Risk Definition

 PMBOK Guide (2004) defines risks as “an uncertain event or

condition that , if it occurs has a positive or negative effect on
project objectives”.
 Every project is risky, meaning there is a chance things won’t turn
out exactly as planned. Project outcomes are determined by many
things , some that are unpredictable and over which project
managers have little control. Risk level is associated with the
certainty level about technical , schedule and cost outcomes. High
certainty outcomes have low risk: low certainty outcomes have
high risks. Certainty derives from knowledge and experience
gained in prior projects, as well as from management ability to
control project outcomes and respond to emerging problems.
 In general risk is a function of uniqueness of a project and the
experience of the project team.
Risk = f(uniqueness , experience of project team)
 Project risk = Σ ( events * probabilities * consequences )
• Project risk management is the art and science of managing risks caused by
unforeseen changes (uncertainties) which may require deviations from the
project plan and therefore affect the achievement of project objectives.
• Project risk management included the process of conducting risk
management planning , identifying , analysing , response planning and
monitoring and control on a project.
• It involves processes , tools and techniques that will the help the project
manager to maximize consequences of positive outcomes and to minimize
adverse impacts to protect scope , cost and schedule.
 Nature of Project Risk
Project risks are as follows:
4. Internal
1. Nation/Region
a) Cash flow unbalance ,
a) Political Situation
b) Human resource shortages
b) Economical and financial
Situation 5. Materials & Equipment
c) Social environment a) Unfavourable sub-suppliers
2. Construction Industry b) Default supply of materials
a) Market Fluctuations c) Equipment's & Plants
b) Law and regulations 6. Project
c) Standards and codes a) Defective physical works
d) Contract Systems b) Schedule Delay
3. Company c) Cost overruns
a) Employer/owner 7. Force Majeure
b) Consultant/architect a) Earthquake
c) Labour & subcontractors b) Fire/Flood/Bad weather
5.2 Types of Project
1) The design and construction phase
2) The operation phase
3) Either Phase
1) Construction Phase risk
a. Completion Risk
• Completion phase carries the greatest risk for the financer.
Construction carries the danger that the project will not be
completed on time, on budget or at all because of technical, labor
and other construction difficulties. Such delays or cost increases
may delay the loan repayments and cause interest and debt to
accumulate. They may also jeopardize contracts for the sale of the
projects out put and supply the contract of raw materials.
2. Operation Phase Risk
a ) Resource/ Reserve Risk
• This is the risk that for mining project , rail project, power station
or toll road there are inadequate outputs that can be processed or
serviced to produce an adequate return. For example, this is the
risk that there are insufficient reserves for mine, passengers for
railway, fuel for PowerStation or vehicles for toll road.
b) Operating Risk
• These are general risk that may affect the cash flow of the
project by increasing the operating costs or affecting the
projects capacity to continue to generate the quantity and
quality of the planned output over life.
• Operating risk include the level of experience of operator,
inefficiencies of operations or shortage of supply of skilled
manpower.
c) Market risk
• Obviously the loan can only be paid if the product generated
can be turned into cash. Market risk is the risk that a buyer
can not be found for the product at a price sufficient to
provide adequate cash flow to service the debt.
• The best mechanism to minimize the market risk before
lending takes place is an acceptable forward sales contract
entered into the financially sound purchaser.
3. Risk common to both construction and Operation Phases
a) Participants/ Credit Risk
• This risk is associated with the sponsors or the borrowers
themselves.
• The question is whether they have sufficient resources to manage
the construction and operation of project and to efficiently resolve
the problems that may rise.
• To minimize this risk, the financers need to satisfy themselves that
the participants have the necessary human resources, experience in
past project of its nature.
b) Technical Risk
• This is the risk of technical difficulties in the construction and
operation of the project’s plant and equipment, including latent
defects.
• Financiers usually minimize this risk by preferring tried and tested
technologies to new unproven technologies.
c) Currency Risk
• It includes inflation of money at construction phase
d) Regulatory/ Operational Risk
• These are the risk that government licenses and approval
required to construct or operate the project will not be issued
( or will only be issued subject to onerous conditions ) or
that the project will subject to excessive taxation, royalty
payments or rigid requirements as to local supply or
distribution.
 e) Political Risk
• This is the danger of political or financial instability in the
host country caused by insurrections, strikes, suspension of
foreign exchange etc.
• It also includes the risk that a government may be able to
avoid its contractual obligations through sovereign immunity
doctrines.
f) Force Majeure Risk
• This is the risk of events which render the construction or
operations of the project impossible, either temporarily ( eg
minor floods ) or permanently ( complete destruction by fire ,
earthquake etc.)
5.3 Analysis of Major Sources of Risk

