Análisis de Riesgo

23/05/2014

1

Elmer Zapata Ramírez, PMP, PMI -RMP

Project Risk ManagementA Preparation Guide for the PMI-RMP Exam


Overview

23/05/2014

2


What is Risk Management?

• Project risk management is actively managing the risks on your project

• The goal of risk management is to be more proactive and less reactive

• The objectives of Project Risk management are to increase the probability &

impact of positive events (opportunities), and decrease the probability &

impact of events adverse to the project (threats)


What is risk?

A risk is an uncertain event that could have a positive or negative effect on your project

* This means there is a probability between 1-99% that the event could occur

• If there is a 0% chance of an event occurring, there is no risk

(example; there is a 0% chance your project will be adequately funded, this is not a risk, it is a reality)

• If there is a 100% chance of an event occurring, this would be an issue, not a risk

• Risks with negative consequences are called threats

• Risks with positive consequences are called opportunities (Yes, risk can be good! Stop thinking of risk as bad, and start thinking of it in terms of probabilities!)

23/05/2014

3


Unknown / knowns Risk …

Known risks

• Those that are identified and can be proactively managed & analyzed

Unknown risks (unknown knowns & unknown unknowns)

• Cannot be proactively managed


Types of Risk

Risks can be broken out into two primary types

• Pure Risk – risk with potential loss only

ex. Fire, theft, personal injury

• Business Risk (speculative risk) – risk with potential loss or gain

ex. A highly skilled employee becomes available to work on your project,

reducing your schedule time, the tax rate changes, a new server costs less

(or more) than you budgeted for

23/05/2014

4


Considerations

• Look for risks caused by things like poor project management, dependency

on uncontrollable external resources, concurrent multiple projects, etc.

• Accept risks if they're in balance with a possible reward

• Communicate about risk information openly & honestly

• Provide risk responses in line with the organization's perceived balance

between risk-taking &risk-avoidance

• To be successful, an organization should be committed to addressing the

management of risk proactively & consistently throughout the project


Who should be involved ..?

• Project sponsor

• Management

• Project manager

• Project team

• Procurement deparment

• Marketing deparment

• Other deparment

• Salespeople

• Legal counsel

• Project manager of previous, similar projects

• Customer

• Customer’s competition

• End users

• Suppliers and vendors

• Expert

• Public

23/05/2014

5


Where to find them ..?

• Project constraints

• Assumptions

• WBS

• Network Diagram

• Plans– Resource

– Communications

– Quality

– Procurement

• Organizational Process Assets

• Historical Records from previous projects

• Lessons learned from previous projects

• Risk tolerance areas


by Rita Mulcahy

What you need before You can

Effectively begin risk management?

23/05/2014

6


Plan for howand who will beinvolved in riskmanagement

Risk identified

Potential riskowners

Triggers

Potentialresponse plans

Short list of risk throughqualitative and quantitativeanalysis

Wachtlist of non-top risks

Riskseliminated bychanging theprojectmanagement plan

Probabilityand impactsreduced bychanging theprojectmanagement plan

Residual risks

Additionalwachtlist items

What to do if anidentified riskocurrs: contingencyplans

What to do ifthe contingencyplan is no effective: fallback plans

Risk that arisefrom riskresponse: secondary risks

People to wachtover each risk: risk owners

Riskregister

Time and costreserves

“Final” Project management plan

Risk monitoring

and control


Risk Management Processes

23/05/2014

7



There are six project risk management processes

• Plan Risk Management

• Identify Risks

• Perform Qualitative Analysis

• Perform Quantitative Analysis

• Plan Risk Response

• Monitor & Control Risks



• Risk Planning – this is how you plan on conducting risk management. You wouldn’t start managing your project without a plan, so why would you approach risk management that way?

* Remember ‘Plan the work, and work the plan’? Applies to risk management as well.

