Created by ejlp12@gmail.
com, June 2010
11 - Project Risk Management
Project Management Training
Project Risk Management
Monitoring &
Controlling Processes
Planni
ng
Processes
Enter phase/ Initiating Closing Exit phase/
Start project Processes Processes End project
Executing
Processes
Knowled Process
ge Initiating Planning Executing Monitoring & Closing
Area Contol
Plan Risk
Management
Risk Identify Risk Monitor and Control
Perform Qualitative Risk Risks
Analysis Perform
Quantitative Risk Analysis
Plan Risk Response
Project Risk Management
• Risk is an uncertain event or condition that, if occurs, has an
effect
on at least one project objective.
• Risk management objectives:
– increase the probability and impact of positive events (opportunities).
– decrease the probability and impact of negative events (threat).
• Terms & concepts:
– Uncertainty: a lack of knowledge about an event that reduces confidence
– Risk averse: someone who does not want to take risks.
– Risk tolerances: area of risk that are acceptable/unacceptable.
– Risk thresholds: the point at which a risk become unacceptable
• Remember that in this area there is no activity in executing process group
Project Risk Management
Risk factors
2. 3. 4.
1. The range Expected The
The of possible timing anticipated
probability outcome (when) in frequency of
that it will (impact) the project risk event
occur life cycle (how often)
11.1 Plan Risk Management
• The process of defining how to conduct risk management activities
for a project.
Tools &
Inputs Outputs
Techniques
1. Project scope statement 1. Planning meetings 1. Risk management
2. Cost management plan and analysis plan
3. Schedule
management plan
4. Communication
management plan
5. Enterprise
environmental factors
6. Organizational
process assets
Plan Risk Management
• Importance of Risk Management Planning
– Ensure that the degree, type, and visibility of risk management are commensurate
– Provide sufficient resource and time for risk management activities
– Establish an agreed-upon basis for evaluating risk
• Risk Categories
– A standard list of risk categories can help to make sure areas of risk are not
forgotten.
– Companies and PMO should have standard list of risk categories to help identify
risk.
• 2 Main type of Risk
– Business – Risk of gain or loss
– •Pure (insurable) risk – Only a risk of loss (i.e. fire, theft, personal injury, etc)
Sources of risk = risk categories
• Risk categories may be structured into Risk Breakdown Structure (RBS)
Risk Management Plan
• Risk management plan describe how risk management will be structured
and performed on the project.
• Subset of project management plan.
• May includes:
Methodology
Roles & responsibilities
Budgeting
Timing
Risk categories.
Definition of probability and impact
Stakeholder tolerances
Reporting formats
Tracking
Probability and impact matrix (?)
8.2 Identify Risk
• The process of obtaining seller responses, selecting a seller, and
awarding a contract.
Tools &
Inputs Outputs
Techniques
1. Project 1. Documentation 1. Risk register
management reviews
plan 2. Information
2. Procurement gathering
documents techniques
3. Source selection 3. Checklist analysis
criteria 4. Assumptions
4. Qualified seller list analysis
5. Seller proposals 5. Diagrammin
6. Project g
documents techniques
7. Make-or-buy 6. SWOT
decisions Q: Who should be involved
analysis in risk
8. Teaming 7. Expert
agreements
iAd:eEnVtifEicRaYtioOnN?E
judgment
9. Organizational
Identify Risk
• Risk should be continually reassessed (iterative) such as in integrated
change control activity, when working with resources, when dealing with
issues.
• Information gathering techniques
– Brainstorming
– Delphi technique: Expert participate anonymously; facilitator use questionnaire; consensus
may be reached in a few rounds; Help reduce bias in the data and prevent influence each
others.
– Interviewing: interviewing experts, stakeholders, experienced PM
– Root cause analysis: Reorganizing the identified risk by their root cause may help identify
more
risks
• Checklist analysis: checklist developed based on accumulated historical information from
previous similar project
• Assumption analysis: identify risk from inaccuracy, instability, inconsistency, incompleteness.
