11: Project Risk Management

IT4306– IT Project Management

Level II - Semester 4

© e-Learning Centre, UCSC

 Intended Learning Outcomes

• At the end of this lesson, you will be able to;

• Describe what the risk is and the importance

of managing it

• List the elements involved in the project risk

management and contents in risk
management plan

• Identify common sources of risks in

information technology projects
© e-Learning Centre, UCSC 2
 Intended Learning Outcomes

• At the end of this lesson, you will be able to;

• Explain the qualitative risk analysis process

and how to calculate risk factors

• Create probability/impact matrixes, apply

the Top Ten Risk Item Tracking technique,
and use expert judgment to rank risks

• Explain the quantitative risk analysis process

and how to apply decision trees
© e-Learning Centre, UCSC 3
 11.1. The Importance of Project Risk
Management
• Project risk management is the art and science
of identifying, analyzing, and responding to
risk throughout the life of a project and in the
best interests of meeting project objectives.

• Risk management is often overlooked in

projects, but it can help improve project
success by helping select good projects,
determining project scope, and developing
realistic estimates.

© e-Learning Centre, UCSC 4

 Research Shows Need to Improve Project
Risk Management
• Study by Ibbs and Kwak shows risk has the
lowest maturity rating of all knowledge areas.
• KLCI study shows the benefits of following
good software risk management practices.
• KPMG study found that 55 percent of runaway
projects—projects that have significant cost or
schedule overruns—did no risk management at
all.*

*Cole, Andy, “Runaway Projects—Cause and Effects,” Software World, Vol. 26, no. 3, pp.
3–5 (1995).

© e-Learning Centre, UCSC 5

 Project Management Maturity by Industry
Group and Knowledge Area*
KEY: 1 = LOWEST MATURITY RATING 5 = HIGHEST MATURITY RATING

Engineering/ Telecommunicatio Informati Hi-Tech

Knowledge Construction ns on Manufacturing
Area Systems
Scope 3.52 3.45 3.25 3.37
Time 3.55 3.41 3.03 3.50
Cost 3.74 3.22 3.20 3.97
Quality 2.91 3.22 2.88 3.26
Human 3.18 3.20 2.93 3.18
Resources
Communication 3.53 3.53 3.21 3.48
s
Risk 2.93 2.87 2.75 2.76
Procurement 3.33 3.01 2.91 3.33
*Ibbs, C. William and Young Hoon Kwak. “Assessing Project Management Maturity,”
Project Management Journal (March 2000).
© e-Learning Centre, UCSC 6
 Benefits from Software Risk Management
Practices*

*Kulik, Peter and Catherine Weber, “Software Risk Management Practices – 2001,” KLCI
Research Group (August 2001).

© e-Learning Centre, UCSC 7

 Negative Risk

• A dictionary definition of risk is “the possibility

of loss or injury.”

• Negative risk involves understanding potential

problems that might occur in the project and
how they might impede project success.

• Negative risk management is like a form of

insurance; it is an investment.

© e-Learning Centre, UCSC 8

 Risk Can Be Positive

• Positive risks are risks that result in good things

happening; sometimes called opportunities.

• A general definition of project risk is an

uncertainty that can have a negative or positive
effect on meeting project objectives.

• The goal of project risk management is to

minimize potential negative risks while
maximizing potential positive risks.

© e-Learning Centre, UCSC 9

 Risk Utility

• Risk utility or risk tolerance is the amount of

satisfaction or pleasure received from a
potential payoff.

• Utility rises at a decreasing rate for people

who are risk-averse.
• Those who are risk-seeking have a higher
tolerance for risk and their satisfaction
increases when more payoff is at stake.
• The risk-neutral approach achieves a balance
between risk and payoff.

© e-Learning Centre, UCSC 10

Risk Utility Function and Risk Preference

© e-Learning Centre, UCSC 11

 Project Risk Management Processes

• Risk management planning: Deciding how to

approach and plan the risk management
activities for the project.

• Risk identification: Determining which risks

are likely to affect a project and documenting
the characteristics of each.

