:
“Asaresultofusinganewtechnology(adefiniterequirement),unexpecteddesignproblemsmayoccur(anuncertainrisk),whichwouldleadtooverspendingontheproject(aneffectonthebudgetobjective).”
“Becauseourorganizationhasneverdoneaprojectlikethisbefore(fact=cause),wemightmisunderstandtherequirements(uncertainty=risk),andourprojectwouldnotmeettheperformancecriteria(contingentpossibility=effectonobjective).”
At the risk identification stage, the impacts on cost and time are not analyzed – that happens in the qualitative risk analysis (Chapter 4) or quantitative risk analysis (Chapter 5) processes.
Theteammembersidentifythepotentialrisks(threatsandopportunities)usinganycombinationof:
Brainstorming, Challengingofassumptions, Lookingfor“newness”(e.g.newmaterials,technology,orprocesses), Theirknowledgeoftheprojectorsimilarprojects, Consultationwithotherswhohavesignificantknowledgeoftheprojectoritsenvironment, Consultationwithotherswhohavesignificantknowledgeofsimilarprojects,and Theexperienceofprojectstakeholdersorothersintheorganization.
AlistoftypicalrisksfromthepreviousCaltransriskmanagementhandbookmaybedownloadedfrom:
http://onramp/riskmanagement
Thelistisforguidanceonly.Itisnotintendedasanexhaustivelist,norisitasubstituteforothermethodsofidentifyingrisks.Someoftheitemsareissuesandnotrisks(Thedifferenceisexplainedinthesidebaronpage4).
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 16
Inidentifyingrisks,theteamconsidersanddocuments:
Whatmayhappenornotgoaccordingtoplan,
Whattheimpactstotheprojectobjectiveswouldbeshouldtheriskarise,
Whattheassumptionsandcurrentstatusarethatsupporttheassessmentoftherisk,
Whataction,ifany,hasbeentakentorespondtotherisk,and
Whatfurtheroptionsmightbeavailableforrespondingtotherisk?
Theinformationisenteredintotheriskregister.EachriskisassignedtoamemberofthePRMTwhobecomesitsRiskOwner.Theriskregisterisreviewedandupdatedthroughouttheproject.
Theprojectmanager,athisoption,mayelicitinitialriskregistersfromthefunctionalunitsandconsolidatethecontributionsintoasingleprojectriskregister.Alternatively,theprojectriskregistermaybedevelopedduringaPRMTmeeting.
DIFFERING SITE CONDITIONS
Accesstoallareasofaprojectsitemaynotbeavailablepriortoconstruction.Thismakesitdifficulttodetermineenvironmentallysensitiveareasorsubsurfaceinformationneededtodesignroadwaysandfoundations.Theteamneedstorecognizetheuncertaintythatarisesfromthislackofinformationandprovidethemeanstoaddressitintheconstructionphase.
Someoptionsforaddressingtherisksfromunknownconditions:
1. Executeaservicecontracttodeterminetheinformationduringthedesignphase,andrevisecontractdocumentsaccordingly.
2. ProvidelanguageintheSpecialProvisionsforthecontractortoprovideaccesstothejobsitefortheDepartment'spersonnelasafirstorderofwork.
3. ProvidelanguageintheSpecialProvisionsforthecontractortoholdoffonorderingmaterialswhosequantitymaybeimpactedbythisnewinformation.
4. Provideresourcesfordesignpersonneltoperformatimelydesign/assessmentusingthenewinformation.
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 17
Examples of Risk Statements 3‐3
TABLE 4 – EXAMPLE RISK STATEMENTS FROM CALTRANS PROJECTS
Risk Statement
Design
Inaccuraciesorincompleteinformationinthesurveyfilecouldleadtoreworkofthedesign.
AdesignchangethatisoutsidetheparameterscontemplatedintheEnvironmentalDocumenttriggersasupplementalEIRwhichcausesadelayduetothepubliccommentperiod.
Environmental
Potentiallawsuitsmaychallengetheenvironmentalreport,delayingthestartofconstructionorthreateninglossoffunding.
Nestingbirds,protectedfromharassmentundertheMigratoryBirdTreatyAct,maydelayconstructionduringthenestingseason.
R/W
Duetothecomplexnatureofthestaging,additionalrightofwayorconstructioneasementsmayberequiredtocompletetheworkascontemplated,resultinginadditionalcosttotheproject.
Duetothelargenumberofparcelsandbusinesses,thecondemnationprocessmayhavetobeusedtoacquireR/W,whichcoulddelaystartofconstructionbyuptooneyear,increasingconstructioncostsandextendingthetimeforCOS.
Construction
Hazardousmaterialsencounteredduringconstructionwillrequireanon‐sitestorageareaandpotentialadditionalcoststodispose.
Unanticipatedburiedman‐madeobjectsuncoveredduringconstructionrequireremovalanddisposal,resultinginadditionalcosts.
IMPORTANCE OF SITE VISITS
Sitevisitsduringthedesignphaseareaneffectiveriskmanagementstep.Notvisitingthesitecreatesuncertaintiesaboutconditions,whichmustberecognizedasrisks.
Forexample,aprojectinSouthSanFranciscousedtheas‐builtsforthecontracttodeterminetheexistingconditions.Theprojectteamwasunawarethattheworkwaspartofacorridorprojectconstructedunderseveralcontracts.Theplansneglectedtoshowthealignmentofseveralrampsinthepreviously‐constructedinterchange.Thisriskcouldhavebeenpreventedwithasitevisit.Inthisinstance,thedesignwasperformedbyanotherdistrict,andtraveltothejobsitewasdeemedimpractical.Consequently,risksstemmingfromsiteconditionswerenotidentified.Fortunately,theimpactofomittingas‐builtconditionswasquicklyidentifiedandmitigatedinconstruction.Whilethistimelyactionreduceddelaystotheproject,significantcontingencyfundswereexpended,necessitatingarequestforsupplementalfunds.
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 18
Entering Data into the Risk Register 3‐4
Theimageshereinarefromthespreadsheetversionoftheriskregisterforeachscalabilitylevel.
Aworkbookcontainingasheetforeachscalabilitylevelriskregistermaybedownloadedfrom:
http://onramp/riskmanagement
Atthisstage,completetheinformationinthefollowingriskregistercolumns:
Column Contents
Status Select “Active” or “Retired.” A risk is retired when it has no further possibility of impacting the project.
