Project Risk Management

Sections of this presentation were adapted from A Guide to the Project Management Body of Knowledge 4th Edition, Project Management Institute Inc., © 2008 & A Guide to the Project Management Body of Knowledge 5th Edition, Project Management Institute Inc., © 2013 & Information Technology Project ManagementJack T. Marchewka 2006 John Wiley & Sons,

Definition

Risk• An uncertain event or condition that, if it occurs, has

a positive or negative effect on the project objectives.

Risk Management• The systematic process of identifying, analyzing,

and responding to project risk. It includes maximizing the probability and consequences of positive events and minimizing the probability and consequences of adverse events.

Why to Manage Risk?Risk Planning• Requires a firm commitment to risk management

from all project stakeholders• Ensures adequate resources to plan for and

manage risk• Focuses on preparationProject problems can be reduced as much as 90% by using risk analysisPositives:• More info available during planning• Improved probability of success/optimum projectNegatives:• Belief that all risks are accounted for• Project cut due to risk level

Key TermsRisk Tolerance – The amount of acceptable riskRisk Adverse – Someone that does not want to take risksRisk Factors

– Probability of occurrence– Range of possible outcomes (impact or amount at stake– Expected Timing of event– Anticipated frequency of risk events from that source

How to Manage Risk?Use the six risk management processes

1. Plan Risk Management2. Identify Risks3. Perform Qualitative Risk Analysis4. Perform Quantitative Risk Analysis5. Plan Risk Responses6. Monitor and Control Risks

Plan Risk Management

Identify Risks

Perform Qualitative Risk Analysis

Perform Quantitative Risk Analysis

Plan Risk Responses

Monitor and Control Risk s

Plan Risk Management

Project Scope Statement

Cost Management Plan

Schedule Management Plan

Enterprise Environmental Factors

Organizational Process Assets

Risk Management Plan

Planning Meetings

Project AnalysisInputsOutputs

Tools & Techniques

Plan Risk Management

Identify Risks Perform Qualitative Risk Analysis

Perform Quantitative Risk Analysis

Plan Risk Responses

Monitor and Control Risk s

What is a Risk Management Plan?

Methodology – Approach, tools, & data Roles & Responsibilities Budgeting – Resources to be put into risk

management Timing – When and how often Risk Categories – Risk Breakdown Structure (RBS) Definitions – Risk probabilities and impact Probability and Impact Matrix Stakeholder tolerances Reporting formats Tracking

Risk Breakdown StructureProject

Technical

Limited Design Time

Specifications Adherence

Organizational

Funding

Prioritization

Resource Availability

Project Management

Estimates

Scheduling

Communication

Lists categories and subcategories where risks may arise

Identify RisksRisk Management Plan

Activity Cost Estimates

Activity Duration Estimates

Scope Baseline

Stakeholder Register

Cost Management Plan

Schedule Management Plan

Quality Management Plan

Project Documents

Enterprise Environmental Factors

Organizational Process Assets

Risk Register

Documentation Reviews

Information Gathering Techniques

Checklist Analysis

Assumption Analysis

Diagramming Techniques

SWOT Analysis

Expert Judgment

Inputs Outputs

Tools & Techniques

Plan Risk Management

Identify Risks Perform Qualitative Risk Analysis

Perform Quantitative Risk Analysis

Plan Risk Responses

Monitor and Control Risk s

Information Gathering TechniquesBrainstorming

Delphi technique• Successive anonymous questionnaires on project risks with

responses summarized for further analysisInterviewingRoot cause identificationStrengths, weaknesses, opportunities, and threats (SWOT) analysis

SWOT Analysis

Diagramming Techniques-Cause and Effect Diagrams

Professor Kaoru Ishikawa created Cause & Effect Analysis in the 1960s. The technique uses a diagram-based approach for thinking through all of the possible causes of a problem. This helps you to carry out a thorough analysis of the situation. There are four steps to using Cause and Effect Analysis: Identify the problem in terms of threat and

opportunity Work out the major factors involved. Identify possible causes for each factors. Continue refining the diagram until satisfied that the

diagram is complete. And analyze the diagram

Also known as Ishikawa or fishbone

Cause and Effect Diagrams-Example 1

Product Delivered

Late

Bad SpecsInsufficient Resources

Inadequate Time

Project Prioritization

Testing

Materials

Potential Causes Effect

Personnel

http://www.mindtools.com

Cause and Effect Diagrams-Example 2

http://www.mindtools.com

Cause and Effect Diagrams-Example 2 completed

Risk Register

List of Identified risks: in as much detail as is possible.

