Chapter 5

Managing Project Risk

 The Baseline Project Plan

Is based on:
– Our understanding of the current situation
Often the project sponsor or client demands results. They may not care how the project
team achieves its goal and objectives as long as it does. The project manager and project
team may rely on aggressive risk taking with little understanding of the impact of their
decisions

– The information available

Risk management and the consequent processes should not be viewed as an add-on to
the project planning process, but should be integrated throughout the project life cycle.
The best time to assess and plan for project risk is at the earliest stages of the project
when uncertainty for a project is the highest. Catastrophic problems or surprises may
arise that require more resources to correct than would have been spent earlier avoiding
them.

– The assumptions we make

Not having a standardized approach to risk management can overlook both threats and
opportunities. Consequently, more time and resources will be expended on problems that
could have been avoided; opportunities will be missed; decisions will be made without
complete understanding or information; the overall probability of success is reduced; and
catastrophic problems or surprises may occur without advanced warning.
 This Leads to Uncertainty

• Because…
– Estimates are really forecasts or predictions.
– Uncertainty is highest at the beginning of the project
because we don’t have all the information we would like
to have.
– Sometimes things happen that are out of our control.

• Although no one can predict the future with 100%

accuracy, having a solid foundation in terms of the
processes, tools, and techniques, can increase our
confidence in these estimates.
Effective and Successful Project Risk
Management Requires:
• Commitment by all stakeholders
To be successful, project risk management requires a commitment by all project
stakeholders. In particular, the project sponsor or client, senior management, the project
manager, and the project team must all be committed. For many managers, the first
impulse may be to shortcut or sidestep many of these processes at the first sign that the
project is in trouble. A firm commitment to a risk management approach will not allow these
impulses to override the project management and risk management processes that the
organization has in place.
• Stakeholder Responsibility
It is important that each risk have an owner. This owner is someone who will be involved in
the project, who will take the responsibility to monitor the project in order to identify any
new or increasing risks, and who will make regular reports to the project sponsor or client.
The position may also require the risk owner to ensure that adequate resources be
available for managing and responding to a particular project risk. However, the project
manager is responsible for ensuring that appropriate risk processes and plans are in place.
• Different Risks for Different Types of Projects
In a study that looked at IT project risks, they found that patterns of risk are different across
different types of IT projects. The implication is that each project has its own unique risk
considerations. To attempt to manage all projects and risks the same way may spell
disaster.
PMBOK Risk Management Processes
Project Management Book Of Knowledge

• Risk Management Planning. Determining how to approach and

plan the project risk management activities. An output of this process is the development of a risk
management plan.

• Risk Identification. Deciding which risks can potentially impact the project. Risk
identification generally includes many of the project stakeholders and requires an understanding of the
project's goal, as well as the project's scope, schedule, budget, and quality objectives.

• Qualitative Risk Analysis. Focusing on a qualitative analysis

concerning the impact and likelihood of the risks that were identified.

• Quantitative Risk Analysis. Using a quantitative approach for

developing a probabilistic model for understanding and responding to the risks identified.

• Risk Response Planning. Developing procedures and techniques

to reduce the threats of risks, while enhancing the possible opportunities.

• Risk Monitoring and Control. Providing an early warning system to

monitor identified risks and any new risks. This system ensures that risk responses have been
implemented as planned and had the effect as intended.
 PMBOK Definitions

• Risk
An uncertain event or condition that, if it occurs, has a
positive or negative effect on the project objectives.

• Risk Management
The systematic process of identifying, analyzing, and
responding to project risk. It includes maximizing the
probability and consequences of positive events and
minimizing the probability and consequences of
adverse events.
IT Project Risk Management Processes
Risk planning is the first step and begins with
having a firm commitment to the entire risk
management approach from all project
stakeholders. This commitment ensures that
adequate resources will be in place to properly
plan for and manage the various risks of the IT
project. These resources may include time,
people, and technology. Stakeholders also
must be committed to the process of
identifying, analyzing, and responding to
threats and opportunities.

