Project

Risk
Management
 THE IMPORTANCE OF PROJECT
RISK MANAGEMENT

◍ Project risk management is the art and science of

identifying, analyzing, and responding to risk throughout
the life of a project and in the best interests of
meeting project objectives.

◍ Risk management is often overlooked in projects, but

it can help improve project success by helping select
good projects, determining project scope, and developing
realistic estimates.
 NEGATIVE RISK

◍ A dictionary definition of risk is “the possibility of

loss or injury.”

◍ Negative risk involves understanding potential problems

that might occur in the project and how they might impede
project success.

◍ Negative risk management is like a form of insurance; it

is an investment.
 RISK CAN BE POSITIVE

❑ Positive risks are risks that result in good things

happening; sometimes called opportunities.

❑ A general definition of project risk is an uncertainty

that can have a negative or positive effect on meeting
project objectives.

❑ The goal of project risk management is to minimize

potential negative risks while maximizing potential
positive risks.
 RISK UTILITY

• Risk utility or Risk tolerance is the amount of

satisfaction or pleasure received from a potential payoff.

– Utility rises at a decreasing rate for people who are

risk-averse.

– Those who are risk-seeking have a higher tolerance for

risk and their satisfaction increases when more payoff
is at stake.

– The risk-neutral approach achieves a balance

between risk and payoff.
 PROJECT RISK MANAGEMENT
PROCESSES

1. Risk management planning: Deciding how to approach and

plan the risk management activities for the project.

2. Risk identification: Determining which risks are likely to

affect a project and documenting the characteristics of each.

3. Qualitative risk analysis: Prioritizing risks based on

their probability and impact of occurrence.
 PROJECT RISK MANAGEMENT
PROCESSES

4. Quantitative risk analysis: Numerically estimating the

effects of risks on project objectives.
5. Risk response planning: Taking steps to enhance
opportunities and reduce threats to meeting project
objectives.
6. Risk monitoring and control: Monitoring identified and
residual risks, identifying new risks, carrying out risk
response plans, and evaluating the effectiveness of risk
strategies throughout the life of the project.
 1. Risk Management Planning

◍ The main output of risk management planning is a risk

management plan
— A plan that documents the procedures for managing risk
throughout a project.

◍ The project team should review project documents and

understand the organization’s and the sponsor’s approaches to
risk.

◍ The level of detail will vary with the needs of the

project.
 Topics Addressed in a Risk
Management Plan
◍ Methodology : Organizations can take several approaches to assess
risks—quantitative, qualitative, semi-quantitative, asset-based,
vulnerability-based, or threat-based. Each methodology can evaluate
an organization’s risk posture, but they all require tradeoffs.

◍ Roles and responsibilities

◍ Budget and schedule

◍ Risk categories

◍ Risk probability and impact

◍ Risk documentation
 CONTINGENCY AND FALLBACK PLANS,
CONTINGENCY RESERVES

◍ Contingency plans are predefined actions that the project team

will take if an identified risk event occurs.

◍ Fallback plans are developed for risks that have a high impact on
meeting project objectives, and are put into effect if attempts to
reduce the risk are not effective.

◍ Contingency reserves or allowances are provisions held by the

project sponsor or organization to reduce the risk of cost or
schedule overruns to an acceptable level.
The Standish
Group developed
an IT success
potential scoring
sheet based on
potential risks.
 BROAD CATEGORIES OF RISK

◍ Market risk refers to the potential for losses due to changes in market
conditions such as interest rates, exchange rates, and asset prices. It
encompasses the uncertainty of returns stemming from macroeconomic factors
and investor behavior.

◍ Financial risk pertains to the potential for losses arising from a

company's financing decisions, including its use of debt, leverage, and
liquidity management. It encompasses the danger of insolvency or inability
to meet financial obligations.

◍ Technology risk refers to the possibility of losses resulting from

technological failures, cybersecurity breaches. It involves the
vulnerability of systems, infrastructure, and data to disruptions or
malicious attacks.
 BROAD CATEGORIES OF RISK

◍ People risk relates to the potential for losses due to human factors such
as employee turnover, skill shortages, or misconduct. It encompasses the
impact of organizational culture, leadership, and talent management on
business operations.

