Project Risk ManagementCompiled by Muhammad Aleem HabibJune 25, 2!"#n$ormation deri%ed $rom PM&'( ) Rita Mulcahy*hat is Project Risk Management+Project risk management is acti%ely managing the risks on your project,he goal o$ risk management is to be more proacti%e and less reacti%e*hy Risk ManagementA project manager-s .ork should not $ocus on dealing .ith problems/ it should $ocus on pre%enting them0 Ho. .ould it $eel to say, 12o problem/ .e anticipated this, and .e ha%e a plan in place that .ill resol%e it30 Per$orming risk management helps pre%entmany problems and helps make other problems less likely*hat is a Risk+A risk is an uncertain e%ent that could ha%e a positi%e or negati%e e$$ect on your project4 ,his means there is a probability bet.een !5667 that the e%ent could occur#$ there is a 7 chance o$ an e%ent occurring, there is no risk 8e9ample/ there is a 7 chance your project .ill be ade:uately $unded, this is not a risk, it is a reality;0*hat is a Risk+#$ there is a !7 chance o$ an e%ent occurring, this .ould be an issue, not a riskRisks .ith negati%e conse:uences are called threatsRisks .ith positi%e conse:uences are called opportunities 8top thinking o$ risk as bad, and start thinking o$ it in terms o$ probabilities=;Risk ?%ent @raph,ypes o$ RiskRisks can be broken out into t.o primary types!0 Pure Risk 8haAard;B risk .ith potential loss onlye90 Cire, the$t, personal injury20 &usiness Risk 8speculati%e risk; B risk .ith potential loss or gaine90 A highly skilled employee becomes a%ailable to .ork on your project, reducing your schedule time, the ta9 rate changes, a ne. ser%er costs less 8or more; than you budgeted $or=Risk Management ProcessThreatsOpportunitiesProject Risk ManagementKnowledge AreaProcessInitiating Planning Executing Monitoring & Contol ClosingRisk Plan Risk ManagementIdentify RiskPerform Qualitative Risk AnalysisPerform Quantitative Risk AnalysisPlan Risk ResonseMonitor and Control Risks?nter phaseD>tart project?9it phaseD?nd project#nitiatingProcessesClosingProcessesPlanningProcesses?9ecutingProcessesMonitoring )Controlling Processes5 '%erall Project Management Processes .ith Risk ManagementRisk Planning B this is ho. you plan on conducting risk management0 es; or categories $rom pre%ious projects .ill help identi$y and organiAe risks0Definitions of risk Risks and their probabilities are probability ) impact de$ined $or use in Hualitati%e Risk Analysis using a scale o$ I%ery Jnlikely to Ialmost certain0Risk &reakdo.n >tructureA risk breakdo.n structure 8R&>; organiAes potential sources o$ risk to the project0 Cunctioning much like a .ork breakdo.n structure, an R&> arranges categories into a hierarchy0 ,his approach allo.s the project team to de$ine risk at %ery detailed le%els0Risk &reakdo.n >tructure $or a >o$t.are Ge%elopment Project>o$t.are Ge% Project&usinessCompetitors>uppliersCash Clo.,echnicalHard.are>o$t.are2et.ork'rganiAational?9ecuti%e >upportJser >upport,eam >upportProject Management?stimatesCommunicationResourcesR&> ?9ampleRisk Pro$ileA risk profile is a list o$ :uestions that address traditional areas o$ uncertainty on a project0,hese :uestions has been designed and de%eloped $rom the e9perience o$ past projects0Risk Pro$ile Huestions%o Category &escrition of Risk IMPAC'PR()A)I*I'+RI,K *E-E*" Resource #estingenvironmentnotavailable $ % &R'()*+ Schedule,ocumentationapprovaltooklongertime$ ' R*,Probabilit-.mpact/atri0Risk Management Plan8Contd0;,takeholder toleran'es B >takeholders ha%e a lo. risk tolerance than impact is high0 ,hat in$ormation should be taken into account to rank cost impacts higher than i$ the lo. tolerance .as in another area0 ,olerances should not be implied, but unco%ered in project initiating and clari$ied or re$ined continually0Reporting B Gescribes