B U D I L U H U R U N I V E R S I T YPOST GRADUATE PROGRAM
MAGISTER ILMU KOMPUTER (M.Kom)
IT PROJECT MANAGEMENT
PROJECT RISK MANAGEMENT
Ruth Drayer
2010
Project risk
An uncertain event or condition that, if it occurs, has a positive or negative effect on at least one project objective (time, cost, scope, quality)
May have one or more causes May have one or more impacts Risk conditions could include aspects of the
project’s or organization’s environment that may contribute to project risk
2010
Known risk Identified & analyzed A risk response generates by the project team
as it is worth
Unknown risk Can not be managed proactively
2010
PROJECT RISK MANAGEMENT PROCESSES
Plan
1. Plan Risk Management
2. Identify Risk
3. Perform Qualitative Risk Analysis
4. Perform Quantitative Risk Analysis
5. Plan Risk Response
Control 6. Monitor and Control Risk
2010
1 PLAN RISK MANAGEMENT
Deciding how to: approach conduct
the risk management activities for a project
The risk management planning process should be completed early during project planning process
The level of detail will vary with the needs of the project
2010
Questions Addressed in a Risk Management Plan (Schwalbe: ITPM Table 11-2).
2010
Terms:
Contingency plans are predefined actions that the project team will take if an identified risk event occurs
Fallback plans are developed for risks that have a high impact on meeting project objectives
Contingency reserves or allowances are provisions held by the project sponsor that can be used to mitigate cost or schedule risk if changes in scope or quality occur
2010
INPUT OUTPUT1. Project scope statement2. Cost management plan3. Schedule management plan4. Communications
management plan5. Enterprise environmental
factors6. Organizational process assets
1. Risk management plan
TOOLS & TECHNIQUES1. Planning meetings & analysis
PLAN RISK MANAGEMENT
2010
PLAN RISK MANAGEMENTINPUT
Project scope statement (see: scope definition)Project management plan (Cost; schedule;
communication)Enterprise environmental factors
• Policy statements express risk attitudes and tolerance
Organizational process assets• Risk categories, risk tolerance• Templates• Roles and responsibilities, and authority
levels of decision making
2010
PLAN RISK MANAGEMENT TOOLS & TECHNIQUES
Planning meetings & analysis• Project manager• Selected team members & stakeholders• Person in the organization with responsibility
to manage the risk planning and execution
2010
PLAN RISK MANAGEMENTOUTPUTS
Risk management plan, includes:• Methodology:
• approaches, tools, data sources to perform risk management
• Roles & responsibility• Defines the lead, support, and risk management
team membership for each type of activity, • Assign people to these roles • Clarifies their responsibilities
2010
PLAN RISK MANAGEMENTOUTPUTS (cont)
Risk management plan, includes (cont 1):• Budgeting:
• Assigns resources• Estimates costs• Included in the project cost baseline
• Timing:• When?• How often?• Establishes risk management acivities to be
included in the project schedule• Risk categories:
• Risk Breakdown Structure• Templates, based on previous projects
2010
PLAN RISK MANAGEMENT OUTPUTS (cont)
Risk management plan, includes (cont 2):• Definitions of risk probability & impact• Probability & impact matrix• Revised stakeholder tolerance• Reporting formats • Tracking (whether & how risk management processes
will be audited)
2010
PLAN RISK MANAGEMENTOUTPUTS: Risk Breakdown Structure
2010
PLAN RISK MANAGEMENT OUTPUTS: Probability & Impact Matrix for 4 Project Objectives
Defined conditions for impact scales of a risk on major project objectivesProject
ObjectiveRelative or numerical scales are shown
Very low / 0,05
Low / 0,10
Moderate / 0,20
High / 0,40
Very high / 0,80
Cost Insignificant cost increase
< 10% cost increase
10 – 20% cost increase
20 – 40% cost increase
>40% cost increase
Time Insignificant time increase
< 5 % time increase
5 – 10% time increase
10 – 20% time increase
>20% time increase
Scope Scope decrease barely noticeable
Minor areas of scope affected
Major areas of scope affected
Scope reduction unacceptable to sponsor
Project end item is effectively useless
Quality Quality degradation barely noticeable
Only very demanding applications are affected
Quality reduction required sponsor approval
Quality reduction unacceptable to sponsor
Project end item is effectively useless
2010
Project Risk Management WorksheetRISK RISK
PROBA-BILITY
IMPACT DESCRIP