• Qualitative risk analysis: Prioritizing risks

based on their probability and impact of
occurrence.
© e-Learning Centre, UCSC 12
 Project Risk Management Processes
(cont’d)
• Quantitative risk analysis: Numerically
estimating the effects of risks on project
objectives.

• Risk response planning: Taking steps to

enhance opportunities and reduce threats to
meeting project objectives.

• Risk monitoring and control: Monitoring

identified and residual risks, identifying new
risks, carrying out risk response plans, and
evaluating the effectiveness of risk strategies
throughout the life of the project.
© e-Learning Centre, UCSC 13
 11.2. Risk Management Planning

• The main output of risk management planning

is a risk management plan—a plan that
documents the procedures for managing risk
throughout a project.

• The project team should review project

documents and understand the organization’s
and the sponsor’s approaches to risk.

• The level of detail will vary with the needs of

the project.
© e-Learning Centre, UCSC 14
 Topics Addressed in a Risk Management
Plan
• Methodology
• Roles and responsibilities
• Budget and schedule
• Risk categories
• Risk probability and impact
• Risk documentation

© e-Learning Centre, UCSC 15

 Contingency and Fallback Plans,
Contingency Reserves
• Contingency plans are predefined actions that
the project team will take if an identified risk
event occurs.
• Fallback plans are developed for risks that
have a high impact on meeting project
objectives and are put into effect if attempts to
reduce the risk are not effective.
• Contingency reserves or allowances are
provisions held by the project sponsor or
organization to reduce the risk of cost or
schedule overruns to an acceptable level.

© e-Learning Centre, UCSC 16

 11.3. Familiar Sources of Risk on IT
Projects

• Several studies show that IT projects share

some common sources of risk.

• The Standish Group developed an IT success

potential scoring sheet based on potential risks.

• Other broad categories of risk help identify

potential risks.

© e-Learning Centre, UCSC 17

Information Technology Success Potential
Scoring Sheet
Success Criterion Relative Importance
User Involvement 19

Executive Management support 16

Clear Statement of Requirements 15

Proper Planning 11
Realistic Expectations 10

Smaller Project Milestones 9

Competent Staff 8

Ownership 6
Clear Visions and Objectives 3

Hard-Working, Focused Staff 3

Total 100

© e-Learning Centre, UCSC 18

 Broad Categories of Risk

• Market risk
• Financial risk
• Technology risk
• People risk
• Structure/process risk

© e-Learning Centre, UCSC 19

 Risk Breakdown Structure

• A risk breakdown structure is a hierarchy of

potential risk categories for a project.

• Similar to a work breakdown structure but

used to identify and categorize risks.

© e-Learning Centre, UCSC 20

Sample Risk Breakdown Structure

© e-Learning Centre, UCSC 21

 Potential Negative Risk Conditions
Associated With Each Knowledge Area
Knowledge Area Risk Conditions
Integration Inadequate planning; poor resource allocation; poor integration
management; lack of post-project review
Scope Poor definition of scope or work packages; incomplete
definition of quality requirements; inadequate scope control
Time Errors in estimating time or resource availability; poor allocation
and management of float; early release of competitive products
Cost Estimating errors; inadequate productivity, cost, change, or
contingency control; poor maintenance, security, purchasing,
etc.
Quality Poor attitude toward quality; substandard
design/materials/workmanship; inadequate quality
assurance
program
Human Resources Poor conflict management; poor project organization
and definition of responsibilities; absence of
leadership
Communications Carelessness in planning or communicating; lack of consultation
with key stakeholders
Risk Ignoring risk; unclear assignment of risk; poor insurance
management
Procurement Unenforceable conditions or contract clauses; adversarial
relations © e-Learning Centre, UCSC 22
 11.4. Identifying Risks

• Risk identification is the process of understanding

what potential events might hurt or enhance a
particular project.
• Risk identification tools and techniques include:
• Brainstorming
• The Delphi Technique
• Interviewing
• SWOT analysis

© e-Learning Centre, UCSC 23

 11.5. Qualitative Risk Analysis

• Assess the likelihood and impact of identified

risks to determine their magnitude and priority.