• Identify Risks – this is the phase where you attempt to identify most of your risks

• Qualitative analysis – this is a subjective analysis of your risks that produces a risk ranking, usually in the order of high, medium, low, or on an ordinal scale. Rankings are by agreement of your project team, sponsors and key stakeholders.

23/05/2014

8



• Quantitative Analysis – a numerical analysis of the probability and impact of

the risk on your project

• Plan Risk Response– a course of action you will take to deal with your risks

should they go from risk to issue

• Monitor & Control Risks – monitoring your lists (there are two lists which I

will discuss later) of risks to enact a risk response plan, to move a risk from

one list to the other, or to remove a risk because it is no longer a risk


Risk Management Planning

23/05/2014

9



Objectives

• Create a plan for handing risk management for the project

• Adapt any policies and procedure for risk to the needs of the project

• Tailor risk management activities to the needs of the project to make sure the level,

type, and visibility of activities are commensurate with:

– The type an size of the project

– The experience of the project team

– The importance of the project to the organization



Metrics

• The number of unidentified risks that occurred in a reporting period

• The number of times risk owners were not prepared to handle an identified risk

• The amount of extra reserve requested

• The number of fallback plans that needed to be implemented

• Etc

23/05/2014

10



Before you start dealing with risks, you should first plan on how you will handle risk on your project

Things to consider when creating your Risk Management plan

• The risk tolerance of your project sponsors and stakeholders – In order to gain buy-in, you need to create a plan your sponsors can support. It is not likely they will support a plan that is in opposition to their agenda or is out of their comfort zone

• The size and value of your project – there is a cost to risk management, you shouldn’t spend more on preventing the risk than the cost of the risk occurring

• The methodology you will use – the methodology you use is not as important as gaining agreement and buy-in on the methodology chosen

• Sources of risk – risk categories; think of all possible areas or events that could introduce risk to your project


Plan Risk Management

Inputs to Risk Management Planning

• Enterprise environmental factors – company culture or existing systems the project will have to deal with or can make use of

• Organizational process assets – processes, procedures, and historical information

• Project scope statement – statement of what the project shall deliver and what it should not deliver (if you don’t know what the scope of your project is, can you really identify all areas of risk?)

• Project management plan – the guide on how you will manage your project

23/05/2014

11



Inputs to Risk Management Planning

• Cost Management Plan – The guide on how you and your team will control

costs on the project to try to stay within budget

• Schedule Management Plan – The guide on how you and your team will

manage the schedule of the project

• Communications Management Plan -The guide on who you need to

communicate to, what information, how it needs to be communicated and

how often



Tools and Techniques

• Planning meeting and analysis

23/05/2014

12



Outputs of Risk Management Planning

• Risk Management Plan

- Methodology

- Roles & Responsibilities

- Budgeting

- Timing

- Risk Categories

- Definitions of risk & impact

- Stakeholder tolerances

- Reporting formats

- Tracking



Chart of Responsabilities

Sponsor Project Manager Risk team Team Risk Owner Other Stakeholders

Plan Risk Management X X

Identify Risks X X X X X X

Perform Quanlitative Risk

AnalysisX X X As needed X

Perform Quantitative Risk

AnalysisX X As needed X

Plan Risk Response X X X As needed X X

Monitor and Control Risk

X X X X

23/05/2014

13


Confusing Terms

Risk rating: is a number between 1 and 10 chosen to evaluate the probability or impact of the risk.

Risk score for each risk: to calculate this, you multiply probability times impact. This gives you a numerical value for each risk. That value is then compared to other risks in the project to determine the risk ranking for each risk within the project.

Risk score for the project: To obtain the project risk score, you add up the risk scores for each risk in the project.

Risk ranking within the project: to rank risks, you compare the risk scores for all the risk. The risk with the hightest risk score becomes the hightestranking risk, the next hightest becomes second, etc

Risk ranking compared to other projects: …


Identify Risks

23/05/2014

14


Identify Risks

Objectives

• Identify and record a long list of threats and opportunities for the project

and by work package; “long” means hundreds of risks.