1. Change in project scope and requirements

2. Design errors and omissions
3. Inadequately defined roles and responsibilities
4. Inaccurate cost and schedule estimates
5. Insufficient skilled staff
6. Force majeure
7. New Technology
5.3 Analysis of Major Source of Risk
1. Change in Project Scope and Requirements
• As a project progresses a project team may later
find that a planned project scope and requirements
need to be revised due to changes in user
requirements , more information gathered and
technical feasibility .
• For example if the client adds additional system to
the project, the project team needs to conduct the
feasibility of the project. This source of project risk
often occurs in later stage of the project
2. Design errors and omissions
• In any project , it is possible that someone does
unintentional errors or omits to implement the
project as planned.
• Due to the complexity of the project and tight time
frame a project team may misunderstand due to
ineffective communication.
• The examples of this source of risk are deficiency
design documents, improperly sized equipment,
design calculation errors. Therefore the impacts
includes delay of the project and additional costs.
3. Inadequately defined roles and responsibilities.
• This source of project risk is deemed a common source in
any typical project because of changes in project
management structure and ambiguous roles and
responsibilities.
• The noticeable examples of this source of risk are ineffective
project communication, different expectations and lack of
common direction.
4. Inaccurate cost and schedule estimates
• This source of risk results from ineffective project planning
at the early stage of the project.
• If the cost and schedule of the project are not accurately
planned and estimated, the entire project will be in the wrong
direction and many issues will be escalated.
• The example of risk resulting from inaccurate cost and
schedule estimates includes incorrect form of project time
line and budget.
5. Insufficient Skilled Staff
• A manager must ensure that a project team has enough
skilled staff to execute the project according to its
objectives.
• Lack of skilled staff potentially causes many problems
in foreseeable future.
• This source of risk significantly affects the project at the
implementation stage since this stage requires
considerable technical knowledge, effective project
management expertise and problem solving skill.
6. Force Majeure
• This is the source of risk that is uncontrollable. It
includes Act of God, insurrections or civil disorder, war
or military operations, national or local emergency, any
kind of fire , lighting, earthquake, flood etc.
• All of these will adversely affect the project. In worst
case the impact will be stoppage of work.
7. New Technology
• It often plays an important role in project risk
analysis, since it can force project team to change
the strategy of the project or revise technology used
in the project.
• New and unproven technology is a major concern in
the project since it is hard for a project team to
predict potential risk
• The impact of this source of risk includes
significantly increased project costs and time.
5.4 Effective Management of Project Risk
Risk Management
• Risk management is the systematic approach to control the
level of risk to mitigate its effects i.e. responding to project
risk.
• The process consist of risk management planning,
identification, analysis, responding and monitoring and
control.
• The objective of risk management is to maximize the
probability and impact of positive events and minimize the
probability and consequences of events adverse to project
objectives.
The processes of risk management are updated
throughout the project life. It involves following steps:
1. Risk Management Planning
2. Risk Identification
3. Qualitative Risk Analysis & Quantitative Risk
Analysis
4. Risk Response Planning
5. Risk Monitoring & Control
5.4.1 Risk Management Planning

• As part of work plan development, project

development team members assign project team
members to create a project risk management plan.
The risk management plan identifies and establishes
in the project plan the activities of risk management
for the project.
• To prepare the risk management plan, the assigned
project team members use the spreadsheet that
shows the risk and responses in an abbreviated
form.
Risk Management Planning
Risk Management Planning

