:
Project Risk Management
Information Technology Project
Management, Seventh Edition
Note: See the text itself for full
citations.
The Importance of Project Risk
Management
Project risk management is the art and science of
identifying, analyzing, and responding to risk
throughout the life of a project and in the best
interests of meeting project objectives
Risk management is often overlooked in projects,
but it can help improve project success by helping
select good projects, determining project scope,
and developing realistic estimates
Information Technology Project
Management, Seventh Edition Copyright 2014 2
Negative Risk
A dictionary definition of risk is “the
possibility of loss or injury”
Negative risk involves understanding
potential problems that might occur in the
project and how they might impede project
success
Negative risk management is like a form of
insurance; it is an investment
Information Technology Project
Management, Seventh Edition Copyright 2014 3
Risk Can Be Positive
Positive risks are risks that result in good
things happening; sometimes called
opportunities
A general definition of project risk is an
uncertainty that can have a negative or
positive effect on meeting project objectives
The goal of project risk management is to
minimize potential negative risks while
maximizing potential positive risks
Information Technology Project
Management, Seventh Edition Copyright 2014 4
Project Risk Management Processes
Planning risk management : Deciding how to
approach and plan the risk management activities for
the project
Identifying risks: Determining which risks are likely
to affect a project and documenting the
characteristics of each
Performing qualitative risk analysis: Prioritizing
risks based on their probability and impact of
occurrence
Information Technology Project
Management, Seventh Edition Copyright 2014 5
Project Risk Management
Processes (cont’d)
Performing quantitative risk analysis:
Numerically estimating the effects of risks on project
objectives
Planning risk responses: Taking steps to enhance
opportunities and reduce threats to meeting project
objectives
Controlling risk: Monitoring identified and residual
risks, identifying new risks, carrying out risk
response plans, and evaluating the effectiveness of
risk strategies throughout the life of the project
Information Technology Project
Management, Seventh Edition Copyright 2014 6
[Link] Risk Management
The main output of this process is a risk
management plan—a plan that documents the
procedures for managing risk throughout a
project
The project team should review project
documents and understand the organization’s
and the sponsor’s approaches to risk
The level of detail will vary with the needs of the
project
Information Technology Project
Management, Seventh Edition Copyright 2014 7
Table 11-2. Topics Addressed in a
Risk Management Plan
Methodology
Roles and responsibilities
Budget and schedule
Risk categories
Risk probability and impact
Revised stakeholders’ tolerances
Tracking
Risk documentation
Information Technology Project
Management, Seventh Edition Copyright 2014 8
Information Technology Project
Management, Seventh Edition Copyright 2014 9
1.1 Planning Risk Management
In addition to a risk management plan, many
projects also include contingency plans, fallback
plans, contingency reserves, and management
reserves.
Contingency plans are predefined actions that
the project team will take if an identified risk event
occurs. For example, if the project team knows
that a new release of a software package may not
be available in time to use for the project, the team
might have a contingency plan to use the existing,
older version of the software.
Information Technology Project
Management, Seventh Edition Copyright 2014 10
1.1 Planning Risk Management
Fallback plans are developed for risks that have
a high impact on meeting project objectives and
are put into effect if attempts to reduce the risk do
not work. For example, a new college graduate
might have a main plan and several contingency
plans for where to live after graduation, but if
these plans do not work out, a fallback plan might
be to live at home for a while. Sometimes the
terms contingency plan and fallback plan are used
interchangeably.
Information Technology Project
Management, Seventh Edition Copyright 2014 11
1.1 Planning Risk Management
Management reserves are funds held for
unknown risks that are used for management
control purposes. If the management reserves are
used for unforeseen work, they are added to the
cost baseline after the change is approved.
Information Technology Project
Management, Seventh Edition Copyright 2014 12
Common Sources of Risk in
Information Technology Projects
A risk breakdown structure is a hierarchy of
potential risk categories for a project
Similar to a work breakdown structure but used to
identify and categorize risks
Information Technology Project
Management, Seventh Edition Copyright 2014 13
Figure 11-4. Sample Risk Breakdown
Structure
14 Information Technology Project Management, Seventh Edition
Common Sources of Risk in
Information Technology Projects
it is also important to identify potential risks according to project
management knowledge areas, such as scope, time, cost, and
quality.
