Project Risk Management
Vishnu C. Rajan, PhD
Assistant Professor
Operations Management & Quantitative Techniques Division
Department of Humanities and Social Sciences, IIT Tirupati
Email: vishnu@[Link]; Mob: +91-9526373908
1
Why risk management is important?
“Run your business as if it’s in trouble. Because if you don’t, it will
be someday”
◦ Mr. Jack Miles, American Author
“We hoped for the best but planned for the worst”
◦ Smt. K. K. Shailaja, Ex-Health Minister, Govt. of Kerala.
(On Kerala’s strategy to combat COVID-19 crisis)
“One back to pat, one head to roll”
◦ Dr D. Babu Paul, IAS (Rtd.)
(During the construction of Idukki reservoir, India’s biggest arch dam)
2
Why risk management is important?
A few incidents that disrupted business in the last
two decades
◦ Global economic recession started in 2008
◦ ISIS crisis in Iraq, Syria and the entire GCC
◦ Political crisis and law & order issues in Yemen, Syria, etc
◦ Satyam Scandal, 2009; Kingfisher crisis, 2012
◦ Chennai floods, 2015; Kerala floods 2018, 2019
◦ Demonetization, 2016; GST rollout, 2017
◦ WannaCry malware attack, 2017
◦ BrExit and US-China trade war
◦ COVID-19 crisis, 2019-22
◦ Suez Canal obstruction, 2021
◦ Russia-Ukraine War, US-Israel-Iran War
source: [Link]/images
3
Popular Stories of Project Failures
4
Recent Incidents:
Project-Level
5
Understanding the Term ‘Risk’
Risk management philosophy is finding applications in different domains
and contexts, including:
◦ Finance and economics
◦ Occupational safety
◦ Healthcare management
◦ Urban Planning
◦ Supply Chain Management
◦ Project management, among others. Source: Google/images
The definition and notion of the term ‘risk’ vary significantly across the
above research domains.
6
Uncertainty Performance Domain
7
Project Risk
• A risk is an uncertain event or
condition that, if it occurs, can have a
positive or negative effect on one or
more objectives
• Negative risks are called threats, and
positive risks are called opportunities.
• The probability that a particular threat
will exploit a particular vulnerability
8
Risk and Uncertainty as per Decision Theory
• Decision Theory treats risk and uncertainty as distinct
• Risk
• Predict the possibility of a future outcome/event
• Manageable
• Measured and quantified using probability theory
• Uncertainty
• Cannot by predicted
• Uncontrollable
• Immeasurable
9
Two Broader Types of Project Risks
Operational
Project Risks
Risks Financial
Risks
10
Project Risk Management: Process View
Plan
Risk Assessment Communication
Risk Risk Response
(Qualitative + Risk Monitoring
Identification Plan &
Quantitative)
Implementation
11
Risk Identification & Classification
Based on Source
• Internal vs External Risks
Based on
Consequences/Nature
• Disruption vs Planning
Challenges vs Uncertainty
Source: Manickavel Arumugam
12
Risk Identification & Classification
13
Significant Risk Factors
Level of decision making
Sl. No. Risk Factors Type of Risk
required
R1 Machine/equipment failure Disruption Risk Strategic level
R2 Power failure Disruption Risk Strategic level
R3 Communication/ Information system Disruption Risk Strategic level
failure/Internet failure/Cyber threats
R4 Inventory management failures Disruption Risk Strategic level
R5 Natural calamities Disruption Risk Operational level
R6 Plant safety failures/accidents Disruption Risk Strategic level
R7 Labour strikes Disruption Risk Operational level
R8 Terrorism Disruption Risk Operational level
R9 Public strikes Disruption Risk Operational level
R10 Technology change Planning Challenge Strategic level
14
Significant Risk Factors
Level of decision making
Sl. No. Risk Factors Type of Risk
required
R11 Mistrust between firms in the supply chain Planning Challenge Strategic level
R12 Community mistrusts/ misbelieves Planning Challenge Strategic level
R13 Forecast errors Planning Challenge Tactical level
R14 Supplier delays Supply Uncertainty Tactical level
R15 Supply quality mismatch Supply Uncertainty Tactical level
R16 Inertia: Lack of company response to market Demand Uncertainty Strategic level
changes
R17 Environmental regulatory issues Institutional Risk Tactical level
R18 Delays in clearances of projects from Tactical level
Institutional Risk
government
R19 Corruption issues Institutional Risk Tactical level
R20 NGO’s & Social Interest groups Institutional Risk Tactical level
15
Significant Risk Factors
Sl. Level of decision
Risk Factor Type of Risk
No. making required
Govt. policy changes (e.g.
R21 Institutional Risk Tactical level
demonetization, tax rate change)
R22 Conflicts in company management Institutional Risk Operational level
R23 Instability in fuel price Financial Risk Tactical level
R24 Credit risk Financial Risk Tactical level
R25 Increasing inflation rate Financial Risk Strategic level
Changes in Cost of Capital (Equity,
R26 Financial Risk Strategic level
Preference Shares, Debt, etc.)
16
Risk Assessment
Two Parameters
17
Project Risk Estimation Approaches
The most accepted method to estimate ‘risk’ is based on the ‘likelihood’ and
‘impact’ of events/interruptions on the systems under consideration (WEF
Global Risk Report, 2020).