Risk Identification. Once commitment

has been obtained and preparations have
been made, the next step entails
identifying the various risks to the project.
Both threats and opportunities must be
identified. When identifying threats to a
project, they must be identified clearly so
that the true problem, not just a symptom,
is addressed.
IT Project Risk Management Processes
Risk assessment. Once the project risks have been
identified and their causes and effects understood, the next
step requires that we analyze these risks. Risk assessment
provides a basis for understanding how to deal with project
risks.
Risk strategies. In addition to resource constraints,
an appropriate strategy will be determined by the
project stakeholders' perceptions of risk and their
willingness to take on a particular risk. Essentially, a
project risk strategy will focus on one of the
following approaches:
1. Accept or ignore the risk.
2. Avoid the risk completely.
3. Reduce the likelihood or impact of the risk (or
both) if the risk occurs.
4. Transfer the risk to someone else (Insurance)

In addition, triggers or flags in the form of metrics should be

identified to draw attention to a particular risk when it occurs.
This system requires that each risk have an owner to monitor
the risk and to ensure that resources are made available in
order to respond to the risk appropriately.

Once the risks, the risk triggers, and strategies or responses are
documented, this document then becomes the risk response plan.
IT Project Risk Management Processes
Risk evaluation. Responses to risks and
the experience gained provide keys to
learning. A formal and documented
evaluation of a risk event provides the
basis for lessons learned and lays the
foundation for identifying best practices.
This evaluation should consider the entire
risk management process from planning
through evaluation. It should focus on the
following questions:
• How did we do?
• What can we do better next time?
• What lessons did we learn?
• What best practices can be incorporated
in the risk management process?
The risk planning process is cyclical because
the evaluation of the risk responses and the risk
planning process can influence how an
organization will plan, prepare, and commit to IT
risk management.
IT Project Risk Management Framework

Identifying and understanding the risks that will

impact a project is not always a straightforward task.
Many risks can affect a project in different ways and
during different phases of the project life cycle.
Therefore, the process and techniques used to
identify risks must include a broad (wide) view of the
project and attempt to understand a particular risk's
cause and impact among the various project
components.
Risk Management Tools For Identifying
IT Project Risks
• Learning Cycles
• Brainstorming
• Nominal Group Technique
• Delphi Technique
• Checklists
• SWOT Analysis
• Cause & Effect (a.k.a. Fishbone/Ishikawa)
• Past Projects
 Identifying IT Project Risks
Learning Cycles
The project team and stakeholders can use this technique, whereby they identify
facts (what they know), assumptions (what they think they know), and
research (things to find out), to identify various risks.
Using these three categories, the group can create an action plan to test
assumptions and conduct research about various risks. Based on the team's
findings, both risks and lessons learned can then be documented.

Brainstorming
It is a less structured activity than learning cycles. Here the team could use the IT
risk framework and the WBS to identify risks (i.e., threats and opportunities)
starting with the phases of the project life cycle and working towards the
framework's core or MOV or working from the MOV outward toward the project
phases. The key to brainstorming is encouraging contributions from
everyone in the group. Thus, initially ideas must be generated without being
evaluated. Once ideas are generated by the group as a whole, they can be
discussed and evaluated by the group.
 Identifying IT Project Risks

Nominal Group Technique (NGT)

1. Each individual silently writes her or his ideas on a piece of paper
2. Each idea is then written on a board or flip chart one at a time in a
round-robin fashion until each individual has listed all of his or her ideas.
3. The group then discusses and clarifies each of the ideas.
4. Each individual then silently ranks and prioritizes the ideas.
5. The group then discusses the rankings and priorities of the ideas.
6. Each individual ranks and prioritizes the ideas again.
7. The rankings and prioritizations are then summarized for the group.
 Identifying IT Project Risks
Delphi Technique
If the time and resources are available, a group of experts can be assembled,
without ever having to meet face-to-face. Using the Delphi technique, a group of
experts are asked to identify potential risks or discuss the impact of a particular
risk. Initially, in order to reduce the potential for bias, the experts are not known to
each other. Their responses are collected and made available anonymously to
each other. The experts are then asked to provide another response based upon
the previous round of responses. The process continues until a consensus exists.
The advantage of using the Delphi technique is the potential for getting an insightful
view into a threat or opportunity; but the process takes time and may consume a
good portion of the project's resources.

