Master of Science in

Project Management (MSPM)

PROJECT RISK
MANAGEMENT
DIFFERENCE BETWEEN QUALITY AND GRADE
PROJECT RISK MANAGEMENT

According to the PMBOK Guide:

“Project Risk Management includes the

processes concerned with conducting
risk management planning, identifica-
tion, analysis, responses, and monitor-
ing and control on a project”.
WHAT IS PROJECT RISK?

A risk is a condition that may occur and be-

come an event which could have a ‘positive’
or ‘negative’ impact on the project.

Positive Risks = OPPORTUNITIES

(Good for the Project!)

Negative Risks = DANGERS or THREATS

(may jeopardize the project or have an unfavorable
impact on its scope, schedule, cost etc.)
PLANNING FOR PROJECT RISKS

Project risk management is about

conducting risk management planning,
identification, analysis, responses and
control on a project, with a view to:
(a) increase the probability of occurrence and
impacts of ‘positive risks’ on the one hand, and

(b) decrease the probability of occurrence and

impact of ‘negative risks’ on the other.
PLANNING FOR PROJECT RISKS

Managing risk is an essential feature of overall pro-

ject planning. It is essential to attempt to identify to
the maximum extent possible during the project
planning phase the threats and opportunities which
may occur and the costs and benefits which may
result therefrom.
Note: The WBS is an important framework of refe-
rence for identifying project risks. In some projects,
the WBS is used to develop a “Technical Breakdown
Structure – TBS”, which is used to identify technical
project risks.
 THE PROJECT RISK MANAGEMENT PROCESS

1:
1: RISK
RISK IDENTIFICATION
IDENTIFICATION
Analyze
Analyze the
the project
project to
to identify
identify sources
sources of
of risk
risk
Review & Revise

2:
2: RISK
RISK ASSESSMENT
ASSESSMENT
Assess
Assess risks
risks in
in terms
terms of
of (a)
(a) severity
severity of
of impact
impact
(b)
(b) Likelihood
Likelihood of
of occurring,
occurring, and
and (c)
(c) controllability
controllability

3:
3: RISK
RISK RESPONSE
RESPONSE DEVELOPMENT
DEVELOPMENT
develop
develop a
a strategy
strategy to
to reduce
reduce possible
possible damage,
damage, and
and
Develop
Develop contingency
contingency plans
plans

4:
4: RISK
RISK RESPONSE
RESPONSE CONTROL
CONTROL
Implement
Implement risk
risk strategy,
strategy, monitor
monitor and
and adjust
adjust plan
plan for
for
new
new risks,
risks, change
change management
management
SOME TYPES OF PROJECT RISK

Project Risks are project-specific and can be catego-

rized into various types, for example:
Macro Risks – Risks which affect the project as a
whole, for e.g., shift in organizational priorities and
resource availability.
Micro Risks – Risks which affect specific portions of
a project, such as, one or more deliverables or work
packages. For e.g., an exit of suppliers from the
market could affect availability or cost of a speciali-
zed input.
SOME TYPES OF PROJECT RISK

External Risks – Risks normally outside the control

of the project manager and project-owning / pro-
ject-developing organization, for e.g.:
 the economic situation
 market conditions
 the political situation
 legal changes
 technological advances
 the security environment
 natural factors
 PROJECTS AND PROJECT MANAGEMENT
(AN ORGANIZATION‘S HOLISTIC PERSPECTIVE)

Economic
Economic
Organization‘s External Environment

Organization‘s P
Organization‘s Internal
Internal Environment
Environment

Life-Cycle Modal
Financial R
Financial
Organization‘s
Organization‘s mission,
mission, goals,
goals, object-
object- O
Political
Political ives
ives &
& strategies,
strategies, priorities,
priorities, current
current J
programme
programme and and project
project portfolio,
portfolio, project
project E
Social
Social organization,
organization, resource
resource base,
base, competency,
competency, C
Experience,
Experience, culture,
culture, policies,
policies, project-focussed
project-focussed T
Regulatory
Regulatory knowledge,
knowledge, process,
process, informational
informational ,, In-
In- S
stitutional
stitutional &
& infrastructural
infrastructural assets
assets
Security
Security

Infrastructure
Infrastructure
Integration,
Integration, Scope,
Scope, Cost,
Cost, Sche-
Sche- Standards
Standards &
& Methodologies
Methodologies
duling,
duling, Risk,
Risk, Quality,
Quality, Procurement,
Procurement,
Markets
Markets Human
(Off-the-shelf:
(Off-the-shelf: (e.g.:
(e.g.: PMI,
PMI, PRINCE2,
PRINCE2,
Human Resources,
Resources, Stakeholders,
Stakeholders, IPMA,
IPMA, APMBOK, P2M, BS 6079), or
APMBOK, P2M, BS 6079), or
Communications
Communications developed
developed inhouse
inhouse by by organizations)
organizations)
H-Resources
H-Resources

