why risk efficiency is a key aspect of best practice projects

INTERNATIONAL JOURNAL OF

PROJECT

International Journal of Project Management 22 (2004) 619–632

MANAGEMENT

www.elsevier.com/locate/ijproman

Why risk efficiency is a key aspect of best practice projects

Chris Chapman *, Stephen Ward

Department of Accounting and Management Science, School of Management, University of Southampton, Highfield, Southampton SO17 1BJ, UK

Received 2 March 2004; received in revised form 26 April 2004; accepted 7 May 2004

Abstract

This paper explains what ‘risk efficiency’ means, why it is a key part of best practice project management, and why it may not be

delivered by common practice as defined by some guidelines. This paper also explains how risk efficiency can be addressed oper-

ationally using comparative cumulative probability distributions (S-curves). Further, this paper explains why risk efficiency provides

a foundation for a convincing business case for:

• formal project risk management processes designed for corporate needs,

• embracing the management of opportunities as well as threats,

• measuring threats and opportunities to assist decision making,

• developing a more effective risk taking culture,

• taking more risk for more reward.

The argument uses linked examples from four successful cases: the first use of a designed project risk management process by BP

for offshore North Sea oil and gas projects, the first use of a designed process by National Power for combined cycle gas powered

electricity generation, a culture change programme for IBM UK concerned with taking more risk to increase the rewards, and a due

diligence assessment of project risk management for a railway infrastructure project. The concepts and tools described are relevant

to any industry sector for projects of any size.

� 2004 Elsevier Ltd and IPMA. All rights reserved.

Keywords: Best practice; Risk efficiency; Project risk management; Opportunity management; Culture change

1. Introduction

Uncertainty which matters is central to all projects. It

is not just a question of how long a project will take, or

how much it will cost. Uncertainty which matters in-

cludes which parties ought to be involved, the alignment

of their motives, the alignment of project objectives withcorporate strategic objectives, shaping the design and

resource requirements, choosing and managing appro-

priate processes, managing the underlying trade-offs

between all relevant attributes measuring performance,

and the implications of associated risk.

It might be argued that formal project risk man-

agement processes are not appropriate for all projects,

* Corresponding author. Tel.: +44-173-592-525; fax: +44-173-593-

844.

E-mail address: [email protected] (C. Chapman).

0263-7863/$30.00 � 2004 Elsevier Ltd and IPMA. All rights reserved.

doi:10.1016/j.ijproman.2004.05.001

but making a choice not to apply formal processes

requires a clear understanding of what best practice

formal project risk management processes could de-

liver, and what this should cost, including associated

uncertainty and risk. Everyone involved in making

such choices needs to understand the implications.

Moreover, even if formal approaches are not appro-priate for some projects, informal approaches ought to

reflect an understanding of the principles underlying

formal processes. Everyone involved in projects ought

to understand these principles, because they are

the basis of simple rules of thumb that work in

practice.

Best practice in project risk management is con-

cerned with managing uncertainty that matters in aneffective and efficient manner. To do so we need to

understand where uncertainty matters, why it matters,

what could be done about it, what should be done about

it, and who should take managerial and financial

mail to: [email protected]

620 C. Chapman, S. Ward / International Journal of Project Management 22 (2004) 619–632

responsibility for it. Best practice in project risk man-

agement also involves the elimination of dysfunctional

‘corporate culture conditions’, like ‘a blame culture’

which fosters inappropriate blame because managers

are unable to distinguish between good luck and goodmanagement, bad luck and bad management. In the

authors’ view best practice in this sense cannot be

achieved without a clear understanding of the concept

of ‘risk efficiency’, and its vigorous pursuit using a

simple operational tool, cumulative probability distri-

butions (S-curves) which compare alternative decision

choices. This paper explains why the authors hold this

view, and why this implies a general need for the pro-ject management community to understand risk effi-

ciency.