ID # Enter a unique identifying number for the risk.
Risk Type (Levels 1 and 2 only)
Enter either a “Threat” or an “Opportunity,”
Category Select one of the categories for the risk. (Environmental, Design, R/W, DES, Construction, External, Organizational, or PM)
Threat/Opportunity Event Provide a descriptive title for the risk.
Description Write a complete description of the event and its potential impacts on the project if this risk were to occur. See Section 3‐2 for the structure of the risk statement.
Current Status/Assumptions If applicable, describe what we currently know about the risk and any assumptions made.
Risk Owner Enter the name of the PRMT member responsible for this risk.
Updated Enter the date the risk was created.
Othercolumnsintheriskregisterwillbecompletedorupdatedbythequalitative(Chapter4)orquantitative(Chapter5)riskanalysisandriskresponseprocessesinChapter7.
PreviouseditionsofriskregistersusedintheDepartmenthaveacolumnfortherisk“trigger,”butnotmanyriskshaveacleartrigger.Soasnottotakespacefromacrowdedriskregister,ifatriggerisidentifiedforarisk,itshouldbedescribedinrelationtotheriskresponse.
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 19
Chapter 4 Qualitative Risk Analysis – Level 1
Qualitativeriskanalysisincludesmethodsforprioritizingtheidentifiedrisksforfurtheraction,suchasriskresponse.ThePRMTcanimprovetheproject’sperformanceeffectivelybyfocusingonhigh‐priorityrisks.
Teammembersrevisitqualitativeriskanalysisduringtheproject’slifecycle.Whentheteamrepeatsqualitativeanalysisforindividualrisks,trendsmayemergeintheresults.Thesetrendscanindicatetheneedformoreorlessriskmanagementactiononparticularrisksorevenshowwhetherariskmitigationplanisworking.
Risk Assessment 4‐1
QualitativeriskanalysisforLevel1projectsassignsaRiskRatingtoeachriskintheriskregister.Theriskratingsdeterminewherethegreatesteffortshouldbefocusedinrespondingtotherisks.Theyfacilitatestructuredriskresponseactionandresourceallocation.
ThethreeratingsforLevel1projectsare:
“High”–Firstpriorityforriskresponse.
“Medium”–Riskresponseastimeandresourcespermit.
“Low”–Noriskresponserequiredatthistime.
Entering Assessment into Risk Register Columns 4‐2
ThequalitativeriskanalysisofeachriskisenteredintothefollowingcolumnsoftheLevel1riskregister.
Column Contents
Risk Rating Select “High”, “Medium”, or “Low” as a measure of the importance of this risk for response action.
Rationale Describe the reasons the PRMT selected this risk rating.
OthercolumnsintheriskregisterwillbecompletedorupdatedbytheriskresponseprocessinChapter7.
Mo
nit
ori
ng
& C
on
tro
l
Response
Planning
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 20
Chapter 5 Qualitative Risk Analysis – Level 2
Qualitativeriskanalysisincludesmethodsforprioritizingtheidentifiedrisksforfurtheraction,suchasriskresponse.ThePRMTcanimprovetheproject’sperformanceeffectivelybyfocusingonhigh‐priorityrisks.
Teammembersrevisitqualitativeriskanalysisduringtheproject’slifecycle.Whentheteamrepeatsqualitativeanalysisforindividualrisks,trendsmayemergeintheresults.Thesetrendscanindicatetheneedformoreorlessriskmanagementactiononparticularrisksorevenshowwhetherariskmitigationplanisworking.
QualitativeriskanalysisforLevel2projectsassessesthepriorityofidentifiedrisksusingtheirprobabilityofoccurringandthecorrespondingimpactonprojectobjectivesiftherisksoccur.
Probability and Impact Ratings for Level 2 Projects 5‐1
Table5liststheCaltransstandarddefinitionofriskprobabilityandimpactratings.Thecostimpactratingsmaybeeasiertoapplyifexpressedintermsofdollars.TheratingsfortheprojectserveasaconsistentframeofreferenceforthePRMTinassessingtherisksduringthelifeoftheproject.
Thetableisintendedasaguide–thePRMTmaydefinedollarandtimerangesasappropriatefortheproject.Theimpactsaretotheoverallproject.Scheduledelayappliestorisksthatareonthecriticalpath(thelongestpath).DuringthePlanningandDesignphase,delayimpactstoRTLmaybeofprimaryinterest.Duringconstruction,delaysimpactprojectcompletion.
CostimpactsarebasedonthesumofCapitalOutlay(CO)andCapitalOutlaySupport(COS)costs.
TABLE 5 –DEFINITIONS OF IMPACT AND PROBABILITY RATINGS
Rating --> Very Low Low Moderate High Very High
Cost Impact of Threat (CO + COS)
Insignificant cost increase
<5% cost increase
5‐10% cost increase
10‐20% cost increase
>20% cost increase
Cost Impact of Opportunity (CO + COS)
Insignificant cost
reduction
<1% cost decrease
1‐3% cost decrease
3‐5% cost decrease
>5% cost decrease
Schedule Impact of Threat
Insignificant slippage
<1 month slippage
1‐3 months slippage
3‐6 months slippage
>6 months slippage
Schedule Impact of Opportunity
Insignificant improvement
<1 month improvement
1‐2 months improvement
2‐3 months improvement
>3 months improvement
Probability 1–9% 10–19% 20–39% 40–59% 60–99%
Mo
nit
ori
ng
& C
on
tro
l
Response
Planning
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 21
Performing Qualitative Risk Analysis 5‐2
ThePRMTassesseseachidentifiedriskinturnandassesses:
Theratingfortheprobabilityoftheriskoccurring,and
Theratingofcostandtimeimpactofeachrisk,shoulditoccur.
TheriskmatrixinFigure2isusedtodeterminetheimportanceofeachriskimpactbasedontheprobabilityandimpactratings.Eachworddescriptoroftheratinghasanassociatednumber;theproductoftheprobabilitynumberandimpactnumberdefinestheriskscore.