• Make sure all risk are in the cause-risk-effcet format

• Understand the risk


Identify Risks

This is the phase where you work with your team to identify as many risks as possible

Things to remember

• Identify Risks can’t be completed without the project scope statement and Work Breakdown Structure (WBS)

• Identify Risks happens at the onset of the project and throughout the project

• Risks can be identified at any time and during any phase of the project

• Risk management is an iterative process, you should work to identify risk during any changes to the project, working with resources, and when dealing with issues

23/05/2014

15


Identify Risks

Inputs to identify risks

• Project Chapter


• Outputs from project planning

• List of common risk categories

• Historical records and project documents

• Stakeholder register


Identify Risks

Methods of documenting Risk

• Forms

• Checklists

• Sticky notes

23/05/2014

16


Identify Risks

Techniques to identify risk

• Brainstorming - the free-flow of ideas on risk, done with the project team, stakeholders, subject matter experts, and experienced resources

• Delphi technique – an anonymous surveying of experts in which information is sent to a group of experts on the risk. The experts each provide input, the responses are compiled and then sent back to all of the experts for further review; the process is repeated until consensus is reached.

• Interviewing – interviews of experts, project stakeholders, or associates who have worked on similar projects in order to discover risks

• Assumptions & constraints Analysis – what assumptions have you made or been given about your project? Are they valid? If not, you could have risk


Identify Risks


• Root Cause Analysis – Determining the cause of the risk; you might be able to identify more risks this way or you might be able to eliminate the risk by eliminating the cause

• SWOT Analysis – An analysis of the strengths, weaknesses, opportunities and threats on your project

• Checklist Analysis – after you have identified your categories of potential risks on your project, you create a checklist of these categories to make sure you’re not neglecting any area where risk can hide

23/05/2014

17


Identify Risks


• Document review

• FMEA / Fault tree analysis

• Force field analysis

• Industry knowledge base

• Influence diagrams

• Nominal group technique

• Post project review / lessons learned / historical information


Identify Risks


• Prompt lists

• Questionaire

• RBS

• Cause and effect diagrams

• System dynamics

• WBS review

* Whenever possible, deal with the cause, not the effect

23/05/2014

18


Risk Factors

When analyzing your risk, you should be aware of the following risk factors

- The probability the risk will occur

- The range of possible outcomes - Impact (consequence)

- Expected timing, when in the project lifecycle the risk is likely to occur

* once the expected timeframe of the risk has passed and it is no

longer a risk, it can be removed from the risk list

- Frequency or the event, how often the risk is expected to occur on the

project


Identify Risks

Outputs of Identify Risks

• Risk Register

- List of risks

- List of potential responses

- Root causes of risks

- Updated risk categories

23/05/2014

19


Perform Qualitative Risk Analysis

“You need analytical skills”



Objectives

• Determinate which risks warrant a response.

– Subjectively evaluate the probability and impact of each risk

– Create a short list of risks by determining the top or critical risks that you will

process to Perform Quantitative Risk Analysis and / or Plan Risk Response

process

– Make a go/no-go decision

23/05/2014

20



This is the phase where you rank the risks you’ve identified from Identify Risks to come up with a list of risks you will create plans for dealing with

Things to remember

• Perform Qualitative Risk Analysis is subjective

• What is the probability of the risk occurring? High, medium, low? 1-10?

• What is the impact if the risk does occur? High, medium, low? 1-10? What is the financial impact, are the consequences positive or negative?

* the earlier you know about risk, the better prepared you will be



Inputs to Perform Qualitative Risk Analysis


• Risk register (list of potential risks)

• Project scope statement

• Project type and an understanding of the work needed to complete the

project.

• Data about the risks to be used during this step to measure their precision

23/05/2014

21



Inputs to Perform Qualitative Risk Analysis

• Assumptions to test

• Scales for probability and impact (if they are standardized for you

department or company)

• Historical records – how were similar risks qualified in the past?



