20/04/2024
ENGG461 Managing Engineering Projects
Learning Outcomes
Understand the concept of risk and risk management process as
applicable to projects
Identify risks associated with a given project
Apply selected qualitative and quantitative tools to assess and
prioritise risks
Develop responses to mitigate the risks identified as above,
including contingency planning
7–2
Uncertainty?
The state of being uncertain!
─ not known or not certain
─ chance events or unpredictable circumstances
7–3
1
20/04/2024
Uncertainty in projects?
Lack of knowledge or information
Variations
Chance events
7–4
Uncertainty in projects?
Lack of knowledge or information
Variations
Chance events
7–5
What is Risk?
Definitions of risk
─ uncertain or chance events that planning can not overcome
or control (Larson and Grey, 2016).
─ the effect of uncertainty on objectives (ISO 31000).
effect is a deviation from what is expected
deviations can be positive (opportunity) or negative (threat)
objectives can be organisational, project-based and personal
Uncertainty that matters (e.g. with respect to the objectives of
the stakeholders concerned) (Hillson, 2009)
7–6
2
20/04/2024
Uncertainty vs. Risk
Rumsfeld Matrix
Cleden, 2016
7 ENGG461
The Risk Event Graph
7–8
Risk Management
A proactive attempt to recognize and manage risks that
affect the project’s success (Larson and Grey, 2016).
Coordinated activities to direct and control an organisation
with regard to risk (Flanagan, 2016).
mitigating the negative effects
What can go wrong (identifying risk events)?
How to reduce the likelihood of a risk event occurring?
How to minimize the risk event’s impact (consequences)?
What can be done before an event occurs (anticipation)?
What to do when an event occurs (contingencies)?
7–9
3
20/04/2024
The Risk
Management
Process
7–10
10
ISO-31000 Risk Management Process
Source: [Link]
health-sector/[Link]
7–11
11
Managing Risks
Step 1: Risk Identification and Classification
Generate a list of possible risks.
macro risks first, then specific events
Risk identification and classification: tools and techniques
brainstorming, checklists, risk profiling
event tree analysis, cause-and-effect diagrams
Classify risk events based on their sources and/or
consequences
may help with decision-making and reporting
e.g. response development – likelihood vs. impact
7–12
12
4
20/04/2024
The Risk Breakdown Structure (RBS)
7–13
13
Risk Categories (Flanagan, 2016)
consequences of risk
7–14
14
Partial Risk Profile for Product Development Project
7–15
15
5
20/04/2024
Assessment 2 Project – Risks?
Risk category?
─ sources: external; estimation
─ consequences: quality/performance; schedule (time)
7–16
16
Assessment 2 Team Project – Risks?
Lack of sufficient credible information about the selected case
project
7–17
17
Assessment 2 Project – Risks?
Cause: information not released due to the nature/type of the
project
─ commercial sensitivity or national security reasons
─ no public interest (taxpayer funds; environmental or safety
concerns; poor project performance)
Effect: not able to deliver expected performance with regard to
quality of presentation (demonstrate learning outcomes)?
─ useful insights into challenges etc.
─ application of PM tools techniques, incl. limitations
7–18
18
6
20/04/2024
Managing Risks (contd.)
Step 2: Risk Assessment
Estimating risk exposure: quantifying the loss (or gain)
risk exposure = likelihood x severity of impact
[Link]
7–19
19
Managing Risks (contd.)
Step 2: Risk Assessment
Risk assessment tools and techniques
scenario analysis for event probability and impact
Failure Mode and Effects Analysis (FMEA)
probability analysis
Decision trees, NPV, and PERT
semi-quantitative scenario analysis
7–20
20
Defined Conditions for Impact Scales of a Risk on Major
Project Objectives (examples for negative impacts only)
7–21
21
7
20/04/2024
Failure Mode and Effect Analysis (FMEA)
22
22
Failure Mode and Effect Analysis: Example
FMEA exercise at Transport Co.
Failure modes associated with goods arriving damaged at
the point of delivery
Failure Mode Probability of Severity of Probability of Risk Priority
Occurrence Failure Detection/ Number
Defect will reach
customer
Goods not 5 6 2 60
secured
Goods incorrectly 8 4 5 160
secured
Goods incorrectly 7 4 7 196
loaded
23
23
Assessment 2 Team Project – Risks?
Lack of sufficient credible information about the
selected case project
Effect – not able to deliver expected performance with
regard to quality of presentation?