Information Technology Project Management, Seventh Edition 15
2. Identifying Risks
Identifying risks is the process of understanding what
potential events might hurt or enhance a particular
project
Another consideration is the likelihood of advanced
discovery
Risk identification tools and techniques include:
◦ Brainstorming
◦ The Delphi Technique
◦ Interviewing Interviewing people with similar project experience
◦ SWOT analysis
Information Technology Project
Management, Seventh Edition Copyright 2014 16
Brainstorming
Brainstorming is a technique by which a group
attempts to generate ideas or find a solution for a
specific problem by amassing ideas spontaneously
and without judgment
An experienced facilitator should run the
brainstorming session
Information Technology Project
Management, Seventh Edition Copyright 2014 17
Delphi Technique
The Delphi Technique is used to derive a
consensus among a panel of experts who make
predictions about future developments
Provides independent input regarding future
events
Uses repeated rounds of questioning and written
responses and avoids the biasing effects possible
in oral methods, such as brainstorming
Information Technology Project
Management, Seventh Edition Copyright 2014 18
SWOT Analysis
SWOT analysis (strengths, weaknesses,
opportunities, and threats) can also be used
during risk identification
Helps identify the broad negative and positive
risks that apply to a project
Information Technology Project
Management, Seventh Edition Copyright 2014 19
Risk Register
The main output of the risk identification process is a list
of identified risks and other information needed to begin
creating a risk register
A risk register is:
◦ A document that contains the results of various risk
management processes and that is often displayed in a
table or spreadsheet format
◦ A tool for documenting potential risk events and related
information
Information Technology Project
Management, Seventh Edition Copyright 2014 20
Risk Register Contents
An identification number for each risk event
A rank for each risk event: a number ,1 is he
highest risk
The name of each risk event
A description of each risk event
The category under which each risk event falls
The root cause of each risk
Information Technology Project
Management, Seventh Edition Copyright 2014 21
3. Performing Qualitative Risk
Analysis
Assess the impact of identified risks to
determine their magnitude and priority
Risk qualitative tools and techniques include:
◦ Probability/impact matrixes
◦ The Top Ten Risk Item Tracking
◦ Expert judgment
Information Technology Project
Management, Seventh Edition Copyright 2014 22
Probability/Impact Matrix
A probability/impact matrix or chart lists the
relative probability of a risk occurring on one side of
a matrix or axis on a chart and the relative impact of
the risk occurring on the other
List the risks and then label each one as high,
medium, or low in terms of its probability of
occurrence and its impact if it did occur
Information Technology Project
Management, Seventh Edition Copyright 2014 23
Figure 11-5. Sample
Probability/Impact Matrix
Information Technology Project
Management, Seventh Edition Copyright 2014 24
Top Ten Risk Item Tracking
Top Ten Risk Item Tracking is a qualitative risk
analysis tool that helps to identify risks and
maintain an awareness of risks throughout the life
of a project
Establish a periodic review of the top ten project
risk items
List the current ranking, previous ranking, number
of times the risk appears on the list over a period
of time, and a summary of progress made in
resolving the risk item
Information Technology Project
Management, Seventh Edition Copyright 2014 25
Table 11-6. Example of Top Ten Risk
Item Tracking
Information Technology Project
Management, Seventh Edition Copyright 2014 26
4.1 Decision Trees
A decision tree is a diagramming analysis
technique used to help select the best course of
action in situations in which future outcomes are
uncertain
Estimated monetary value (EMV) is the product
of a risk event probability and the risk event’s
monetary value
You can draw a decision tree to help find the EMV
Information Technology Project
Management, Seventh Edition Copyright 2014 27
4.1 Decision Trees
Figure 11-7. Expected Monetary Value (EMV) Example
Higher and
Positive is
better
Information Technology Project
Management, Seventh Edition Copyright 2014 28
5. Planning risk response
Information Technology Project
Management, Seventh Edition Copyright 2014 29
Residual and Secondary Risks
It’s also important to identify residual and
secondary risks
Residual risks are risks that remain after all of
the response strategies have been implemented
Secondary risks are risks that can be a direct
result of implementing a risk response
Information Technology Project
Management, Seventh Edition Copyright 2014 30
6. Controlling Risks
Controlling risk: Monitoring identified and
residual risks, identifying new risks, carrying out
risk response plans, and evaluating the
effectiveness of risk strategies throughout the
life of the project
Project teams sometimes
use workarounds—unplanned responses to
risk events—when they do not have contingency
plans in place.
Tools and techniques for monitoring risks
include data analysis, audits, and meetings
Information Technology Project
Management, Seventh Edition Copyright 2014 31
Using Software to Assist in Project
Risk Management
Risk registers can be created in a simple Word or
Excel file or as part of a database
More sophisticated risk management software, such
as Monte Carlo simulation tools, help in analyzing
project risks
You can purchase add-ons for Excel and Project
2010 to perform simulations
Information Technology Project
Management, Seventh Edition Copyright 2014 32