FIGURE 2 – CALTRANS RISK MATRIX
Foraparticularimpact,thecombinationoftheprobabilityratingoftheriskoccurringandtheimpactratingpositionstheriskintooneofthethreecoloredzonesintheriskmatrix.Thecolorofthezoneindicatesthepriorityoftheriskforriskresponse:redzonesignifieshighimportance,yellowismediumimportance,andgreenislowimportance.
Forexample,ariskhavinga“Moderate”probabilityanda“High”impactfallsintotheredzone.Itsimpactscoreis3x8=24.
Entering Assessments into the Risk Register 5‐3
ThequalitativeriskanalysisofeachriskisenteredintothefollowingcolumnsoftheLevel2riskregister.
Column Contents
Probability Select the probability level from the drop‐down list.
Cost Impact Select the cost impact level from the drop‐down list.
Time Impact Select the time impact level from the drop‐down list.
Rationale Describe the rationale for these assessments.
The“CostScore”isequaltotheProbabilitynumbertimestheCostImpactnumber.
Pro
bab
ilit
y R
atin
g 5 – Very High
4 – High 3 – Moderate 2 – Low 1 – Very Low
1
Very Low 2
Low 4
Moderate 8
High 16
Very High
Impact Rating
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 22
The“TimeScore”isequaltotheProbabilitynumbertimestheTimeImpactnumber.
TherisksinacoloredzonemaybefurtherprioritizedforriskresponseaccordingtotheirCostandTimeScores.Thehigherthescore,thehigherthepriorityforriskresponseandmonitoring.
OthercolumnsintheriskregisterwillbecompletedorupdatedbytheriskresponseprocessinChapter7.
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 23
Chapter 6 Quantitative Risk Analysis – Level 3
Level3willrequireexpertiseandtraining.PleaseseetheDistrictRiskManagementCoordinatorforguidance.
Quantitativeriskanalysisisawayofnumericallyestimatingtheprobabilitythataprojectwillmeetitscostandtimeobjectives.Quantitativeanalysisisbasedonasimultaneousevaluationoftheimpactofallidentifiedandquantifiedrisks,usingMonteCarlosimulationby@Risk,CrystalBall,orPrimaveraRiskAnalysissoftware.Theresultisaprobabilitydistributionoftheproject’scostandcompletiondatebasedontheidentifiedrisksintheproject.
Quantitativeriskanalysissimulationstartswiththemodeloftheprojectandeitheritsprojectscheduleoritscostestimate,dependingontheobjective.Thedegreeofuncertaintyineachscheduleactivityandeachline‐itemcostelementisrepresentedbyaprobabilitydistribution.Theprobabilitydistributionisusuallyspecifiedbydeterminingtheoptimistic,themostlikely,andthepessimisticvaluesfortheactivityorcostelement.Thisistypicallycalledthe“3‐pointestimate.”Thethreepointsareestimatedbytheprojectteamorothersubjectmatterexpertswhofocusonthescheduleorcostelementsoneatatime.
Specializedsimulationsoftwareruns(iterates)theprojectscheduleorcostestimatemodelmanytimes,drawingdurationorcostvaluesforeachiterationatrandomfromtheprobabilitydistributionderivedfromthe3‐pointestimatesforeachelement.Thesoftwareproducesaprobabilitydistributionofpossiblecompletiondatesandprojectcosts.Fromthisdistribution,itispossibletoanswersuchquestionsas:
Howlikelyisthecurrentplantocomeinonscheduleoronbudget?
Howmuchcontingencyreserveoftimeormoneyisneededtoprovideasufficientdegreeofconfidence?
Whichactivitiesorline‐itemcostelementscontributethemosttothepossibilityofoverrunningscheduleorcosttargetscanbedeterminedbyperformingsensitivityanalysiswiththesoftware.
Quantifying the Risks 6‐1
TheprojectriskmanagerleadsthePRMTinquantifyingcostandschedulerisks.
Theprobabilityoftheriskoccurringisexpressedbytwovalues:“Low”and“High”thatcovertherange.
Three‐pointestimatesareusedforcostandscheduleimpacts.Thethree‐pointestimateconsistsofdeterminingthe“Low”(optimistic),“High”(pessimistic)and“MostLikely”valuesforthecostandtime.Themostlikelyvaluemaybeomittedifitcannotbeestablishedcredibly.
Thecostimpactsincludedirectcostsonly;theyexcludeanycostofdelay(determinedfromtheoutputofascheduleriskanalysis–see“ScheduleRiskAnalysis”onpage25).Scheduleimpactsareexpressedindaysofpotentialdelayduetotherisk.Somerisksmaynothavebothcostandscheduleimpacts.
Mo
nit
ori
ng
& C
on
tro
l
Response
Planning
Qu
alitative
An
alysis
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 24
PotentialprojectdeliveryscheduledelayscanimpactRTLandconstructionduration.ThecostofpotentialdelaytoRTLmaybeariskitemintheriskregister.
Thepotentialdelayduringconstructionisconvertedtocostusingadailyratethatincludestime‐relatedoverheadandthedirectcostsassociatedwithtime(equipment,etc.).ItiscarriedintheriskregisterseparatelyfromtheRTLdelayrisk.
Entering Quantifications into the Risk Register 6‐2
ThequalitativeriskanalysisofeachriskisenteredintothefollowingcolumnsoftheLevel2riskregister.
Column(s) Contents
Probability Enter the “Low” to “High” values.
Cost Impact
If there is a cost impact, enter a “Low” and “High” cost. If there is reason for a credible “Most Likely” cost, enter it; otherwise, leave this entry blank. If no cost impact, leave these cells blank.
Time Impact
If there is a time impact, enter a “Low” and “High” time in days. If there is reason for a credible “Most Likely” time, enter it; otherwise, leave this entry blank. If there is no time impact, leave these cells blank.
Rationale Enter the rationale for these assessments.
“Probable Cost” is calculated from the average value of the Probability range multiplied by the average value of the Cost Impact range. “Probable Time” is calculated from the average value of the Probability range multiplied by the average value of the Time Impact range.
Therisksareprioritizedforriskresponseindescendingorderoftheir“ProbableCost”and/or“ProbableTime”.
OthercolumnsintheriskregisterwillbecompletedorupdatedbytheriskresponseprocessinChapter7.