A basic definition of ‘risk efficiency’ is simply

‘the minimum risk decision choice for a given level of expected

performance’, ‘expected performance’ being a best estimate of

what should happen on average, ‘risk’ being ‘the possibility of

adverse departures from expectations’.

What this means and how it affects project manage-

ment processes is more complex, the focus of this paper

as a whole.

Common practice in project risk management involves

a limited agenda relative to best practice. Common

practice is largely focused on what we will call ‘risk

events’, rather than the accumulated effect of all the riskevents and all other sources of uncertainty which are

relevant to decision choices. A ‘risk event’ in this sense is

‘risk’ as defined on page 127 of the 2000 edition of the

PMBOK by the PMI [1],

‘an uncertain event or condition that, if it occurs, has a positive

or negative effect on a project objective’,

with a directly comparable definition of ‘risk’ on page 16of the 1997 edition of the PRAM Guide by the APM [2],

‘an uncertain event or set of circumstances that, should it occur,

will have an effect on the achievement of the project’s objec-

tives’.

The above PMI and APM definitions of ‘risk’ reflectand reinforce the common practice focus on ‘risk

events’, as do many of the others covered in an extensive

review of risk definitions by Hillson [3]. One of the ex-

ceptions in the project risk management area is that used

in the RAMP [4] guide, which accords with that used in

this paper, expressed slightly differently.

In the authors’ experience common practice in project

risk management reflects important limiting character-istics which are linked to the PMI/APM views of risk

noted above and its lack of compatibility with a ‘risk

efficiency’ perspective on risk management. Under-

standing how risk efficiency is the key to moving from

common practice to best practice has to begin by ‘un-

learning’ the common PMI/APM definitions of risk

noted above if they are part of the reader’s framing

assumptions, always more difficult than just learning

something new.

Risk efficiency is a basic concept in financial eco-

nomics, central to understanding risk management in

terms of financial portfolio decision making models, andthe basis of most explanations of the way financial

markets work. In this context it is widely seen as ‘useful

theory’, in the sense that it provides an essential con-

ceptual framework to make experience operational, to

explain basic ideas like ‘do not put all your eggs in one

basket’, and to refine rules of thumb like ‘keep X% of

your portfolio of investments in cash, Y% in equities,

and so on’. Its direct application in terms of usableoperational tools is problematic, because of practical

operational difficulties using a Markowitz [5] mean–

variance quadratic programming framework, but un-

derstanding the concept is an integral part of a financial

economics education, and it is widely recognised that

this understanding should underlie the use of all asso-

ciated tools and rules of thumb. Markowitz was awar-

ded a Nobel Prize for Economics for his seminal work inthis area, and the basic ideas he developed are generally

understood by anyone with a degree in economics, fi-

nance, accounting, or business studies. Texts like Brea-

ley and Myers [6] provide a modern financial perspective

on risk efficiency and related subjects like the appro-

priate discount rate to use when evaluating projects

which most people with an MBA will understand, and

some involved in project management may find usefulreading.

Risk efficiency is also central to understanding the

relationship between portfolio theory and decision the-

ory, the two key conceptual frameworks for managing

uncertainty and risk in terms of making decision choices

any context [7]. In simple terms, basic portfolio theory

[5] is about continuous variable allocation of resource

choices, while basic decision theory [8] is about makingdiscrete either/or choices, using ‘stochastic dominance’

notions directly comparable to risk efficiency. Features

provided by a decision theory framework which are

particularly useful include multiple stage choices por-

trayed by decision trees, statistical dependency por-

trayed by probability trees, and a range of approaches to

multiple attribute choices. In practice both frameworks

need to be integrated, embedding one in the other [7].A number of organisations which have been partic-

ularly effective users of project risk management have

seen risk efficiency as central to holistic project man-

agement for decades, and best practice project man-

agement has to be holistic. For example, risk efficiency

was central to the published [9] project risk management

process for offshore North Sea projects which BP in-

troduced in the late 1970s and adapted for use worldwide by the early 1980s. Risk efficiency was an integral