• Planning how risk will be managed in the particular

activities and job within project
• Assigning risk officer
• Maintaining live project risk database
• Creating risk reporting channel
• Preparation of mitigation plans, i.e. answer on What
, When , by whom and how
• Summarizing planning & its effectiveness of
mitigation activities.
5.4.2 Risk Identification
• Risk Identification involves identifying the potential project risks
and documenting their characteristics. Risk identification results
in a deliverable the project risk list. The assigned team members
identify the potential risk and opportunities using
 Listing out of potential risks and looked into it on a regular basis
throughout the project
 To identify the potential risks that can impact the project
objectives
 Risk Identification for:
a) New activities
b) Existing activities where rate of occurrence of undesired events
are abnormally high
c) Management Change
d) Existing activities with new exposures and techniques
e) Infrequent/irregular activities
Risk Identification tools & techniques
1. Documentation Reviews
 Reviewing of project documents
 Lessons learned from past & planning for future
 Reviews of meetings , minutes , reports , discussion and decisions
2. Brainstorming
 Open discussion with participants and idea generation for
potential problems
3. Delphi Techniques
 Like brainstorming but the participant do not know one another
 Location differ, via email , telephone conversation, postal such
that do not know one another
4. Assumption Analysis
 To identify area of uncertainty
 Make assumptions to future events (Earthquake, Landslide ,Flood)
5. Interviews/Interactions
 Senior management/Stockholders
 With expert or people with sufficient experience
6. Checklists
 List of predetermined risks that are going to happened
 List of risks with Standard & norms
7. Flow Charting
 Diagram showing details procedures
 Cause & effect diagram
 To find out potential area of risk
8. WBS analysis
 Each components and activities are analyse w.r. to risk and who is
the responsible for that is known
 Equipment risk , technical difficulty , supplier problems ,
management problems
5.4.3. Qualitative and Quantitative Risk Analysis
• Qualitative risk analysis assesses the importance of the
identified risks and develops prioritized lists of these risks
for further analysis or direct mitigation. The team assess
each identified risk for its probability of occurring and its
impact on project objectives. Team members sort the
identified risks into high, moderate and low risk categories
for each project objective ( Time, cost, scope )
• Qualitative Assessment Methods
Probability & Impact Assessment
Probability and impact matrix
Risk data quality assessment
Risk categorization
Impact Values for different Technical, Cost & Time
Situations
Impact Value Technical Cost Impact Schedule
impact (TI ) ( CI ) Impact (SI)
0.1 ( Low ) Minimal Within budget Negligible
0.3 ( Minor ) Small Reduction Cost Increase Minor slip
in performance (1-10% ) ( <1 month )
0.5 ( Moderate ) Moderate Cost increase Moderate slip
reduction in ( 10-25 % ) ( 1-3 month )
performance
0.7 ( Significant ) Significant Cost increase Significant slip
Reduction in (25-50%) ( > 3 months )
performance
0.9 ( high ) Technical goals Cost increase in Large slip
might not be excess of 50 % (unacceptable )
achieved
Quantitative risk analysis
• Quantitative risk analysis is a way of numerically estimating
the probability of that a project will meet its cost and time
objectives
• Quantitative analysis is based on a simultaneous evaluation
of the impact of all identified and quantified risks.
• Quantitative risk analysis involves statistical techniques that
are most easily used with specialized software.
• Quantitative Analysis Methods are: Probability analysis,
Sensitivity analysis, decision tree, simulations and modelling
etc.
Risk Impact
• Risk impact can be expressed as a qualitative rating such as
high , medium or low. The rating is subjective and depends
upon the opinion of managers about the importance of risk.
For example a risk leading to schedule delay of 1 Month or
less might be considered low impact, whereas a delay of 3
months or more might be deemed high impact.
• Risk impact also can be expressed as a numerical measure
between 0 & 1 , where 0 is not serious and 1 is catastrophic.
• Composite Impact Factor (CIF) = W1*TI+W2*CI+W3*SI
• TI,CI & SI are Technical , Cost & Schedule Impact
respectively &
