Point International LTD © 2002

X Point International Ltd © 2002
What is risk ?
A Working Definition of Risk
Any Issue which Impact Organizations Ability to

Meet its Objectives

What is risk ?
Risk can be defined as the likelihood of occurrence

of an undesirable event combined to the
magnitude of its impact
A future event (or series of events) with a probability

of occurrence and the potential for
a) Loss or
b) Impact on objectives that can be either positive or

negative’
Objectives of Risk Management ?
 Not to eliminate risks
 But to identify them and minimize their effects

through:
» improved awareness of their likelihood of
occurrences and potential impact and;
» Development and implementation of

appropriate mitigation plans

Types of Projects
ERP
Super implementation
High-Tech in multi-national
Uncertainty / Risk
New software Advanced

High-Tech
radar
Medium-Tech New
cellphone
Low-Tech Construction Auto repair
Assembly System Array

Projects Projects Projects
System Complexity
Few Definitions
Opportunity
Uncertainty Harness risk to your

advantage and enhance
stakeholder value
Hazard
Event driven risk

Perspectives of Risk and The Way We Manage Risk
Risk Continuum Perspective Approaches
Hazard What is my contingency •Business Continuity Plan

plan should a negative
event actually occur ? •Disaster Recovery Plan
Uncertainty How can I meet my • Project Risk Management

operational objectives
despite the uncertain • Management Support Office
future?
• Change Management
Opportunity Is there any way I can gain •Operational Risk

competitive advantage by
managing change better ? • Operational Effectiveness

Understanding Risk & Uncertainty
• Risk is defined as “unpredictability in
corporations/ businesses outcome variables”
• Uncertainty is defined as “unpredictability of

environmental and organizational variables
that impact corporation/ businesses
performance”

Types of Risk in Business
Overall Business Strategy

Project Risk
Legal Risk
Financial Risk Business Risks
Market Risk
Manufacturing Risk
Transportation EHS
Risk Political Risk Risk

Nature of Risks
 Technical
 Operational
 Political
 Economic
 Financial
 Managerial
 Resistance to Change
 Systems Integration Failure
 Efficiency Rates
 Schedule, extended transition

Categories of Risk
Strategic Risk Goals and Objectives
Financial Risk Loss of assets
Operational Risk Ongoing management process
Compliance Risk Laws and Regulations
Reputation Risk Tarnishing of Image
Information Risk Loss of competitive advantage
New Risks ???

Categorization of uncertainties
A: General Environment Uncertainties
a) Political
b) Government Policy
c) Macroeconomic
d) Social
e) Natural

B: Industry Uncertainties
a) Input Market
b) Product Market
c) Competitive

C: Firm Uncertainties
a) Operating
b) Liability
c) R & D
d) Credit
e) Behavioural
f) Project Implementation

Categorization of Uncertainties
Industry Uncertainties Firm Uncertainties

Genl. Env.
Uncertainties
Political Input Market Operating
War, revolution Labor

Quality
Govt. changes Input supply
Govt. Policy Market Supply Production
Fiscal/Monetary Liability
Quality used by other buyers
Price Control Product
Regulations
Product Market Emission pollutants
(In)Nationalization Consumer taste R&D
Macroeconomic Results of R&d

Substitute Goods
Inflation, Forex Credit
Interest Rates Complementary Goods Collections
Social Behavioural
Competitive
Riots, Demonstration Project Implementation
Terrorist Movements
Rivalry Time2market
Natural New entrants Cost of Implementation
Earthquakes, etc. Quality

X Point International Ltd © 2002 Tech-Product Process Innov.
Organizational Response to Uncertainties
Strategic Management
Financial Risk Management
Avoidance
Forward or Futures contract
Divestment
Insurance Delay New market entry
Low uncertainty niches
Control
Political activities
Gain market power
Vertical integration – Mergers & Acq.
Cooperation
Long term contracts suppliers buyers
Alliance or JVs
Franchising, Licensing
Imitation’
Flexibility
Diversification
Operational Flexibility

General Classification
Risk
Business Financial Operations
Market Share Cost Profit Time2market

Outcome Revenues Customization
Variables
Success of Risk
Macro Political
Country
Competitive
Foreign Ex.
Micro Legal & Other