In addition to this approach of estimating risk, Aven and Cox (2016) have
presented a consolidated list of other existing approaches to estimate risk
including, including
◦ Risk = expected consequences
◦ Risk = consequences and probability
◦ Risk = event with a potential for some consequences
◦ Risk = consequences and uncertainties.
18
Time
Ultimate Overrun
Impact of Quality
Underrun
Cost Overrun
Risks on
Projects Scope
Creep
Risk Appetite and Risk Threshold
▪ Project team members engage with relevant stakeholders to understand
their risk appetite and risk thresholds.
▪ Risk appetite: the degree of uncertainty an organization or individual is
willing to accept in anticipation of a reward.
▪ Risk threshold: the measure of acceptable variation around an objective that
reflects the risk appetite of the organization and stakeholders.
▪ The risk threshold reflects the risk appetite. Therefore, a risk threshold of
±5% around a cost objective reflects a lower risk appetite than a risk
threshold of ±10%.
▪ The risk appetite and risk threshold inform how the project team navigates
risk in a project.
Techniques/Tools for Risk Assessment
Subjective Techniques/Qualitative
• Expert Opinion/Delphi Technique
• Cause and Effect Diagram/Fishbone Diagram/Ishikawa Diagram
• Multi-attribute Decision-Making Tools like AHP, ANP, TOPSIS, ISM,
DEMATEL, etc.
Objective Techniques/Quantitative
• Historical Data Analysis
• Risk Prioritization Matrix
• Failure Mode, Effects, and Criticality Analysis (FMECA)
• Simulations, Scenario Analysis, Decision Trees, Sensitivity Analysis
21
Risk Matrix: Impact vs Likelihood
22
Risk Matrix: Impact vs Likelihood
Source: Manickavel Arumugam
23
Risk Matrix: Impact vs Likelihood
Source: Manickavel Arumugam
24
Failure Mode, Effects, and Criticality
Analysis (FMECA)
The FMCEA methodology is employed to locate the risks involved in the
physical assets employed in the project and classify them based on factors
such as
◦ Severity (S),
◦ Occurrence (O), and
◦ Detection of failures (D),
i.e., the three dimensions of criticality that determine the Risk Priority Number (RPN)
(RPN = S*O*D)
25
Failure Mode, Effects, and Criticality
Analysis (FMECA)
Severity of failure effects (S)
Level Value Definition
Failure stops the component but not the installation that operates
Minor 1
in degraded mode.
Failure stops the equipment but not the production that operates
Way 2
in degraded mode.
Failure stops the production from 20 minutes to an hour and
Major 3
requires maintenance.
Failure stops the production for more than 2 hours. Important
Important 4
intervention on the sub-systems
Failure stops production, leading to serious problems for Frequency of failure (Occurrence, O)
Catastrophic 5
personnel safety or the installation/environment.
Level Value Definition
Exceptional 1 No participant memory
Rare 2 It has happened once or twice
Frequent 3 It has already happened several times
Certain 4 It will happen for sure
26
Failure Mode, Effects, and Criticality
Analysis (FMECA)
Failure detection capability (D)
Level Value Definition
Obvious 1 Certain detection
Possible 2 Detectable by the operator
Unlikely 3 Difficult to detect
Impossible 4 Undetectable
Criticality levels
Value Definition
1≤ RPN <8 Negligible: ignore the failure for the time being
8≤ RPN< 14 Average: wonder whether to ignore them or consider them
14≤ RPN <27 High: need to frame countermeasures to implement and the ensure stocking components. Also
requires continuous monitoring.
27≤ RPN ≤80 Prohibited: Preventive measures should be implemented, the actions must be recorded, and the
components or parts must be put in stock
(Note: Risk Priority Number, RPN = S*O*D)
27
Simulations: Scenario Analysis
28
Risk Response Plan
29
Conventional Risk Responses/Mitigation
Strategies
Business
Contract
Continuity Postponement Risk Pooling
Management
Plans (BCP)
Multi-location
Poka Yoke Partnerships/
Sourcing/ Insurance
(Fail Safe) Joint Ventures
Strategic Stocks
Pricing Strategy/ Quality
Create Futures/
Product Standards
Awareness Reconfiguration Options
(ISO, ISI, etc.)
Product/ Contingency/ Condition-
Back-up/
Logistics Management based
Redundancy
Diversification Reserves Maintenance
30
Strategic Capabilities for Managing Risks
31
Risk Communication/Implementation
Source: Manickavel Arumugam
32
Standard Operating Procedures
33
Signboards
34
Drills
35
Risk Monitoring
• A regular risk monitoring practice should be adopted to make sure that
the possible adverse impacts are controllable.
• Failure data analytics is considered the crucial activity in monitoring
major supply chain risks quantitatively
• Each disruption event is recorded in the MIS with details like its
occurring time, impact potential score, recovery time, etc.
• Using these data, reliability parameters are calculated
• Plot the failure/reliability curve of every activity in the project
• Develop Early Warning Models
36
Risk Monitoring: Risk Register
37
Technological
Tools/Solutions
SOURCE: [Link]/IMAGES
The Barrier
(C) VISHNU, HSS, IIT TIRUPATI Source: [Link]/images
The
Piraputanga
Mindset
(C) VISHNU, HSS, IIT TIRUPATI Source: [Link]/images
Query Time
41