TION
LEVEL OF
IMPACT
DATE OF IMPACT
PRIORITY
LEVEL
RISK MANAGEMENT
PLAN
Risk probability & level of impact:VL=very low; L=low; M=medium; H=high; VH=very high
2010
2 IDENTIFY RISK
Determining which risks might affect the project and documenting their characteristics
An iterative process; new risks may be known as the project progresses through its life cycle
2010
INPUT OUTPUT1. Risk management plan2. Activity cost estimates3. Activity duration estimates4. Scope baseline5. Stakeholder register6. Cost management plan7. Schedule management plan8. Quality management plan9. Project documents10.Enterprise environmental factors11.Organizational process assets
Risk register
TOOLS & TECHNIQUES
IDENTIFY RISK
2010
INPUT OUTPUT
Risk register
TOOLS & TECHNIQUES
1. Documentation reviews2. Information gathering
techniques3. Checklist analysis4. Assumption analysis5. Diagramming techniques6. SWOT analysis7. Expert judgement
IDENTIFY RISK
2010
IDENTIFY RISK INPUT
Risk management plan• Assignments of roles & responsibilities• Provision for risk management acrtivities in
the budget & schedule• Categories of risk
Activity cost estimates
Activity duration estimates
2010
IDENTIFY RISK INPUT
Scope baseline • Uncertainty in project scope statement
Stakeholder register
Project management plan • Schedule namagement plan• Cost management plan• Quality management plan
2010
IDENTIFY RISK INPUT
Project documents
Enterprise environmental factors• Published information, commercial
databases, benchmarking, industry/academic studies
Organizational process assets• Lesson learned & actual data from previous
project files
2010
IDENTIFY RISK TOOLS & TECHNIQUES
Documentation reviews
Information gathering techniques• Brainstorming• Delphi technique• Root cause analysis• Interviewing: Experienced project participants;
stakeholders; expertsChecklist analysisAssumptions analysis
2010
IDENTIFY RISK TOOLS & TECHNIQUES
Diagramming Techniques Cause & effect diagram System / process flow diagram
SWOT analysis
Expert judgment
2010
IDENTIFY RISK OUTPUTS
Risk register• List of identified risk• List of potential responses
2010
3 PERFORM QUALITATIVE RISK ANALYSIS
Prioritizing risks for subsequent further analysis or action by assessing and combining their probability of occurrence and impact
2010
Potential Risk Conditions Associated with Each Knowledge Area (Schwalbe: Table 11-5.)
Knowledge Area Risk Conditions
Integration Inadequate planning; poor resource allocation; poor integrationmanagement; lack of post-project review
Scope Poor definition of scope or work packages; incomplete definitionof quality requirements; inadequate scope control
Time Errors in estimating time or resource availability; poor allocationand management of float; early release of competitive products
Cost Estimating errors; inadequate productivity, cost, change, orcontingency control; poor maintenance, security, purchasing, etc.
Quality Poor attitude toward quality; substandarddesign/materials/workmanship; inadequate quality assuranceprogram
Human Resources Poor conflict management; poor project organization anddefinition of responsibilities; absence of leadership
Communications Carelessness in planning or communicating; lack of consultationwith key stakeholders
Risk Ignoring risk; unclear assignment of risk; poor insurancemanagement
Procurement Unenforceable conditions or contract clauses; adversarial relations
2010
INPUT OUTPUT
1. Risk register2. Risk management plan3. Project scope statement4. Organizational process assets
Risk register updates
TOOLS & TECHNIQUES
1. Risk probability and impact assessment2. Probability and impact matrix3. Risk data quality assessment4. Risk categorization5. Risk urgency assessment6. Expert judgment
PERFORM QUALITATIVE RISK ANALYSIS
2010
PERFORM QUALITATIVE RISK ANALYSISINPUT
Risk registerList of identified risksRisk management plan
• Roles & responsibilities for conducting risk management
• Budget; schedule; probability & impacts matrix;• Stakeholders’ risk tolerances
Project scope statement • Technology used (common / state of the art)
Organizational process assets• Data about risks on past projects• Lessons learned knowledge base
2010
PERFORM QUALITATIVE RISK ANALYSISTOOLS & TECHNIQUES
Risk probability and impact assessment• Investigate the potential effect (neg or pos) on a
project objective• Probability & impact are assessed for each
identified risk. The level is evaluated during the interview or meeting.
