PMP® Certification Training

Lesson 11—Project Risk Management

This course is based on PMBOK® Guide – Fifth Edition Copyright 2014, Simplilearn, All rights reserved.
PMP, PMI, PMBOK is a registered mark of PROJECT MANAGEMENT INSTITUTE®

1 Copyright 2014, Simplilearn, All rights reserved.

Objectives

After completing ● Define risk

this lesson, you will
● Identify key terms related to risk
be able to:
● Calculate risk
● Identify different categories of risk
● Describe Project Risk Management processes

2 Copyright 2014, Simplilearn, All rights reserved.

Risk

The definition of Risk is as follows:

Risk is an uncertain event or condition that, if it occurs, has a positive or negative effect on a
project’s objectives.[1]

You are currently using a software for managing the team’s time sheet. Due to a budget constraint, you are
expected to use a new software. You are apprehensive on using the new software, but on using it, you
realize that the new software is more efficient and has better reporting structure. This is a case of risk
having a positive outcome.

If the Government declares a mandatory holiday to check flu spread, the project timelines may get
hampered and this is an example of risk affecting the project negatively.

3 Copyright 2014, Simplilearn, All rights reserved.

Key Terms

Positive risks are known as opportunities and negative risks are known as threats. A risk that can have
a positive or negative risk is called business risk. A risk that can only have a negative consequence is
called pure risk. Given below are other risk related terms:
Risk averse
One who does not take risks.

Risk tolerance
The level of risk that can be tolerated.

Risk threshold
Amount of risk that is acceptable.

Understanding the key terms of project risk management may be useful while answering the exam.
Exam Tips

4 Copyright 2014, Simplilearn, All rights reserved.

Calculation of Risk

Risks can be managed only if they are measured quantitatively.

● Risk is measured by assigning a monetary value to it.

● Risk is calculated by multiplying probability and impact of risk.

Risk Weight = Risk Probability * Risk Impact

Where, risk probability is the likelihood that a risk event could happen
and risk impact is the effect on the project objectives if a risk event
happens.

5 Copyright 2014, Simplilearn, All rights reserved.

Calculation of Risk—Example

Q Calculate the expected monetary value for the given work packages.

Work Package Probability Impact

X 25% -$10,000
Y 40% -$2,000
Z 10% +$20,000

A Work Package Probability Impact Expected Monetary Value (EMV)

X 25% -$10,000 -$2,500
Y 40% -$2,000 -$800
Z 10% +$20,000 +$2,000
TOTAL EMV -$1,300

6 Copyright 2014, Simplilearn, All rights reserved.

Risk Categorization

Risks can be classified in various ways. One classification of risk is as follows:

Arise out of external factors. E.g., regulatory, governmental policies, subcontractors,
External Risks
suppliers, and environmental.

Internal Risks Arise within the project. E.g., funding, resources, and prioritization.

Technical Risks Arise out of the technology being used. E.g., requirements, technology, and quality.

Project Arise out of project management activities. E.g., estimating, planning, schedule, and
Management Risks communication.

Risks can also be classified on the basis of their origin; scope risks, resource risks, schedule risks, cost
risks, and quality risks.
7 Copyright 2014, Simplilearn, All rights reserved.
Decision Tree

A decision tree is used to analyze risk and its impact on decisions, in the face of uncertainties.
Failure : Probability=10%
Impact= $15,000
Initial cost of buying the new car
= $20,000 Pass : Probability=90%
Impact= $000
Decision: Which car would you
buy? A new one or a used one.
Failure : Probability=70%
Initial cost of buying the old car= Impact= $10,000
$15,000
Pass : Probability=30%
Impact= $000
Q If you need to buy a car, which one would you buy? Which option has a risk over a period of 5 years?