part of all the cases described in [10] and associated

underlying papers. And risk efficiency was central to a

C. Chapman, S. Ward / International Journal of Project Management 22 (2004) 619–632 621

successful early 1990s culture change programme un-

dertaken by IBM UK with contributions from both

authors of this paper. The 1997 PRAM process [2] as

elaborated by the 1997 first edition of Chapman and

Ward’s book ‘Project Risk Management’ gives risk ef-ficiency a central position, as does the 2003 edition of

this book [11], and both editions provide other examples

of successful application of an approach to project

management which integrates project risk management

centred on the pursuit of risk efficiency. This is done in

the context of describing best practice project risk

management processes as we understand them, based on

working with organisations which embrace best practicein this sense, as a target if not a current achievement.

What is meant by the term ‘risk efficiency’ in a project

management context has evolved considerably since the

1970s. Explaining what it means with minimal com-

plexity and how to use it effectively in simple forms has

also received considerable attention over this period [7].

This paper reflects these developments. But the focus of

this paper is providing a concise overview of the impli-cations of successful use of the concept for those who

are interested in holistic project management, without

fully exploring the associated operational implications

for project risk management, leaving the reader inter-

ested in technical details to explore them elsewhere

[7,11].

The next section of this paper outlines the example

which motivated BP to adopt risk efficiency as a centralconcern for all projects world wide, to provide a prac-

tical motivating case study as a starting point, and a

basis for illustrating linked concepts later. This is

followed by the clearest full explanation of the risk ef-

ficiency concept the authors could devise, using simple

models in a restricted context, aiming for simplicity

without being simplistic. Subsequent sections generalise

the concept and elaborate the explanation, includinglinking it to organisational culture, with further case

based examples. Cultural implications are central to a

holistic project management perspective.

Cost

1.0

Cum

ulat

ive

prob

abili

ty

0

1.6 m bargeinitial choice

3.0 m bargerevised choice

c

a

1.6m

b

expected value

Fig. 1. Barge choice example.

2. An initial project risk management case study

A major North Sea oil project was about to seekboard approval and release of funds to begin construc-

tion. Risk analysis using a new process [9] was under-

taken to give the board confidence in the project plan

and its associated cost. One activity involved a hook-up,

connecting a pipeline to a platform. It had a target date

in August. A 1.6 m barge was specified, equipment

which could work in waves up to a nominal 1.6 m

height. Risk analysis demonstrated that August was anappropriate target date, and a 1.6 m barge was appro-

priate in August. However, risk analysis also demon-

strated that, because this hook-up was late in the overall

project sequence, and there was considerable scope for

delays to earlier activities, there was a significant chance

that this hook-up would have to be attempted in No-

vember or December. Using a 1.6 m barge at this time of

year would be costly because it would be time con-suming. It might mean delays until the following spring,

with severe opportunity cost implications. A revised

analysis was undertaken assuming a 3 m wave height

capability barge, costing more than twice as much per

day. This more capable barge was more effective in the

face of bad weather, and it avoided the risk of going into

the next season because of earlier delays as well as the

accumulated effects of bad weather during hook-up,significantly reducing risk in terms of the threat of a cost

overrun relative to the expected cost. It also significantly

reduced the expected cost. Fig. 1 portrays this choice in

the cumulative probability ‘S-curve’ format considered

by the board.

The location of the point where the curves cross on

the cumulative probability axis (point ‘a’) indicates that

most of the time the 1.6 m barge should be cheaper.However, the long right-hand tail on the 1.6 m barge

curve drags the expected cost to point ‘c’ on the cost

axis, beyond the expected cost of the 3 m barge (point

‘b’). This long right-hand tail, with a horizontal portion,

reflects the massive increase in cost if an additional

season is needed, a low probability but high impact

outcome. The 3 m barge curve is relatively vertical, be-

cause the outcome is relatively certain. Most of the timethe 3 m barge would be more expensive, but on average

it would be cheaper, because it avoids the implications

of extreme events.