reports related to RM and ho. they .ill be used and .hat they .ill include0Tra'king B Auditing, documentation regarding RMHF1Anuncommonstateo$nature, characteriAedbytheabsenceo$any in$ormationrelatedtoadesiredoutcome3, is a common de$inition $orFA0 An act o$ @od&0 An amount at stakeC0 JncertaintyG0 Risk a%ersion!!02 #denti$y Risks,hisisthephase.hereyou.ork.ith yourteamtoidenti$yasmanyrisksas possible0#denti$y RisksF ,hings to remember#denti$y Risks can-t be completed .ithout the project scopestatementand*ork&reakdo.n>tructure 8*&>;#denti$yRiskshappensattheonseto$theproject and throughout the projectRiskscanbeidenti$iedatanytimeandduringany phase o$ the projectRiskmanagementisaniterati%eprocess,you should.orktoidenti$yriskduringanychangesto theproject,.orking.ithresources,and.hen dealing .ith issuesHuestion +)ho should *e involved in Risk Identifi'ation(#denti$y RiskF ,ools ) ,echDo'umentation Revie&s B including charter, contracts, and planning documentation, can help identi$y risks0 ,hose in%ol%ed in risk identi$ication might look at this documentation, as .ell as lessons learned, articles, and other documents, to help unco%er risks0 #denti$y RiskF tools ) tech+rainstormingF 'ne idea generates anotherDelphi te'hni-ueF ?9pert participate anonymously/ $acilitator use :uestionnaire/ consensus may be reached in a $e. rounds/ Help reduce bias in the data and pre%ent in$luence each others0Intervie&ingF inter%ie.ing e9perts, stakeholders, e9perienced PMRoot 'ause analysisF ReorganiAing the identi$ied risk by their root cause may help identi$y more risks#denti$y RiskF ,ools ) ,echChe'klist analysisF checklist de%eloped based on accumulated historical in$ormation $rom pre%ious similar projectAssumption analysisF identi$y risk $rom inaccuracy, instability, inconsistency, incompleteness0,)OT analysis B >trengths, *eaknesses, 'pportunities, ,hreats#denti$y RiskF tools ) techInfluen'e diagramssho. the casual in$luences among project %ariables, the timing or time ordering o$ e%ents, and the relationships among other project %ariables and their outcomes0Cause and .ffe't Diagramslo&'harts'utputF Risk Register'utput is initial entries into the risk register0 #t includesFKist o$ riskKist o$ P',?2,#AK responsesRoot causes o$ risksJpdated risk categoriesRisk Register ?9ampleHF Risk tolerances are determined in order to helpFA0 ,he team rank the project risks&0 ,he project manager estimate the projectC0 ,he team schedule the projectG0 Management kno. ho. other managers .ill act to the project!!02 Per$orm Hualitati%e Risk Analysis,his is the phase .here you rank the risks you-%e identi$ied $rom #denti$y Risks to come up .ith a list o$ risks you .ill create plans $or dealing .ithPer$orm Hualitati%e Risk AnalysisThings to remem*erPer$orm Hualitati%e Risk Analysis is subjecti%e*hat is the probability o$ the risk occurring+ High, medium, lo.+ !5!+*hat is the impact i$ the risk does occur+ High, medium, lo.+ !5!+ ,ools and ,echni:ues o$ Hualitati%e AnalysisPro*a*ility & Impa't Matri/ B a matri9 that creates a consistent e%aluation o$ high, medium, or lo. $or your projects0 ,his helps to make the risk rating process more repeatable bet.een projects0Risk Data Quality Assessment B*hat is the :uality o$ the data used to determine or assess the risk+ ,hink about the $ollo.ing?9tent o$ the understanding o$ the riskGata a%ailable about the riskHuality o$ the dataReliability ) #ntegrity o$ the data,ools and ,echni:ues o$ Hualitati%e AnalysisRisk Categori0ation B *hich o$ your categories has more risk than others+ *hich o$ your .ork packages could be most a$$ected by risk+Risk 1rgen'y Assessment B *hich o$ your risks could occur soon, or re:uire a longer planning time+ Risk urgency assessment helps mo%e these risks more :uickly through the rest o$ the