Project Risk Management

Project Management Body of Knowledge (PMBOK Guide Training Slides) Program Project Risk Management Chapter 11 : Project Management Body of Knowledge (PMBOK Guide Training Slides) Program Project Risk Management Chapter 11 International Information Technology and Applications 2289 South Cobb Drive Smyrna, Georgia 30080 Tel: 404-207-3981, fax 404-348-4514 www.iitainc.com, info@iitainc.com

Project Risk Management : Project Risk Management Project Risk Management processes involve conducting risk management planning, identification, analysis, response planning, and monitoring and control of a project. Project risk Management Processes are: Plan Risk Management – Defines how to conduct risk management activities. Identify Risks – Determination of risks that may affect a project and documenting their characteristics. Perform Qualitative Risk Analysis – Prioritizing risks for further analysis and combining their probability of occurrence and impact Perform Quantitative Risk analysis – Numerically analyzing the effects of the identified risks and impact on the project objectives Plan Risk Responses – Developing options and actions to enhance opportunities and reduce threats to the project objectivities Monitor and Control Risks – Implementing risk responses’ plans, tracking identified risks, monitoring residual risks, identifying new risks and evaluating risk process effectiveness throughout the project.

Project Risk Management : Project Risk Management Project Risk Management Overview Plan Risk Management Inputs 1.Project Scope Statement 2.Cost Management plan 3.EEFs 4.OPAs Tools & Techniques 1.Planning meetings and analysis Outputs 1.Risk management plan Identify Risks Inputs 1.Risk management Plan 2.Activity Cost Estimate 3.Activity duration Estimates 4.Scope baseline 5.Stakeholder register 6.Cost management plan 7.Schedule management Plan 8.Quality management Plan 9.Project documents 10.EEFs 11.OPAs Tools & Techniques 1.Documentation reviews Information gathering techniques 2.Check list analysis 3.Diagramming Techniques 4.SWOT analysis 5.Expert Judgment Outputs Risk Register Perform Qualitative Risk Analysis Inputs 1.Risk Register 2.Risk Management Plan 3.Project Scope Statement 4.OPAs Tools & Techniques 1.Risk probability & Impacts Assessment 2.Probability & impact matrix 3.Risk data quality assessment 4.Risk categorization 5.Risk urgency assessment 6.Expert Judgment Outputs Risk Register ri Perform Quantitative risk analysis Inputs 1.Risk Register 2.Risk management plan 3.Cost management plan 4.Schedule management plan Tools & Techniques 1.Data gathering and representation techniques 2.Quality risk analysis and modeling 3.Expert Judgment Outputs 1.Risk register update Plan Risk Response Inputs 1.Risk Register 2.Risk management plan Tools & Techniques 1.Strategies for negative risks or threats 2.Strategies for positive risks or opportunities 3.Contingent response strategies 4.Expert Judgment Outputs 1.Risk register updates 2.Risk related contract decision 3.Project management plan 4.Project doc updates Monitor & Control Risks Inputs 1.Risk register 2.Project management plan 3.Work performance Information 4.Performance reports Tool & Techniques 1.Risk Reassessment 2.Risk Audit 3.Variance and trend Analysis 4.Technical performance Measurements 5.Reserve analysis 6.Status meetings Outputs 1.Risk register updates 2.OPAs updates 3.Change requests 4.Project management Plan updates 5.Project document updates

Plan Risk Management: Inputs : Plan Risk Management: Inputs Project Scope Statement – Establishes the project framework and how significant risk management should be. Cost Management Plan – Determines provisions for risks in the budget as contingencies and management reserves and how to report them Schedule Management Plan – Defines schedule contingencies and it should be reported EEFs – Defines the risk tolerance in the industry and organization and sharing information on the risks, responses and at different times within the industry and government standards OPAs – Defines organization historical risk categories, risk statement formats, standard templates, roles and responsibilities

