Project Risk Management

Module 1 Introduction to Risk Management

Introductions
Instructor: Hamid Faridani. PhD, PMP Email: hamid.faridani@utoronto.ca Phone: 416 577 9331

Project Management Processes & Knowledge Areas

4.2 Develop Project Mgmt Plan 5.1 Collect Requirement 5.3 Create WBS 11.1 Plan Risk Mgmt 11.2 Identify Risks 11.3 Perform Qual. Risk Analysis 11.4 Perform Quant. Risk Analysis 11.5 Plan Risk Resp.

Planning
9.1 Dev. HR Plan 8.1 Plan Quality 10.1 Plan Comm. 7.1 Estimate Cost 7.2 Determine Budget 6.3 Estimate Act. Res. 6.1 Definie Activities 6.4 Estimate Act. Duration 6.2 Sequence Activities 6.5 Develop Schedule

Monitoring and Controlling

4.4 Monitor & Control Work 5.4 Verify Scope 5.5 Control Scope 6.6 Control Schedule 7.3 Control Costs 8.3 Perform Quality Cont. 10.3 Report Performance 10.4 Manage Stakeholders . 11.6 Mon + Ctl Risks 12.3 Admin. Procurement

4.5 Perform Int. Chg. Ctl

5.2 Define Scope 12.1 Plan Procurement 12.2 Plan Contracting

Executing Initiating
4.1 Dev. Prj Charter 10.1 Id. Stakehldrs 9.2 Acquire Project Team

4.3 Direct & Manage Project Execution

Closing
8.2 Perform QA 10.2 Distribute Information 10.4 Manage Stkhldr Expect 12.2 Conduct Procurements

4.6 Close Project

9.3 Develop Project Team

9.4 Manage Project Team

12.6 Close Procurements

The Link between Project Risk and Quality Management and Project Success
High quality Project Processes and Practices Managed and Mitigated Project Risks Successful Projects

Measures of Projects Success

Project Success: Level 2 Was the right project done?

Plan & execute Project to deliver

Product

Use product to produce

Value or Benefit

Project Success: Level 1 Was the project done right?

Project Success: Level 3 Were the right projects done right, time after time?

Project Success Indicators and Factors

Success Level

Measures of Projects Success

Level 1: Project Management Success Was the project done right? Time Cost Quality Scope Safety

Typical Criteria for Success

Possible Critical Success Factors (Inputs)

Organizational Accountability

Clear & doable goals Effective project team Adequate resources Clear technical performance requirements Effective planning & control Risk & quality management

Project Manager PMO

Level 2: Project Success Was the right project done?

ROIC IRR Other financial indicators Stakeholders satisfaction

Clear & doable goals Stakeholders commitment & attitude Effective benefits realization and management Appropriate operational strategy

Project sponsor Client, owner or operator

Level 3: Consistent Projects Success Were the right projects done right, time after time?

Maturity of PM culture and practices Incorporation of knowledge management Productivity of corporate resources

Incorporation of quality management culture in organization Effective portfolio management Comprehensive use of metrics

Shareholders Senior management Portfolio managers

Risk in Projects: The Why Question

Uniqueness: There are always some project components or sub projects that have not been done before. Deliverables: Products or services developed often cannot meet shifting customer expectations Assumptions: By their very nature, involve uncertainty, and hence risks Stakeholders: The conflicting expectations of various stakeholders represent risk factors

Conflicting Constraints of time, cost and scope. Organizations and People: The unpredictable and conflicting needs of teams working on projects Project Environment and Change: Change involves uncertainty and risk

The Nature of Risk

Risks are associated with uncertainty concerning the assumptions made about projects activities such as their duration, cost and performance requirements. Uncertainty will eventually affect a projects objectives and hence its success:

Negatively, resulting in threats Positively, resulting in opportunities

Thinking outside the box involves uncertainty and risks

The Dimensions of Risk

Risk Driver: Definite fact about the project or its environment Cause or Trigger Trigger: Use of unionized workers in a construction project

Risk Event: Uncertain situation that if it occurs can have an impact on the projects objectives

Risk

Risk Event: Union strike during project implementation

Risk Effect: Contingent effect of risk on project objectives

Impact Impact

Impact: Delay in project schedule and possible associated penalties and costs

Sources of Uncertainty in Projects

Level 0
Project Risk

Level 1
Management

Level 2
Corporate Customer

Level 3
Experience Organizational & Financial Culture History & Requirements Loyalty

External

Natural Environment

Physical Environment Facilities & Services

Socio-Cultural Economic

Government and Politics The Legal Environment

Structure of the Economy Labour and Financial Markets

Technology

Requirements & Performance

Applications

Scope uncertainty & Complexity Technology Maturity and Limits

Organizational Experience Physical Infrastructure Personnel Experience

Relationship between Risk and Objectives

Type of Risk
Project Risk is any uncertainty that, if
occurs, would affect one or more of the projects objectives.