Event (may occur) IMPACT Event (if there is a CAUSE)EFFECT

Potential responses : should be used as inputs to the Plan Risk Root causes of f these risks Updated risk categories (if required)

Potential risk responses should be recorded andused to support future risk identification for this and other projects.

.

Perform Qualitative Risk Analysis

Risk Register

Risk Management Plan

Project Scope Statement

Organizational Process Assets

Risk Register Updates

Risk probability and impact statement

Probability and impact matrix

Risk data quality assessment

Risk categorization

Risk urgency assessment

Expert Judgment

Inputs

Outputs

Tools & Techniques

Plan Risk Management

Identify Risks Perform Qualitative Risk Analysis

Perform Quantitative Risk Analysis

Plan Risk Responses

Monitor and Control Risk s

IT Project Risk Management Planning Process

Risk Analysis• Risk = f(Probability * Impact)

– What is the probability of a particular risk occurring?

– What is the impact on the project if it does occur?

Risk Assessment• Focuses on prioritizing risks so that an effective

strategy can be formulated for those risks that require a response.– Depends on Stakeholder risk tolerances– You can’t respond to all risks!

Risk Analysis and Assessment Tools

Qualitative Approaches• Expected Value• Payoff Table• Decision Trees• Risk Impact TableQuantitative Approaches• Probability Distributions

– Discrete• Binomial

– Continuous• Normal• PERT• Triangular

• Simulations

Expected Value of a Payoff Table

Schedule Risk AProbability

BPayoff (in 000s)

A + BProb. * Payoff

Project completed20 days early

5% $300 $15

Project completed10 days early

20% $100 $20

Project completedon schedule

50% $100 $50

Project completed10 days late

20% $ -- $ --

Project completed20 days late

5% $ (50) $ (3)

100% $83Expected Value

Tusler’s Risk Classification Scheme

Binomial Probability Distribution

Normal Distribution

Shape is determined by its mean (µ) and standard deviation ()Probability is associated with area under the curve.Since the distribution is symmetrical, the following probability rules of thumb apply About 68 percent of all the values will fall between

+1 of the mean About 95 percent of all the values will fall between

+2 of the mean About 99 percent of all the values will fall between

+3 of the mean

Normal Distribution

PERT distribution uses a three-point estimate where: • a denotes an optimistic estimate • b denotes a most likely estimate • c denotes a pessimistic estimate PERT Mean = (a + 4m + b) / 6 PERT Standard Deviation = (b - a) / 6

PERT Distribution

PERT Distribution

http://www.mm4xl.com/

Triangular Distribution

uses a three-point estimate similar to the PERT distribution where: • a denotes an optimistic estimate • b denotes a most likely estimate • c denotes a pessimistic estimate

weighting for the mean and standard deviation are different from PERT• TRIANG Mean = (a + m + b) / 3 • TRIANG Standard Deviation =

[((b-a)2 + (m-a)(m-b)) /18]1/2

Triangular Distribution

http://www.mm4xl.com/

Simulations

Monte Carlo• a technique that randomly generates specific values for a

variable with a specific probability distribution.• goes through a specific number of iterations or trials and

records the outcome.• @risk

Sensitivity Analysis• Tornado Graph

Risk Simulation Using @Risk™ for Microsoft Project

Output from Monte Carlo Simulation

Cumulative Probability Distribution

Sensitivity Analysis Using a Tornado Graph

Figure 8.14

Risk Strategies

Depends On:• The nature of the situation itself

– Really a threat or an opportunity?• The impact of the risk on the project and

objectives– What is the probability and impact of a risk

• The project’s constraints in terms of scope, schedule, budget, and quality – Can a response be made with existing resources

and/or constraints?• Risk Tolerances or preferences of the project

stakeholders– How much risk is tolerable?