Producing the Risk Probability Curves 6‐3
Thequantificationsintheriskregistershouldbecombinedtoproduceprobabilitycurvesofthetotalcostoftherisksandthetotaldelaytotheproject.Thisrequiresknowledgeofspecialriskmodelingtoolssuchas@Risk,CrystalBall,orPrimaveraRiskAnalysisforscheduleriskmodeling.Theprojectriskmanagermayperformtheseriskanalysistasks,iftrained,ortheymaybeperformedbyaDepartmentspecialist.TheDistrictRiskManagementCoordinatorcanobtainexpertservicesasneeded.
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 25
Cost Risk Curve
TheRiskCost(RC)istheprobabilitydistributionofthetotalcostofallrisksintheprojectriskregister.
Figure3isanexampleofaproject’sRiskCostprobabilitydistribution.
FIGURE 3 – RISK COST PROBABILITY DISTRIBUTION
Thechartshowsthecurvesforthecurrentassessmentandthepreviousassessment,ifavailable.SelectedvaluesofRCat90%,50%,and10%probabilitylevelsaccompanythechart.Fortheexampleabove,thetablewouldindicate:
Current Previous
90% chance RC is greater than $ 144 M $ 164 M
50% chance RC is greater than $ 185 M $ 206 M
10% chance RC is greater than $ 226 M $ 248 M
Schedule Risk Analysis
ScheduleriskanalysismaybeperformedusingasimplemodelthatcombinesdelayrisksonthecriticalpathtoRTLandprojectcompletion.Thissimpleversioncanbemodeledusing@Risk.ThisapproachissatisfactoryifaCriticalPathMethod(CPM)scheduleisnotavailable.
IfaCPMscheduleisavailable,thescheduleisimportedintoPrimaveraRiskAnalysis,andthedelayrisksareinserted.Thistoolrunsthesimulationandproducesoutputprobabilitycurvesforselectedmilestones.Expertknowledgeisrequiredtousethistool.ThecurvewilllooksimilartoFigure3exceptthehorizontalaxiswillbeatimescale.
Ifnoneoftheaboveapproachesareavailable,thePRMTcanestimatetheoveralldelaytoRTLandprojectcompletion,andquantifythemintheriskregister.
ThecostofthepotentialdelaytoRTLandprojectcompletion,determinedbyanyoftheabovemethods,shouldbecapturedintheriskregisterastwospecificrisks.
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 26
Using the Probability Curves
TheprobabilitydistributionsofcostandschedulemaybeusedbyProjectManagementtoaccomplishthefollowing:
ForaprojectinthePlanningandDesignphase:
Setprojectcostandscheduletargets
Evaluateifcostestimatesandschedulesarerealistic
Evaluatetheadequacyofcontingencyreserves
RequestacontingencyexceedingthestandardCaltransallowance
Evaluatetheprobability(risk)ofexceedingspecificcostandtimetargets
Determinethesensitivityoftheoutputprobabilitydistributiontoinputrisks(RiskSensitivityDiagram),highlightingthemainriskdrivers.
ForaprojectintheConstructionphase:
Performrisk‐basedbudgetanalysesandforecastingcostatcompletion
Assesstheadequacyofremainingcontingency
Requestsupplementalfunds
Evaluatetheprobabilityofmeetingcompletiontargets.
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 27
Chapter 7 Risk Response
Riskresponseistheprocessofdevelopingstrategicoptions,anddeterminingactions,toenhanceopportunitiesandreducethreatstotheproject’sobjectives.Aprojectteammemberisassignedtotakeresponsibilityforeachriskresponse.Thisprocessensuresthateachriskrequiringaresponsehasanownermonitoringtheresponses,althoughtheownermaydelegateimplementationofaresponsetosomeoneelse.
Risk Response Strategies 7‐1
For Threats For Opportunities
Avoid.Riskcanbeavoidedbyremovingthecauseoftheriskorexecutingtheprojectinadifferentwaywhilestillaimingtoachieveprojectobjectives.Notallriskscanbeavoidedoreliminated,andforothers,thisapproachmaybetooexpensiveortime‐consuming.However,thisshouldbethefirststrategyconsidered.
Exploit.Theaimistoensurethattheopportunityisrealized.Thisstrategyseekstoeliminatetheuncertaintyassociatedwithaparticularupsideriskbymakingtheopportunitydefinitelyhappen.Exploitisanaggressiveresponsestrategy,bestreservedforthose“goldenopportunities”havinghighprobabilityandimpacts.
Transfer.Transferringriskinvolvesfindinganotherpartywhoiswillingtotakeresponsibilityforitsmanagement,andwhowillbeartheliabilityoftheriskshoulditoccur.Theaimistoensurethattheriskisownedandmanagedbythepartybestabletodealwithiteffectively.Risktransferusuallyinvolvespaymentofapremium,andthecost‐effectivenessofthismustbeconsideredwhendecidingwhethertoadoptatransferstrategy.
Share.Allocateriskownershipofanopportunitytoanotherpartywhoisbestabletomaximizeitsprobabilityofoccurrenceandincreasethepotentialbenefitsifitdoesoccur.Transferringthreatsandsharingopportunitiesaresimilarinthatathirdpartyisused.Thosetowhomthreatsaretransferredtakeontheliabilityandthosetowhomopportunitiesareallocatedshouldbeallowedtoshareinthepotentialbenefits.
Mitigate.Riskmitigationreducestheprobabilityand/orimpactofanadverseriskeventtoanacceptablethreshold.Takingearlyactiontoreducetheprobabilityand/orimpactofariskisoftenmoreeffectivethantryingtorepairthedamageaftertheriskhasoccurred.Riskmitigationmayrequireresourcesortimeandthuspresentsatradeoffbetweendoingnothingversusthecostofmitigatingtherisk.
Enhance.Thisresponseaimstomodifythe“size”ofthepositiverisk.Theopportunityisenhancedbyincreasingitsprobabilityand/orimpact,therebymaximizingbenefitsrealizedfortheproject.Iftheprobabilitycanbeincreasedto100percent,thisiseffectivelyanexploitresponse.
Acceptance.Thisstrategyisadoptedwhenitisnotpossibleorpracticaltorespondtotheriskbytheotherstrategies,oraresponseisnotwarrantedbytheimportanceoftherisk.Whentheprojectmanagerandtheprojectteamdecidetoacceptarisk,theyareagreeingtoaddresstheriskifandwhenitoccurs.Acontingencyplan,workaroundplanand/orcontingencyreservemaybedevelopedforthateventuality.