Probability and impact matrix• Ratings are assigned to risks based on their
assessed probability and impact. Result: low or moderate or high risks. Risk rating rules can be tailored in the risk management planning
2010
Probability & Impact Matrix
Probability
Threats Opportunities
0,90 0,05 0,09 0,18 0,36 0,72 0,72 0,36 0,18 0,09 0,05
0,70 0,04 0,07 0,14 0,28 0,66 0,66 0,28 0,14 0,07 0,040,50 0,03 0,05 0,10 0,20 0,40 0,40 0,20 0,10 0,05 0,03
0,30 0,02 0,03 0,06 0,12 0,24 0,24 0,12 0,06 0,03 0,02
0,10 0,01 0,01 0,02 0,04 0,08 0,08 0,04 0,02 0,01 0,01
0,05 0,10 0,20 0,40 0,80 0,80 0,40 0,20 0,10 0,05
Impact ( ratio scale) on an objective (e.g. cost, scope, time, quality
= high risk
= low risk
2010
Risk data quality assessment• Require accurate and unbiased data
Risk categorization• RBS & others
Risk urgency assessment• Risk requiring near-term responses may be
considered more urgent to address
Expert judgment
PERFORM QUALITATIVE RISK ANALYSISTOOLS & TECHNIQUES
2010
PERFORM QUALITATIVE RISK ANALYSISOUTPUTS
Risk register updates, includes• Relative ranking or priority list of project risk• Risks grouped by categories• List of risks requiring response in the near-term• List of risks for additional analysis and response• Watch lists of low priority risks• Trends in qualitative risk analysis results
2010
4 PERFORM QUANTITATIVE RISK ANALYSIS
Assess the likelihood and impact of identified risks to determine their magnitude and priority
Performed on risks that have been prioritized by the qualitative risk analysis process as potentially and substantially impacting the project competing demands
Large, complex projects involving leading edge technologies often require extensive quantitative risk analysis
Managers often perform quantitative risk analysis right after risk identification process
Should be repeated after risk response planning
2010
INPUT OUTPUT1. Risk register2. Risk management plan3. Cost management plan4. Schedule management plan5. Organizational process assets
1. Risk register updates
TOOLS & TECHNIQUES1. Data gathering and representation
techniques2. Quantitative risk analysis and modeling
techniques3. Expert judgment
PERFORM QUANTITATIVE RISK ANALYSIS
2010
PERFORM QUANTITATIVE RISK ANALYSISINPUT
Risk register• Identified risks• Relative ranking or priority list of project risk• Risks grouped by categoriesRisk management plan • Roles & responsibilities• Budget; schedule activity for risk management; • Probability & impacts matrix;• Stakeholders’ risk tolerances• Risk categories
2010
PERFORM QUANTITATIVE RISK ANALYSISINPUT
Project management plan• Schedule management plan• Cost management plan
Organizational process assets• Similar completed projects information• Risk databases• Studies of similar projects by risk specialists
2010
PERFORM QUANTITATIVE RISK ANALYSISTOOLS & TECHNIQUES
Data gathering and representation techniques• Interviewing probability & impact on project
objectives• Probability distribution• Expert judgmentQuantitative risk analysis and modeling techniques• Sensitivity analysis• Expected monetary value (EMV) analysis
EMV = ∑ pi . Qi p = probability• Decision tree analysis
a diagramming method used to help select the best course of action in situations in which future outcomes are uncertain
2010
Quantitative risk analysis and modeling techniques• Modeling and simulation : a representation or model
of a system to analyze the expected behavior or performance of the system Monte Carlo analysis simulates a model’s outcome
many times to provide a statistical distribution of the calculated results
To use a Monte Carlo simulation, you must have three estimates (most likely, pessimistic, and optimistic) plus an estimate of the likelihood of the estimate being between the optimistic and most likely values
2010