• SWOT analysis – Strengths, Weaknesses, Opportunities, Threats
Diagramming techniques
• Cause and effect diagrams (fish-bone
diagram) Described in Quality
Management
• System or process flow charts.
• Influence
– show thediagrams
casual influences among project variables, the timing or time ordering of events,
and the relationships among other project variables and their outcomes.
– excellent for displaying a decision’s structure
Risk Register
• After Indentify Risk process the output is initial entries into the risk
register. It includes:
List of risk
List of POTENTIAL responses
Root causes of risks
Updated risk categories
11.3 Perform Qualitative Risk Analysis
• The process of prioritizing risks for further analysis of action by
assessing and combining their probability of occurrence and impact.
Tools &
Inputs Outputs
Techniques
1. Risk register 1. Risk probability 1. Risk register updates
2. Risk management and impact
plan assessment
3. Project scope 2. Probability and
statement impact matrix
4. Organizational 3. Risk data
process quality
assets assessment
4. Risk
categorization
5. Risk
urgency
assessment
6. Expert
judgment
Qualitative Risk Analysis
• Help to focus on high priority risks
• A subjective analysis
• Analysis using…
– Relative probability or likelihood of occurrence
– Impact on project objective
– Time frame response
– Organization’s risk tolerance
– Etc.
• Can be also used to:
– Compare risk to the overall risk of other projects
– Determine whether the project should be selected, continued or
terminated.
– Determine whether to proceed to Perform Quantitative Risk Analysis
Probability Impact
Matrix
• Different matrices can be used for cost, time, scope
• It helps guide risk responses (priority action & response
strategies)
Colors shows
level of
importance
PROB RISK
No Category Description of Risk IMPACT
A LEVE
BILITY L
1 Resource Testing environment not 4 B ORANGE
available
Documentation approval took
2 Schedule 4 A RED
longer time
Risk Register
Updates
• Update/add additional information to previous output i.e.
Risk Register, which include:
– Relative ranking/priority
– Risk grouped by categories
– List of risk requiring additional analysis in the near term
– List of risk for additional analysis and response
– Watch-list (non-critical or non-top risks)
– Trends
Since risk analysis process is iterative, PM should know if risk is increasing,
decreasing or staying the same
– Cause of risk requiring particular attention
11.4 Perform Quantitative Risk Analysis
• The process of numerically analyzing the effect of identified risks on
overall project objectives.
Tools &
Inputs Outputs
Techniques
1. Risk register 1. Data gathering 1. Risk register updates
2. Risk management and
plan representation
3. Cost management techniques
plan 2. Quantitative risk
4. Project scope analysis and
statement modeling
5. Organizational techniques
process assets 3. Expert judgment
If not necessary, this process may be
skipped.
Quantitative Risk Analysis
• Is a numerical evaluation (more objective)
• This process may be skipped.
• Purpose of this process
– Determine which risk events warrant a response.
– Determine overall project risk (risk exposure).
– Determine the quantified probability of meeting project
objectives.
– Determine cost and schedule reserves.
– Identify risks requiring the most attention.
– Create realistic and achievable cost, schedule, or scope
targets.
Quantitative Risk Analysis: Tools & Techniques
• Determining Quantitative Probability and Impact might be done
by:
– Interviewing
– Cost and time estimating
– Delphi technique
– Use of historical records from previous projects
– Expert judgment
– Sensitivity analysis – tornado diagram
– Expected monetary value (EMV) analysis
– Decision tree
– Monte Carlo analysis (simulation)
Decision Tree and EMV
EVM (Probability) (Impact)
• EVM used with Decision Tree to choose between many alternative which take
into account the future events
• Example:
Example Source:
Sensitivity Analysis
• To determine which risks have the most potential impact to the
project
• Changing one or more elements/variables and set other elements
to its baseline then see the impact.
• One typical display of sensitivity analysis is the tornado diagram
Risk Register Updates
• Update/add additional information to previous output i.e.
Risk Register, which include:
– Prioritize list of quantified risks
– Amount of contingency time and cost reserve needed
– Possible realistic and achievable completion dates, project cost,
with confidence level
– The quantified probability of meeting project objectives
– Trends
11.5 Plan Risk Response
• The process of developing option and action to enhance opportunities
and to reduce threats to project objectives.