On the basis of this analysis, the 3 m barge was

chosen. Further, this change in decision choice was used

to demonstrate to the board the kind of insights the new

project risk management process provided. The board

approved the 3 m barge choice and the project. Theboard also mandated use of the process world wide for

all projects of reasonable size or sensitivity. What they

were looking for when they mandated this process was

risk efficiency in the sense portrayed by Fig. 1 – revised

decision choices which simultaneously reduce both


expected cost (our best estimate of what things should

cost on average) and risk (possible unfavourable de-

partures from expectations). Looking for risk efficiency

was a key step in this process, in effect the central pur-

pose of the process. It was immediately recognised atboard level that a process with this risk efficiency goal

would pay for itself many times over. Eventually it was

acknowledged that because this process was not an ‘add-

on’ to give the board comfort, it was an ‘add-in’ to make

project planning and costing more effective, organisa-

tional structure changes would be useful. Initially a

project risk management team was set up to support

project planning, then it became a driving part of projectplanning, then it became a driving part of project

planning and costing. Later still the links between pro-

ject risk management and corporate risk management

were strengthened.

It is worth noting that this case illustrates the

importance of a top-down view of uncertainty man-

agement, concerned with the accumulative effect of all

sources of uncertainty from the beginning of the projectuntil the completion of the hook-up, and general (not

event specific) responses to deal with this uncertainty,

risk being the result of a failure to ensure such flexible

responses are in place. Best practice involves the inte-

gration of a bottom-up perspective which may be risk

event driven in part with a top-down perspective. Both

are important, but a top-down perspective is the only

one viable on its own, whether or not a formal riskmanagement process is used.

It is also worth noting that the basis of the business

case for making formal risk management as described in

[9] mandatory world wide was improvements in risk

efficiency, and this in turn led to it being seen as an add-

in rather than an add-on, with widespread implications.

Cost

Cum

ulat

ive

prob

abili

ty

1.0

0

P Q R

a b c

d

e f

.

..

Fig. 2. Response choice example with linear distributions.

3. Risk efficiency as a complete concept using simple

models

The notion that looking for risk efficiency can deliver

both lower expected cost and lower associated risk is a

basic characteristic of the concept, in line with the basic

definition provided earlier, but it does not really explain

risk efficiency as a complete concept. The long right-hand tail of the 1.6 m barge choice in Fig. 1 was an

important characteristic of this particular decision, but

such tails are not always a feature of risk efficient

choices. In addition, some choices involve more than

one attribute, including attributes associated with safety

and other issues which raise measurement difficulties.

This section provides a complete concept description

using simple models in a simple context in terms of twokey simplifying characteristics.

First, assume all aspects of project uncertainty can be

reduced to a single attribute, and that single attribute is

cost. For example, when choosing between alternative

approaches to a project, assume any scope for relevant

time uncertainty can be translated into a cost equivalent

and added to other cost uncertainty, and all other

measures of performance (‘quality’ measures for exam-ple) can be translated and added in a similar manner if

relevant.

Second, assume all relevant uncertainty about alter-

native approaches to a project can be measured in terms

of linear cumulative probability distributions. Linear

cumulative probability distributions correspond to uni-

form probability density functions – any value in the

feasible range is equally likely. This implies expectedvalues are defined by the mid-point in the range, which

is also the median value (there is a 50% chance of higher

or lower values), and modal (most likely) values are not

an issue. Easy identification of expected values is one

key simplification here, but another key simplification is

there are no conditions (assumptions) which are not

common to all the choices being considered.