A
Risk = Probability * Impact
Risk associated with the new car is $20,000 + ($15,000 * 10%) + ($000*90%) = $21,500
Risk associated with the old car is $15,000 + ($10,000*70%) + ($000*30%) = $22,000
8 Copyright 2014, Simplilearn, All rights reserved.
Risk Reserve

Project cost should include both the known and unknown risks. The various risk reserves are
calculated in the order given below:
Management
Reserve
Cost
Baseline
Contingency
Reserve
Project
Control
Work Account
Packages
Activities

Small, Work packages Set of Reserve for Project cost Reserve for
Lowest level
assigned clubbed to control known for unknown
of WBS
project tasks manage cost accounts uncertainties budgeting uncertainties
9 Copyright 2014, Simplilearn, All rights reserved.
Project Risk Management

The definition of Project Risk Management is as follows:

Project Risk Management includes the processes of conducting risk management planning,
identification, analysis, response planning, and controlling risk on a project.[2]

The key objective of risk management is to increase the probability and or impact of positive events
and decrease the probability and or impact of negative events.

10 Copyright 2014, Simplilearn, All rights reserved.

Business Scenario—Problem Statement

Q Cynthia is a subject matter expert and the Director of New Store Construction in Small Markets.
Because of her expertise and experience in managing complex store build out for the corporation, she
has been appointed as the manager of a new, large, and complex construction project involving a gas
station. None of the previous construction projects included a gas station and convenience store
component. Since this is a new initiative and way for the company to diversify their business, this
project is business critical, very visible to senior management and can be a career maker or breaker.
The senior management team is anxious to see the project brought to life, but the company lacks a
strong risk management process. They would like Cynthia to prepare a risk response plan and submit it
prior to the project’s first milestone in 3 weeks. What should Cynthia do?

11 Copyright 2014, Simplilearn, All rights reserved.

Business Scenario—Solution

A Because the company lacks a risk management structure and has handled risk poorly in the past,
Cynthia should first search internally for risk experts. Internal experts would be knowledgeable of risks
that exist within the business as it deals with construction. Then she should identify subject matter
experts external to the organization knowledgeable of risk management as it relates to convenience
stores with a gas station component. Another viable resource would be the historical documents
around risk from previously completed projects, which will also point out other stakeholders and/or
SMEs who can contribute to the risk response planning process. After having the key players in place,
Cynthia can work with them to go through the identification and prioritization process of risk that
leads up to the development of their plan.

12 Copyright 2014, Simplilearn, All rights reserved.

Project Risk Management Processes

Given below are the Project Risk Management processes:

13 Copyright 2014, Simplilearn, All rights reserved.

Plan Risk Management

Plan Risk Management is the process of defining how to conduct risk management activities for a project. The
key benefit of this process is it ensures that the degree, type, and visibility of risk management are commensurate
with both the risks and the importance of the project to the organization. [3] It is part of the Planning Process Group.

PROJECT RISK MANAGEMENT

Project management plan

Project charter

Stakeholder register Plan Risk Management

Enterprise environmental factors

Organizational process assets

Risk management plan

Legend
Input
Output Analytical techniques Expert judgment Meetings
Tools & Techniques
Planning Process

14 Copyright 2014, Simplilearn, All rights reserved.

Definition of Impact Scale—Example

The table given below shows the impact on scope, cost, time, and quality.

Project Very Low Low Moderate High Very High

Objective 0.05 0.1 0.2 0.4 0.8
Scope Barely noticeable Minor areas Some important Unacceptable Entire scope
change affected areas affected change in scope rendered useless
Cost Insignificant cost <10% cost 10-20% cost 20-40% cost >40% cost increase
increase increase increase increase
Time Insignificant change <5% change to 5-10% change to 10-20% schedule >20% schedule
schedule schedule change change
Quality Barely noticeable Few parameters Needs sponsor Major quality Need to scrap the
degradation affected approval compromise project

15 Copyright 2014, Simplilearn, All rights reserved.

Identify Risks

Identify Risks is the process of determining which risks may affect the project and documenting their characteristics. [4]
It belongs to the Planning Process Group.

