BMII 3213 Engineering Economy and
Management
Project Risk Management
Lecture by: Dr. Nadiah Ahmad
• The art and science of identifying, analyzing, & responding to risk
throughout the life of a project and in the best interests of meeting
project objectives
• Risk management is often overlooked in projects
2
At the very least, risk management can:
Allow project owners to set up procedures to avoid the risk, minimize its
impact, or at the very least help cope with its impact.
A dictionary definition of risk is “the possibility of loss or injury”
Project risk involves understanding potential problems that might
occur on the project and how they might impede project success
Risk management is like a form of insurance; it is an investment
4
Uncertainty implies that future events are unknown
Risks can be positive or negative
Positive Risk?
Negative Risk?
RISK MONITORING AND
RISK EVALUATION CONTROL
RISK IDENTIFICATION Risk evaluation are evaluated and Continuously monitoring identified risks
ranked according to their priority. and tracking new risks throughout the
Identifying potential risks that
This involves comparing the levels project lifecycle. It includes implementing
could affect the project. Risks can
3
of risk against pre-established the planned risk responses, assessing
1 5
come from various sources, such as
criteria, such as project objectives their effectiveness, and making
technical challenges, financial
or risk tolerance levels. The adjustments as necessary. Regular risk
constraints, regulatory changes, or
outcome is a prioritize list of risks reviews and updates to the risk register
environmental factors.
that require attention. are essential parts of this process.
RISK ANALYSIS
Once risks are identified, the next
step is to analyze them to RISK RESPONSE PLANNING RISK COMMUNICATION AND
understand their potential impact REPORTING
2 4 6
and likelihood of occurrence. This
After evaluating the risks, the next Reporting the status of risks to
can be done qualitatively or
step is to develop strategies to stakeholders, keeping them informed
quantitatively. The purpose is to
address them about risk management activities, and
assess the severity of each risk and
ensuring that everyone involved in the
prioritize them based on their
project understands the risks and how
potential effect on the project.
they are being managed
Brainstorming
Whether alone or in a group, brainstorming involves focusing on quantity over quality. Just write
everything you can think of on paper, and then come back and narrow down the list later.
Subject matter experts
There is no substitute to having experts in subject matter advising you of the risks involved with the
work. Often they are in other departments but their advice is second-to-none.
Checklists
Although we have a generic checklist, it is best to eventually develop a specific one for you
organization or type of project.
Lessons learned
Few organizations maintain a lessons learned database, but it is an invaluable tool. It’s a collection
of project summaries, a record of problems encountered, mistakes made, and what the project
manager would do differently in future projects. When you’re starting a new project and you spend
a few minutes reading that, how can you go wrong?
Documentation review
This involves learning about the project, its technical details, and its people. The higher risks will be
present in the non-standard tasks that haven’t been performed by the organization before.
Results from this stage will be listed in a
Risks are recorded in a Risk Register which should be frequently
reviewed to ensure that the risks are being appropriately
managed.
Excellent Examples of Risk Statement:
A thunderstorm may occur during lunch, causing
a cancellation of our outdoor luncheon.
If a low pressure systems moves across our
area, a thunderstorm may occur during lunch
leading to, a cancellation of our outdoor
luncheon.
Poor Examples of Risk Statements:
Bad weather (not specific enough)
Vehicle breakdown (not specific enough)
Risk analysis is carried out as part of the risk management plan.
Risk analysis is about understanding, assessing and prioritizing
the identified risks associated with a project and determining
which risk events warrant a response.
It involves evaluating the likelihood and potential consequences
of identified risks to determine their overall impact
PMBOK® Guide Fifth Edition defines Perform Qualitative Risk
Analysis “The process of prioritizing risks for further analysis or action
by assessing and combining their probability of occurrence and
impact.”
PMBOK® Guide Fifth Edition defines Perform Quantitative risk Analysis as
“—the process of numerically analyzing the effect of identified risks on
overall project objectives”
Note that both quantitative and qualitative use numbers for risk rating and
prioritization of risks. But qualitative is a subjective evaluation, whereas
quantitative is more objective in terms of value or cost terms.
In qualitative analysis, for example, the risk rating could be “5” or “10” after
multiplying the P and I values of the individual risks. For quantitative
analysis you establish the overall cost or time impact on the project, such
as: USD 4000 and the probability of it happening at 10%.
An example is given below:
Qualitative Risk Analysis (QLRA) Quantitative Risk Analysis (QTRA)
Performed first. Performed after qualitative analysis is
done.
Should be always done. Can be optional.
Examines individual project risks. Examines the combined effects of
risks on the project as a whole to
determine an overall project risk.
Day-to-day risk management is Overall project risk is important for
focused on individual project risks. strategic decision making and project
governance.
For smaller projects QLRA will For large projects, QTRA is needed to
suffice. QTRA is time-consuming and know the overall risk of the project.
hence may not be desired.
Risk scale is qualitative and can be Risk scale and scores are
textual (low, medium, high), color quantitative, typically specified in
coded, numeric (from 1 to 5) or some monetary and schedule terms.
combination.
The Risk Impact/Probability Chart is based on the principle that a
risk has two primary dimensions:
Probability – A risk is an event that "may" occur. The probability
of it occurring can range anywhere from just above 0 percent to
just below 100 percent. (Note: It can't be exactly 100 percent,
because then it would be a certainty, not a risk. And it can't be
exactly 0 percent, or it wouldn't be a risk.)
Impact – A risk, by its very nature, always has a negative impact.
However, the size of the impact varies in terms of cost and impact
on health, human life, or some other critical factor.
The chart allows you to rate potential risks on these two
dimensions. The probability that a risk will occur is represented on
one axis of the chart – and the impact of the risk, if it occurs, on
the other.
For each risk you need to be able to defend/justify the reasons for
each rating (very low to very high)
It is a good idea to establish definitions for your rating of each risk
Define what you mean by low, high etc……..
An example is given in the next slide
Qualitative Analysis : Probability and
Impact Analysis
What can you conclude from this example?
Probability and Impact Analysis tool will help in prioritizing risks
E.g. those risks that you need to attend urgently…….
In the above example “fire in data center” and “loss of power” are high
risk events.
You are part of a project management team working on the development
of a new smart home security system for residential customers. The
project involves designing hardware (security cameras and sensors),
creating software (a mobile app for remote monitoring), and coordinating
with vendors for production and distribution. The timeline for the project
is tight, as the product must be launched before the holiday season to
capitalize on market demand.
During the initial planning phase, your team has identified the following
potential risks:
Key components for the security cameras may not arrive on time due to supply
chain disruptions.
The mobile app may contain bugs that could impact functionality or user
experience
A competitor may launch a similar product with advanced features before your
product is ready.
Assess Likelihood and Impact…