Likelihood of this risk eventuating?
Impact?
Detection difficulty?
Overall risk score (exposure)?
7–24
24
8
20/04/2024
Managing Risks (cont’d)
Step 3: Risk Response Development (strategy)
─ Avoiding Risk
Changing the project plan to eliminate the risk or condition.
─ Mitigating Risk
Reducing the likelihood an adverse event will occur.
Reducing impact of adverse event.
─ Transferring Risk
Paying a premium to pass the risk to another party.
Requiring Build-Own-Operate-Transfer (BOOT) provisions.
─ Retaining Risk
Making a conscious decision to accept the risk.
7–25
25
Risk Response
Pre-event Post-event
26 ENGG461
26
Risk Strategy Example
Description of Strategy Response Type
Remove a work package or activity from the project Avoid
Assign a team member to visit the seller’s
Mitigate
manufacturing facilities frequently to learn about a Impact
problem with delivery as early as possible
Move a work package to a date when a more
experienced resource is available to be assigned to Exploit
the project
Outsource a work package Share
Notify management that there could be a cost
increase if a risk occurs because no action is being
take to prevent the risk Accept
7–27
27
9
20/04/2024
Risk Strategy Example
Description of Strategy Response
Type
Remove a troublesome resource from the project
Provide a team member who has limited experience
with additional training
Train the team on conflict resolution strategies
Outsource difficult work to a more experienced
company
Ask the client to handle some of the work
Prototype a risky piece of equipment
7–28
28
Contingency Planning
Contingency Plan
─ an alternative plan that will be used if a possible foreseen risk
event actually occurs.
─ a plan of action that will reduce or mitigate the negative impact
(consequences) of a risk event.
Risks of Not Having a Contingency Plan
─ having no plan may slow managerial response.
─ decisions made under pressure can be potentially dangerous
and costly.
7–29
29
Risk and Contingency Planning
Technical Risks
backup strategies if chosen technology fails.
assessing whether technical uncertainties can be resolved.
Schedule Risks
use of slack increases the risk of a late project finish.
imposed duration dates (absolute project finish date)
compression of project schedules due to a shortened project
duration date.
7–30
30
10
20/04/2024
Risk and Contingency Planning (cont’d)
Cost-related Risks
time/cost dependency links: costs increase when problems
take longer to solve than expected.
deciding to use the schedule to solve cash flow problems
should be avoided.
price protection risks (a rise in input costs) increase if the
duration of a project is increased.
Funding Risks
changes in the supply of funds for the project can
dramatically affect the likelihood of implementation or
successful completion of a project.
7–31
31
Contingency Funding and Time Buffers
Contingency Funds
funds to cover project risks; identified and unknown.
size of funds reflects the overall risk of a project
budget reserves
are linked to the identified risks of specific work packages.
management reserves
are large funds to be used to cover major unforeseen risks (e.g.,
change in project scope) of the total project.
Time Buffers
amounts of time used to compensate for unplanned delays in the
project schedule.
Severe risk, merge, noncritical, and scarce resource activities
7–32
32
Contingency Fund Estimate ($000s)
7–33
33
11
20/04/2024
Risk Responses
Response strategy
7–34
34
Managing Risks (cont’d)
Step 4: Risk Response Control
─ Risk control
Execution of the risk response strategy
Monitoring of triggering events
Initiating contingency plans
Watching for new risks
─ Establishing a Change Management System
Monitoring, tracking, and reporting risk
Fostering an open organization environment
Repeating risk identification/assessment exercises
Assigning and documenting responsibility for managing risk
7–35
35
Points for Reflection
Why the risk management approach we discussed might still
be insufficient to ensure a risk-free project?
When (under what circumstances) would the risk management
approach we discussed fail?
The output of risk assessment is an input to the decision-
making processes of the organization (ISO31000 Guide)
[Link]
[Link]
[Link]
7–36
36
12
20/04/2024
Opportunity Management Tactics
Exploit
seeking to eliminate the uncertainty associated with an opportunity
to ensure that it definitely happens.
Share
allocating some or all of the ownership of an opportunity to another
party who is best able to capture the opportunity for the benefit of
the project.
Enhance
taking action to increase the probability and/or the positive impact of
an opportunity.
Accept
being willing to take advantage of an opportunity if it occurs, but not
taking action to pursue it.
7–37
37
Thank You
38
13