With these assumptions in mind, consider a projectwhich involves a choice between three strategies or

tactics, designated P, Q and R, with associated cost

uncertainty portrayed by Fig. 2. At a strategic level three

different ways of getting oil from an oil field to a refinery

might be involved – pipelines, ships, and a combination

of both, for example. At a tactical level, three different

ways of responding to a particular risk event given a

particular strategy might be involved – replacing a failedphotocopier with the same model from the same sup-

plier, a new model from the same supplier, or a new

model from another supplier, for example. Throughout

the project life cycle, any organisation undertaking any

project has a wide range of choices to make between

bounds comparable to these strategic and tactical level

examples. The linearity of the cumulative probability

distribution curves in Fig. 2 is most realistic in thecontext of a simple tactical choice like the photocopier

example, but it is helpful to use this simple starting point

for all levels of decision choices.

To provide a concrete example, assume Fig. 2 is de-

fined by our photocopier example. Assume all three

feasiblesolution area

non-feasiblesolution area

Expected cost

Cos

t ris

k

00

G

EC

risk efficientboundary C-G

F

D

B

A

Fig. 3. Risk efficient options.


choices involve a known contracted rent per unit time

plus a known contracted charge per copy – the only

unknown is the number of copies which will be needed.

In each case the bottom of the cumulative probability

curve, associated with a cumulative probability of zero,is defined by the minimum plausible number of copies,

and the top of the curve is defined by the maximum

plausible number of copies. Fig. 2 implies choice P in-

volves the highest charge per copy (hence the flattest

slope), but a significantly lower rent per unit time (the

reason it is entirely to the left of the other curves). As-

sume choice P is the same machine from the same sup-

plier as the failed photocopier.Choice P is clearly and unequivocally risk efficient,

because it has a lower expected value (at ‘a’, relative to

‘b’ and ‘c’), and less risk, defining risk as the possibility

of adverse departures from expectations as noted earlier.

For example, the probability of exceeding any given cost

is less using P than it is for Q or R. This is indicated by

the line for P being entirely to the left of the lines for Q

and R. In decision theory terms [8], P exhibits stochasticdominance relative to Q and R. P is a preferable choice

for any rational person. But note that P exhibits more

variability than Q or R. Variability (as measured by

range or variance for example) is only a valid measure of

risk if we are comparing distributions with the same

expected value (mean) and all other moments (which

define shape) are the same, as observed by Markowitz

[5] in relation to his mean–variance approach to port-folio theory.

Now assume choice P is not available – we cannot

obtain the same photocopy machine, and we must

choose between Q and R. Both are risk efficient. This

is indicated by the fact that the lines cross (at ‘d’) and

the lower expected value for R. Given the linear form

of the cumulative probability distribution curves, two

curves crossing above expected values imply bothchoices are risk efficient. Choice R has a lower ex-

pected cost, but more risk defined in terms of adverse

variability relative to the expected outcome for the

preferred choice. The dimensions of the triangle d–e–f

provide measures of this risk, but viewing the size and

shape of the triangle d–e–f in the context of both

cumulative distributions as a whole is more useful

than decomposed measurements. Figs. 1 and 2 providewhat we will call a ‘risk portrait’, portraying risk-re-

ward trade-offs in terms of identified expected values

and the effect of all moments as captured by the cu-

mulative probability curve as a whole. Whether or not

linear forms are used, risk and risk efficient choices

need to be judged using risk portrait diagrams in the

Figs. 1 and 2 formats, without any summary measures

other than the expected values indicated in Figs. 1 and2, because this is the only simple way to visualise in a

holistic manner the implications of distribution shape

[7].

The associated decision rules for making choices

follow.

1. If one choice has a curve entirely to the left of the oth-

ers, chose it as the only risk efficient choice (illustrated

by P in Fig. 2).2. If two curves cross, one has an equal or preferable ex-

pected value and a preferable risk portrait, chose it as

the only risk efficient choice (illustrated by the 3 m

barge choice in Fig. 1, and a curve like Q in Fig. 2

which has been shifted to the left so that the point of

intersection ‘ d’ is at or below the expected value of R).