Corresponding Objectives
Scope, time, cost, performance, quality and client satisfaction Profitability, market share, competitiveness, Internal Rate of Return IRR, reputation, repeat business, share price and others

Business Risk is any uncertainty that,

if occurs, would affect one or more of the business objectives.

Safety Risk is any uncertainty that, if

occurs, would affect one or more of the safety objectives.

Low accident rate, minimal lost days, reduced insurance premiums, regulatory and legal compliance
Performance, functionality, serviceability reliability, and maintainability of the product

Product Technical Risk is any

uncertainty that, if occurs, would affect one or more of the product technical objectives.

Security Risk is any uncertainty that, if

occurs, would affect one or more of the security objectives.

Physical plant security, personnel and asset security, and information security

Project Risk Management (PMBoK)

Project Risk Management PRM is the systematic process of identifying, analyzing, and responding to project risks. It includes PRM includes maximizing the probability and consequences of positive events (opportunities); and minimizing the probabilities and consequences of negative events (threats) An Opportunity is not the absence of the absence of threat. Distinctive opportunities exist in their own right presenting a chance to deliver the projects product early, at a lower cost and, therefore, increasing customer satisfaction.

Threats and Opportunities in Projects

100

80 60
Threat Zone

40 Normal Variations 20
Opportunity Zone

Project Objectives: Cost or Schedule

Target value

The Definition of Risk

Risk
Any uncertainty that, if it occurs, would affect one or more of the projects objectives

Threat
Any uncertainty that, if it occurs, would affect one or more of the projects objectives negatively

Opportunity
Any uncertainty that, if it occurs, would affect one or more of the projects objectives positively

Uncertainty in Project Activities

Risks in a project arise because the cost, duration and outcome of projects activities involve a degree of uncertainty. The uncertainty is defined in terms of a probability distribution.

Probability The estimated value is a function of x1, x2 and x3

Cost or Duration Estimate x

10 Least Likely x1

15 Most Likely x2

25 Least Likely x3

Risk and Decision Making

Cost Benefit Analysis: A risky course of action should only be taken when the potential benefit and chance of winning exceed the remedial cost of an unsuccessful decision and chances of loosing by a acceptable margin The risk taker should obtain answers to:

Why should the risk be taken? What will be gained? What could be lost? What are the chances of success and failure? What can be done if the desired result is not achieved? Is the potential reward worth the risk?

Risk and Decision Makers

Risk elements that tend to Attract and/or determine the Response attitudes of decision makers include: Potential frequency of loss Amount and reliability of information available Severity of potential loss Vividness of the consequences Potential for (adverse) publicity Ability to measure the consequences

Risk Management is Proactive

Project risk management should be advance preparation for possible adverse events, rather than responding as they happen though both may be needed. Crisis Management (reactive mode) consists of taking the appropriate response if an event occurs. Anticipation and Planning (proactive mode) makes it possible we hope to avoid this situation in the first place by planning an appropriate response should the adverse event take place.

Venture Risk vs. Project Risk

Venture Risk: Analyzing information and selecting the right project

Project Risk: Managing uncertainty to meet the project objectives

Will the project results be as effective as originally planned? Will the market for the product/service exist to the same degree that was forecast?

Can we complete the project on schedule? Will the project results meet the agreed requirements? Can we remain within the approved budget?

The Dimensions of Risk

Probability

Statistical likelihood of a specific event taking place Damage or benefits that will result if that event occurs Timing and situation should the event occur

Impact

Conditions or Context

Probability of a Risk Event

Expresses the likelihood of an event taking place Based on scientific observation of similar events, review of scenarios, analysis of a situation, etc. Useful in many business areas, including insurance, investments, gaming, etc. Dependent on accuracy of the information available: Weather P(6 and 4) = P(6). P(4) forecast compared to gambling odds = (1/6).(1/6) Can be expressed as a percentage or = 1/36 a decimal = 2.7 % Often expressed in relative terms (likely <> unlikely)

Probability as a Measure of Uncertainty

Uncertainty in common terminology is often expressed by phrases such as:

not very likely or highly unlikely better than even or probable for sure or highly likely

Probability is stated on a scale from 0 to 1

0 probability indicates an event has no chance of occurring 1 probability indicates an event is absolutely sure to occur

P( Rain) > 90% during the monsoon season in South Asia P (Rain) < 10% in the summer in North Africa

The Risk Value

Impact: The magnitude of consequences

The amount at stake; the extent of adverse or positive consequences which might affect the projects objectives of: Scope (S), Cost (C), Schedule (T) and Quality (Q) The ratio of the number of chances that an event may happen, to the sum of the chances of it both happening and not happening