• W1,W2 & W3 are valued from 0 to 1 and together sum to 1
(Simple Weighted Average)
Risk Consequences
• The risk is a function of risk likelihood and risk impact. This notion is
referred to as the risk consequence. Risk consequence can be expressed
in two ways.
• First it can be expressed as a simple numerical rating with a value
ranging from 0 & 1. In that case , the risk consequence rating RCR, is
• RCR= CLF +CIF-(CLF)*(CIF)
• The composite likelihood factors (CLF)
• Composite impact factors (CIF)
• RCR >0.7 : High Risk Project
• RCR <0.48 : Moderate level Risk
• RCR <0.2 : Low Risk Project
Second Method can be expressed as a risk consequence is an Expected value.
The risk consequence expected value is computed as:
Risk Consequence = (Impact)*(Likelihood)
The risk consequence on project duration is called the risk time
(RT) =(Corrective time)* (Likelihood)
The risk consequence on project cost is called the risk cost
(RC) =(Corrective Cost)* (Likelihood)
Numerical
Suppose the baseline time estimate (BTE) for project
completion is 26 weeks and the baseline cost estimate (BCE)
is NRs. 550,000. Assume that the risk likelihood for the
project as a whole is 0.25 , and should the risk materialize , it
would delay the project by 5 weeks and increase the cost by
NRs. 90,000. Calculate the expected project completion time
ET and expected project completion cost EC , Considering risk
into account.
Solution:
As the probability of the risk materializing is 0.25 , the
probability of not materializing is 0.75. If the risk does not
materialize , no corrective measures will be necessary , so the
corrective time and cost will be nil. Hence,
Risk Time (RT) = 5*0.25+0*.75=1.25 Weeks
Risk Cost (RC) = 90,000*0.25+0*.75 = NRs. 22,500
• Expected Project Completion Time (ET) = BTE +RT
• = 26+1.25 = 27.25 Weeks.
• Expected Project Completion Cost (EC) = BCE +RC
= 550,000+22,500 = NRs. 572,500
When the corrective time and cost cannot be estimated then ET
& EC are computes as:
ET= BTE(1+Likilihhod)=26*(1+0.25)=32.50 Weeks
EC= BCE(1+Likilihhod)=550,000*(1+0.25)= NRs. 687,500
5.4.4 Risk Response Planning
• The risk response planning involves determining ways to reduce
or eliminate any threats to the project, and also the opportunities
to increase their impact. Project managers should work to
eliminate the threats before they occur
• Risk response planning focuses on the high risk items in
qualitative and/or quantitative risk analysis.
• It identifies and assigns parties to take responsibility for each risk
response.
• The project manager identifies which strategy is best for each risk
and then designs specific actions to implement that strategy. These
strategies and action include:
1. Avoidance: the team changes the project plan to eliminate the
risk or to protect the project objectives from its impact. The
team might achieve this by changing the scope, adding time or
adding resources.
• more detailed planning;
• the selection of alternative approaches;
• improving designs and systems engineering, or adopting
enhanced design standards;
• procedural changes;
• permits to work;
• protection and safety systems;
• preventive maintenance;
• formal processes and quality assurance procedures;
• operations reviews;
• regular inspections and audits; and
• training and skills enhancement.
2. Transference: the team transfers the financial impact of risk
by contracting out some aspect of work. Transference reduces
the risk only if the contractor is more capable of taking steps to
reduce the risk and does so. Insurance purchases, warranties,
guarantees, etc are examples of risk transfers
3. Mitigation/Risk Reduction: The team seeks to reduce the
probability or consequences of a risk event to an acceptable
threshold. They accomplish this via many different means that
are specific to project and the risk.
 Continuous efforts for improvements
 Improvement on physical , procedural , educational and
training within every department
 Improving maintenance , first aid facilities ,security
 Provision of contingency budget for risk management
 Models and simulation of key technical parameters
 Employ of best technical team and specialists
4. Acceptance: The project manager and the project
team decide to accept certain risks. They do not
change the project plan to deal with a risk or identify
any response strategy other than agreeing to address
the risk and when it occurs.
• “do nothing option”
• Regular monitoring , reporting , reviewing and
updating of all risks