Interviewing
Another useful technique for identifying and understanding the nature of IT project
risks is to interview various project stakeholders. This technique can prove useful
for determining alternative points of view; but the quality of the information derived
depends heavily on the skills of the interviewer and the interviewees, as well as the
interview process itself.
 Identifying IT Project Risks
Checklist
Checklists provide a structured tool for identifying risks that have occurred in the past. They allow the current
project team to learn from past mistakes or to identify risks that are known to a particular organization or
industry. One problem with checklists is that they can lead to a false sense of security—i.e., if we check off
each of the risks on the list, then we will have covered everything.

Example of a Risk Check List

Funding for the project has been secured

Funding for the project is sufficient

Funding for the project has been approved by senior management

The project team has the requisite skills to complete the project

The project has adequate manpower to complete the project

The project charter and project plan have been approved by senior
management or the project sponsor

The project’s goal is realistic and achievable

The project’s schedule is realistic and achievable

The project’s scope has been clearly defined

Processes for scope changes have been clearly defined
 SWOT Analysis

SWOT stands for Strengths, Weaknesses, Opportunities, and Threats.

Brainstorming, NGT, or the Delphi technique could be used to identify and understand the
nature of IT project risks by categorizing risks using this frame work. The usefulness of using
SWOT analysis is that it allows the project team to identify threats and opportunities as well as
their nature in terms of project or organizational strengths and weaknesses.
 Cause and Effect Diagram
The most widely known and used cause-and-effect diagram is the fishbone, or
Ishikawa, diagram developed by Kaoru Ishikawa to analyze the causes of poor
quality in manufacturing systems. The diagram can also be used for understanding
the causes or factors of a particular risk, as well as its effects. This technique itself
can be used individually or in groups by using the following steps:

– Identify the risk in terms of a threat or opportunity.

– Identify the main factors that can cause the risk to
occur.
– Identify detailed factors for each of the main
factors.
– Continue refining the diagram until satisfied that
the diagram is complete.
 Cause and Effect Diagram

The diagram shows the possible causes and effects of a key member of the team
leaving the project.
 IT Project Risk Management
Planning Process
• Risk Analysis
Risk = f(Probability * Impact)
• What is the probability of a particular risk occurring?
• What is the impact on the project if it does occur?

• Risk Assessment
Focuses on prioritizing risks so that an effective
strategy can be formulated for those risks that
require a response.
• Depends on Stakeholder risk tolerances
• You can’t respond to all risks!
 Risk Analysis and Assessment Tools
• Qualitative Approaches
– Expected Value
– Payoff Table
– Decision Trees
– Risk Impact Table
– Tusler’s risk classification scheme

• Quantitative Approaches
– Probability Distributions
• Discrete.
– Binomial
• Continuous
– Normal
– PERT
– Triangular
– Simulations
 Expected Value of a Payoff Table
The concept of expected value provides the basis for both qualitative and quantitative risk analysis. Expected
value is an average that takes into account both the probability and impact of various events or outcomes.

Schedule Risk A B AxB

Probability Payoff Prob. x Payoff
Project completed 20 days early 5% $200 000 $10 000
Project completed 10 days early 20% $150 000 $30 000
Project completed on schedule 50% $100 000 $50 000
Project completed 10 days late 20% $ -- $ --
Project completed 20 days late 5% $ (50 000) $ (3 000)
100% K$88 Expected Value

Assume that a project manager would like to determine the expected return or payoff associated
with several possible outcomes. These outcomes, in terms of possible schedule scenarios,
determine the profits the project will return to the firm. The project manger believes each outcome
has a probability of occurring and an associated payoff. The project manager's subjective beliefs
are summarized in the upper payoff table.
From the table we note, the project manager believes that the project has a small chance of
finishing twenty days early or twenty days late. The payoff for finishing the project early is quite
high, but there appears to be a penalty for completing the project late. As a result, the expected
value or return to the consulting firm is $88,000. Since each event is mutually exclusive (i.e., only
one of the five events can occur), the probabilities must sum to 100 percent.
 Decision Tree Analysis
The decision tree provides a visual, or
graphical, view of various decisions and
outcomes.

Assume that a project is going to

overrun its schedule and budget. The
project manager is contemplating
reducing the time allocated to testing
the application system as a way of
bringing the project back within its
original schedule and budget
objectives.