Tools &
Inputs Outputs
Techniques
1. Risk register 1. Strategies for 1. Risk register updates
2. Risk management negative 2. Risk-related contract
plan risks or threats decisions
3. Cost management 2. Strategies for 3. Project
plan positive risks or management
4. Project scope opportunities plan updates
statement 3. Contingent
4. Project
5. Organizational response
document
process assets strategies
updates
4. Expert judgment
Plan Risk Responses/Mitigation
• Do something to eliminate threats before they happens
• Do something to make sure the opportunities happens
• Decrease the probability and/or impact of threats
• Increase the probability and/or impact of opportunities
• For the remaining (residual) threats that cannot be
eliminated:
– Do something if the risk happens (contingency plan).
– Do something if contingency plan not effective (fallback plan)
Strategies for Threats
• Avoid
– Eliminate the threat entirely
– Isolate project objectives from the risk’s impact
• Transfer (Deflect, Allocate)
– Shift some or all the negative impact of a threat to a third party
• Mitigate
– Implies a reduction in the probability and/or impact of an adverse risk
event
to be within acceptable threshold limits
• Accept
– Deal with the risks
– Project management plan is not changed
Transferring a risk will leave some risk
behind.
Strategies for Opportunities
• Exploit
– Seek to ensure the opportunities definitely happen
• Share
– Allocate some or all of the ownership of the opportunity to a third party
who is best able to capture the opportunity for the project benefit.
• Enhance
– Increase the probability and/or the positive impacts of an opportunity.
• Accept
– Not actively pursuing an opportunity
11.6 Monitor & Control Risk
• The process of ..
– implementing risk response plans,
– tracking identified risks,
– monitoring residual risks,
– identifying new risks, and
– evaluating risk process effectiveness throughout the
project.
Tools &
Inputs Outputs
Techniques
1. Risk register 1. Risk reassessment 1. Risk register updates
2. Project 2. Risk audits 2. Organizational
management 3. Variance and trend process assets
plan analysis updates
3. Work 4. Technical 3. Change requests
performance performance 4. Project
information measurement
management
4. Performance 5. Reserve analysis
plan updates
report 6. Status meetings
5. Project
document
Risk Monitoring & Controlling
• Other purposes are to determines if
– Project assumptions are still valid
– Risk has changed or can be retired
– Risk management policy & procedure are being
followed
– Align contingency reserves with current risk
assessment
BACKUP SLIDES
Important Terms
• Mutual Exclusive: if two events cannot both occur in a single trial
• Probability: something will occur
• Normal Distribution: common probability density distribution chart
• Statistical independence: the probability of one event occurring does not affect
the probability of another event occurring
• Standard deviation (or Sigma): how far you are from the mean
• 3 or 6 sigma
– Represent the level of quality has decided to try to achieve
– 6σ is higher quality standard than 3σ
– Used to calculate the upper and lower control limits in a control chart
Percentage of occurrences
Number of σ between two control
limits
1 68.26%
2 95.64%
3 99.73%
6 99.99985%
Example: Definition of Risk Probability and Impact
• This should be defined in Risk
Management Plan
• Required for Perform Qualitative Risk
Analysis
• Can reduce the influence of bias
Image Source: PMBOK Guide 4th Edition. PMI © 2009, p.281
Example: Risk Breakdown Structure (RBS)
• Showing risk categorization
• Help to ensure a comprehensive process of systematically identifying
risk to a consistent level of detail
Image Source: PMBOK Guide 4th Edition. PMI © 2009, p.281
Example: Influence Diagram
• Diagramming technique used when Identify
Risk
Decision Node
ValueNode
Usage
decision
Test
Survey Economic
Value
Chance event Net
Node Human Value
Exposure Cancer
Cost
Cancer
Risk
Carcinogenic
potential
Image Source: Influence Diagram & Decision Trees, Lecture slide MHA 6350, Dr. Lloyd R. Burton
Next topic:
Project Procurement Management
Thank You