Methodologies

Probability and Impact Matrix• Based on Failure Modes and

Effects Analysis (FMEA)• From 1950’s analysis of military

systems

Probability and Impact Matrix

Define Probability Scale & Impact Scale

Likelihood ClassLikelihood of Occurrence

(events/year)

Not Likely (NL)<0.01% chance of

occurrence

Low (L)0.01 - 0.1% chance of

occurrence

Moderate (M)0.1 - 1% chance of

occurrence

High (H)1 - 10% chance of

occurrence

Expected (E) >10% chance of occurrence

Consequence Health and Safety

ExtremeFatality or multiple fatalities

expected

HighSevere injury or disability likely; or

some potential for fatality

Moderate

Lost time or injury likely; or some potential for serious injuries; or

small risk of fatality

LowFirst aid required; or small risk of

serious injury

Limited No concern

Probability ScaleImpact Scale

Probability and Impact Plots Rate each risk on scales then plot on

matrix Construct a mitigation technique for risks

above tolerance

http://www.lancsresilience.org.uk

Risk Register Update

Add • Probability and Impact Matrix results• Perform quality check on results• Categorize the risks to make them easier to handle• Perform urgency assessment to determine which

risk need immediate attention

Risk Register Report

http://www.tdm-ltd.com

Perform Quantitative Risk Analysis

Risk Register

Risk Management Plan

Cost Management Plan

Schedule Management Plan

Organizational Process Assets

Risk Register Updates

Data gathering and representation techniques

Quantitative risk analysis and modeling

Expert Judgment

Inputs

Outputs

Tools & Techniques

Plan Risk Management

Identify Risks Perform Qualitative Risk Analysis

Perform Quantitative Risk Analysis

Plan Risk Responses

Monitor and Control Risk s

Quantitative Risk Analysis

Analyze numerically the probability and consequence of each riskMonte Carlo analysis popularDecision Tree analysis on test• Diagram that describes a decision and probabilities associated

with the choicesExpected Monetary Value Analysis (EMV): with all other things equal, a project with higher EMV is more favorable than a project with lower EMV. EVM helps PMs to analyze potential outcomes based on uncertain conditions

Gives the average value of the decision if it were made repeatedly

Uses all the information concerning events and their likelihood

Expected Monetary Value (EMV)

Building Cost Probability

Optimistic Outcome $150K 0.2 $30K

Likely Outcome $230K 0.5 $115K

Pessimistic Outcome

$300K 0.3 $100K

Expected Value $245K

Decision Tree Analysis-Example Question

Build or Upgrade new APP

New APP

-$100

Upgrade existing

APP

-$60

Strong Demand

Weak Demand

Strong Demand

Weak Demand

70%

$200

30%

$90

70%

$120

30%

$60

?

?

?

?

Decision Definition

Decision Node

Chance Node

Net Path Value

EMV of New APP= ?

EMV of Upgrade existing APP?

Solution

NPV: New App Strong Demand:-$100+ $200= $ 100NPV: New App Weak Demand:-$100+ $90=- $ 10

NPV: Update App Strong Demand:-$60+ $120= $ 60NPV: Update App Weak Demand:-$60+ $65= $ 5

Multiply NVP by proability of each scenario:$ 100*70% + (- $ 10)*30= $67 for EMV New APP$ 60*70% + ($ 5)*30= $43,5 for EMV Updating APP

Plan Risk Responses

Risk Management Plan

Risk RegisterRisk Register Updates

Strategies for negative risks or threats

Strategies for positive risks or opportunities

Contingent response strategy

Expert Judgment

Inputs

Outputs

Tools & Techniques

Project Management Plan Updates

Risk-related Contract Decisions

Plan Risk Management

Identify Risks Perform Qualitative Risk Analysis

Perform Quantitative Risk Analysis

Plan Risk Responses

Monitor and Control Risk s

Strategies

Negative Risks (or Threats)• Avoid• Transfer• Mitigate• AcceptancePositive Risks (or Opportunities)• Exploit• Share• Enhance• Acceptance

Monitor and Control Risks

Risk Register

Project Management Plan

Work Performance Information

Performance Reports

Risk Register Updates Risk reassessment

Risk audits

Variance and trend analysis

Technical performance measurement

Reserve analysis

Status meetings

Inputs

OutputsTools & Techniques

Organizational Process Assets

Change Requests

Project Management Plan Updates

Project Document Updates

Plan Risk Management

Identify Risks Perform Qualitative Risk Analysis

Perform Quantitative Risk Analysis

Plan Risk Responses

Monitor and Control Risk s