3. If two curves cross, one has a preferable expected value

and the other has a preferred risk portrait, both are risk

efficient, and a choice must be made considering the

risk-reward trade-off (illustrated by Q and R when P

is not available in Fig. 2).

The first rule could be expressed as a special case of

the second, so a joint rule could be defined, but it is

useful to keep them separate to simplify interpretation.

Understanding the risk efficiency concept in general

and the issue of trade-offs in particular is helped byanother form of diagram, a variant of that used by

Markowitz [5], as shown in Fig. 3.

Fig. 3 can be associated with portraying all feasible

ways to complete a project using two dimensions – ex-

pected cost and associated cost risk. It provides a

framework for thinking about making an optimal choice

of approach from all feasible choices in terms of these

two dimensions. Point G portrays the minimum ex-pected cost solution – an option with a lower expected

cost is not available. Point C portrays the minimum cost

risk solution – an option with a lower risk is not avail-

able. The points C, D, E, F and G all lie on the ‘risk

efficient boundary’ C–G, and illustrate what we mean by

risk efficiency. All options defined by points on the risk

efficient boundary C–G minimise risk for a given level of

expected cost, and/or minimise expected cost for a givenlevel of risk. They are what economists call a Pareto

optimum, defining an efficient frontier. We cannot do

better in one dimension without doing worse in the

other. All options defined by points below and to the left

of this boundary are not feasible because they are not


available. Best practice by definition requires an effective

and efficient search for risk efficiency in this sense. Points

A and B are feasible but not risk efficient. For example,

F is better than B because it has a lower expected cost, D

is better than B because it has less cost risk, and E isbetter than B in both these respects.

The risk efficient boundary C–G is usually portrayed

as smooth and well behaved, as shown in Fig. 3, because

the choices allowed by basic Markowitz [5] mean–vari-

ance quadratic programming models yield this form. In

practice discrete choices may render this boundary

rough and badly behaved, but the risk efficiency concept

is unchanged. In a project management context we arenot dependent upon continuous variable mathematics to

define the risk efficient boundary. Indeed, we cannot

define the whole of the boundary or the feasible solution

area, only the finite set of choices which we start with

and evolve as the project plans evolve. We may believe

we are at a point like E, but later discover we were at a

point like B or A. For example, the change from a 1.6 m

barge to a 3 m barge in the barge selection examplecould be associated with a move from B to E if no other

sources of risk inefficiency remained. But if other sour-

ces of risk inefficiency remained, a move from A to B

would be a more appropriate portrayal.

Fig. 3 is especially useful to consider risk-reward

trade-offs in conceptual terms. For the moment consider

a variant of the barge selection example. Assume this

variant involves a different risk portrait which yields aversion of Fig. 1 which involves shifting the expected

value for the 3 m barge at point b to the right of point c

by £5 million. Then the 3 m barge and the 1.6 m barge

are both risk efficient choices. Point F in Fig. 3 might

correspond to the 1.6 m choice, and point E might

correspond to the 3 m choice. Moving from F to E re-

duces the risk, but it increases the expected cost. Is it

worth it?If we are considering this project in isolation from

other corporate risk, the basic Markowitz perspective

applies, and this question has to be answered in terms of

the preferences of those making the decision on behalf

of the project. If our variant of the barge selection ex-

ample involved an increase in expected cost of £5 million

to avoid a 10% chance of an extra £100 million, this

might look like reasonably priced ‘insurance’, worthbuying. However, if we are considering this project from

a corporate policy perspective, a much more aggressive

view of appropriate risk-reward trade-offs is needed.