Project management PROJECT RISK MANAGEMENT

Project documents
plan
Risk management plan
Activity cost estimates Scope baseline

Activity duration Cost management plan

estimates

Quality management Identify Risks Risk register

Stakeholder register plan

Schedule management Procurement

plan documents

Human resource Organizational process Risk register

management plan assets
Legend Enterprise
Input environmental factors Documentation Diagramming
Assumptions analysis Expert judgment
Output reviews techniques
Tools & Techniques Information gathering
Checklist analysis SWOT analysis
Planning Process techniques

16 Copyright 2014, Simplilearn, All rights reserved.

Perform Qualitative Risk Analysis

Perform Qualitative Risk Analysis is the process of prioritizing risks for further analysis or action by assessing their
probability of occurrence and impact. [5] This process belongs to the Planning Process Group.
PROJECT RISK MANAGEMENT

Scope baseline Risk register Risk management plan

Enterprise environmental Perform Qualitative Risk Project documents

factors Analysis updates

Organizational process
assets

Legend
Input Risk probability and Risk data quality Probability and impact
Output impact assessment assessment matrix
Tools & Techniques Risk urgency
Risk categorization Expert judgment
Planning Process assessment

Concept based questions on qualitative risk analysis can be expected in the exam.
Exam Tips
17 Copyright 2014, Simplilearn, All rights reserved.
Probability and Impact Matrix—Example

A probability and impact matrix tabulates the probability and impact scales for the opportunities and
threats on the project.
Probability Threats Opportunities
0.9 0.05 0.09 0.18 0.36 0.72 0.72 0.36 0.18 0.09 0.05
High 0.7 0.04 0.07 0.14 0.28 0.56 0.56 0.28 0.14 0.07 0.04
0.5 0.03 0.05 0.10 0.20 0.40 0.40 0.20 0.10 0.05 0.03
Medium
0.3 0.02 0.03 0.06 0.12 0.24 0.24 0.12 0.06 0.03 0.02
Low 0.1 0.01 0.01 0.02 0.04 0.08 0.08 0.04 0.02 0.01 0.01
Impact 0.05 0.10 0.20 0.40 0.80 0.80 0.40 0.20 0.10 0.05

Low Medium High

Once the probability and impact matrix is filled, a risk threshold can be defined and a risk becomes a
! candidate for active management.
18 Copyright 2014, Simplilearn, All rights reserved.
Perform Quantitative Risk Analysis

Perform Quantitative Risk Analysis is the process of numerically analyzing the effect of identified risks on overall
project objectives.[6] This is part of the Planning Process Group.

PROJECT RISK MANAGEMENT

Cost management plan Risk register Risk management plan

Schedule management
plan
Perform Quantitative Risk
Project document updates
Enterprise environmental Analysis
factors

Organization process
assets

Legend
Input Data gathering and Quantitative risk analysis and
Expert judgment
Output representation techniques modeling techniques
Tools & Techniques
Planning Process

19 Copyright 2014, Simplilearn, All rights reserved.

Plan Risk Responses

Plan Risk Responses is the process of developing options and actions to enhance opportunities and to reduce threats
to project objectives.[7] It is part of the Planning Process Group.

PROJECT RISK MANAGEMENT

Risk register Risk management plan Project management plan

update

Plan Risk Responses

Project documents
updates

Legend
Input Strategies for negative risks (or threats): Avoid, transfer, mitigate, accept Contingent response strategies
Output
Tools & Techniques
Planning Process Strategies for positive risks (or opportunities): Exploit, share, enhance, accept Expert judgment

Residual risks are those that remain after the risk responses were implemented. Secondary risks arise out
! of implementing risk responses.
20 Copyright 2014, Simplilearn, All rights reserved.
Control Risks

Control Risks is the process of implementing risk response plans, tracking identified risks, monitoring residual risks,
identifying new risks, and evaluating risk process effectiveness throughout the project. [8] It is part of the Monitoring
and Controlling Process Group.

PROJECT RISK MANAGEMENT

Project management plan
Risk register updates

Work performance Project documents

Work performance data
reports updates

Project management plan Control Risks Work performance

information

Organizational process
assets updates

Change request

Legend
Input Risk audits Risk re-assessment Meetings
Output
Tools & Techniques Variance and trend Technical performance
Monitoring & Controlling
Reserve analysis
analysis measurement
21 Copyright 2014, Simplilearn, All rights reserved.
 Quiz

22 Copyright 2014, Simplilearn, All rights reserved.

 QUIZ Purchasing insurance coverage for your project equipment is an example of which risk
1 response?

a. Transfer
b. Mitigation
c. Acceptance
d. Avoidance

23 Copyright 2014, Simplilearn, All rights reserved.

 QUIZ Purchasing insurance coverage for your project equipment is an example of which risk
1 response?

a. Transfer
b. Mitigation
c. Acceptance
d. Avoidance

Answer: a.
Explanation: It is an example of transfer as the financial risk is transferred to the insurance
company.

