Project management

Topic 5Risk

What is risk?• An uncertain outcome

– either from a positive opportunity or negative threat

• Risk management is about:– Managing the probability of specific risks occurring and the

potential impact if they do occur– Planning and taking action to keep exposure to risks to an

acceptable level in a cost-effective way

• Risk tolerance:– The amount of risk that can be tolerated– Tolerance depends on many factors

• Health and safety – tolerance may be no tolerance• New technology – tolerance may be large depending on future proofing

priorities

Project Board controls• Project Manager is responsible for identifying,

recording and reviewing risks• Project Board is responsible for:– Identifying external risk exposure to the project– Making decisions on risk mitigations– Balancing risk of activity with potential benefits of activity– Reporting occurrence of a risk to the business

• Project Manager modifies plans to include agreed actions to manage the impact of risk

• Ownership of each specific risk is assigned to a person best suited to monitor it

Risk management cycle• Identify risk (or opportunities)

– Risk entered in the Risk Log• Evaluate the risk

– How likely is the risk?– What impact? Time, quality, benefit, people/resources

• Identify responses for the risk– Prevention, reduction, transference, acceptance, contingency

• Select a risk response– Balancing the cost of the risk response with the value of what it is

protecting• Plan and resource

– Developing a detailed plan of action and identifying required resources• Monitor and report

– Checking responses are working, watching for early warning signs of a risk developing, watching trends

Identify responses for the risk• Prevention

– Terminate the risk by finding another way to do the activity

• Reduction– Treat the risk to reduce the likelihood of the risk happening or limit the

impact

• Transference– Transfer the risk to a third party such as insurance or penalty clauses

• Acceptance– Tolerate the risk because mitigation is too expensive and the likelihood

or impact is low

• Contingency– Plan actions to take if the risk should occur, organise resources actions

will require

Risk orofileGraphical summary of risks in terms of probability

(likelihood) and impact– Risk tolerance line set to highlight high impact and

high probability risks– Graph is reviewed regularly

Budgeting for risk

• Cost of risk management should be recognised• Budget allocated for:– Risk assessment activities– Risk treatment activities– Risk contingency planning

Managing risk control points• Preparing Project Brief

– Risk Log is created• Authorising initiation

– Formal assessment of risk by Project Board• Refining Business Case

– As detail is added new risks emerge• Authorising the project

– Review of risk log, owners of risks confirmed• Planning

– Identify new risks and assess existing risks– Modify the plan to take action to respond to risks– Update changes to risk log

Managing risk control points• Authorising work packages, examining project issues, reviewing

stage status– Review the risks at each of these control points

• Escalating project issues– A risk change may cause the Project Manager to raise an exception

report for the Project Board• Ad hoc advice

– Project Board makes decisions about deviations to the project plan caused by the occurrence of a risk

• Reporting highlights– Warnings of new risks and updates on existing risks

• Follow-on actions• Risks which may affect operational life are identified and transferred

in recommendations to operations and support

Risk interdependencies

• Risks can affect other risks and compound the impact, should the risk happen

• Interdependencies with:– Other projects– External suppliers– Internal stages and products

• Consider the big picture of risk– Risks cross ownership, decision making,

organisational and geographic boundaries• Evaluate risk to product delivery and to

achieving project benefits

Fundamentals• Project Board responsibilities• Project Manager/Team Manager responsibilities• Managing risk

– Identify risk – Evaluate the risk– Identify responses for the risk

• Prevention, reduction, transference, acceptance, contingency– Select a risk response– Plan and resource– Monitor and report

• Risk control points• Risk interdependencies