Knowing such projects could double in cost, and to cope

with this a consortium approach to all offshore projects

had been put in place to cope with cost overruns of

£1000 million, a risk efficient corporate perspective

would demand the 1.6 m barge choice, on the groundsthe organisation could live with £100 million losses and

should not lower expected profits by avoiding risk it

could live with. If the organisation ‘gave away’ expected

profits associated with risk it could live with, as a con-

sequence of an ‘insurance’ approach to risk reduction, it

would risk lowering its overall profit levels to the point

where predatory take-over became a serious risk, by

organisations who would live with such risk, to theirshareholders benefit. This can lead us to distinguish

between ‘project choice’ (pc) and ‘corporate perspective’

(cp) risk efficiency, formally associating Fig. 3 with these

two separate cases. For example, point G in a cp context

involves minimising expected cost for all projects with

no exceptions, while point F in a cp context involves a

slight reduction in expected cost on some projects when

a significant risk reduction can be obtained. For presentpurposes the key point is the implications of a ‘complete

view’ of risk efficiency which uses the broader corporate

perspective to suggest the following decision rule.

Always minimise the expected cost of a project unless the risk

implications at a corporate level are unacceptable, in which case

the minimum expected cost increase to yield an acceptable level

of corporate risk should be sought.

This complete risk efficiency concept adopting a

corporate perspective has the virtue of simplicity at an

operational level, as well as a higher level of optimality.

Risk efficiency at a project level will yield inappropriate

‘local optimality’ rather than an appropriate ‘globaloptimality’ unless a corporate perspective drives a focus

on expected cost outcomes. And if the focus is a cor-

porate perspective, most of the time expected cost out-

comes are all that need consideration, provided choices

involving potentially unacceptable corporate risks are

identified and considered more fully, using the Fig. 1

risk portrait approach.

As part of the culture change programme mentionedearlier, IBM UK adopted this rule and took an ag-

gressive view of the need to take cost risk on each pro-

ject when bidding for projects, in the sense that they

recognised that the risk of not obtaining enough prof-

itable projects by minimising the expected cost of de-

livering what customers wanted on all projects was

much more important than the risk of loosing money on

any particular project. Put another way, contractorswho bid for work on a basis which avoids the risk of

loosing money on all projects inevitably go out of

business, because they are underbid by contractors who

are prepared to take and manage risk in a way which

balances the risk of going out of business as a conse-

quence of any single project with the risk of not ob-

taining enough business.

Fig. 4 is a useful linear cumulative distribution in-terpretation (linear S-curves) of some of the points

shown in Fig. 3. For example: A is dominated by B (A

is relatively risk inefficient), indicated in Fig. 4 by the

line for A being entirely to the right of the line for

B, indicated in Fig. 3 by the point for A being to the

right and above the point for B; B is dominated by D,

0.2

0.4

0.6

0.8

1

Cost

Cum

ulat

ive

prob

abili

ty

0

DABE

DB

Fig. 4. Example cumulative probability distribution portrayals.Fig. 5. An illustrative opportunity/incompetence boundary.


indicated in Fig. 4 by B and D having the same expected

value but a greater slope on the B line, indicated in

Fig. 3 by the point for B being directly above the point

for D; E involves more risk than D, but less expectedcost, so a trade-off is involved, indicated by the Fig. 4

lines crossing with a lower expected cost for E, the

points for both being on the Fig. 3 risk efficient

boundary.

One of the virtues of the simple linear cumulative

probability distribution portrayal illustrated by Fig. 4 is

a starting place to understand the link between the

conceptually useful framework of Fig. 3 and the oper-ationally useful framework provided by cumulative

probability distribution diagrams like Fig. 1. To con-

sider risk efficient choices in practice we use the con-

ceptual framework of Fig. 3 and the operational

framework of Fig. 1. It is worth developing familiarity

with the relationship between Figs. 3 and 4, then Fig. 3

and sets of curves like those of Fig. 1.