24 Copyright 2014, Simplilearn, All rights reserved.

 QUIZ
What action should a project manager first take when an unidentified risk event occurs?
2

a. Inform the customer of the possible consequences

b. Inform the senior management of the possible consequences
c. Redo the risk identification process to get prepared for other ‘known-
unknowns’
d. Create a work around

25 Copyright 2014, Simplilearn, All rights reserved.

 QUIZ
What action should a project manager first take when an unidentified risk event occurs?
2

a. Inform the customer of the possible consequences

b. Inform the senior management of the possible consequences
c. Redo the risk identification process to get prepared for other ‘known-
unknowns’
d. Create a work around

Answer: d.
Explanation: The right project management practice dictates that a work around should be
created as a response to the event.

26 Copyright 2014, Simplilearn, All rights reserved.

 You are a project manager with a financial firm that has multinational dealings. You feel the financial
QUIZ meltdown in one of the client countries could affect your project adversely, so you want to hedge your
3 risks. Although the probability of occurrence of the event is low, you are advised to play it safe. In
terms of risk attitude, your organization could best be described as?

a. Risk Seeker
b. Risk Averse
c. Risk Neutral
d. Risk Mitigator

27 Copyright 2014, Simplilearn, All rights reserved.

 You are a project manager with a financial firm that has multinational dealings. You feel the financial
QUIZ meltdown in one of the client countries could affect your project adversely, so you want to hedge your
3 risks. Although the probability of occurrence of the event is low, you are advised to play it safe. In
terms of risk attitude, your organization could best be described as?

a. Risk Seeker
b. Risk Averse
c. Risk Neutral
d. Risk Mitigator

Answer: b.
Explanation: Someone who doesn't want to take risk is called risk averse and the attitude of
the organization seems to be the same.

28 Copyright 2014, Simplilearn, All rights reserved.

 QUIZ
Decision tree analysis can be classified as a __________.
4

a. Quantitative risk analysis and modeling technique

b. Subset of the EMV technique
c. Subset of the Earned Value Management (EVM) technique
d. Risk response strategy

29 Copyright 2014, Simplilearn, All rights reserved.

 QUIZ
Decision tree analysis can be classified as a ________________.
4

a. Quantitative risk analysis and modeling technique

b. Subset of the EMV technique
c. Subset of the Earned Value Management (EVM) technique
d. Risk response strategy

Answer: a.
Explanation: Decision tree analysis is a quantitative risk analysis technique that involves a
diagram describing different decisions under consideration and the impact on the project of
choosing one over the another.
30 Copyright 2014, Simplilearn, All rights reserved.
 QUIZ
How early can a comprehensive risk analysis be done on a project?
5

a. During project initiation

b. After scope decomposition
c. During scope validation
d. After the project management plan has been baselined

31 Copyright 2014, Simplilearn, All rights reserved.

 QUIZ
How early can a comprehensive risk analysis be done on a project?
5

a. During project initiation

b. After scope decomposition
c. During scope validation
d. After the project management plan has been baselined

Answer: b.
Explanation: Only after the entire scope has been defined in the Work Breakdown Structure
(WBS), a comprehensive risk analysis can be done.