Risk Management isn’t “No Surprises”
Unknowable
Unpreventable
Not cost effective
Number
of Risks
Prevented
Cost of Risk Management

Business Continuity Plan
Business are run based on the assumption that the current level of
resources will not decline. But all organizations face the risk that disasters
may compromise the availability of resources
Tsunami - Andaman Terrorist Attack on WTC

Business Risk Continuum
Opportunity Compliance
Operational Strategic
and
Performance Initiatives
Prevention
Uncertainty
Hazard Controller CFO/CCO CEO/Board

VA
In Pursuit of the Upside

Enterprise Risk Management
Must Measure and Optimize All Types of Risk
ENTERPRISE RISK PLATFORM
Operational Financial
Physical Risk Sales Risk
Risk Risks
Cpty/Creidt Market Risk

Liquidity Risk
Risk
Business Continuity Plan
Businesses are run based on the

assumption that the current level of
resources will not decline. But all
organizations face the risk that disasters
may compromise the availability of
resources.

Visualizing Risk Management
Policy & Attitudes

Is Risk purely a perception ?
 For some people taking risks is not necessary,

and they avoid risky environments.
 Avoiding risk means getting out of business.
 Ignorance makes some people more confident

to take risk.
 For some people awareness of risk creates

fear of failure & so better avoid it.

Risk to whom ?
 A good risk manager should address basic

question before managing risks.
Risk to me
Risk to organization
Risk to sponsor
Risk to vendor
Risk to end user

Organization's Perception about
Risks
 Risk is related as a threat to success
 If risk is accepted then what would be the reward ?
 Risks could be opportunities for future benefits
 Fast track schedules can possibly overrun the

risks.

A model for Risk Management
Qualitative
Risk
Analysis
Risk Risk
Risk Response Monitoring
Identification Planning and Control
Quantitative
Risk
Assessment

Having identified your risks, you need to manage them
too many risks...

...which one first? ...what do I do?
...what do I do?
risk plan
...what’s that?
 Risk Prioritisation
 Risk Plans
 Roles & Responsibilities
 Execution & Monitoring

Risk Analysis Method
 Describe the Risks
» Brainstorming the potential risks
» walkthrough the risk identification checklist
 Analyze And Prioritize Risks

» Walkthrough each sheet and estimate the
probability and cost of each task
» Calculate risk rating of each risk
» prioritize in risk concentrate on class “High”

Risk combines notions of hazard and uncertainty
likelihood of
hazard occurring
high
risk
impact of likelihood
risk = hazard of hazard
occurring * occurring
low
risk
impact if
hazard occurs
contours of equal
risk exposure.

Relative risk exposure can be represented
on a 4*4 ‘risk grid’
likelihood of intermediate
high risk
risk
hazard
occurring
D
A B C D
low risk
impact if hazard occurs
Risk Analysis Process
Develop risk
Event driver(s)
Estimate risk
Event profitability
Go to next risk
Develop impact
Driver(s) and total
loss
Estimate impact
Probability
The Standard Risk Model
Probability of Probability of
Risk event (Pe) impact (Pi)
Risk Event Impact Total Loss (Lt)
Risk event
Impact Drivers
drivers (s)

When
 Business Case Analysis

 Preparation for outsourcing (partner
selection, frame contract)
 Status & Briefing of Requirements
 Detailed contracts & Project Planning
 Milestone in Project Execution
 Transfer & Maintenance
Risk Management is a Continuous Process

Risk Analysis
Scale Probability Impact
Very Low Unlikely to occur Negotiable Impact
Low May occur occasionally Minor impact on time, cost

or quality
Medium Is as likely as not to occur Notable impact on time,
cost or quality
High Is likely to occur Substantial impact on
time, cost or quality
Very high Is almost certain to occur Threatens the success of
the project

Likelihood
What is the likelihood that Risk Will Happen
Level  Your approach and processes

1 Not Likely … will effectively avoid or mitigate this risk based
on standard practices
2 Low Have usually mitigated this type of risk with
Likelihood minimal oversight in similar cases
3 Likely May mitigate this risk, but workarounds will be

required
4 Highly Cannot mitigate this risk, but a different approach
Likely might
5 Near Cannot mitigate this type of risk; no known