◍ Structure/process risk refers to the potential for losses resulting from

weaknesses or inefficiencies in organizational structures, operational
processes, or governance frameworks. It involves the susceptibility to
errors, delays, or breakdowns in executing business activities.
 RISK BREAKDOWN
STRUCTURE

A risk breakdown
structure is a
hierarchy of potential
risk categories for a
project.
BROAD CATEGORIES OF RISK
 2. Risk Identification

Risk identification is the process of understanding what potential

events might hurt or enhance a particular project.

Risk identification tools and techniques include:

– Brainstorming
– The Delphi Method
– Interviewing
– SWOT analysis
 The Delphi method

❑ The Delphi method is a process used to arrive at a group opinion

or decision by surveying a panel of experts.
❑ Experts respond to several rounds of questionnaires, and the
responses are aggregated and shared with the group after each
round.
❑ The experts can adjust their answers each round, based on how
they interpret the “group response” provided to them. The
ultimate result is meant to be a true consensus of what the group
thinks.
 3. Qualitative Risk Analysis

Assess the likelihood and impact of identified risks to determine

their magnitude and priority.

Risk quantification tools and techniques include:

– Probability/impact matrixes
– The Top Ten Risk Item Tracking
– Expert judgment
 Probability/Impact matrixes

A Probability and Impact Matrix is a tool used in risk management to

assess and prioritize risks within a project, business, or other
contexts. It helps stakeholders evaluate the potential consequences
(impact) of a risk and the likelihood (probability) of that risk
occurring.
1. Probability: This measures the likelihood or chance that a
specific risk event will occur. It's often expressed as a
percentage or a qualitative assessment (e.g., low, medium, high).
2. Impact: This measures the severity of the consequences or effects
if the risk event were to occur. Impact can be assessed on
various dimensions, such as financial, operational, reputational,
or safety. It's also often expressed qualitatively (e.g., low,
medium, high).
Probability/Impact matrixes
 Top Ten Risk Item Tracking

◍ Top Ten Risk Item Tracking is a qualitative risk

analysis tool that helps to identify risks and maintain an
awareness of risks throughout the life of a project.

◍ Establish a periodic review of the top ten project risk

items.

◍ List the current ranking, previous ranking, number of

times the risk appears on the list over a period of time,
and a summary of progress made in resolving the risk item.
 Top Ten Risk Item Tracking

◍resolving the risk item.

 Expert Judgment

◍ Many organizations rely on the intuitive feelings and

past experience of experts to help identify potential
project risks.

◍ Experts can categorize risks as high, medium, or low

with or without more sophisticated techniques.

◍ Can also help create and monitor a watch list, a list of

risks that are low priority, but are still identified as
potential risks.
 4. Quantitative Risk Analysis

◍ Often follows qualitative risk analysis, but both can

be done together.

◍ Large, complex projects involving leading edge

technologies often require extensive quantitative risk
analysis.

Main techniques include:

– Decision tree analysis
– Simulation
– Sensitivity analysis
 Decision Trees and Expected
Monetary Value (EMV)

◍A decision tree is a diagramming analysis technique used

to help select the best course of action in situations in
which future outcomes are uncertain.

◍• Estimated monetary value (EMV) is the product of a risk

event probability and the risk event’s monetary value.

◍• You can draw a decision tree to help find the EMV.

Click Here
 5. Risk response planning

◍ Risk Avoidance:
This strategy involves taking steps to eliminate the risk
entirely, often by choosing not to engage in the activity
that presents the risk.
◍ Risk Acceptance:
This approach acknowledges the presence of a risk and
consciously decides to accept the potential consequences,
usually because the cost of mitigating the risk is higher
than the cost of the risk itself.
◍ Risk Mitigation:
This involves taking measures to reduce the impact or
likelihood of the risk, such as implementing safety
protocols or backup systems.
 6. Risk monitoring and control

◍Risk monitoring and control is a continuous process in risk

management that involves tracking identified risks, monitoring
residual risks, identifying new risks, and evaluating the
effectiveness of risk response strategies.

◍This ensures that risks are properly managed throughout the

lifecycle of a project or operation, allowing for timely
adjustments to risk management plans as needed to address any
changes or new developments.
 SUMMARY

Project risk management is the art and science of

identifying, analyzing, and responding to risk throughout
the life of a project and in the best interests of meeting
project objectives.

Main processes include:

– Risk management planning

– Risk identification
– Qualitative risk analysis
– Quantitative risk analysis
– Risk response planning
– Risk monitoring and control
Thanks!