• Positive attitude toward risk and its retention
• Handling the risks as per company capacity and
capability
• Not all impacts are severe and fatal
• Ready to bear possible losses and costs
5.4.5 Risk Monitoring and Control
• Risk monitoring and control keeps track of the
identified risks, residual risks and new risks. It also
ensures the execution of risk response plans and
evaluates its effectiveness. Risk monitoring and control
continues for the life of the project. The list of project
risks changes as the project matures, new risk develop
or anticipated risks disappear.
• Risk monitoring and control is carried out by following
methods.
Risk reassessment:
• It reviews the project risk at project team meetings.
Major reviews are made at major milestones. Risk
ratings and prioritization may change during the life of
the project. These changes may require additional
qualitative and quantitative risk analysis.
Risk audits
• Risk audit is the examination and documentation of the effectiveness of risk
responses in dealing with identified risk and their root causes, as well as the
effectiveness of the risk management process.
• A risk audit involves identifying and assessing all risks so that a plan can
be put in place to deal with any occurrence of any undesirable event
which causes harm to people or detriment to the organization.
• Variance and trend analysis
• Used for monitoring overall project cost and schedule performance against a
baseline plan. Significant deviations indicate that updated risk identification
and analysis should be performed.
Reserve analysis
• As execution progresses, some risk events may happen with positive or
negative impact on cost or schedule or contingency reserves. Reserve
analysis compares available reserves with the risk remaining at the time and
determines whether the reserves are sufficient.
Status Meetings
• Risk management can be addressed regularly by including the subject in
project meetings.
 The main goals to risk monitoring and control:
– To confirm risk responses are implemented as planned
– To determine if risk responses are effective or if new responses are needed
– To determine the validity of the project assumptions
– To determine if risk exposure has changed, evolved, or declined due to
trends in the project progression
– To confirm policies and procedures happen as planned
–To monitor the project for new risks
– To monitor risk triggers (Risk triggers are those events that will cause the
threat of a risk to become a reality.)
Main inputs to effectively monitor and control risks:
– Risk management plan
– Risk Register / Risk Tracker
– Risk response plan
– Project communications
– New risk identification
– Scope changes
Risk Management Plan (RMP)
• It is the document prepared after the risk management
planning meetings which describes the way,
mechanisms, and methods of performing risk
identifications, risk analysis, response planning and risk
monitoring and controlling mechanisms.
Risk Register (RR)
Risk register is a record to document the results of the
risk management process. it contains the following
information
• List of identified risk with description
• List of potential responses
• Root cause of risk
• Updated risk categories.
Contingency Plan
• A contingency plan is developed in advance to
respond to risks that arise during the project.
Planning would reduce the cost of an action the risk
occurs. Risk triggers such as missing intermediate
milestones should be defined and tracked.
• The most usual risk acceptance response is to
establish a contingency allowance or reserve
including amount of time , money or resources to
account for known risks.
Outputs of Risk Monitoring and Risk Control:

– Workaround plans
– Corrective / Preventive actions
– Change requests
– Risk response plan updates
– Risk database
– Checklist updates
Home Assignment for Chapter -5

• Project Risk Analysis and Management

1. Define Risk and Risk Management. Explain about internal risk
of any Hydropower project that is facing by Nepalese
hydropower company.
2. Why we need analysis of project risk? Explain about major
sources of risk in a project. What do you mean by qualitative
and quantitative risk analysis?
3. Define risk and explain various sources of project risks. Briefly
explain the effective management of project risk.
4. Explain the various techniques of Risk Identification. What are
the various strategy for Risk response planning?
5. Write short notes on
a)Risk Monitoring & Control b) Risk Management Planning