The project manager, then, is faced with a decision about whether the project team should conduct a full
systems test as planned or shorten the time originally allocated to testing. The cost of a full test will be $10,000;
but the project manager believes that there is a 95 percent chance the project will meet the quality standards
set forth by the client. In this case, no additional rework will be required and no additional costs will be incurred.
Since there is only a 5 percent chance the system will not meet the standards, the project manager believes
that it would only require a small amount of rework to meet the quality standards. In this case, it will cost about
$2,000 in resources to bring the system within standards.
 Decision Tree Analysis

Moreover, a failure will require more

rework and cost more to fix than if
these problems were addressed during
a full testing of the system. From the
figure we see that a limited testing of
the system will cost only $8,000, but
the chances of the system failing to
meet the quality standards increase.
Moreover, the time and cost to
complete the rework will be higher.

Even though the project manager still has a difficult decision to make, it now becomes a more informed
decision. If the project team continues with the testing activities as planned, there is a very good chance that
the system will not require a great deal of rework. On the other hand, reducing the time to test the system is
more of a gamble. Although there is a 30 percent chance the limited testing will save both time and money,
there is a high probability that the system will not pass or meet the quality standards. As a result, the required
rework will make the project even later and more over its budget.

If you were the project manager, what decision would you make?
 Risk Impact Table

Risk score, it does provide

mechanism for determining
which risks should be
monitored and which risks
may require a response.

The probabilities do not sum to 100

percent because the risks are not Potential impact associated with the risk event
mutually exclusive. In other words, occurring. This is a subjective estimate based on
none, some, or all of the risk events a score from 0 to 10, with zero being no impact
could occur. and ten having a very high or significant impact on
the project
Tusler’s Risk
Classification Scheme

Kittens : These risks that have a low probability of occurring and a low impact on the project.

Tigers : These types of risks have a high probability of occurring and a high impact.

Puppies : They are similar to kittens, but can become a source of problems very quickly because
they have a high probability of occurring.

Alligators : They are not a problem if you know where they are, other wise, they can be.
Binomial Probability Distribution

Discrete probability distributions use only integer or whole numbers

where fractional values are not allowed or do not make sense. For
example, flipping a coin has only two outcomes -heads or tails. 50%
- 50% chance for each.
 Normal Distribution
• Shape is determined by its mean
(µ) and standard deviation (σ)
• Probability is associated with area
under the curve.
• Since the distribution is
symmetrical, the following
probability rules of thumb apply
– About 68 percent of all the
values will fall between +1 σ of
the mean
– About 95 percent of all the
values will fall between +2 σ of
the mean
– About 99 percent of all the
values will fall between +3 σ of
the mean
 PERT Distribution
PERT (a=2,m=4,b=8)

PERT distribution uses a three-point

estimate where:
– a denotes an optimistic estimate
– m denotes a most likely estimate
– b denotes a pessimistic estimate

PERT Mean = (a + 4m + b) / 6
PERT Standard Deviation = (b - a) / 6
 Triangular Distribution

• uses a three-point estimate similar

to the PERT distribution where:
a denotes an optimistic estimate
m denotes a most likely estimate
b denotes a pessimistic estimate

• weighting for the mean and

standard deviation are different
from PERT

TRIANG Mean = (a + m + b) / 3

TRIANG Standard Deviation =

[((b-a)2 + (m-a)(m-b)) /18]1/2
 Simulations
if you wanted to study projects, you might randomly select a certain number of projects
and then collect data about certain attributes in order to make comparisons.

• Monte Carlo
– a technique that randomly generates specific values
for a variable with a specific probability distribution.
– goes through a specific number of iterations or trials
and records the outcome.
– For example, instead of flipping a coin five hundred times and then recording the
outcome to see whether we get about the same number of heads as we do tails,
a Monte Carlo simulation can literally flip the coin five hundred times and record
the outcome for us.