Mo
nit
ori
ng
& C
on
tro
l
Response
Planning
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 28
Examples of Risk Responses
Table 6 repeats the example risk statements from Table 4 and shows a risk response for each.
TABLE 6 –EXAMPLE RISK RESPONSES
Risk Statement Risk Response
Design
Inaccuraciesorincompleteinformationinthesurveyfilecouldleadtoreworkofthedesign.
Mitigate:WorkwithSurveystoverifythatthesurveyfileisaccurateandcomplete.Performadditionalsurveysasneeded.
AdesignchangethatisoutsideoftheparameterscontemplatedintheEnvironmentalDocumenttriggersasupplementalEIRwhichcausesadelayduetothepubliccommentperiod.
Avoid:MonitordesignchangesagainstEDtoavoidreassessmentofEDunlesstheopportunityoutweighsthethreat.
Environmental
Potentiallawsuitsmaychallengetheenvironmentalreport,delayingthestartofconstructionorthreateninglossoffunding.
Mitigate:Addressconcernsofstakeholdersandpublicduringenvironmentalprocess.Scheduleadditionalpublicoutreach.
Nestingbirds,protectedfromharassmentundertheMigratoryBirdTreatyAct,maydelayconstructionduringthenestingseason.
Mitigate:Schedulecontractworktoavoidthenestingseasonorremovenestinghabitatbeforestartingwork.
R/W
Duetothecomplexnatureofthestaging,additionalrightofwayorconstructioneasementsmayberequiredtocompletetheworkascontemplated,resultinginadditionalcosttotheproject.
Mitigate:Re‐sequencetheworktoenableROWCertification.
Duetothelargenumberofparcelsandbusinesses,thecondemnationprocessmayhavetobeusedtoacquireR/W,whichcoulddelaystartofconstructionbyuptooneyear,increasingconstructioncostsandextendingthetimeforCOS.
Mitigate:WorkwithRight‐of‐WayandProjectManagementtoprioritizeworkandsecureadditionalright‐of‐wayresourcestoreduceimpact.
Construction
Hazardousmaterialsencounteredduringconstructionwillrequireanon‐sitestorageareaandpotentialadditionalcoststodispose.
Accept:Ensurestoragespacewillbeavailable.
Unanticipatedburiedman‐madeobjectsuncoveredduringconstructionrequireremovalanddisposalresultinginadditionalcosts.
Accept:IncludeaSupplementalWorkitemtocoverthisrisk.
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 29
Responding to Risks
Followingidentificationandanalysisofprojectrisks,thePRMTtakesactioninresponsetotheriskstoimprovetheoddsinfavorofprojectsuccess.Ultimately,itisnotpossibletoeliminateallthreatsortakeadvantageofallopportunities–buttheywillbedocumentedtoprovideawarenessthattheyexistandhavebeenidentified.Successfulriskresponsewillchangetheriskprofilethroughtheprojectlifecycle,andriskexposurewilldiminish.
Riskresponseinvolves:
ThePRMTdeterminingwhichriskswarrantaresponseandidentifyingwhichstrategyisbestforeachrisk.
AssigninganactiontotheRiskOwnertoidentifyoptionsforreducingtheprobabilityorimpactsofeachrisk.TheRiskOwnertakestheleadandcaninvolveexpertsavailabletotheproject.
Evaluatingeachoptionforpotentialreductionintheriskandcostofimplementingtheoption.
Selectingthebestoptionfortheproject.
Requestingadditionalcontingency,ifneeded(forguidance,refertoAppendix“A”ofProjectDeliveryDirectivePD‐04“ProjectContingenciesandSupplementalWork”).
AssigninganactiontotheRiskOwnertoexecutetheselectedresponseaction.TheRiskOwneristheleadandmayassignspecifictaskstootherresourcestohavetheresponseimplementedanddocumented.
IfthePRMTjudgesthatariskshouldbeaccepted,itmayassignanactiontotheRiskOwnertoprepareacontingencyplanifdeemednecessary.
A RISK PERSPECTIVE CAN ENHANCE DECISIONS
Whenconsideringriskmitigationmethodology,itisimportanttorecognizetheimpactsofthedecision.Theimpactofrespondingtoariskmaymakesenseintheshortterm(e.g.Savesdesigncosts,allowsteamtomeetschedule),buttheimpactoftheriskneedstobetakenasawhole.
Forexample,theimpactofjustafewunknownconditionscanaffecttheconstructionscheduletothepointwhereanenvironmentalworkwindowrequirestheprojecttobesuspended.Itisimportanttorecognizehowmuchofanimpacttherewouldbeinmakingadecision.Whilethedirectcostofresolvingtheunknownconditionmaybelessthanthecostofasitevisit,theoverallimpactofthechangemaybeasignificantdelaytothecontractifnotrecognized.
Entering Risk Responses into the Risk Register 7‐4
Theriskresponseactionforeachriskisenteredintothe“ResponseActions”columnoftheriskregister.
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 30
Chapter 8 Risk Monitoring
Continuousmonitoringbytheprojectriskmanagerandtheprojectteamensuresthatnewandchangingrisksaredetectedandmanagedandthatriskresponseactionsareimplementedandeffective.Riskmonitoringcontinuesforthelifeoftheproject.
Riskmonitoringandcontrolkeepstrackoftheidentifiedrisks,residualrisks,andnewrisks.Italsomonitorstheexecutionofplannedstrategiesfortheidentifiedrisksandevaluatestheireffectiveness.
Riskmonitoringandcontrolcontinuesforthelifeoftheproject.Thelistofprojectriskschangesastheprojectmatures,newrisksdevelop,oranticipatedrisksdisappear.Riskratingsandprioritizationscanalsochangeduringtheprojectlifecycle.
Typically,duringprojectexecution,riskmeetingsshouldbeheldregularlytoupdatethestatusofrisksintheriskregister,andaddnewrisks.Periodicprojectriskreviewsrepeattheprocessofidentification,analysis,andresponseplanning.
Ifanunanticipatedriskemerges,orarisk’simpactisgreaterthanexpected,theplannedresponsemaynotbeadequate.TheprojectmanagerandthePRMTshouldperformadditionalresponsestocontroltherisk.