Decision Tree
Sumber: Schwalbe 2004
2010
PERFORM QUANTITATIVE RISK ANALYSISOUTPUTS
Risk register updatesUpdates includes : • Probabilistic analysis of the project• Probability of achieving cost and time objectives• Prioritized list of quantified risks• Trends
2010
5 PLAN RISK RESPONSES
Process of developing options, and determining actions to enhance opportunities and reduce threats to the project objectives
Planned risk response must be: Appropriate to the significance of the risk Cost effective in meeting the challenge Timely Realistic within the project context Agreed upon by all parties involved Owned by a responsible person
2010
INPUT OUTPUT
1. Risk register2. Risk
management plan
1. Risk register updates2. Risk related contract decision3. Project management plan
updates4. Project document updates
TOOLS & TECHNIQUES
1. Strategies for negative risk or threat2. Strategies for positive risks or
opportunities3. Contingent response strategies4. Expert judgment
PLAN RISK RESPONSE
2010
PLAN RISK RESPONSE INPUT
Risk register• Identified risks• Root causes of risks• List of potential responses• Risk owners• Risk symptoms & warning signsRisk management plan• Roles and responsibilities• Risk analysis definitions• Risk thresholds for low, moderate, and high risk• Time & budget required to conduct project risk
management
2010
PLAN RISK RESPONSE TECHNIQUES
Strategies for negative risk or threat• Avoid: changing the project plan to eliminate the
threat posed by an adverse risk ( acquiring expertise, obtaining information, etc)
• Transfer: shifting the consequence of a risk and responsibility for its management to a third party (insurance)
• Mitigate: taking early action to reduce the probability of its occurrence
2010
General risk mitigation strategies for
technical, cost, and schedule risks
Source: Schwalbe, ITPM 3rd ed
2010
RISK RESPONSE PLANNINGTOOLS & TECHNIQUES
Strategies for positive risks or opportunities• Exploit (ensure )• Share (allocating ownership to a third party)• Enhance
Contingent response strategies• Used only if certain events occur
Expert judgment
2010
PLAN RISK RESPONSE OUTPUTS
Risk register updates
Risk related contractual agreements• Agreements for insurance, services, etc
Project management plan updates
Project document updates
2010
6 MONITOR & CONTROL RISK
Monitoring risks involves knowing their status
Controlling risks involves carrying out the risk management plans as risks occur
Workarounds are unplanned responses to risk events that must be done when there are no contingency plans
2010
INPUT OUTPUT
1. Risk register2. Project management plan3. Work performance
information4. Performance reports
1. Risk register updates2. Organizational process
assets updates3. Change requests`4. Project management
plan updates5. Project document
updates
TOOLS & TECHNIQUES
MONITOR & CONTROL RISK
2010
MONITOR & CONTROL RISKINPUT
Project management plan • Assignment of people (risk owners), time, other
resources to project risk managementRisk register
Work performance information• Project deliverables status• Corrective actions• Performance reportsPerformance reports• Analysis results
2010
MONITOR & CONTROL RISKTOOLS & TECHNIQUES
Risk reassessment• Identification, analysis, response design of new risksRisk auditsExamine the effectiveness of the risk mgmt processVariance and trend analysis• EV analysis; CPI; SPITechnical performance measurements• Comparing performance vs project management planReserve analysis• Time & budgetStatus meetings• Periodic
2010
MONITOR & CONTROL RISKOUTPUTS
Risk register updates
Organizational process assets updates• Lessons learned
Change requests
Project management plan updates
Project documents updates
2010
TUGAS
Buatlah Risk Management Worksheet untuk proyek anda
PROJECT RISK MANAGEMENT
The End