• Sensitivity Analysis
– Tornado Graph
 Example Analysis

Assume that a project manager has a project with five tasks (A through E) and has
created a project plan using Microsoft Project. As we can see from the figure, the
project is estimated to be completed in sixteen days. However, each task has a level
of uncertainty in terms of each task's estimated duration. Tasks A and D follow a
PERT distribution, while Tasks B and C follow a triangular distribution. In addition,
Task E follows a normal distribution.
The distributions and values are listed in the @Risk Functions column created by
the @Risk add-on.
 Output from Monte Carlo Simulation

The Monte Carlo simulation using @Risk was set The cumulative probability distribution view
to run five hundred iterations or trials. the probability of completing the project on
Each bar in the histogram shows the frequency, September 26, the end of the project
or number of times, an iteration generated a manager's original sixteen-day estimate, is
particular completion date for the project based less than 0.2 or 20%
on the probability distributions for the five tasks.
The project manager can assess the likelihood of
the project finishing on September 26
Sensitivity Analysis Using a Tornado Graph

Tornado graph summarizes the tasks with the most significant risks at the top. As the
risks are ranked from highest to lowest, the bars of the graph sometimes resemble a
tornado. The tornado graph allows us to compare the magnitudes of impact for each of
the tasks by comparing the size of each bar. As you can see, Task E has the greatest
potential for impacting the project's schedule.
 Risk Strategies

Depends On:
– The nature of the risk itself
Really a threat or an opportunity?

– The impact of the risk on the project’s MOV and objectives

 What is the probability and impact of a risk

– The project’s constraints in terms of scope, schedule,

budget, and quality
Can a response be made with existing resources and/or constraints?

– Risk Tolerances or preferences of the project stakeholders

How much risk is tolerable?

MOV : Measurable Organizational Value

 IT Project Risk Management
Planning Process
Risk Strategies
Accept or ignore the risk.
– Management Reserves; controlled and released by senior management, are not included in the project's
budget

– Contingency Reserves; controlled and released by the project manager, are included in the project's budget

– Contingency Plans; alternative plan or plan B such as disaster recovery plan

Avoid the risk completely, eliminate or prevent the possibility of the threat occurring.
Reduce the likelihood or impact of the risk (or both) if the risk
occurs. lessening the probability and/or the impact of threat if it does occur.
Transfer the risk to someone else. Insurance against a particular risk or subcontracting a
portion of the project work to someone who may have more knowledge or expertise in the particular area.
Risk Response Plan should include:
• The project risk
• The trigger which flags that the risk has occurred
• The owner of the risk (i.e., the person or group
responsible for monitoring the risk and ensuring that
the appropriate risk response is carried out)
• A risk response based on one of the four basic risk
strategies
 IT Project Risk Management
Planning Process
• Risk Monitoring and Control
• Risk Response
• Risk Evaluation
– How did we do?
– What can we do better next time?
– What lessons did we learn?
– What best practices can be incorporated in
the risk management process?
 Risk Monitoring and Control

Tools for monitoring and controlling project risk

– Risk Audits by external people. Using outsiders provides a fresh perspective;

the project team may be too close to the project and miss significant threats or opportunities.

– Risk Reviews by internal team members. These reviews should be

part of each team meeting and part of the project team's learning cycles.

– Risk Status Meetings and Reports, a monitoring and control system

should provide a formal communication system for monitoring and controlling project risks.
 Project Risk Radar

Monitoring project
risks is analogous
to a radar scope
where threat and
opportunities may
present themselves
at different times.
 Risk Response and Evaluation

Lessons learned and best practices help us to:

– Increase our understanding of IT project risk in general.
– Understand what information was available to managing
risks and for making risk-related decisions.
– Understand how and why a particular decision was
made.
– Understand the implications not only of the risks but also
the decisions that were made.
– Learn from our experience so that others may not have
to repeat our mistakes.
Risk Scenario - Marketing
A company that supplies food to a supermarket chain is concerned that a new
product it intends to launch will not sell.
– List the consequences for the company and the supermarket if the product
does not sell.
– Suggest a strategy for reducing the risks to both companies.

Consequences
Marketing a new product is always risky, the simple question is "will the product sell?"
Some consequences of the product not selling for the product manufacturer are:
• The money spent on developing the new product would be lost.
• The money spent on setting up production of the new product would be lost- this.
• The money spent on literature and marketing for the new product would be.
• The opportunity of generating income from the new product would be lost.