Plan Risk Management: Tools & Techniques : Plan Risk Management: Tools & Techniques Planning Meetings and analysis: Holding of Risk Planning meetings comprising of project team members, and stakeholders including sponsors to determine: Risk management responsibilities Risk categories Risk levels Probability by type of risks Impact by type of objectivities Probability and impact matrix Risk contingency reserve application approaches Development of risk management cost elements and activities

Plan Risk Management: Outputs : Plan Risk Management: Outputs Risk Management Plan includes: Methodology - Defining the approaches, tools, and data for defining risk management Role and responsibilities – Defining the lead, support and risk management team members for each type of activities Budgeting – Assigning resources, estimate funds needed for risk as part of risk management for inclusion in the cost baseline Timing - Defines when and how often risk management process will be performed during the project life cycle Risk Categories – Using risk breakdown structure (RBS) which depicts risks in hierarchical forms and the subcategories identifies the areas and causes of potential risks

Plan Risk Management: Outputs (continues) : Plan Risk Management: Outputs (continues) Risk Management Plan includes (cont.): 6. Definition of risk probability and impact - Defining different levels of risk probabilities and their impacts 7. Probability and impact matrix – Combining risk probabilities with their impacts and ranking them as High, Moderate and Low 8. Revised Stakeholders’ tolerances 9. Reporting format – Defining how the outcomes of risk management processes will be documented 10. Tracking – Defining how risk management processes will be auditted.

Example of Risk Breakdown Structure : Example of Risk Breakdown Structure RBS Project Resources Project Dependencies Communication Controlling Planning Estimating Project Management External Organizational Prioritization Ruling Market Regulatory Subcontractors and Suppliers Customer Quality Performances and Reliability Complexity and Interfaces Requirements Technical

Definition of Impact Scales for four Project objectives : Definition of Impact Scales for four Project objectives

Identify Risks: Inputs : Identify Risks: Inputs Risk Management plan – Using RBS and providing for risks in budget and schedule Activity cost Estimates – Using quantitative assessment of TCPI and expressing it as a range. The wider the more risks are involved Activity Duration Estimates Scope baseline Stakeholder register Cost Management Plan Schedule Management Plan Quality management Plan Project Documents – Assumption Log, Work performance reports, Earned value reports, Network diagrams, Baselines etc. EEFS – Benchmarking, industry studies, published checklists, Risk attitudes OPAs - Project files, risk statement templates, Lesson learnt project process control

Identify Risks: Tools & Techniques : Identify Risks: Tools & Techniques Documentation Reviews – reviewing assumptions, requirements contracts etc. Information Gathering Techniques: Brainstorming – Obtaining comprehensive listing of all risks by categories using RBS Delphi Technique – Using anonymous experts by using questionnaires for getting consensus on risks. It keeps bias away Interviewing – Asking subject matter specialists to identify risks Root Cause Analysis – Identifying the risk problem, the underlying causes that leads to it and developing preventive actions

Identify Risks: Tools & Techniques (conts) : Identify Risks: Tools & Techniques (conts) Checklist Analysis – Using the lowest level of RBS as checklist based on historic information and knowledge of projects Assumptions Analysis – Exploring the validity of assumptions, accuracies, completeness, stability and consistency Diagramming Techniques: Causes and effects also known as ISHIKAWA – identifying risk causes System or process flow charts – identifying system interrelate and mechanism of causation Influence diagram – graphical representation showing causal, influences, time ordering of events SWOT Analysis – Strength–Weakness-Opportunities-Threats Expert Judgment – Using experts such as consultants

Identify Risks: Outputs : Identify Risks: Outputs Risk Register List of Identified risks – The identified lists must be described in details such as CAUSE, EVENT, EFFECTS List of potential Responses – List of possible potential responses and their impacts

Perform Qualitative Risk Analysis : Perform Qualitative Risk Analysis Perform Qualitative Risk Analysis is the process of prioritizing risks for further analysis which involves combining their probabilities of occurrence and impacts, the time frame for response should the risk occur and the organization’s risk tolerance associated with the project constraints of cost, schedule, scope and quality