Tools and Techniques of Qualitative Analysis

• Probability & Impact Matrix – a matrix that creates a consistent evaluation of high, medium, or low for your projects. This helps to make the risk rating process more repeatable between projects.

• Risk Data Quality Assessment – What is the quality of the data used to determine or assess the risk? Think about the following

– Extent of the understanding of the risk

– Data available about the risk

– Quality of the data

– Reliability & Integrity of the data

23/05/2014

22



Tools and Techniques of Qualitative Analysis

• Risk Categorization – Which of your categories has more risk than others? Which of your work packages could be most affected by risk?

• Risk Urgency Assessment – Which of your risks could occur soon, or require a longer planning time? Risk urgency assessment helps move these risks more quickly through the rest of the project management process

* Perform Qualitative Risk Analysis is subjective



Outputs of Perform Qualitative Risk Analysis

• Risk Register Updates

– Risk ranking for the project compared to other projects

– List of prioritized risks and their probability and impact ratings

– Risks grouped by categories

– List of risks requiring additional analysis in the near term

– List of risks for additional analysis and response

– Watchlist (non-critical risks)

– Trends

– Go / no-go decision

23/05/2014

23



Perform Qualitative Risk Analysis can help you determine the following

• Which risks need to move on to Perform Quantitative Risk Analysis?

• Which of your projects should be selected when compared with other projects?

* You have two projects available and you can only complete one of them, both projects are projected to have the same benefit, but the qualitative risk score for one of the projects is higher than the other, would you want to know this before you decided which project you would work on?


Perform Quantitative Risk Analysis

“You need analytical and mathematical skills”

23/05/2014

24



Objectives

• Changes to numerically analyzing the probability and impact of each risk and

analyzing the extent of overall project risk.

• Translate subjective risk score to objective risk score.

• Calculate specific time and cost impacts of each risk



This is the phase of risk management where you conduct a numerical analysis of the probability and impact of the risks with the highest risk rating score determined from qualitative analysis

Things to remember

Quantitative analysis is used to….

• Determine which of your risks should have a response plan

• Determine overall project risk

• Determine the probability of delivering your project objectives

• Should be repeated after the Plan Risk Response process to determinate if the lower amount of risk in the project is within the acceptable project time and cost requirements

23/05/2014

25



Things to remember

• Determine cost and schedule reserves

• Identify risks that will require more planning

• Create more realistic and achievable cost, schedule, or scope goals



Inputs to Perform Quantitative Risk Analysis


• Risk register

– Prioritized risks from Perform Qualitative Analysis process

– List of risks carried forward for additional analysis

• Historical records – how were similar risks quantified in the past?

• Output from other parts of project planning, including the cost management

plan, and schedule management plan

23/05/2014

26



Tools and Techniques of Quantitative Analysis

• Sensitivity Analysis – Which risks will have the most impact on the project?

• Monte Carlo Analysis – A technique that uses simulation to show the probability of completing your project on time and within budget.

– Determines the overall risk of the project, not the task

– Determines the probability of completing the project on a specific day and for a specific cost

– Takes into account path convergence (places in the network diagram where many paths converge into one activity)

– Used to evaluate the impact to your schedule and budget

– Due to the complicated mathematical computations used, Monte Carlo analysis is usually done with a computer program

– Creates a probability distribution – triangular, normal, beta, uniform or lognormal (learn these)

* Perform Quantitative Risk Analysis is a numerical analysis



Risk Probability Impact EMV

A 20% $ (100,000.00) $(20,000.00)

B 90% $ 10,000.00 $ 9,000.00

C 5% $ 30,000.00 $ 1,500.00

D 65% $ (75,000.00) $(48,750.00)

Total $(58,250.00)


EMV – Expected Monetary Value – What is the probability of the risk occurring

multiplied by the impact if the risk does occur? If the risk occurs, what could the

financial or time loss be to your project?