Certainty processes or workarounds are available

Consequence
Level Technical Schedule Cost
1 Minimal or no impact Minimal or no impact Minimal or no impact
2  Minor Performance Additional activities Budget increase of
shortfall, same required; able to meet less than 1 %
approach retained key dates
3 Mod perf. shortfall, but Minor schedule slip; Budget increase by
workarounds available will miss need date less than 5 %
4 Unacceptable but Program critical path Budget increase of

workarounds available affected less than 10 %
5 Unacceptable; no Cannot achieve key Budget increase of
alternatives exist program milestone more than 10 %

Risk Logging : Cause and Effect
 Condition
 Cause
 Consequence
 Context

Who Is Involved in Risk Management ?
 Customer
 End Users
 Project Team
 Management
 Product Management
 Related Projects
 Subcontractors and Suppliers

Risk Management is an integral part of Project Mgt
…but different
(rest of) project mgt.

•project definition
•project structuring
•planning
•cost/schedule status
•project control
risk management
…in what way is Risk Mgt different?

Need for Risk Management arises from uncertainty
(rest of) certain

project management
obstacle
risk management likelihood
impossible

Assumptions based approach is proposed
•Requirement •Work Plan & Budget

•Issues Assumptions •External threats
•Hazard checklist Register •Internal weaknesses
•…. •….
Risk Evaluation Risk Register Monitoring Risks

& Prioritisation & Assumptions Risk
Mgt
Risk Planning
Roles
Risk Plans
Risk Plan
Execution
Projects are exposed to the risk of assumption failure
 Decisions are made based on limited information
 Working assumptions
 Conscious/Explicit
 Unconscious/Implicit (become evident later, or remain hidden)
 Working assumptions proven to be:

 True – will not disturb the project
 False – will disturb the project
 For every assumption the project makes there is an inherent risk

that the assumption will not be true

If hazard is project assumption failure, the risk grid
axes become project sensitivity, assumption instability
assumption
instability
D
A B C D
project sensitivity
to assumption failure
First catch your assumptions…
...then assess the associated risk
Hazard checklists
Business Case Internal weaknesses

Open Issues  Broad search
Budget
Requirement Spec.  What could go wrong?
Workplan  Capture working assumptions

External dependencies
 Assess associated risk exposure
External threats
Stakeholders

Project Assumptions and Project Risks
need to be recorded in consolidated registers
Project Mgt.
assumptions
risks
Risk Mgt.

Document assumptions in an Assumptions Register
 Assumption Identifier
 Project, Assumption Title & No.
assumption
 Assumption Description
 Sufficient to explain the nature of
identifier the assumption
 Associations
assumption  Key Dependents, Associated
description Assumptions, References,
Associated Risk No
associations
 Registration
 Registration Date, Registered By,
Project Mgr
registration
closure  Closure
 Closure Comment, Closure Date,
Closed By, Project Mgr

Document risks in a Risk Register
 Risk Identifier & associations

 Project, Risk No., Assumption Title &
No., Associated Risk Nos., Refs.
risk identifier  Project Sensitivity (initial registration &
& associations subsequent re-evaluation)
 Explanation of the project’s sensitivity
project incl. the expected impact date, A-D
sensitivity score, Comment, Date, Risk Owner,
Risk Mgr, Project Mgr.
 Assumption Instability
assumption
 Similar to ‘Project Sensitivity’
instability
 Closure
closure  Closure Comment, Closure Date,
Closed By, Project Mgr

Risk Management is a bit like playing ‘space invaders’
(Hugh Lake)
 Threats of different
size approach closer
and closer
 Aim is to defend your

patch… but with
limited ammo
 Which one to attack

next?