Perform Qualitative Risk Analysis: Inputs : Perform Qualitative Risk Analysis: Inputs Risk Register Risk Management Plan – Detailing definitions of categories, probability and impact, stakeholder risk tolerance Project Scope Statement – State-of-the-art or first-of-its-kind technology and complex projects tend to have more risks Organization Process Assets – Risk information on prior projects

Perform Qualitative Risk Analysis: Tools and Techniques : Perform Qualitative Risk Analysis: Tools and Techniques Risk Probability and Impact Assessment – investigates the likelihood of each risk occurring and the assessment of the impacts on project objectives such as on schedule, cost quality or performance by interviewing stakeholders Probability and Impact Matrix - Rating risks for prioritizing as low, moderate or high Risk Data Quality Assessment - Examining the degree of accuracy, quality, reliability, and integrity of gathered data regarding the risks

Probability and Impact Matrix : Probability and Impact Matrix Impact (numerical scale) on an objective (e.g., cost, time, scope or quality Each risk is rated in accordance to its probability of occurring and impact on an objective if it occur. The organization’s thresholds for low, moderate or high risks are shown in the matrix and these determine whether the risk is scored as high, moderate or low for that objective. Medium Low High Low Risks Medium Risks High Risks

Perform Qualitative Risk Analysis: Tools & Techniques (cont) : Perform Qualitative Risk Analysis: Tools & Techniques (cont) Risk Categorization –Grouping risks by their root causes Risk Urgency Assessment - Establishing indicators as warning signals for risks that should be addresses urgently based on risk severity rating Expert Judgment – Using consultants internal and or external

Perform Qualitative Risk Analysis: Outputs : Perform Qualitative Risk Analysis: Outputs Risk Register Updates Relative ranking or priority list of project risks Risks grouped by categories Causes of risk or project areas requiring particular attention List of risks requiring response in the near future List of risks for additional analysis and response Watch lists of low-priority risks Trends in qualitative risk analysis results

Perform Quantitative Risk Analysis : Perform Quantitative Risk Analysis This is the process of analyzing numerically the effects of the analyzed risks on the project objectives. The analysis could be for individual risks and or for aggregate effect of all the risks that may affect the project. It presents a quantitative approach for decision making when risks are involved

Perform Quantitative Risk Analysis: Inputs : Perform Quantitative Risk Analysis: Inputs Risk Register Risk Management Plan Cost Management Plan Schedule Management Plan OPAs

Perform Quantitative Risk Analysis: Tools and Techniques : Perform Quantitative Risk Analysis: Tools and Techniques Data Gathering & Representation Techniques a) Interviewing – documenting risk range & assumptions the output of interviewing b) Probability Distribution – discrete and continuous distributions can be used Quantitative Risk Analysis and Modeling Techniques a) Sensitivity Analysis - e.g. tornado diagram use for comparing the relative impacts of variables with high risks with those that are stable b) Expected monetary value analysis – calculated by multiplying the values of outcomes with their probabilities & adding the products e.g. in decision tree analysis C) Modeling and simulation – iterative simulation using Monte Carlo techniques Expert Judgment – using experts with relevant experience

Example of range of Project cost estimates collected during a risk interview : Example of range of Project cost estimates collected during a risk interview Interviewing stakeholders often helps to establish the three point estimates for the WBS for both beta and triangular distributions. In this case the likelihood of completing the project with only $47m is rather small as shown in the next Cost Risk simulation

Total Project Cost Cumulative Chart : Total Project Cost Cumulative Chart Mean Cost Probability 25% 50% 75% $20m $40m $60m $80m 100% $52.33m $47m 37% The Cumulative data in slide 23 shows that the project is 25% likely to meet the $47m estimate, if there is a desire to meet 50% of likelihood, a contingency will have to be added which will be calculated as (($52.33-$47m)/$47m) = 11.3% $64m

