1

BEC 3324: PROJECT MANAGEMENT YEAR III SEMESTER II SESSION 7

FMSC - USJ

By: H K Amarasinghe

Project Risk Management

Lecture Outline

Plan Risk Management The process of defining how to conduct risk management activities for a project. Identify Risks The process of determining which risks may affect the project and documenting their characteristics. Perform Qualitative Risk Analysis The process of prioritizing risks for further analysis or action by assessing and combining their probability of occurrence and impact. Perform Quantitative Risk Analysis The process of numerically analyzing the effect of identified risks on overall project objectives.

Plan Risk Responses The process of developing options and actions to enhance opportunities and to reduce threats to project objectives.
Monitor and Control Risks The process of implementing risk response plans, tracking identified risks, monitoring residual risks,

Introduction
3

Project risk is always in the future. Risk is an uncertain event or condition that, if it occurs, has an effect on at least one project objective. Objectives can include scope, schedule, cost, and quality. A risk may have one or more causes and, if it occurs, it may have one or more impacts. A cause may be a requirement, assumption, constraint, or condition that creates the possibility of negative or positive outcomes. For example, causes could include the requirement of an environmental permit to do work, or having limited personnel assigned to

Risks
4

Project risk has its origins in the uncertainty present in all projects. Known risks are those that have been identified and analyzed, making it possible to plan responses for those risks. Specific unknown risks cannot be managed proactively, which suggests that the project team should create a contingency plan. A project risk that has occurred can also be considered an issue.

Organizations and Risk

Organizations perceive risk as the effect of uncertainty on their project and organizational objectives. Organizations and stakeholders are willing to accept varying degrees of risk. This is called risk tolerance. Risks that are threats to the project may be accepted if the risks are within tolerances and are in balance with the rewards that may be gained by taking the risks.

Tolerance and Avoidance

Individuals and groups adopt attitudes toward risk that influence the way they respond. These risk attitudes are driven by perception, tolerances, and other biases, which should be made explicit wherever possible. A consistent approach to risk should be developed for each project, and communication about risk and its handling should be open and honest. Risk responses reflect an organizations perceived balance between risk taking and risk avoidance.

Plan Risk Management Activities

Plan Risk Management is the process of defining how to conduct risk management activities for a project. Careful and explicit planning enhances the probability of success for the five other risk management processes. Planning risk management processes is important to ensure that the degree, type, and visibility of risk management are commensurate with both the risks and the importance of the project to the organization. Planning is also important to provide sufficient resources and time for risk management activities, and to establish an agreed-upon basis for evaluating risks.

Planning Risk Activities Inputs/ Output

Risk Management Plan

The risk management plan describes how risk management will be structured and performed on the project. It becomes a subset of the project management plan. The risk management plan includes the following:
Methodology-

Defines the approaches, tools, and data sources that may be used to perform risk management on the project. Roles and responsibilities -Defines the lead, support, and risk management team members for each type of activity in the risk management plan, and clarifies their responsibilities.

Cont
10

Budgeting - Assigns resources, estimates funds needed for risk management for inclusion in the cost performance baseline, and establishes protocols for application of contingency reserve Timing - Defines when and how often the risk management process will be performed throughout the project life cycle, establishes protocols for application of schedule contingency reserves, and establishes risk management activities to be included in the project schedule Risk categories - Provides a structure that ensures a comprehensive process of systematically identifying risks to a consistent level of detail and contributes to the effectiveness and quality of the Identify Risks process. An organization can use a previously prepared categorization framework which might take the form of a simple list of categories or might be structured into a Risk Breakdown Structure (RBS).

The RBS is a hierarchically organized depiction of the identified project risks arranged by risk category and subcategory that identifies the various areas and causes of potential risks.

Cont
11

Definitions

of risk probability and impact - The quality and credibility of the Perform Qualitative Risk Analysis process requires that different levels of the risks probabilities and impacts be defined. General definitions of probability levels and impact levels are tailored to the individual project during the Plan Risk Management process for use in the Perform Qualitative Risk Analysis process (Similar tables could be established with a positive impact perspective).

Cont
12

Probability

and impact matrix - Risks are prioritized according to their potential implications for having an effect on the projects objectives. A typical approach to prioritizing risks is to use a look-up table or a Probability and Impact Matrix. The specific combinations of probability and impact that lead to a risk being rated as high, moderate, or low importance, with the corresponding importance for planning responses to the risk, are usually set by the organization. Revised stakeholders tolerances - Stakeholders tolerances, as they apply to the specific project, may be revised in the Plan Risk Management process.

Cont
13

Reporting

formats - Defines how the outcomes of the risk management processes will be documented, analyzed, and communicated. It describes the content and format of the risk register as well as any other risk reports required. Tracking - Documents how risk activities will be recorded for the benefit of the current project, as well as for future needs and lessons learned, as well as whether and how risk management processes will be audited.

Identify Risk
14

Identify Risks is the process of determining which risks may affect the project and documenting their characteristics. Participants in risk identification activities can include the following:

project manager, project team members, risk management team (if assigned), customers, subject matter experts from outside the project team, end users, other project managers, stakeholders, and risk management experts.

While these personnel are often key participants for risk identification, all project personnel should be encouraged to identify risks. Identify Risks is an iterative process because new risks may evolve or become known as the project

Identify Risk Inputs/ Outputs

Tools and Techniques

Information Gathering Diagramming Methods

Risk Register
17

The primary outputs from Identify Risks are the initial entries into the risk register. The risk register ultimately contains the outcomes of the other risk management processes as they are conducted, resulting in an increase in the level and type of information contained in the risk register over time. The preparation of the risk register begins in the Identify Risks process with the following information, and then becomes available to other project management and Project Risk Management processes.