project management process'utputF Risk Register JpdatesRisk ranking $or the project compared to other projectsKist o$ prioritiAed risks and their probability and impact ratingsRisks grouped by categoriesList of risks for additional analysis and responseWatchlist (non-critical risks) ,rendsPer$orm Huantitati%e Risk AnalysisA numerical analysis o$ the probability and impact o$ the risks .ith the highest risk rating score determined $rom :ualitati%e analysis#s a numerical e%aluation 8more objecti%e;,his process may be skipped0Per$orm Huantitati%e Risk AnalysisPurpose of this pro'essGetermine .hich risk e%ents .arrant a response0Getermine o%erall project risk 8risk e9posure;0Getermine the :uanti$ied probability o$ meeting project objecti%es0Getermine cost and schedule reser%es0#denti$y risks re:uiring the most attention0Create realistic and achie%able cost, schedule, or scope targets0,ools and ,echni:ues o$ Huantitati%e Analysis.M2 3 ./pe'ted Monetary 2alue 3 *hat is the probability o$ the risk occurring multiplied by the impact i$ the risk does occur+ #$ the risk occurs, .hat could the $inancial or time loss be to your project+#n the e9ample belo., this project has an ?ML o$ 8M5N,25;, this means that you need to put aside M5N,25 in your risk reser%e account $or potential risksRisk Probability Impact EMVA 20%$ (100,000.00)$(20,000.00)B 0%$ 10,000.00 $,000.00 ! "%$ #0,000.00 $1,"00.00 $ %"%$ (&",000.00)$('(,&"0.00))otal$("(,2"0.00)HF #$ a project has a O7 chance o$ a J> M !, pro$it and a E7 chance o$ a J> M !, loss, the e9pected monetary %alue $or the project is FA0 M !, pro$it&0 M O, lossC0 M 2, pro$itG0 M E, loss,ools and ,echni:ues o$ Huantitati%e AnalysisDe'ision Tree B used $or planning on indi%idual risks instead o$ planning $or the .hole project,akes into account $uture e%ents to make a decision todayCan calculate the ?ML in more comple9 situations#n%ol%es mutual e9clusi%ity Airline A has a 67 chance to reach at time and Airline & has a O7 chance to reach at time0 #$ you don-t reach at time, it .ill cost you !,0 Jse ?ML to $ind .hich airline you should choose+Gecision tree D?ML e9ampleAirline A .M24 !, P 8!7 4 !,; Q 2,Airline + .M24 N P 8E74!,; Q EN,,ools and ,echni:ues o$ Huantitati%e AnalysisMonte Carlo Analysis B A techni:ue that uses simulation to sho. the probability o$ completing your project on time and .ithin budget0 Getermines the o%erall risk o$ the project, not the taskGetermines the probability o$ completing the project on a speci$ic day and $or a speci$ic cost,akes into account path con%ergence 8places in the net.ork diagram .here many paths con%erge into one acti%ity;Jsed to e%aluate the impact to your schedule and budgetGue to the complicated mathematical computations used, Monte Carlo analysis is usually done .ith a computer programCreates a probability distribution B triangular, normal, beta, uni$orm or lognormal 8learn these;Sensitivity Analysis,o determine .hich risks ha%e the most potential impact to the projectChanging one or more elementsD%ariables and set other elements to its baseline then see the impact0'ne typical display o$ sensiti%ity analysis is the tornado diagramTornado diagram is use$ul in analyAing risk taking scenarios0 ,hey pro%ide the positi%e and negati%e impact o$ each risk on the project and let you decide to choose .hich risk to take0>ample >ensiti%ity Analysis'utcome o$ Huantitati%e RARisk Register JpdatesPrioritiAed list o$ :uanti$ied risksAmount needed $or contingency reser%es $or time and costCon$idence le%els o$ completing the project on a certain date $or a certain amount o$ money,he probability o$ deli%ering the project objecti%es,rends5 risk management is an iterati%e process/ as you repeat the process you can track your o%erall project risk and determine the trend 8i$ you