Risk Handling Techniques – four main categories
Risk Handling
Techniques
risk avoidance risk mitigation risk transfer risk retention
modify objectives or reduce likelihood contract contingency funds

performance targets reduce impact insurance contingency plans
modify approach partnerships/ fix-on-fail
joint ventures crisis management
proactive reactive
Risk Plans Risk Plans

Risk mitigation is based on two basic strategies
assumption • Basic strategies

instability • stabilise the assumption
• de-sensitise the project
D
action required
to de-sensitise
C
• Recommend developing at least
two candidate risk plans
B
action required • Risk plan might combine
to stabilise
A
assumption stabilisation and
project de-sensitisation
A B C D
project sensitivity

Risk Mitigation and Contingency Planning
 List Mitigation Actions

» Start with severe risks
» List possible actions to reduce probability
and/ or cost
» Some risks can be avoided
 Contingency Planning
» Only for the most severe risks that can not be
mitigated
» List actions to take should the risk materialize

Exercise: Risk Management applied to House Burglary
 Background
 You’ve just moved to a new town and you’ve a 1001 things to sort out
 You learn that a number of burglaries have taken place in your new
neighbourhood.
 Do you lock your self in, and refuse leave your
house? – No. You’ve got a life to lead!
 What is your working assumption?

Exercise: Risk Management applied to House Burglary
 Background
 You’ve just moved to a new town and you’ve a 1001 things to sort out
 You learn that a number of burglaries have taken place in your new
neighbourhood.
 Do you lock your self in, and refuse leave your
house? – No. You’ve got a life to lead!
 The principal working assumption is an implicit
assertion ‘We will not get burgled today’.
 The assumption wasn’t ‘I might get burgled’
That isn’t an assumption, it’s an infallible truism.
 But your working assumption might be wrong!
 Failure of that working assumption constitutes the
hazard. You’ve identified a risk.
 How are you going to manage it?

Here’s a heap of ‘risk plans’…
assign each to a category of risk handling technique
Risk avoidance
…
…
Risk mitigation
(stabilise the assumption)
 keep stock of glass, timber to repair windows …
 store valuable items in a safe, or at bank …
 adopt non-materialistic philosophy
 arrange house contents insurance Risk mitigation
 install extra high-security locks (de-sensitise impact)
 take any burglary ‘on the chin’ …
 move away to safer district …
 install a burglar alarm
 buy a big, noisy dog Risk transfer
 buy a quiet crocodile …
…
…what else? Risk retention
…
…
Categorised Risk Plans
 Risk avoidance
 move away to safer district
 adopt non-materialistic philosophy
 Risk mitigation (stabilise the assumption)

 install extra high-security locks
 install a burglar alarm
 buy a big, noisy dog
 Risk mitigation (de-sensitise impact)

 store valuable items in a safe, or at bank
 buy a quiet crocodile
 Risk transfer
 arrange house contents insurance
 Risk retention
 keep stock of glass, timber to repair
windows
 take any burglary ‘on the chin’

Risk Management places extra responsibilities
on the Steering Committee and Project Mgr
Steering Committee/senior management
•Reports critical risks

•Reports results •Risk budget
•Accounts for risk budget
Ensure risks identified/captured •Approve plans & allocate resource

•Assumption & risk registers •Monitor progress
•Agree monitoring Project Manager
•Approve closure

RM places responsibilities on the Steering Committee and
Project Mgr and introduces two new roles: Risk Managers and
Risk Owners
Steering Committee/senior management •Identify & appoint external

Risk Owners & Risk Mgrs
•Reports critical risks
•Reports results •Risk budget
•Accounts for risk budget
•Ensure risks identified/captured •Approve plans & allocate resources

•Assumption & risk registers •Monitor progress
•Agree monitoring Project Manager
•Approve closure
•Appoint Risk Owners •Appoint & empower Risk Mgrs
report report
delegation
&
empowerment
•Confirm/review risks •Draw up plans
•Agree the aim Risk Owner Risk Manager •Run the plan
•Monitor plans •Close plan
•Stop plans agree
What happens after you have prioritised
the risks and selected the risk plans?
Prioritising Kicking-off
Risks Risk Plans
Monitoring Developing Running

Assumptions & Selecting the
& Risks Risk Plans Risk Plan
Closing
Risk Plans

Summary
 Risk as a product of hazard likelihood and hazard impact
 Risk Management relative to Project Management
 Proactive, Assumptions-based approach

 Assumption-failure as the source of project risk
 Integrated assumption & risk registers
 Complexity of deciding what risks to attack
 Risk handling: avoidance, mitigation, transfer, retention
 Devolved Risk Management organisation - responsibility and
ownership devolved throughout, and outside, the project team
 Questions