• Risk quantification tools and techniques

include:
• Probability/impact matrixes
• The Top Ten Risk Item Tracking
• Expert judgment

© e-Learning Centre, UCSC 24

 Probability/Impact Matrix

• A probability/impact matrix or chart lists the

relative probability of a risk occurring on one side
of a matrix or axis on a chart and the relative
impact of the risk occurring on the other.
• List the risks and then label each one as high,
medium, or low in terms of its probability of
occurrence and its impact if it did occur.
• Can also calculate risk factors:
• Numbers that represent the overall risk of
specific events based on their probability of
occurring and the consequences to the project
if they do occur.

© e-Learning Centre, UCSC 25

Sample Probability/Impact Matrix

© e-Learning Centre, UCSC 26

Sample Probability/Impact Matrix for
Qualitative Risk Assessment

© e-Learning Centre, UCSC 27

Chart Showing High-, Medium-,
and Low-Risk Technologies

© e-Learning Centre, UCSC 28

 Top Ten Risk Item Tracking

• Top Ten Risk Item Tracking is a qualitative risk

analysis tool that helps to identify risks and
maintain an awareness of risks throughout the
life of a project.

• Establish a periodic review of the top ten

project risk items.

• List the current ranking, previous ranking,

number of times the risk appears on the list
over a period of time, and a summary of
progress made in resolving the risk item.
© e-Learning Centre, UCSC 29
 Example of Top Ten Risk Item Tracking
Monthly Ranking
Risk Item This Last Number Risk Resolution
Month Month of Months Progress

Inadequate 1 2 4 Working on revising the

planning entire project plan
Poor definition 2 3 3 Holding meetings with
of scope project customer and
sponsor to clarify scope
Absence of 3 1 2 Just assigned a new
leadership project manager to
lead
the project after old
one quit
Poor cost 4 4 3 Revising cost estimates
estimates
Poor time 5 5 3 Revising schedule
estimates estimates

© e-Learning Centre, UCSC 30

 Expert Judgment

• Many organizations rely on the intuitive

feelings and past experience of experts to help
identify potential project risks.

• Experts can categorize risks as high, medium,

or low with or without more sophisticated
techniques.

• Can also help create and monitor a watch list,

a list of risks that are low priority, but are still
identified as potential risks.

© e-Learning Centre, UCSC 31

 11.6. Quantitative Risk Analysis

• Often follows qualitative risk analysis, but both

can be done together.

• Large, complex projects involving leading edge

technologies often require extensive
quantitative risk analysis.

• Main techniques include:

• Decision tree analysis
• Simulation
• Sensitivity analysis

© e-Learning Centre, UCSC 32

 Decision Trees and Expected Monetary
Value (EMV)
• A decision tree is a diagramming analysis
technique used to help select the best course
of action in situations in which future
outcomes are uncertain.
• Estimated monetary value (EMV) is the
product of a risk event probability and the risk
event’s monetary value.
• You can draw a decision tree to help find the
EMV.

© e-Learning Centre, UCSC 33

Expected Monetary Value (EMV) Example

© e-Learning Centre, UCSC 34

 Using Software to Assist in Project Risk
Management
• Risk registers can be created in a simple Word
or Excel file or as part of a database.

• More sophisticated risk management software,

such as Monte Carlo simulation tools, help in
analyzing project risks.

• The PMI Risk Specific Interest Group’s Web site

at [Link] has a detailed list of
software products to assist in risk
management.

© e-Learning Centre, UCSC 35

Results of Good Project Risk Management

• Unlike crisis management, good project risk

management often goes unnoticed.

• Well-run projects appear to be almost

effortless, but a lot of work goes into running a
project well.

• Project managers should strive to make their

jobs look easy to reflect the results of well-run
projects.

© e-Learning Centre, UCSC 36

 Summary

• Project risk management is the art and science

of identifying, analyzing, and responding to risk
throughout the life of a project and in the best
interests of meeting project objectives.

• Main processes include:

• Risk management planning
• Risk identification
• Qualitative risk analysis
• Quantitative risk analysis
• Risk response planning
• Risk monitoring and control
© e-Learning Centre, UCSC 37