Managing Risks
1
Introduction
•Great deeds are usually wrought at great risk.
»Herodotus, Greek Historian
2
Introduction
•No amount of planning can overcome risk,
•Risk is an uncertain event or condition that, if it
occurs, has positive or negative effect on project
objectives.
•A risk has a cause and, if it occurs a
consequence.
3
What is a Risk?
•Risk is the possibility of suffering loss.
•Forms of loss:
–diminished quality of the end product,
–increased costs,
–delayed completion, or
–failure.
Introduction
•Some potential risk events can be identified
before the project starts – e.g. equipment
malfunction or change in technical
requirements.
5
Risk versus Opportunity
•Risk and opportunity go hand in hand.
•The opportunity for advancement cannot be
achieved without taking risk.
Risk versus Opportunity
•"Risk in itself is not bad;
•risk is essential to progress, and failure is
often a key part of learning.
•balance risk against opportunity."
Risk Management
•Attempts to recognize and manage potential
and unforeseen trouble spots that may occur
when the project is implemented.
8
Risk Management Process
•The establishment of mechanisms to keep risks
under review and to make sure they are being
addressed.
•A means of identifying the potential risks to the
project.
•An assessment of the likelihood of each risk
materialising.
(cont)
•An assessment of the probable impact of each
risk.
•The formulation of measures to avoid each risk
occuring.
•The development of fallback measures to
mitigate the risks if avoidance actions fail.
•The determination of the urgency of the risk
and of taking appropriate counter measures.
Risk Identification
•Staff
–Do not work at the pace assumed
(inexperienced)
–Do not grasp and conform to standards
–Are difficult to manage
–Understaffed
(cont)
•Commercial Background
–Business case is unsound
–Funding not approved
–More than one customer
–Several suppliers (are thre
–Contract is inappropriate
–Solution: pre-project review procedure
(cont)
•The Contract
–Scope of work is ill-defined
–Penalty clauses for delay or underperformance
–Payment schedule is unclear
–Solution: Document any assumption and ask
the customer to approve them.
(cont)
•The Customer
–Access to important staff may be difficult
–Internal political difficulties
–Solution: make an early effort to get to know
the various parties; gain the support of key
people
(cont)
•The Users
–Not committed
–Unfamiliar with technology
–Unwilling to change working practice
–Solution: involve users; provide training;
persuade them in a more constructive approach
(cont)
•Acceptance
–Criteria and Mechanisms not defined
– Solution: test plan must be agreed; test
specifications; individual tests; whole system.
Risk Assessment
•Scenario Analysis
[Link] undesirable event
[Link] the outcomes of the event’s occurrence
[Link] magnitude or severity of the event’s impact
[Link]/probability of the event happening
[Link] the vent might occur in the project
[Link] with other parts of this or other projects.
19
Risk Assessment
•Urgency
–The urgency with which the risk is likely to
materialize.
–The urgency with which we need to take
avoidance or amelioration actions.
Probability Analysis
•The NPV
•Correlations between past project’s cash flow
and cumulative project cost curve-baseline-over
the life of the project have been used to assess
cash flow risks.
21
Risk Severity Matrix
•Red zone – major risk
•Yellow Zone – moderate risk
•Green Zone – minor risk
•Vertical (Likelihood), Horizontal (Impact)
5
4
3
2
1
1 2 3 4 5
22
Risk Assessment
–Impact is generally considered more important
than likelihood.
–E.g. a 10-percent chance of losing $1,000,000 is
usually considered more severe risk than a 90-
percent chance of loosing $1,000.
•The risk severity matrix provides a basis for
prioritizing which risks to address.
FMEA
•Failure Mode and Effects Analysis
[Link] the risk severity matrix by including ease of
detection in the equation.
[Link] is defined as the ability of the project team
to discern that the risk event is imminent.
3.A score of 1 is given if even a chimpanzee could spot
the risk coming.
4.A score of 5 is given to events that could only be
discovered after it is too late.
24
Example
•A risk with an impact of 1 zone (1 x 1 x 1) with a
very low probability ad an easy detection.
•A high impact risk with a high probability and
impossible to detect would score 125 (5x5x5).
25
Risk Assessment Form
Risk Event Likelihood Impact Detection When
Interface 4 4 4 Conversion
Problems
System 2 5 5 Start-up
Freezing
User Backlash 4 3 3 Post-
installation
Hardware 1 5 5 Installation
Malfunctioning
26
Example
•Assume the chances of a resource shortage of a particular skill
are about 80%.
•The outcomes could be a delayed project, tighter scheduling
and less flexibility, increased cost, etc.
•The impact could be a 10% increased in cost and a 5% delay in
project duration.
•The shortage will show up in the design stage of the project.
•A delay in this project may delay other projects or require
change in priorities.
27
Risk Actions
•Avoidance (Reduction) Actions – things we can
do to try to prevent the risks from occurring.
•Mitigation Actions – steps we can take to
reduce the impact of the risks if they occur.
Reduction Action
•E.g. The project is responsible for installing a
new OS in their parent company.
•Before implementing the project, the team
tested the new system on a smaller isolated
network.
•By doing so, they discovered a variety of
problems and were able to come up with
solutions prior to implementation.
29
Avoidance Action
•Adopting a proven technology instead of
experimental technology can eliminate technical
failure.
30
Transferring Action
•Fixed-price contracts are example of
transferring risk from an owner to a contractor.
•A monetary risk factor is added to the contract
bid price.
31
Risk Sharing
•Any example????
32
Retaining Risk
•Why???
•The chance of such an event is slim.
•Budget reserve can absorb if they materialize.
33
Mitigation Actions
•Change Control Management
–Every detail of a project plan will not
materialize as expected.
–Changes can occur.
34
Categories
•Scope changes in the form of design or
additions represent big changes.
•Implementation of contingency plans, when
risk events occur, represent changes in baseline
costs and schedules.
•Improvement changes suggested by project
team members.
35
Change Control Management
•Identify proposed changes.
•List expected effects on schedule and budget
•Review, evaluate, and approve/disapprove changes formally.
•Negotiate and resolve conflicts of change
•Communicate changes to parties
•Assign responsibility for implementing change
•Adjust master schedule and budget.
•Track all changes
36