Monitoringalsodetermineswhether:
ThePRMTisperformingperiodicriskreviewandupdating
Riskmanagementpoliciesandproceduresarebeingfollowed
Theremainingcontingencyreservesforcostandscheduleareadequate
Anditmayinvolverecommending:
Alternativeriskresponses
Implementingacontingencyplan
Takingcorrectiveactions
Changingtheprojectobjectives
Risk Review and Updating 1‐1
Periodically,thePRMTwillconvenetoreviewtheproject’sriskregisterandriskresponseactions,andtoupdateprojectriskinformation.
Beforeupdatingtheregisterandrecordingchanges,theprojectriskmanagershouldmakeacopyoftheriskregisterfortheprojectfiles,notingitsdatadate.Thesetofriskregisterswilldocumenthowriskshavechangedoverthelifeoftheprojectandprovideanaudittrailshoulditberequired.
Mo
nit
ori
ng
& C
on
tro
l
Response
Planning
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 31
ThereviewtasksofthePRMTincludethefollowing:
Identify,analyze,andplanresponseactionsfornewlyarisingrisks,andaddthemtotheriskregister.
Reviewtheexecutionofriskresponseactions,andevaluatetheireffectiveness.
Re‐assessexistingrisks,verifythattheassumptionsarestillvalid,andmodifythepreviousassessmentsasnecessary.
AssignadditionalriskresponseactionstotheRiskOwner.
Retireriskswhoseopportunitytoimpacttheprojecthaselapsed,orwhoseresidualimpactontheprojectisdeemedtohavereachedanacceptablelevel.
ThePRMTshoulddiscussanyrisksforwhichresponseactionsarenotbeingcarriedouteffectivelyorwhoseriskimpactisincreasing.IfthesecannotberesolvedwithinthePRMT,theyshouldbeescalatedtotheprojectmanagerwithrecommendationsforaction.
Updating the Risk Register 1‐2
Makeanychangesandadditionstotherisksandentertherevisiondateintothe“Updated”column.
Lessons Learned 1‐3
Whenariskisretired,thePRMTwillreviewthehistoryoftherisktorecordanylessonslearnedregardingtheriskmanagementprocessesused.Theteamisessentiallyaskingitself:“What,ifanything,wouldwehavedonedifferentlyandwhy?”
TheprojectriskmanagerwillconductaperiodicreviewofalllessonslearnedwiththePRMT.
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 32
Chapter 2 Communication and Accountability
Communicationandconsultationwithprojectstakeholdersandsponsorsarecrucialfactorsinundertakinggoodriskmanagementandinachievingprojectoutcomesthatarebroadlyaccepted.Thishelpseveryonetounderstandtherisksandtrade‐offsthatmustbemadeinaprojectandsupportstheprojectmanager’sefforts.
Regularreportingisanimportantcomponentofcommunication.Reportsonthecurrentstatusofrisksandriskmanagementensurethatallpartiesarefullyinformedandunderstandtherisks,thusavoidingunpleasantsurprises.
Theprojectriskmanagerwillensurethattheriskmanagementprocessisdocumentedtoensureaclearaudittrail.
RE‐FILE HAND‐OFF – A VITAL COMMUNICATION
Communicationisimportantinriskmanagement.Resolvinguncertaintiesiseasierandhaslessimpactthanresolvingsurpriseslater.Adiscussionoftheprojectbetweenthedesignteamsandtheconstructionteamsisimperativeinthesuccessfulmanagementofriskinaconstructionproject.Itisimportantthatbothteamsagreeonwhatriskremainsandcommittomanagingitthroughouttheproject.
AprojectinDistrict4wasonanaccelerateddeliveryschedule.DiscussionsbetweenDesignandConstructionidentifiedseveralissuesthatneededtobeaddressed.MostofthisinformationwasprovidedintheREPendingfileinsomeform,buttheconstructionteamcouldnotprioritizetheireffortswithoutdetaileddiscussionswithDesign.
Communication and Accountability Checkpoints 2‐1
Therearethreekindsofcheckpoints:
Communication–Wherethecurrentriskregisteriscommunicatedtostakeholders,sponsors,andteammemberstomakethemawareofthecurrentstatusofrisks.
Accountability–Wherethedeputiessignoffontherisks,indicatingthattheyhavereviewedtherisksdocumentedintheriskregisterandagreethattheyhavebeenmanagedtotheextentpossiblebythePRMT.
PerformanceMeasure–WheretheDESOEvalidatestherequiredsignaturesanddatesoftheaccountabilitycheckpointsbeforeRTL.
Mo
nit
ori
ng
& C
on
tro
l
Response
Planning
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 33
Figure4showsthecheckpointsduringthephasesofaproject’slifecycle.Communicationcheckpointsareshadedgrayandrequiredaccountabilitycheckpointsareinred.PIDApprovalandREFileHandoffarerecommendedaccountabilitycheckpoints.
Project Phase
Checkpoint No.
Deliverable or Communication Checkpoint
PID 1 PID [RecommendedAccountabilityCheckpoint]
PA&ED 23
DraftProjectReport(DPR)ProjectReport(PR) [RequiredAccountabilityCheckpoint]
PS&E
4444567
30%ConstructabilityReview(CR)TypeSelection60%ConstructabilityReview(CR)90%ConstructabilityReview(CR)FoundationReportApproved(FR)PS&EtoDES‐OE [RequiredAccountabilityCheckpoint]PerformanceMeasure
R/W 8910
BetweenM225(RegularR/W) andM410(R/WCert)BetweenM410&M412(AdvertiseandAward)ApprovedUtilityRelocationPlanapproval
Construction
1112131415
REFileHandoff [Recommended AccountabilityCheckpoint]BetweenM500(ApproveContract)andM600(ContractAcceptance)CCOsNOPCsSupplementalFundRequest&G12’s(SFR)
FIGURE 4 – COMMUNICATION AND ACCOUNTABILITY CHECKPOINTS
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 34
What Happens at a Communication Checkpoint 2‐2
Thecurrentprojectriskregisterissubmittedbytheprojectmanagerateachcheckpoint.TheriskregisterwithacoversheetwillserveastheriskcommunicationmediumforLevel1andLevel2projects.Thecoversheetshouldsummarizethechangestotheriskregistersincethepreviouscommunication,suchas:
Changesinriskpriorities,
Risksthathavebeenretired,
Newrisksidentified,and
Riskresponseactionsthathavebeencompleted.