are decreasing or increasing the le%el o$ risk on your project;'utcome o$ Huantitati%e RAF ?9amples*hat are the risks that are most likely to cause trouble+ ,o a$$ect the critical path+ ,hat need the most contingency reser%e+ 1,he project re:uires another 5, and t.o months o$ time to accommodate the risks on the project+3 1*e are 65 percent con$ident that .e can complete this project on May 25th $or M6N6, budget+3 1*e only ha%e a R5 percent chance o$ completing the project .ithin the MN, budget03 1*hat are .e going to do no. about each top risk+3Risk Response Planning?liminate the threats be$ore they happenMake sure opportunities happen Gecrease the probability andDor impact o$ threats#ncrease the probability andDor impact o$ opportunitiesCor Residual ,hreatsContingency PlansCallback PlansRisk Response >trategiesRisk'pportunities?9ploit?nhance>hareAcceptActi%eContingency PlanCallback PlanPassi%e*orkaround,hreatsA%oid,rans$erMitigate,TRAT.5I., OR 6.5ATI2. RI,7, OR T%R.AT,A%oidanceRisk pre%entionChanging the plan to eliminate a risk by a%oiding the causeDsource o$ riskProtect project $rom impact o$ risk?9amplesFChange the supplier D engineerGo it oursel%es 8do not subcontract;Reduce scope to a%oid high risk deli%erablesAdopt a $amiliar technology or productMitigation>eeks to reduce the impact or probability o$ the risk e%ent to an acceptable threshold&e proacti%eF ,ake early actions to reduce impactDprobability and don-t .ait until the risk hits your project?9amplesF>taging 5 More testing 5 PrototypeRedundancy planningJse more :uali$ied resources,rans$er>hi$t responsibility o$ risk conse:uence to another partyGoes 2', eliminate riskMost e$$ecti%e in dealing .ith $inancial e9posure?9amplesF&uyDsubcontractF mo%e liabilities>electing type o$ Procurement contractsF Ci9ed Price#nsuranceF liabilities P bonds P *arranties,TRAT.5I., OR PO,TI2. RI,7, OR OPPORT16ITI.,>trategies $or 'pportunities./ploit4 ?nsure opportunity is realiAed?9F Assigning organiAation most talented resources to the project to reduce cost lo.er than originally planned0.nhan'e4 #ncrease the probability andDor the positi%e impact o$ the opportunity?9F Adding more resources to $inish early>trategies $or 'pportunities,hareF Allocating some or all o$ the o.nership to third part best able to capture the opportunity?9F Joint %entures, special5purpose companiesAcceptance 8&oth $or ,hreats ) opportunities;A'tive A''eptan'eGe%elop a contingency plan to e9ecute i$ the risk occurContingency plan Q be ready .ith Plan &Call back plan Q plan C i$ & $ailsPassive A''eptan'eGeal .ith the risks as they occur Q *orkaroundsJsually $or lo. ranked risksRisk Response Matri9Risk .vent Response Contingen'y PlanTrigger )ho is responsi*le#nter$ace ProblemsMitigateF ,est Prototype*orkaround until help comes2ot sol%ed .ithin 2E hoursAsi$>ystem $reeAingMitigateF ,est PrototypeReinstall '> >till $roAen a$ter ! hour(halidJser backlash MitigateF Prototype demonstration#ncrease sta$$ supportCell $rom top managementJa%ed?:uipment mal$unctionMitigateF >elect reliable %endor,rans$erF *arranty'rder replacement?:uipment $ails Aleem'utputs o$ Risk Response Planning1pdates to Risk RegisterResidual Risks B risks that are le$t o%er a$ter Plan Risk ResponseContingen'y Plans B plans o$ action in case the risk does occurRisk Response O&ners B the person on the team responsible $or monitoring the risk, risk triggers, de%eloping a response strategy, and implementing the strategy should the risk occur,e'ondary Risks B ne. risks that result $rom the implementation o$ the contingency plans $or the primary risks'utputs o$ Risk Response Planning1pdates to Risk RegisterRisk Triggers B early .arning signs that there is a high probability the risk .ill occurall*a'k Plans B a secondary contingency plan, in case