List of identified risks

18

Perform Qualitative Risk Analysis

Perform Qualitative Risk Analysis is the process of prioritizing risks for further analysis or action by assessing and combining their probability of occurrence and impact . Organizations can improve the projects performance by focusing on high-priority risks. Perform Qualitative Risk Analysis assesses the priority of identified risks using their relative probability or likelihood of occurrence, the corresponding impact on project objectives if the risks occur, as well as other factors such as the time frame for response and the organizations risk tolerance associated with the project constraints of cost, schedule, scope, and quality. Such assessments reflect the attitude of the project team and other stakeholders to risk. Effective assessment therefore requires explicit identification and management of the risk attitudes of key participants in the Perform Qualitative Risk Analysis process.

Cont
19

Where these risk attitudes introduce bias into the assessment of identified risks, attention should be paid to evaluating bias and correcting for it. Establishing definitions of the levels of probability and impact can reduce the influence of bias. The time criticality of riskrelated actions may magnify the importance of a risk. An evaluation of the quality of the available information on project risks also helps clarify the assessment of the risks importance to the

Qualitative Risk Analysis Input/ Output

Tools and Techniques

Risk Probability and Impact Assessment Risk probability assessment investigates the likelihood that each specific risk will occur. Risk impact assessment investigates the potential effect on a project objective such as schedule, cost, quality, or performance, including both negative effects for threats and positive effects for opportunities.

Probability and Impact Matrix Risks can be prioritized for further quantitative analysis and response based on their risk rating. Usually, these risk-rating rules are specified by the organization in advance of the project and

Cont
22

Risk Data Quality Assessment

A qualitative risk analysis requires accurate and unbiased data if it is to be credible. Analysis of the quality of risk data is a technique to evaluate the degree to which the data about risks are useful for risk management. It involves examining the degree to which the risk is understood and the accuracy, quality, reliability, and integrity of the data regarding the risk.

Risk Categorization

Risks to the project can be categorized by sources of risk (e.g., using the RBS), the area of the project affected (e.g., using the WBS), or other useful category (e.g., project phase) to determine areas of the project most exposed to the effects of uncertainty. Grouping risks by common root causes can lead to developing effective risk responses.

Cont
23

Risk Urgency Assessment Risks requiring near-term responses may be considered more urgent to address. Indicators of priority can include time to affect a risk response, symptoms and warning signs, and the risk rating. In some qualitative analyses the assessment of risk urgency can be combined with the risk ranking determined from the probability and impact matrix to give a final risk severity rating. Expert Judgment Expert judgment is required to assess the probability and impact of each risk to determine its location in the matrix. Experts generally are those having experience with similar projects that occurred in the not-too-distant past. In addition, those who are planning and managing the specific project are experts, particularly about the specifics of that project. Securing expert judgment is often accomplished with the use of risk facilitation workshops or interviews. The experts bias

24

Outputs Risk Register Updates

Relative ranking or priority list of project risk Risks grouped by categories. Causes of risk or project areas requiring particular attention. List of risks requiring response in the nearterm. List of risks for additional analysis and response. Watch-lists of low-priority risks. Trends in qualitative risk analysis results.

25

Perform Quantitative Risk Analysis

Perform Quantitative Risk Analysis is the process of numerically analyzing the effect of identified risks on overall project objectives. It is performed on risks that have been prioritized by the Perform Qualitative Risk Analysis process as potentially and substantially impacting the projects competing demands. The Perform Quantitative Risk Analysis process analyzes the effect of those risk events. It may be used to assign a numerical rating to those risks individually or to evaluate the aggregate effect of all risks affecting the project. It also presents a quantitative approach to making decisions in the presence of uncertainty.

Quantitative Risk Analysis Inputs/ Outputs

Data Gathering and Representation Techniques

Interviewing Probability Distributions Sensitivity Analysis Expected Value Analysis (Decision Tree Analysis)

Decision Tree Analysis - E.g.

Related Risk Register Updates

Probabilistic Analysis of the Project Probability of achieving cost and time objectives. Prioritized list of quantified risks. Trends in quantitative risk analysis results.

Plan Risk Responses

Plan Risk Responses is the process of developing options and actions to enhance opportunities and to reduce threats to project objectives. It follows the Perform Qualitative Risk Analysis process and the Perform Quantitative Risk Analysis process (if used). It includes the identification and assignment of one person (the risk response owner) to take responsibility for each agreed-to and funded risk response. Plan Risk Responses addresses the risks by their priority, inserting resources and activities into the budget, schedule and project management plan as needed. Planned risk responses must be appropriate to the significance of the risk, cost effective in meeting the challenge, realistic within the project context, agreed upon by all parties involved, and owned by a responsible person. They must also be timely. Selecting the best risk response from several options is often required.

Plan Risk Response Inputs/ Outputs

Tools and Techniques

Strategies for Negative Risks or Threats Avoid Transfer Mitigate Accept Strategies for Positive Risks or Opportunities Exploit Share Enhance Accept

Monitor and Control Risks

Monitor and Control Risks is the process of implementing risk response plans, tracking identified risks, monitoring residual risks, identifying new risks, and evaluating risk process effectiveness throughout the project. Planned risk responses that are included in the project management plan are executed during the life cycle of the project, but the project work should be continuously monitored for new, changing, and outdated risks. The Monitor and Control Risks process applies techniques, such as variance and trend analysis, which require the use of performance information generated during project execution. Other purposes of the Monitor and Control Risks process are to determine if:

Project assumptions are still valid, Analysis shows an assessed risk has changed or can be retired, Risk management policies and procedures are being followed, and Contingency reserves of cost or schedule should be modified in alignment with the current risk assessment.

Monitor and Control Risks Inputs/ Outputs

35

End of Session 07

Thank You