Probability: The likelihood of occurrence

Risk Value = Probability x Impact

Impact of a risk event

Description of the consequences (benefit or loss) that will result, should the event take place: Impact is not related to the probability of that event Often expressed in financial terms, but can also affect other aspects of the organization or project:Cost impact is expressed in same units as the budget. Estimate is based on scientific observation of similar events, review of scenarios, analysis of a situation May be easy or difficult to estimate the degree of impact Estimate assumes that only normal safeguards are in place Depends on the conditions in effect when/if the event occurs

Simple Risk Assessment Matrix

Probability
Third priority risks First priority risks

High

Low priority risks Low

Second priority risks

Low

High

Impact

Risk Factors in the Project Life Cycle

Project risk factors change during the life cycle During project planning, the probability of opportunity or threat remain high, but the amount at stake (investment) is low During project implementation, the probability of opportunity or threat progressively falls as the unknowns become knowns, but the amount at stake rises steadily as resources are invested Highest vulnerability to risk is during the last two phases of the life cycle

Total Project Life Cycle Plan

Phase 1 CONCEPT Conceive (C) Phase 2 DEVELOPMENT Develop (C)

Accomplish
Phase 3 IMPLEMENTATION Execute (E) Phase 4 TERMINATION Finish (F)

INCREASING RISK

Opportunity and Risk

$ VALUE

Amount at Stake

R. M. Wideman, 1992

TIME

Typical Life Cycle Risks

Phase 1 Conceptualization

Phase 3 Life CyclePhase 2 Analysis Risk Development

No Risk Management Plan Hasty and Poor Planning Poor Specifications Unclear WBS & SOW Unclear Definition of Roles and Responsibilities Lukewarm Management Support Inexperienced PM and Project Team

Implementation
Unskilled Labour Unreliable Suppliers Quality and Availability of Materials Changes in Scope Changes in Costs and Schedules Labour Strikes Weather Conditions Changes in Regulatory Requirements Environmental or OHS Compliance Inadequate Monitoring Control Systems

Phase 4 Termination
Poor Performance and Quality of Product or Service Changes in Customers Expectations Cash Flow Problems

Unavailable Experts Poor Definition of Problem No or Poor Feasibility Study Unclear Objectives Lukewarm Support from Sponsor Unproven Technology Poor Market Intelligence

Effective Risk Management

Open Communication

Enabling formal, informal and impromptu communication and flow of information. Using processes that value the individual voice and insight into identifying and managing project risks Making risk management an integral and vital part of project management Adapting risk management tools and methods to the project management infrastructure and culture

Integrated Management

The PMI Risk management Processes

Plan Risk Management

meetings to develop a risk management plan determining project risks and their characteristics assessing relative impact and likelihood of identified risks numeric analysis of probability and consequences developing options to enhance opportunities, reduce threats tracking identified risks, executing risk plans and contingency plans

Identify Risks

Perform Qualitative Risk Analysis

Perform Quantitative Risk Analysis

Plan Risk Responses

Monitor and Control Risks

The Risk Management Processes

*Guide to Project Management Body of Knowledge (PMBOK): Fourth Edition. The Project Management Institute PMI

The Risk Management Processes

*Guide

to Project Management Body of Knowledge (PMBOK): Fourth Edition. The Project Management Institute PMI

The Risk Management Processes

*Guide to Project Management Body of Knowledge (PMBOK): Fourth Edition. The Project Management Institute PMI

The Risk Management Processes

*Guide to Project Management Body of Knowledge (PMBOK): Fourth Edition. The Project Management Institute PMI

The Risk Management Processes

*Guide to Project Management Body of Knowledge (PMBOK): Fourth Edition. The Project Management Institute PMI

The Risk Management Processes

*Guide to Project Management Body of Knowledge (PMBOK): Fourth Edition. The Project Management Institute PMI

Risk Conditions in PM Knowledge Areas

Knowledge Area Integration Scope Time Cost Quality Human Resources Communications Risk Procurement Risk Conditions Inadequate planning; poor resource allocation; poor integration management; lack of post-project review Poor definition of scope or work packages; incomplete definition of quality requirements; inadequate scope control Errors in estimating time or resource availability; poor allocation and management of float; early release of competitive products Estimating errors; inadequate productivity, cost, change, or contingency control; poor maintenance, security, purchasing, etc. Poor attitude toward quality; substandard design/materials/workmanship; inadequate quality assurance program Poor conflict management; poor project organization and definition of responsibilities; absence of leadership Carelessness in planning or communicating; lack of consultation with key stakeholders Ignoring risk; unclear assignment of risk; poor insurance management Unenforceable conditions or contract clauses; adversarial relations

Attributes of the Effective Risk Management Process (RMP)

Value Added: The RMP should be seen to provide value to the project team but simple to use and implement, without undue administrative burden. Structured and Generic: The process should be a structured and generic but readily adaptable to sector-specific projects Scalable: RMP should be readily scalable to projects of different scope.