the contingency plan does not .ork or is not e$$ecti%eReserves Contingency reserves5 co%ers the cost $or Skno.n unkno.ns- disco%ered during risk management/ co%ers the residual risks0 ,he contingency reser%e is calculated and made part o$ the baseline0Management reserves B these are estimated and made part o$ the project budget, not the baseline0 Management appro%al is needed to use the management reser%e0'utputs o$ Risk Response PlanningPro8e't Management Plan 1pdatesChanges made due to risk management .ill be changes made to the project and should be updated in the project management planHF Replacing a doubt$ul supplier .ith an e9pensi%e but reliable one is an e9ample o$FA0 Mitigation&0 ,rans$erenceC0 AcceptanceG0 A%oidanceHF A Reser%e is generally intended to be used $orF A0Re.ork acti%ities0&0Compensate $or inaccurate project cost estimates0C0Reducing the risk o$ missing the cost or schedule objecti%es0G0Compensate $or inaccurate project schedule estimates0>ome important pointsF*hat do you do .ith non5critical risks+*ould you choose only one risk response strategy+*hat risk management acti%ities are done during e9ecution o$ the project+*hat is the most important item to be discussed in project team meetings+Ho. .ould risk be addressed in project meetings+>ome important pointsF*hat do you do .ith non5critical risks+Put them in a .atch5list and re%isit them periodically0*ould you choose only one risk response strategy+ome important pointsF*hat is the most important item to be discussed in project team meetings+'$$ course, Risk=Ho. .ould risk be addressed in project meetings+Asking, .hat is the status o$ risks+ #s their any ne. risk+ #s the rank o$ any risk goes up and do.n+Monitor and Control Risk,he process o$ implementing risk response planstracking identi$ied risksmonitoring residual risksidenti$ying ne. risks and e%aluating risk process e$$ecti%eness throughout the project B risk audit0#nputs to Monitor ) Control RiskRisk Management PlanRisk RegisterAppro%ed Change Re:uests*ork per$ormance in$ormationGeli%erable status>chedule progressCosts incurredPer$ormance reportsMonitor ) Control RiskF ,ools)orkaround B a response to a risk that has occurred .hen no contingency plan e9ists0Risk audit B a team o$ e9perienced project team members re%ie.s the risk management process and response strategies to see i$ you-%e e$$ecti%ely identi$ied the major risks on the project and de%eloped e$$ecti%e strategies $or dealing .ith them0Monitor ) Control RiskF ,oolsRisk Reassessment B Risk management is iterati%e, you should re%ie. the risks on your project throughout the project to update their :ualitati%e and :uantitati%e %alues0,tatus meetings B status meetings should be used to identi$y ne. risks or changes to e9isting risks0 ,his is a great opportunity to discuss .ith your team and stakeholders e9isting risks and ne. risks0Monitor ) Control RiskF ,oolsReserve analysis B has the reser%e kept up .ith changes to the risk list+ Goes the reser%e still co%er the costs o$ these risks should they occur+Closing of risks B Risks are e9pected to happen during a particular phase o$ the project0 *hen that phase has passed and the risk is no longer probable, the risk should be remo%ed $rom the risk list and any reser%e associated should be $reed up0'utputs o$ Monitor ) Control Risks1pdates to Risk Register'utcomes o$ the risk reassessments and risk auditsClosing o$ risks that are no longer applicableGetails o$ .hat happened .hen risks occurred Kessons learned'utputs o$ Monitor ) Control RisksRe:uested Changes Recommended Correcti%e ) Pre%enti%e ActionsJpdates to the Project Management Plan'rganiAational Process Assets JpdatesPractice ?9amAns.ersPractice ?9amAns.ersPractice ?9amAns.ersPractice ?9amAns.ersPractice ?9amAns.ersPractice ?9amAns.ers