In the example below, this project has an EMV of ($58,250), this means that you

need to put aside $58,250 in your risk reserve account for potential risks

23/05/2014

27




• Decision Tree – used for planning on individual risks instead of planning for

the whole project

– Takes into account future events to make a decision today

– Can calculate the EMV in more complex situations

– Involves mutual exclusivity



23/05/2014

28



Setup Cost Cost/Unit Units Needed Cost for Units Defects/Unit Defect

Cost

Total Cost

Make $200,000 $27.50 500,000 $13,750,000 20/10,000 $1,375.00 $13,951,375

Buy $0 $30.00 500,000 $15,000,000 10/10,000 $1,500 $15,001,500

Decision Tree

* It is cheaper to make the units rather than buying them



Outputs of Perform Quantitative Risk Analysis

• Risk Register Updates

– Prioritized list of quantified risks

– Amount needed for contingency reserves for time and cost

– Confidence levels of completing the project on a certain date for a

certain amount of money

– The probability of delivering the project objectives

– Trends - risk management is an iterative process; as you repeat the

process you can track your overall project risk and determine the trend

(if you are decreasing or increasing the level of risk on your project)

23/05/2014

29


Plan Risk Response

“You need creativity”


Plan Risk Response

Objectives

• Determinate what can be done to reduce the overall risk of the project by

decresing the probability and impact of threat and increasing the probability

and impact of opportunities.

23/05/2014

30


Plan Risk Response

This is the phase of risk management where you decide how you will respond to your most important risks

• Risk Response Strategies

Threats

– Avoid – remove the cause of the risk so that it never materializes

– Mitigate – reduce the probability and or impact of the risk

– Transfer – transfer the risk to another party; usually done with insurance, performance bonds, warranties, guarantees or outsourcing the work.

Opportunities

– Exploit – make sure the opportunity occurs, you can add work or make a change to the project

– Enhance – increase the probability and or positive impact of the risk

– Share – share the opportunity with a third party to be able to take advantage of the opportunity


Plan Risk Response

• Risk Response Strategies

For both Threats & Opportunities

– Accept –

Active acceptance – preparing a contingency reserve of cost or time

reserves in case the risk does happen

Passive acceptance – preparing for the dealing with the effects of the risk

after the risk has occurred

23/05/2014

31


Plan Risk Response

Inputs to Plan Risk Response


• Risk register

– List of prioritized risks

– Ranking of the project risks

– Risk scores and expected monetary values of top risk

– Potential risk owners

– Wacthlist


Plan Risk Response

Inputs to Plan Risk Response

• Forecast or potential schedule and cost for the project

• Monte Carlo Analysis probability of achieving the project objectives

• Historical records about risk responses from past projects and common risk

causes

• Risk thresholds

23/05/2014

32


Plan Risk Response

Tools and Techniques of Plan Risk Response

• Brainstorming

• Check list

• Contingency planning

• Contingency reserve estimation

• Critical chain project management (CCPM)

• Decision Tree Analysis

• Delphi Technique

• Expected Monetary Value (EMV)


Plan Risk Response


• Force Field Analysis

• Industry knowledge base

• Interviews

• Nominal Group Technique

• Multi-criterion selection techniques

• Post project review / lessons learned / historical information

23/05/2014

33


Plan Risk Response


• Prompt Lists

• Quantitative Risk Analysis

• Root-Cause Analysis

• Scenario Analysis


Plan Risk Response

Outputs of Risk Response Planning

• Project Management Plan Updates – Changes made due to risk management will be changes made to the project and should be updated in the project management plan

• Updates to Risk Register

– Residual Risks – risks that are left over after Plan Risk Response

– Secondary Risks – new risks that result from the implementation of the contingency plans for the primary risks

– Contingency Plans – plans of action in case the risk does occur

23/05/2014

34


Plan Risk Response



– Risk Owner – the person on the team responsible for monitoring the risk, risk triggers, developing a response strategy, and implementing the strategy should the risk occur

– Risk Action Owners – the person will implement preapproved risk response, leaving the risk owner with the responsibility of ensuring that risk response is effective

– Risk Triggers – early warning signs that there is a high probability the risk will occur

– Fallback Plans – a secondary contingency plan, in case the contingency plan does not work or is not effective


Plan Risk Response



– Workaround

– Reserves

– Contingency reserves - covers the cost for ‘known unknowns’ discovered during risk management; covers the residual risks. The contingency reserve is calculated and made part of the baseline.