O-Resources
O-Resources Project Management Knowledge Framework
THE RISK CONTEXT CAN CHANGE RAPIDLY

Risks are not static – they can

change rapidly even over relati-
vely short-periods of time. Risks
deemed remote may assume
astronomical proportions “over-
night”.
The global economic crisis of
2008 brought on by the mort-
gage and banking crisis in the
US is a case in point.
THE RISK CONTEXT CAN CHANGE RAPIDLY

In Pakistan, the campaign of

terror waged by the Taliban
have affected adversely many
on-going/planned projects,
particularly development pro-
jects undertaken by foreign
NGOs in the north-west of the
country, many of whose staff-
ers have been killed, abducted
or assaulted.
A NOTE OF CAUTION

Sometimes it is not possible

to foresee all risks which may
affect a project throughout or
at specific points in time.
The devastating Tsunami of
December 2004 is a case in
point as is the Earthquake
which flattened large settled
areas of northern Pakistan in
October 2005.
TOOLS FOR IDENTIFYING PROJECT RISKS

 Analysis: Project Scope, Charter, WBS,

Schedule etc.
 Risk Profiling
 Review of Historical Records
 Brainstorming
 Delphi Technique
 Interviewing
 Root Cause Identification
TOOLS FOR IDENTIFYING PROJECT RISKS

 SWOT: Strengths, Weaknesses,

Opportunities, Threats
 Risk Identification Checklists
 Assumptions Analysis
 Diagramming Techniques
 Commercial Databases and Industry
Studies
THE PROJECT RISK BREAKDOWN STRUCTURE

Project
Project X
X
Project
Project
Technical
Technical External
External Organizational
Organizational Management
Management

Subcontractors
Subcontractors Project
Project
Requirements
Requirements Estimating
Estimating
&&Suppliers
Suppliers Dependencies
Dependencies

Technology
Technology Regulatory
Regulatory Resources
Resources Planning
Planning

Complexity
Complexity& & Market
Market Funding
Funding Controlling
Controlling
Interfaces
Interfaces

Performance
Performance Customer
Customer Prioritization
Prioritization Communication
Communication
&&Reliability
Reliability

Quality
Quality Weather
Weather
 MONITORING RISK: THE RISK ITEM TRACKING TABLE

Risk Item This Month Last Month No. of Risk Resolution

Months Progress

Inadequate 1 2 4 Plan revision in

Planning progress

Unclear Scope 2 3 3 Meetings with

Definition Client underway

Leadership 3 1 2 New Project

Shortcomings Manager

Delayed Funding 4 1 2 Improved

Communication

Schedule 5 2 3 Improved
Overrun Estimating
PROJECT RISK ANALYSIS AND ASSESSMENT

After project risks have been identified, they must

be prioritized in order to determine which risks may
have a significant adverse impact on the project,
and which risks may not.
Project Managers use two basic types of techniques
to analyze and assess project risks:
- qualitative
- quantitative
PROJECT RISK ANALYSIS AND ASSESSMENT

Qualitative Risk Analysis – This looks at the

probability of risk occurrence and corresponding
impact on project performance in the event that the
risk does occur and become an event.
Example: Using Expert Judgments of individuals
(e.g. project managers, team members, consultants)
based on their intuition, knowledge, insights and
past experience accumulated in projects to identify
and categorize project risks.
PROJECT RISK ANALYSIS AND ASSESSMENT

Quantitative Risk Analysis – This assesses the

impact of project risks using numerical methods
with a view to guiding project managers in regard to
their decision-making.

Quantitative techniques require an extensive pool

of (high-quality) data and are sometimes viewed
skeptically by project mgrs.

Examples: Sensitivity Analysis, Expected Monetary

Value Analysis, and Decision Tree Analysis.
QUANTITATIVE TOOLS IN
PROJECT RISK ANALYSIS AND ASSESSMENT

Sensitivity Analysis – Used to help determine which

risks may have the most significant potential impact
on the project. The probability values of (uncertain)
inputs are altered incrementally and the impact on
the project outputs is measured.

Expected Monetary Value Analysis – This method

calculates the average outcome by multiplying the
value of each possible outcome by its probability of
occurrence and then adding up the results.
QUANTITATIVE TOOLS IN
PROJECT RISK ANALYSIS AND ASSESSMENT

Decision Tree Analysis – This method graphically

depicts the costs, the entire range of possible
outcomes and the probability of their occurrence in
order to calculate and compare expected values.
EXAMPLE: DECISION TREE ANALYSIS &
EXPECTED MONETARY VALUE (EMV)
 THE RISK PROBABILITY AND IMPACT MATRIX

Risk Risk Score = Risk Occurrence Probability x

Occurrence Impact of Risk Occurrence on Project
Probability
99%
Danger!

