Risk management

Risk management
Risk identification – what are the risks to a project?
Risk analysis – which ones are really serious?
Risk planning – what shall we do?
Risk monitoring – has the planning worked?
We will also look at PERT risk and critical chains

SPM (6e) risk management© The McGraw-Hill Companies, 2017 1

 Some definitions of risk
‘the chance of exposure to the adverse
consequences of future events’ PRINCE2
‘an uncertain event or condition that, if it occurs, has
a positive or negative effect on a project’s
objectives’ PM-BOK
Risks relate to possible future problems, not
current ones
They involve a possible cause and its effect(s)
e.g. developer leaves > task delayed

SPM (6e) risk management© The McGraw-Hill Companies, 2017 2

Categories of risk

SPM (6e) risk management© The McGraw-Hill Companies, 2017 3

 Risk Management Approaches
Proactive:
The proactive approaches try to anticipate the possible
risks that the project is susceptible to.
After identifying the possible risks, actions are taken to
eliminate the risks.
Reactive:
Reactive approaches take no action until an
unfavourable event occurs.
Once an unfavourable event occurs, these approaches
try to contain the adverse effects associated with the
risk and take steps to prevent future occurrence of the
same risk events.
SPM (6e) risk management© The McGraw-Hill Companies, 2017 4
 A framework for dealing with risk

The planning for risk includes these steps:

Risk identification – what risks might there be?
Risk analysis and prioritization – which are the
most serious risks?
Risk planning – what are we going to do about
them?
Risk monitoring – what is the current state of
the risk?

SPM (6e) risk management© The McGraw-Hill Companies, 2017 5

 Risk identification

Approaches to identifying risks include:

Use of checklists – usually based on the
experience of past projects
Brainstorming – getting knowledgeable
stakeholders together to pool concerns
Causal mapping – identifying possible chains of
cause and effect

SPM (6e) risk management© The McGraw-Hill Companies, 2017 6

 Boehm’s top 10 development risks
Risk Risk reduction techniques

Personnel shortfalls Staffing with top talent; job matching; teambuilding; training and
career development; early scheduling of key personnel

Unrealistic time and cost Multiple estimation techniques; design to cost; incremental
estimates development; recording and analysis of past projects;
standardization of methods

Developing the wrong software Improved software evaluation; formal specification methods; user
functions surveys; prototyping; early user manuals

Developing the wrong user Prototyping; task analysis; user involvement

interface

SPM (5e) risk management© The McGraw-Hill Companies, 2009 7

 Boehm’s top ten risk - continued
Gold plating Requirements scrubbing, prototyping,
design to cost

Late changes to Change control, incremental development

requirements
Shortfalls in externally Benchmarking, inspections, formal specifications,
supplied components contractual agreements, quality controls
Shortfalls in externally Quality assurance procedures, competitive design etc
performed tasks
Real time performance Simulation, prototyping, tuning
problems
Development technically too Technical analysis, cost-benefit analysis, prototyping ,
difficult training

SPM (5e) risk management© The McGraw-Hill Companies, 2009 8

 Risk prioritization
Risk exposure (RE)
= (potential damage) x (probability of occurrence)
Ideally
Potential damage: a money value e.g. a flood would cause
£0.5 millions of damage
Probability 0.00 (absolutely no chance) to 1.00 (absolutely
certain) e.g. 0.01 (one in hundred chance)
RE = £0.5m x 0.01 = £5,000
Crudely analogous to the amount needed for an insurance
premium

SPM (6e) risk management© The McGraw-Hill Companies, 2017 9

 Risk probability: qualitative
descriptors

Probability level Range

High Greater than 50% chance of happening
Significant 30-50% chance of happening
Moderate 10-29% chance of happening
Low Less than 10% chance of happening

SPM (6e) risk management© The McGraw-Hill Companies, 2017 10

 Qualitative descriptors of impact on cost and
associated range values

Impact level Range

High Greater than 30% above budgeted expenditure

Significant 20 to 29% above budgeted expenditure

Moderate 10 to 19% above budgeted expenditure

Low Within 10% of budgeted expenditure.