Level3projectswillrequireamoredetailedreportthatincludestheprobabilitycurvesandtheirrelationtoprojectobjectivesandtheriskoutlookuntilthenextreviewperiod.
What Happens at an Accountability Checkpoint 2‐3
Theprojectmanagerwillschedulethemeeting,ortheSingleFocalPointcanarrangeformultipleprojectstobediscussedinonemeeting.ThegoalisforthedeputiestoreviewtheprojectanditsriskstoensurethatthePRMThasmanagedtherisksacceptably.
TheprojectmanagerwillcreateaRiskRegisterCertificationFormtobringtotheaccountabilitycheckpointmeetingsforsignaturebythedeputies.ThesignedformiskeptintheprojectfilesforuseateachaccountabilitycheckpointandissubmittedtotheDES‐OEattheperformancemeasurecheckpoint.TheformisshowninAppendixB,andmaybedownloadedfrom:http://onramp/riskmanagement.
What Happens at the Performance Measure Checkpoint 2‐4
TheDesignthroughConstructionSubcommittee'sPerformanceMeasuresTaskGroupdevelopedaPerformanceMeasureforRiskManagement.ItrequiresthatatRTL,theDES‐OEwillvalidatethedatesandsignaturesontheRiskRegisterCertificationFormoftheproject.
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 35
ACRONYMS AND DEFINITIONS Appendix A
ACRONYMS
CCA Construction Contract Acceptance
CCO Contract Change Order
CCPSC Caltrans Construction Partnering Steering Committee
CPM Critical Path Method
CR Constructability Review
DES Division of Engineering Services
DOE District Office Engineer
DPR Draft Project Report
DRL Dispute Resolution Ladder
EIR Environmental Impact Report
EIS Environmental Impact Study
ERM Enterprise Risk Management
G12 General Delegation 12
HQ Headquarters
NOPC Notice of Potential Claim
OE Office Engineer
PCR Project Change Request
PDD Project Delivery Directive
PDT Project Development Team
PID Project Initiation Document
PM Project Manager
PMBOK Project Management Body of Knowledge
PR Project Report
PRM Project Risk Manager
PRMT Project Risk Management Team
PSR Project Study Report
PA & ED Project Approval and Environmental Document
PS & E Plans, Specifications, and Estimates
RC Risk Cost
RE Resident Engineer
RMP Risk Management Plan
R/W Right of Way
RTL Ready to List
SFP Single Focal Point (PM District Deputy Director)
SFR Supplemental Funds Report
TRO Time Related Overhead
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 36
DEFINITIONS
Accountability Checkpoint
Pointsintimeduringtheprojectlifecyclewhereaformalsign‐offwilloccur.Sign‐offsignifiesthatthereisanunderstandingandacceptanceoftherisksmovingforwardintothenextphaseoftheproject.
Communication Checkpoint Apointintheprojectlifecyclewhererisksarecommunicatedtostakeholders,sponsors,andteammembers.
Dispute Resolution Ladder Outlineswhenandhowadisputewillbeelevatedandsubsequentlyresolved.
Enterprise Risk Management Themethodsandprocessesusedbyorganizationstomanagerisks,identifythreats,andseizeopportunitiesrelatedtotheachievementoftheirobjectives.
Project Life Cycle Allphasesofprojectdeliveryfromprojectinitiationtoprojectclose‐out.
Project Objectives Theagreed‐upondeliverytargets, suchascost,time,scope, orquality.
Project Risk Anuncertaineventorconditionthat,ifitoccurs,hasapositiveoranegativeeffectonatleastoneprojectobjective.
Project Risk Management Aprocessforidentifying,communicating,andmanagingprojectrisksthroughallphasesofprojectdelivery.
Project Risk Manager Facilitatestheriskmanagementprocessandactsasgatekeeperfortheriskregister.
Qualitative Risk Analysis Theprocessofprioritizingrisks.
Quantitative Risk Analysis Theprocessofprobabilistically analyzingthecostandtimeeffectsofidentifiedrisksonoverallprojectobjectives.
Risk Anuncertaineventorconditionthat,ifitoccurs,hasanegativeorpositiveeffectonatleastoneprojectobjective.
Risk Cost Theprobabilitydistributionofthetotalcostofallrisksintheprojectriskregister.
Risk Management Performance Measure
AcheckpointwheretheSPFreviews eachprojectandits riskstoensurethatthePDThasadequatelyrespondedtothehighestpriorityrisks.
Risk Owner AmemberofthePRMTtowhichtheriskisassigned.
Risk Register Adocument(typicallyaspreadsheet)thatcontainstheresultsofaqualitativeriskanalysisand/oraquantitativeriskanalysisandariskresponse.
Risk Response Actionstakentoenhanceopportunitiesandreducethreatstotheachievementofprojectobjectives.
Scalable Approach Providestheminimumlevelofeffortofprojectriskmanagementthatisappropriatetoaparticularprojectdependingonitssizeandcomplexity.
Time Related Overhead Overheadcostsprimarilyproportionaltothetimetoperformwork.
Time Related Overhead Plus Thedirectcostsassociatedwithtime.
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 37
RISK MANAGEMENT PLAN TEMPLATE Appendix B
Downloadthistemplatefrom:http://onramp/riskmanagement.
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 38
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 39
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 40
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 41
RISK REGISTER CERTIFICATION FORM Appendix C
Downloadthisformfrom:http://onramp/riskmanagement.
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 42
PD‐09 PROJECT RISK MANAGEMENT Appendix D
Downloadthedirectivefrom:http://onramp/riskmanagement.
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 43
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 44
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 45
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 46
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 47
PROJECT RISK MANAGEMENT STRUCTURE Appendix E
Project Risk Management Elements
Projectriskmanagementincludesthefollowingprogramelements.EachelementisimportanttodevelopingeffectiveprojectriskmanagementonCaltransprojects.