75%

50%

25%

Impact of 1: Low 2: Moderate 3: High 4: Critical

Occurrence
of Risk on Low Moderate Major
the Project
QUANTIFYING SEVERITY OF RISKS ON A PROJECT

Risk Concern Expectation Impact Severity

Staff-Related 6 5 30

Project Inputs 5 8 40
Delayed

Inadequate 5 5 25
Communication

Severity =
Expectation (1-10) x Impact (1-10)
 EXAMPLE
RISK ASSESSMENT MATRIX

GOVERNMENT OF SOUTH
AUSTRALIA
(DEPT. OF EDUCATION AND CHILDREN’S SERVICES)
 THE
PROJECT RISK
REGISTER
THE PROJECT RISK REGISTER

The Project Risk Register is the project management

document containing comprehensive data on
identification, causes, analyses, prioritization and
responses along with and all other salient
information relating to project-related risks.

It is used and updated continuously throughout the

project’s life cycle.
THE PROJECT RISK REGISTER

A Project Risk Register usually includes:

 a unique identifier for each risk

 a description of each risk and how it will affect
the project
 an assessment of the likelihood the risk will occur
and the possible seriousness / impact on the
project if it does occur (low, medium, high)
THE PROJECT RISK REGISTER

- a grading of each risk according to a risk

assessment table
 who is responsible for managing the risk
 an outline of proposed mitigation actions
(preventative and contingency), and
 in larger projects, the cost for each mitigation
strategy
 EXAMPLE
PROJECT RISK REGISTER

PROJECT FIRECONTROL
RESPONDING TO PROJECT RISKS

According to the PMI, risk response plan-

ning is:
“the process of developing options
and determining actions to enhance
opportunities [i.e. positive risks] and
reduce threats [i.e. negative risks] to
the project’s objectives”.
RESPONDING TO PROJECT RISKS

Risk Response Planning addresses risks by their

priority, inserting resources and tasks into the
budget, schedule and project management
plan as needed.
The response must be appropriate to the
significance of the risk, cost-effective in
meeting the challenge, timely, realistic in the
project context, agreed upon by all parties
involved, and owned by a risk response owner.
RESPONDING TO PROJECT RISKS

The nature of the risk response varies according to the

type of risk.

Risk responses can include different strategies. In

project management frequent reference is made to the
following four:
 Risk Avoidance
 Risk Mitigation
 Risk Transference
 Risk Sharing
STRATEGIES FOR RESPONDING TO PROJECT RISKS

RISK AVOIDANCE

Risk Avoidance entails “avoiding” or (better)

“eliminating” the chances of risks occurring.

Examples: Changing the project scope, allocating

additional time for completing the project, impro-
ving the quantity and quality of available infor-
mation, boosting communicational interaction with
project stakeholders and so forth.
STRATEGIES FOR RESPONDING TO PROJECT RISKS

RISK MITIGATION

Risk Mitigation entails aiming to reduce the

probability as well as adverse impact of risks to an
acceptable threshold.

Examples: Delivering software to the client / users

incrementally instead of at the end of the project
(new versus old methodologies; AGILE, Scrum, etc.).

.
STRATEGIES FOR RESPONDING TO PROJECT RISKS

RISK TRANSFERANCE

This entails shifting the adverse impact of a risk, and

the responsibility for dealing with it, to a third
party.

Examples: Insurance (equipment, personnel,

output), careful contract formulation, performance
bonds, warranties.
STRATEGIES FOR RESPONDING TO PROJECT RISKS

RISK SHARING

Risk Sharing entails sharing project risks amongst

different parties.

Examples: Forming consortiums to share research

and development risk and funding in large
engineering construction and defence-related
projects.
RISK CONTINGENCY PLANNING

A Contingency Plan is a plan of action that will be

used if a possible foreseen risk becomes an event
(i.e. reality) in the project.

It aims at mitigating the adverse impact of the risk

turned event. The non-existence of a contingency
plan (or contingency plans) can, under certain
circumstances, spell very serious trouble for a
project.
RISK CONTINGENCY PLANNING

Contingency Plans should be communi-

cated to, and endorsed by, all project
stakeholders in advance, and should in-
clude a cost estimate and an indication
of the source of funding.
RISK CONTINGENCY PLANNING

Contingency Funds are used to bridge

shortfalls caused by errors, wrong
estimates, technical problems, project
scope changes and project risks. The level
of funding will depend on the nature of
the project
(Contingency Reserve, Management
Reserve)