Projects have many stakeholders…
…with interlinked objectives
 Many stakeholders
Executives  interdependent
Customers
 network of objectives
 failure doesn’t stay put
 Know your stakeholders

Vendors Users  identify them
project  understand their objectives
 what is success/failure
for them?
Community Finance
Employees

What happens after you have
prioritised the risks and selected the risk plans
Risks Risk Plans

Project Manager has to ensure
& Risks that:
Risk Plans Risk Plan
•Budget is agreed with the Risk Manager
•Success and closure criteria are agreed in advance with the
Risk Owner and Risk Manager
•Roles & Responsibilities are agreed and published for all
Closing
personnel involved in the risk plan
Risk Plans
•Commitment of external owners, points of contact and
champions, is agreed in advance.
Risks Risk Plans
Nominated Risk Manager:

•Manages execution of the risk plan
& Risks Risk Plans Risk Plan
•Agrees with the Risk Owner progress
against the plan
•Reports progress using the monitoring

system agreed with the Project Manager Closing
Risk Plans

Risks Risk Plans
•A risk plan must be stopped & closed when:
- it has achieved its objectives
- it is seen to be failing, or it has failed
- Monitoring
it is no longer necessary Developing Running
•Closing & Risks
is relatively easy if, when
Risk
launched,
Plans the plan Risk Plan
has clear objectives and clear success criteria
Closing
Risk Plans

Risks Risk Plans
The lists of assumptions and risks need to

Monitoring Developing
be reviewed Running
regularly. Are any changes
Assumptions & Selecting
occurring the
& Risks Risk Plans
• internally, or Risk Plan
• externally to the project
which could alter
• project’s sensitivity to the assumption
• stability of the assumption
Closing
• expected hazard impact Risk date
Plans

A Trivial Example
Albert Pinto

Pinto’s Risk Analysis

Pr = 0.5 Pr= 0.5
Severe Heart
Attack within Death Loss = 1,500,000
5 years
1. Stressful job 1. 50 miles from ambulance

2. 50 years old male 2. 100 miles from nearest hospital
3. No regular exercise 3. Spouse does not drive
4. Excessively overweight 4. Makes 100,000 a year until age 65 yrs
5. High Blood Pressure

Risk Management Process
Steps : Critical Information

Step 1
Risk events and impacts
Identifying Risks
Step 2 Drivers, probabilities and total

loss
Analyzing Risks
Step 3
Subset of risks to be managed
Prioritize & Map Risks
Types of action plans : avoidance,
Step 4 transfer, redundancy and mitigation
Resolve Risks (prevention, contingency, reserves)
Step 5
Assess status and closure of
Monitor Risks targeted risks; identify new risks
Calculating Expected Loss/Exposure
Probability Probability Total Loss Expected

of risk X of impact X = Loss
(Lt)
event (Pe) (P i )
(Le)
Total
amount of Answers
Risk Likelihood
loss if risk questions,
occurs “How risky
is it?
Pinto’s Risk Analysis
Pe = 0.5 Pi = 0.5
Severe heart
Attack within Death Lt = $1,500,000
5 years
1. Stressful job
2. 50 year old male 1. 50 miles from ambulance
3. No regular exercise 2. 100 miles from nearest hospital
4. Excessively overweight 3. Spouse does not drive
5. High blood pressure
Pinto’s Risk Management Priorities
Risk Status Probability Probability LIkelihood Total Loss Expected

Identifier of risk of impact loss
1. Heart Active 0.5 0.7 0.35 Rs.55 Rs.19.25

Attack lakhs lakhs
2. Inactive 0.1 0.5 0.05 Rs.55 Rs.2.75

Melanoma lakhs lakhs
3. Inactive 0.1 0.1 0.01 Rs.2 lakhs Rs.0.02

Osteoporos lakhs
is

Risk Planning Process
Risk resolution
Defer action for Develop action Take no action

more info plans Accept the risk
Transfer risk to Add redundancy Mitigate the

Avoid the risk
A third party (alternatives) Risk
Prevention of Contingency if Reserves of budget