Elements of an Appropriate RMP Infrastructure

Project Management Information System

Risk Management Information System Performance Failure Information System Lessons Learned Information System Earned Value Information System
Simulation Tools Decision Analysis Tools Policies and Procedures Standards and Templates Risk Experts Training for Project Team Networking with Relevant External Bodies

Risk Analysis Software Tools

Risk Resources

Risk Strategies and Organizational Environment

Project Risk Management Policies & Procedures
Rigid

Avoidance or Exploitation

Transferring or Sharing
Mitigation or Enhancement
Guidelines

Acceptance

High

Risk Tolerance

Low

Project Management: A Systems Approach, Harold Kerzner, J Wiley & Sons

Organizations Risk Culture

Risk Averse: Organizations that have low risk threshold Risk Taker: Organizations that have a high risk threshold and track record of managing risky projects. Risk Ignorant/Hostile: Organizations that, because of the nature of their sector, have arrogant or ignorant attitude towards risk. Risk Mature: Organizations that recognize and accept uncertainty as inevitable, and are prepared to develop mature risk management processes to manage the negative impact of threats and reap the benefits of opportunities.

Risk Attitudes and Drivers of Behaviour

Uncertainty Uncertainty

Attitude

Neutral Environment

Attitude

Hostile Environment

Attitudes drive behaviour in a neutral or positive environment

Behaviour

Behaviour

Hostile environment drives behaviour

Individuals Risk Attitudes

Risk Averse (RA)

Uncomfortable with uncertainty and has low tolerance for ambiguity Practical, accepting, has common sense approach to issues, and enjoys working with facts rather than theories. Threats are more readily perceived by the RA, while opportunities are underrated. RAs tend to over react to threats and under react to opportunities Takes uncertainty in a stride as a normal feature of project work Has a laissez-faire approach that may lead to failure to assess the potential impact of both threats and opportunities May appear to have a balanced attitude towards risk, but outlook can have negative long term effects

Risk Tolerant (RT)

Individuals Risk Attitudes

Risk Neutral (RN)

Sees risk taking as a price worth paying for future payoffs They think abstractly and creatively and are not afraid of dealing with uncertainty RNs have mature attitudes towards threats and opportunities
Welcomes the challenge of dealing with risks, and the thrill of garnering potential payoffs. Risk seekers tend to be adaptable and resourceful, enjoy lifes challenges and are driven by the promise of payoffs RSs tend to under estimate the consequences of threats and over estimate the benefits of opportunities

Risk Seeking (RS)

Individuals Risk Attitudes

Attribute

Risk Averse

Risk Neutral

Risk Tolerant

Risk Seeking

Attitude towards threats Actions towards threats Attitude towards opportunity Actions towards opportunity

Over sensitive and aware Aggressively avoids and/or minimizes their consequences Under sensitive and/or unaware

Aware

Unconcerned and cavalier Does not respond

Underestimates importance Accepts or ignores them

Responds proportionately

Seek strategies that have high future payoff Responds proportionately

Unconcerned and cavalier

Overestimates their importance

Under react and/or ignore

None

Aggressively exploit and/or enhance

Tolerance for Risk

Hig h

Risk Seeker

Satisfaction

Risk Neutral

Risk Averter

Low
Low

Value at stake

Hig h

Behaviour Modification of Risk Attitudes

Risk attitudes are not hard wired in the human brain. All attitudes are chosen situational responses driven by subtle and complex set of factors, some of which are subconscious and deep rooted. Project team members through reflection and the use of various available psychometric self assessment instruments (Emotional Intelligence Individual Diagnostic IQ) can raise their self awareness, which can lead to self-regulation, behaviour modification and management. Behaviour modification involves understanding of which attitudes will produce the desired effect in a given situation, and consciously modifying ones attitude as appropriate, even if it means adopting an approach that is counterintuitive Project team members can also be trained to look actively for opportunities rather than only for threats, and adopt a more positive thinking frame of mind that recognizes that opportunities exist, have to be proactively identified and effectively managed.

The Risk-Balanced Project Team

Team Work is essential in the risk management process, where the attributes of each member contribute to the overall capacity of the team The risk averse person can be relied upon to challenge plans and strategies looking for threats and testing the feasibility of proposed solutions. The risk seeker colleague can look more proactively for opportunities for doing work better, faster and cheaper. The risk neutral team member can test all strategies for their long term benefits to the project and the organization. The risk tolerant can offer an overall balanced view from the Centre