– Management reserves – these are estimated and made part of the project budget, not the baseline. Management approval is needed to use the management reserve.

23/05/2014

35


Plan Risk Response

Calculate reserves

– Percent

– Guess

– EVM

– Montecarlo Simulation


Monitor and Control Risks

23/05/2014

36



Objectives

• Implement the risk response plans, ensure compliance, and manage progress

• Manage the contingency and management reserves

• Create workarounds

• Control de project risk

• Refine and update the risk register

• Perform additional risk identification, qualitative and quantitative risk

analysis, and risk response planning

• Reestimate the project



This is the phase of risk management where you monitor the risk list for risks

that have a higher probability of affecting your project, and the risk watchlist

for risks that could change and should either be added to the risk list or

removed from the watchlist

23/05/2014

37



Things to Know

• Workaround – a response to a risk that has occurred when no contingency plan exists

• Risk audit – a team of experienced project team members reviews the risk management process and response strategies to see if you’ve effectively identified the major risks on the project and developed effective strategies for dealing with them

• Risk Reassessment – Risk management is iterative, you should review the risks on your project throughout the project to update their qualitative and quantitative values

* the earlier you know about risk, the better prepared you will be



Things to Know

• Status meetings – status meetings should be used to identify new risks or changes to existing risks. This is a great opportunity to discuss with your team and stakeholders existing risks and new risks

• Reserve analysis – has the reserve kept up with changes to the risk list? Does the reserve still cover the costs of these risks should they occur?

• Closing of risks – Risks are expected to happen during a particular phase of the project. When that phase has passed and the risk is no longer probable, the risk should be removed from the risk list and any reserve associated should be freed up

23/05/2014

38



Inputs to Monitor and Control Risks


• Risk Register

– Risks

– Risk response plans

– Risk owners

– Triggers

– Contracts

– Wachtlist

– Time and cost reserves



Inputs to Monitor and Control Risks


• Work results

• Project communications

• Risk events

• Project changes

• Additional risk that have been identified as the project progresses

23/05/2014

39



Outputs of Monitor & Control Risks


– Outcomes of the risk reassessments and risk audits

– Updates to previous parts of risk management

– Closing of risks that are no longer applicable

– Details of what happened when risks occurred

– Lessons learned

• Requested Changes

• Recommended Corrective & Preventive Actions

• Updates to the Project Management Plan

• Organizational Process Assets Updates


Risk Governance

23/05/2014

40


Risk Governance

Its extends throughout the project.

Risk governance involves oversight of the entire risk management process, making

sure the risk management activities are consistent, and that they are continuously

improved throughout the organization.

This is responsibility may fall to:

•Project Manager

•PMO

•Risk Management Department

•Management of the Organization


Risk Governance

Standards, Policies, Procedures, and Practices

• Organizational risk tolerances and thresholds

• Methods to use identify risks

• Definitions of impact ratings to be used in perform Qualitative Risk Analysis process

• Standard probability and impact matrix

23/05/2014

41


Risk Governance

Creation of Metrics

Metrics are standards of performance that, once evaluated, tell how work is

performing against the Plan and help you to measure the progress and to warn of

potential problems.

Risk Governance involves the creation of metrics for risk management activities in

the Organization.


Risk Governance

Lessons Learned Management

To ensure that lessons learned related to risk management are captured on all

projects and then made available for use on other projects.

Should include:

• What went right?

• What went wrong?

• What would be done differently if the project could be done again?

23/05/2014

42


Questions…?

Date post:	23-Dec-2015
Category:	Documents
Upload:	robertorfr
View:	12 times
Download:	0 times

Análisis de Riesgo

Documents