The risk event Risk event occurs schedule

Elements of the Risk Model Suggest Certain Action Plans
Probability Probability
Of Risk
Of Impact (Pi)
Event(Pe)
Transfer
(can also
work on
impact) and Risk Event Impact Total Loss (Lt)
redundancy
work on the
risk event)
Risk event
Impact drivers
Driver(s)

Pinto’s Prevention Plans
Risk event driver(s) Prevention Plans Implementation)?)
1. Stressful job 1. Take stress management courses Yes
2. Request to be re-assigned to a different job function Yes

2. 54 year old male 1. None N/A
3. No regular exercises 1. Schedule appointment with doctor for health evaluation Yes
and to develop a safe exercise program.
An exercise program will be initiated Yes
4. Excessively overweight 1. Schedule appointment with doctor for health evaluation Yes
and to develop a safe diet program.
2. A Doctor supervised diet will be started Yes
5. High blood pressure Covered by stress relief plan above -

Pinto’s Contingency Plans
Impact driver(s) Contingency Plans Implementation?
1. 8 K.M.from the ambulance 1. Work with village trustees to acquire an ambulance Yes
service
2. Place house for sale and move closer to the larger city No
2. 12 Km to the nearest hospital 1. Work with village trsutees to acquire an immediate care Yes
facility
2. Place house for sale and move closer to the larger city
3. Spouse does not drive 1. Schedule driving lessons for spouse. No
4. Will make Rs.5 lakhs per year until 5. Take out the insurance policy equal to the value of the Yes
retirement at age 65 expected loss.

Expected Loss based on Outcomes

More Ways to Monitor Risks

Risk Table
(Primary Measure)
3 2
2 3 1 4
1 2 4
1 2 3 4 3
LIKELIHOOD OF OCCURRENCE
Some People Look at Things As they are and Ask – “Why?”
Others Look at Things As They Could Be and

Ask – “Why Not?”

Point International LTD © 2002

Hochgeladen von

Dokumentinformationen

Originaltitel

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

Point International LTD © 2002

Hochgeladen von

Copyright:

Verfügbare Formate

X Point International Ltd © 2002

A Working Definition of Risk

Any Issue which Impact Organizations Ability to

X Point International Ltd © 2002

Risk can be defined as the likelihood of occurrence

A future event (or series of events) with a probability

b) Impact on objectives that can be either positive or

 Not to eliminate risks

 But to identify them and minimize their effects

» Development and implementation of

X Point International Ltd © 2002

New software Advanced

Low-Tech Construction Auto repair

Assembly System Array

Uncertainty Harness risk to your

Event driven risk

X Point International Ltd © 2002

Hazard What is my contingency •Business Continuity Plan

Uncertainty How can I meet my • Project Risk Management

Opportunity Is there any way I can gain •Operational Risk

X Point International Ltd © 2002

• Uncertainty is defined as “unpredictability of

X Point International Ltd © 2002

Overall Business Strategy

X Point International Ltd © 2002

X Point International Ltd © 2002

Strategic Risk Goals and Objectives

Financial Risk Loss of assets

Operational Risk Ongoing management process

Compliance Risk Laws and Regulations

Reputation Risk Tarnishing of Image

Information Risk Loss of competitive advantage

New Risks ???

X Point International Ltd © 2002

X Point International Ltd © 2002

X Point International Ltd © 2002

X Point International Ltd © 2002

Industry Uncertainties Firm Uncertainties

War, revolution Labor

Govt. Policy Market Supply Production

(In)Nationalization Consumer taste R&D

Macroeconomic Results of R&d

Interest Rates Complementary Goods Collections

Natural New entrants Cost of Implementation

Earthquakes, etc. Quality

Insurance Delay New market entry

Low uncertainty niches

Gain market power

Vertical integration – Mergers & Acq.

Long term contracts suppliers buyers

X Point International Ltd © 2002

Business Financial Operations

Market Share Cost Profit Time2market

Micro Legal & Other

X Point International Ltd © 2002

Cost of Risk Management

Tsunami - Andaman Terrorist Attack on WTC

Hazard Controller CFO/CCO CEO/Board

In Pursuit of the Upside

X Point International Ltd © 2002

ENTERPRISE RISK PLATFORM

Cpty/Creidt Market Risk

Businesses are run based on the