Some consequences of the product not selling for the supermarket are not so severe.
The money spent on purchasing products from the manufacturer would be lost.
The space made available for displaying the new product would not generate any
income- there would be an opportunity loss.
Risk Scenario - Marketing
A company that supplies food to a supermarket chain is concerned that a new
product it intends to launch will not sell.
– List the consequences for the company and the supermarket if the product
does not sell.
– Suggest a strategy for reducing the risks to both companies.

Possible Strategies
The new product manufacturer could (should?):
• Carryout research to identify the target market for the product
• Carryout market research to identify similar competitor products
• Test small quantities of the product on samples of the target market- the supermarket
may collaborate in this
• Produce pilot runs of the product, say in a small number of selected supermarket
locations. This would not involve full production setup and marketing costs. The
supermarket would probably collaborate in this.
• Analyze the data of all the activities objectively, before committing to full production of
the product.
The supermarket could make the supplier of the new product cover the costs any tests
and pilot runs it collaborates on.
Risk Scenario - Production
A drug company intends to use a new type of plastic bottle for a
range of its products. The bottles will be produced in very high
volumes and are to have a child proof lid.
– List the consequences to the company if the lid does not operate correctly.
– Suggest a strategy for reducing the risks.
The packaging of drugs and medicines is risky. The risks, the consequences of which may prove
fatal or very damaging to children, involve legal, commercial and company image issues. If the lid
does not operate correctly a child may take a drug with serious and/or fatal consequences.

Consequences could involve:

• Litigation for compensation- very expensive and time consuming.
• Loss of customer confidence- very expensive and damaging in both the short and long
term.
• Product recall, if several products use the same container and lid, they may all have to be
recalled- very expensive.
• Product recall may result in suspending sales, with serious loss of income.
• Re-tooling: high volume products containers and lids are produced in plastic. Plastic
injection
moulding tools are expensive and difficult to "get right first time".
• Simple plastic injection tools are made in 2 halves and one tool may be used to produce
numerous lids.
• Plastic mouldings are manufactured by a moulding company and this may not be the same
company that produces the moulding tool.
Risk Scenario - Production
A drug company intends to use a new type of plastic bottle for a
range of its products. The bottles will be produced in very high
volumes and are to have a child proof lid.
– List the consequences to the company if the lid does not operate correctly.
– Suggest a strategy for reducing the risks.

Some possible strategies are:

Use computer aided design (CAD) tools to produce the drawings for the final lid and container
Use the output of the CAD tools to produce realistic versions of the lid and container, before
committing to tooling. The output of the CAD tools are used "build" a solid version of the plastic
components. This allows the components to be checked for correct operation and
appearance before committing to tool design.
The tool designer and manufacturer should be made to work with manufacturer of the plastic
components as the tool is being developed. Both companies should take responsibility for the
production of the plastic parts.
The tool should be designed to allow for small adjustments to be made to it to allow the plastic parts
to be "fine tuned".
A small batch of containers and lids should be produced, using production settings for the tools and
the plastic injection machines. These should be tested and analyzed thoroughly before approving
volume production.
In production the moulding tool should be checked regularly and maintained correctly.
100% testing should be considered for each container/lid.
Initial use of the new lid and containers should be confined to a small range of company products.
Risk Scenario - Design
A engineering company is to design product that is functionally complex. The product will be
produced and sold in large volumes. A major problem in developing new electronic based products
that are to be used in Europe is that they must comply with the EC directive. Only production
products can be tested for compliance, prototypes cannot be used.
– List the consequences to the company if the production of the version of the product does not
comply with the EC directive.
– Suggest a strategy for reducing the risk.

If the product does not comply with the relevant EC directives it could require a major redesign. For
example this could involve redesign of the case, the electronic circuitry, and possibly the product
display.
Some possible consequences are:
• Financial - the cost of a redesign.
• Time to market would be increased, resulting in loss of income.
• If the product is for an external customer, the customer may cancel the development.
• Any other projects in the pipeline may be delayed.
Some possible strategies are:
• Use simulation techniques (AED tools) to check product performance and compliance before
any
hardware is built.
• Use pre-compliance testing of product prototypes, before committing to full production.
• Purchase in-house pre-compliance EMC test equipment, which is cheaper that full compliance
testing equipment. This allows the product to be tested at the prototype stage during the
development phase.