SPM (6e) risk management© The McGraw-Hill Companies, 2017 11

Probability impact matrix

SPM (6e) risk management© The McGraw-Hill Companies, 2017 12

 Risk planning

Risks can be dealt with by:

Risk acceptance
Risk avoidance
Risk reduction
Risk transfer
Risk mitigation/contingency measures

SPM (6e) risk management© The McGraw-Hill Companies, 2017 13

 Risk reduction leverage

Risk reduction leverage =

(REbefore- REafter)/ (cost of risk reduction)
REbeforeis risk exposure before risk reduction e.g. 1%
chance of a fire causing £200k damage
REafter is risk exposure after risk reduction e.g. fire
alarm costing £500 reduces probability of fire
damage to 0.5%
RRL = (1% of £200k)-(0.5% of £200k)/£500 = 2
RRL > 1.00 therefore worth doing
SPM (6e) risk management© The McGraw-Hill Companies, 2017 14
Probability chart

SPM (6e) risk management© The McGraw-Hill Companies, 2017 15

 Using PERT to evaluate the effects of
uncertainty

Three estimates are produced for each activity

Most likely time (m)
Optimistic time (a)
Pessimistic (b)
‘expected time’ te = (a + 4m +b) / 6
‘activity standard deviation’ S = (b-a)/6

SPM (6e) risk management© The McGraw-Hill Companies, 2017 16

 A chain of activities

Task A Task B Task C

Task a m b te s

A 10 12 16 ? ?

B 8 10 14 ? ?

C 20 24 38 ? ?

SPM (6e) risk management© The McGraw-Hill Companies, 2017 17

 A chain of activities

What would be the expected duration of the chain

A + B + C?
Answer: 12.66 + 10.33 + 25.66 i.e. 48.65
What would be the standard deviation for A + B+
C?
Answer: square root of (12 + 12 + 32) i.e.
3.32

SPM (6e) risk management© The McGraw-Hill Companies, 2017 18

 Assessing the likelihood of meeting a
target

Say the target for completing A+B+C was 52 days

(T)
Calculate the z value thus
z = (T – te)/s
In this example z = (52-48.33)/3.32 i.e. 1.01
Look up in table of z values – see next overhead

SPM (6e) risk management© The McGraw-Hill Companies, 2017 19

Graph of z values

SPM (6e) risk management© The McGraw-Hill Companies, 2017 20

 Monte Carlo Simulation
An alternative to PERT.
A class of general analysis techniques:
Valuable to solve any problem that is complex,
nonlinear, or involves more than just a couple of
uncertain parameters.
Monte Carlo simulations involve repeated random
sampling to compute the results.
Gives more realistic results as compared to
manual approaches.

SPM (6e) risk management© The McGraw-Hill Companies, 2017 21

 Steps of a Monte Carlo Analysis
1. Assess the range for the variables being
considered.
2. Determine the probability distribution of each
variable.
3. For each variable, select a random value based on
the probability distribution.
4. Run a deterministic analysis or one pass through
the model.
5. Repeat steps 3 and 4 many times to obtain the
probability distribution of the model’s results.
SPM (6e) risk management© The McGraw-Hill Companies, 2017 22
Critical chain concept
Traditional planning approach

SPM (6e) risk management© The McGraw-Hill Companies, 2017 23

 Critical chain approach

One problem with estimates of task duration:

Estimators add a safety zone to estimate to take
account of possible difficulties
Developers work to the estimate + safety zone, so
time is lost
No advantage is taken of opportunities where
tasks can finish early – and provide a buffer for
later activities

SPM (6e) risk management© The McGraw-Hill Companies, 2017 24

 Critical chain approach

One answer to this:

1. Ask the estimators for two estimates
Most likely duration: 50% chance of meeting
this
Comfort zone: additional time needed to
have 95% chance
2. Schedule all activities using most likely values
and starting all activities on latest start dates

SPM (6e) risk management© The McGraw-Hill Companies, 2017 25

Most likely and comfort zone estimates

SPM (6e) risk management© The McGraw-Hill Companies, 2017 26

 Critical chain - continued

3. Identify the critical chain – same a critical path

but resource constraints also taken into account
4. Put a project buffer at the end of the critical
chain with duration 50% of sum of comfort zones
of the activities on the critical chain.

SPM (5e) risk management© The McGraw-Hill Companies, 2009 27

 Critical chain -continued

5. Where subsidiary chains of activities feed into

critical chain, add feeding buffer
6. Duration of feeding buffer 50% of sum of
comfort zones of activities in the feeding chain
7. Where there are parallel chains, take the
longest and sum those activities

SPM (6e) risk management© The McGraw-Hill Companies, 2017 28

Plan employing critical chain concepts

SPM (6e) risk management© The McGraw-Hill Companies, 2017 29

 Executing the critical chain-based plan

No chain of tasks is started earlier than

scheduled, but once it has started is finished
as soon as possible
This means the activity following the current
one starts as soon as the current one is
completed, even if this is early – the relay
race principle

SPM (6e) risk management© The McGraw-Hill Companies, 2017 30

 Executing the critical chain-based plan

Buffers are divided into three zones:

Green: the first 33%. No action required

Amber : the next 33%. Plan is formulated
Red : last 33%. Plan is executed.

SPM (6e) risk management© The McGraw-Hill Companies, 2017 31