Ascalableprojectriskmanagementprocess‐threelevelsofeffortbasedonthesizeandcomplexityoftheproject
Clearcommunicationandaccountabilitycheckpointssothatprojectdeliveryisseenasoneprocessacrossmultiplefunctions
Anewupdated“how‐to”stylehandbook
IncorporationofprojectriskmanagementintotheexistingFunctionalUnits’guidance
ProjectDeliveryDirective(PD‐09)andpoliciesforimplementation
TrainingandsubjectmatterexpertsfromHeadquartersandDistricts
Project Risk Management Overview
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 48
FIGURE 5 – CALTRANS PROJECT RISK MANAGEMENT
Figure5isanoverviewoftheProjectRiskManagementstructure.Itisdividedintotwolevels:CorporateandProject.
Corporate Level
ThecorporatelevelillustrateshowprojectriskmanagementisoverseenbytheProjectDeliveryBoard,astheyareresponsibleforthesuccessfuldeliveryofprojects.TheProjectDeliveryBoardandtheChiefEngineerhavedevelopedPD‐09astheirprojectriskmanagementpolicythatistobecarriedout.AllGuidanceforProjectDeliveryFunctionsareexpectedtoincorporatetheprojectriskmanagementpoliciesandrequirementsasoutlinedinthishandbook.Traininginprojectriskmanagementwillbedevelopedandmadeavailabletoallofthoseaffectedbythenewrequirements.
TheProjectManagementDivisionisresponsibleforfacilitatingtheriskmanagementprocessandensuringthatrisksaremanagedonprojects.ProjectManagementDivisionisresponsibleforprovidingHeadquartersProjectRiskManagementCoordination(expertise)toprojectsandDistrictProjectRiskManagementCoordinators.
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 49
Project Level
EachDistrictwillprovideriskmanagementexpertisethroughaDistrictRiskManagementCoordinatorwhowillassistprojectteamsintheimplementationoftheprojectriskmanagementprocess.Attheinceptionofriskmanagementforaproject,theprojectteamwilldeterminetheproject’sscalabilitylevelasLevel1,2,or3.TherequirementsforeachlevelarepresentedinChapter1,Section1‐4.
TheprojectmanagerfacilitatesthedevelopmentandmanagementofariskregisterfromPlanningandDesignphasesthroughtheConstructionphase.Thegrayboxesonthechartindicatewherethecommunicationpointsaretooccur.Theredboxesareaccountabilitycheckpointswhereaformalsign‐offmustoccur.ThegreenboxindicateswheretheDesignthroughConstructionPerformanceMeasurewilloccur.Thismeasureensuresthattheprojectriskmanagementprocesshasbeenfollowedfortheproject.
Projectmanagersarenotexpectedtoidentifyalloftherisksbythemselves.TheProjectRiskManagementTeam(comprisedofmembersofthePDT)willworktogethertoidentifytheprojectrisks,populatetheriskregister,andmanagetherisksuntilcompletionofconstruction.Managingrisksinaworkshopenvironmentwillensurethatallmembersoftheteamunderstandtherisksandtheirpotentialimpactontheirfunctionalareas.
TheProjectRiskManagementTeamisexpectedtostaytogethertomanagerisksuntilprojectcompletion.
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 50
ACKNOWLEDGEMENTS Appendix F
RISK MANAGEMENT TASK GROUP
TheDesign‐ConstructionStrategicPartneringSubcommitteeaskedtheRiskManagementTaskGrouptodevelopaneffectiveProjectRiskManagementprocessforCaltransprojects.
Task Group Co‐Chairs:
JonTapping–TollBridgeProgram,RiskManagementRobStott–DESStructureConstruction
Task Group Members:
ElizabethDooher–PartneringProgramManagerFarhadFarazmand–D‐4ConstructionRichFoley–RiskManagerwithTollProgramAnupKhant–HQProjectManagementDivisionRobertoLacalle–DES,ProjectManagementReinLemberg–CALTROPCorporationEdmondMatevosian–ProjectManagement,RiskManagementKenSolak–HQConstruction,PartneringCoordinatorRonTsung–D‐4DesignJackYoung–DES,StructureOEDaveYoumans–ProjectManagement
Facilitator:
SueDyer‐OrgMetrics
Sponsors:
MarkLeja,ChiefofDivisionofConstructionTerryAbbott,ChiefofDivisionofDesignJimDavis,ActingChiefofDivisionofEngineeringServicesBobPieplow,ChiefofDivisionofEngineeringServices
SCALABLE PROJECT RISK MANAGEMENT
Version 1 (June 2012) Page 51
DESIGN THROUGH CONSTRUCTION SUBCOMMITTEE
TheDesignthroughConstructionSubcommitteeisapartoftheCaltransConstructionPartneringSteeringCommittee(CCPSC).TheCCPSCisaCaltransandIndustrygroupworkingtodevelopacultureofpartnershiponprojectsthroughouttheprojectlifecycle.TheDesignthroughConstructionSubcommitteehastakenonDesignthroughConstructionPerformanceMeasures;ProjectRiskManagement,andwillsoonstartCapturingLessonsLearnedandPDTTeameffectivenessandPartnering.
Subcommittee Co‐Chairs:
TerryAbbott,ChiefofDivisionofDesignMarkLeja,ChiefofDivisionofConstructionBobPieplow,ChiefofDivisionofEngineeringServicesKarlaSutliff,ChiefofDivisionofProjectManagement
Caltrans Construction Members:
RobEffinger(Acting)–DivisionofConstruction,AssistantChiefElizabethDooher–DivisionofConstruction,PartneringProgramManagerJohnRodrigues–NorthRegionConstructionRegionalDivisionChiefMarkDerMatoian–CentralRegionConstructionRegionalDivisionChiefRoyFisher–District7ConstructionDeputy
Caltrans Design Members:
TimCraggs–DivisionofDesign,AssistantChiefLenkaCulik‐Caro–District4DesignDeputyBillReagan–District7DesignDeputyGaryVettese–District11DesignDeputy
Caltrans Engineering Services (Structures) Members:
JohnMcMillan–DivisionofEngineeringServices,OfficeEngineerDeputyKevinThompson–DivisionofEngineeringServices,StructureDesignDeputyRobStott–DivisionofEngineeringServices,StructureConstructionDeputy
Facilitator:
SueDyer–OrgMetrics
Sponsor:
RichardLand,ProjectDeliveryDeputyDirectorandChiefEngineer