Examples of Commonly used distributions : Examples of Commonly used distributions 0.1 0.0 0.1 0.00 Beta Distribution Triangular Distribution The horizontal axis represents possible value of cost or time while the vertical axis represents relative likelihood. Beta and Triangular distributions are frequently used in quantitative analysis as well as others such as uniform, normal and lognormal ditributions

Decision Tree Diagram : Decision Tree Diagram Build or Upgrade Upgrade Plant (Invest $60m) Build New Plant (Invest $140m) Weak Demand ($80M) Strong Demand ($140m) Weak Demand ($100m) Strong Demand ($220m) Decision Node Chance Node End of Branch 60% 40% 60% 40% $220m - $140m = $80m $80m $100m - $140m = -$40m -$40m $140m - $60m = $80m $80m $80m - $60m = $20m $20m .60($80m) + .40(-$40) = $32m EMV (Before Costs) of build New Plant considering demand .60($80m) + .40($20m) = $72m EMV (before build costs) of upgrade Plant considering demand Decision EMV = $72m i.e. the larger of $32m & $72m Input: Cost of each Decision Output: Decision made Input: Scenario Probability Reward if it occurs Output: Expected Monetary Value (EMV) Computed: Payoffs minus Costs along Path Scenarios Probability of strong demand is 60% and Probability of Weak demand is 40% Build new plant will cost $140m while strong demand yields $220m and weak demand yields $100m Upgrade Plant will yield $140m while weak demand will yield $80m Decision made upgrade because its EMV is $72m while that of build new plant is $32m

Perform Qualitative Risk Analysis: Outputs : Perform Qualitative Risk Analysis: Outputs Risk Register Updates includes -Probability Analysis of the project – listing possible completion dates and cost and their confident levels of achieving and using contingency reserve to bring result to an acceptable level -Probability of achieving cost and time objectives – Using cumulative chart -Prioritized lists of quantified risks - using tornado diagram to identified most impacting risks and listing them -Trends in quantitative risk analysis results – using historical reports of past risks trends on schedule cost , time and quality

Plan Risk Response : Plan Risk Response This is process of developing options and actions for opportunities and threats. It includes assigning one person as each risk owner to take responsibility for each agreed to and funded risk response, addressing the risks by priorities and putting more resources and activities into the budget, schedule and cost of quality as approved in the Project Management Plan.

Plan risk response: Inputs : Plan risk response: Inputs Risk Register Risk Management Plan

Plan Risk Response: Tools and Techniques : Plan Risk Response: Tools and Techniques Strategies for Negative Risks -Avoid e.g. Reducing scope -Transfer e.g. Insurance, Performance bond, Warranties, Fixed price transfer risk to the seller, cost-plus contracts transfer risk to the buyer -Mitigate e.g. choosing a more stable supplier, conducting more tests for early detection -Accept e.g. providing a contingency reserve to take care of it if it occurs Strategies for Positive Risks -Exploit e.g. Assigning most talented person to perform the tasks – reduces time to do the job -Share e.g. forming joint venture to share the benefits -Enhance e.g. Maximizing the key drivers that creates the opportunity -Accept e.g. Willingness to take advantage when the opportunity occurs but not actively pursuing it Contingency Response strategies e.g. identifying events that can trigger the contingency response Expert Judgment e.g. Using Risk Experts with specialized education

Plan Risk Responses: Outputs : Plan Risk Responses: Outputs Risk Register updates Risk related contracts Project Management Updates Project Document updates

Monitor and Control Risks: Inputs : Monitor and Control Risks: Inputs Risk Register Project Management Plan Work Performance Information Performance Reports

Monitor and Control Risks: Tools and Techniques : Monitor and Control Risks: Tools and Techniques Risk Assessment Risk Audit Variance and Trend analysis Technical Performance measurement Reserve analysis Status meetings

Monitor and Control Risks: Outputs : Monitor and Control Risks: Outputs Risk Register Updates OPAs Change requests Project Management Updates Project Document Updates