32 Copyright 2014, Simplilearn, All rights reserved.

 A project manager is managing a short duration pilot project and has started the risk
QUIZ management planning process. He has identified new risks and prioritized them based
6 on the probability and impact matrix. The project manager now proceeds to plan
responses for the risks without analyzing the risks numerically. According to you, this
decision of project manager is:
a. Incorrect, as it is important to numerically analyze each risk so that they
can be responded properly
b. Correct, as quantitative risk analysis is waste of time and not required if
risks are already assessed qualitatively
c. Incorrect, as quantitative risk analysis is important. It is important to
calculate EMV for each risk and then later move to risk response planning
d. Correct, as this is a short duration project and project manager might skip
quantitative risk analysis if he feels it is not assisting in the risk management process

33 Copyright 2014, Simplilearn, All rights reserved.

 A project manager is managing a short duration pilot project and has started the risk
QUIZ management planning process. He has identified new risks and prioritized them based
6 on the probability and impact matrix. The project manager now proceeds to plan
responses for the risks without analyzing the risks numerically. According to you, this
decision of project manager is:
a. Incorrect, as it is important to numerically analyze each risk so that they
can be responded properly
b. Correct, as quantitative risk analysis is waste of time and not required if
risks are already assessed qualitatively
c. Incorrect, as quantitative risk analysis is important. It is important to
calculate EMV for each risk and then later move to risk response planning
d. Correct, as this is a short duration project and project manager might skip
quantitative risk analysis if he feels it is not assisting in the risk management process
Answer: d.
Explanation: The amount of rigor in the analysis is dependent upon the duration and
complexity of the project. For a short duration project, it may not be necessary to perform
numeric (quantitative) risk analysis.

34 Copyright 2014, Simplilearn, All rights reserved.

Summary

● Risk is an uncertain event or condition that has a positive or negative effect

Here is a quick
recap of what was on a project’s objectives.
covered in this ● Risk is calculated by multiplying probability and impact of risk (Risk
lesson: Weighting = Probability * Impact).
● Risk can be classified in various ways. Under one category, risks are classified
as external, internal, technical, and project management; and on the basis
of origin, risks can be classified as scope, resource, schedule, cost, and
quality risks.
● A decision tree is used to analyze risk and its impact on decisions, in the face
of uncertainties.
● The six Project Risk Management processes are Plan Risk Management,
Identify Risks, Perform Qualitative Risk Analysis, Perform Quantitative Risk
Analysis, Plan Risk Responses, and Control Risks.

35 Copyright 2014, Simplilearn, All rights reserved.

Additional Reading (Refer to the exercises provided along with handbook)

•Exercise 19
•Exercise 20

36 Copyright 2014, Simplilearn, All rights reserved.

 Thank You

This course is based on PMBOK® Guide – Fifth Edition Copyright 2014, Simplilearn, All rights reserved.
PMP, PMI, PMBOK is a registered mark of PROJECT MANAGEMENT INSTITUTE®

37 Copyright 2014, Simplilearn, All rights reserved.

References

[1] Definition taken from the Glossary of the Project Management Institute, A Guide to the Project Management Body
of Knowledge, (PMBOK® Guide) – Fifth Edition, Project Management Institute, Inc., 2013.
[2] Project Management Institute, A Guide to the Project Management Body of Knowledge, (PMBOK® Guide) – Fifth
Edition, Project Management Institute, Inc., 2013, Page 309.
[3] Project Management Institute, A Guide to the Project Management Body of Knowledge, (PMBOK® Guide) – Fifth
Edition, Project Management Institute, Inc., 2013, Page 313.
[4] Project Management Institute, A Guide to the Project Management Body of Knowledge, (PMBOK® Guide) – Fifth
Edition, Project Management Institute, Inc., 2013, Page 319.
[5] Project Management Institute, A Guide to the Project Management Body of Knowledge, (PMBOK® Guide) – Fifth
Edition, Project Management Institute, Inc., 2013, Page 328.
[6] Project Management Institute, A Guide to the Project Management Body of Knowledge, (PMBOK® Guide) – Fifth
Edition, Project Management Institute, Inc., 2013, Page 333.
[7] Project Management Institute, A Guide to the Project Management Body of Knowledge, (PMBOK® Guide) – Fifth
Edition, Project Management Institute, Inc., 2013, Page 342.
[8] Project Management Institute, A Guide to the Project Management Body of Knowledge, (PMBOK® Guide) – Fifth
Edition, Project Management Institute, Inc., 2013, Page 349.
38 Copyright 2014, Simplilearn, All rights reserved.