The feasible solution boundary other than the risk ef-ficient portion, above G and to the right of C, is also

usually portrayed as shown in Fig. 3. The mathematical

assumptions behind a basicMarkowitz model [5] support

this portrayal for financial portfolios. In practice the

feasible solution area for project management option

choices may only be constrained above and to the right by

eliminating the obviously ridiculous options, treating

them as non-feasible because no reasonable person wouldcontemplate them. Some readersmayprefer to include the

ridiculous and draw a horizontal boundary from C to the

right, a vertical boundary from G upwards.

Fig. 5 refines the idea of a finite feasible solution area

defined by excluding ridiculous options. It shows an

opportunity/incompetence boundary which separates an

‘opportunity region’ close to the risk efficient boundary

from an ‘incompetence region’ significantly removedfrom the risk efficient boundary. Several threads of ra-

tionale lie behind Fig. 5, explored in [11], outlined briefly

here.

Exactly where the opportunity/incompetence bound-

ary lies is clearly open to debate, but it is very useful to

associate risk efficiency improvements like that illus-

trated by the initial version of the BP barge selection

example with opportunity management, moving from a

point like B to a point like E in Fig. 5. There is no need

to suggest that reasonable planning prior to effective risk

management processes was incompetent. A more useful

perspective is that effective risk management processes

facilitate systematic searches for opportunities to im-

prove risk efficiency. Indeed, searching for opportunitiesto improve risk efficiency is the best way to visualise

what is going on, and to motivate those involved to do it

effectively. However, if planning without effective risk

management processes is incompetent, or risk manage-

ment processes themselves foster incompetent planning,

it can be useful to associate this with a point like A in

Fig. 5, as part of a change management process. Not all

feasible approaches are competent, and what is and isnot competent matters. If you want to stop incompetent

practices, you have to understand what makes them

incompetent, and how to avoid it. Point A in Fig. 5 may

depict a strategy which fails to deliver risk efficiency

because the risk efficiency concept is not understood, so

risk efficient choices are not looked for. If corporate

decision processes do not look for risk efficiency, it is

unlikely to found.The initial version of the BP barge selection example

involves an opportunity associated with avoiding the

threat of an additional season because of an accumula-

tion of delays associated with threats, not a ‘proper

opportunity’ from some perspectives, although the au-

thors see viewing the search for such changes as an

important part of opportunity management.

The IBM culture change example illustrates takingmore risk on individual projects for more reward at a

corporate level, part of their business case and BP’s

business case for formal risk management, and an

important part of any organisation’s business case for

formal risk management if risk efficiency is under-

stood in the complete sense of interest here. This can

be associated with reducing corporate level risk by

increasing project level risk. But in the authors’ view itis a key part of opportunity management, best viewed

from that perspective in a Fig. 5 context, because a


positive spin which allows the integration of all deci-

sion choices improves the effectiveness of the process.

Consider two further examples of opportunities of

the kind best practice must stimulate a search for.

InNorth Sea projects it is obvious that ‘bad weather’ isa threat to be managed. ‘Good weather’ is an associated

opportunity. If a pipeline progresses faster than expected,

it is very important not to run out of pipe. Further, if any

activity finishes early, it is very important to manage this

good luck proactively, pulling other activities forward in

time, otherwise the swings and roundabouts of good luck

and bad luck will suffer a ratchet effect and become pure

bad luck – the good luck will be lost if it is not captured byopportunity management [7,11].

A combined cycle gas-powered electricity generation

station assessed by a designed modification of the BP

process discussed earlier [9] for use by National Power

on its first outing had to look for a general response to

the combined effect of a series of threats, including de-

lays in obtaining permissions from government agencies

because of a new political context. The focus of themanagement of this risk by the engineers involved was

completing testing of the plant prior to the ‘first gas

contract date’ involving a take-or-pay contract for gas

which might lead to delay penalties. But when the fi-

nance staff saw how the engineers had solved this issue

[11], they recognised a later first gas contract date could

be used to improve the cash flow, an opportunity in

terms of more profit in year one of operation. The res-olution of a threat by one part of the organisation was

recognised as the basis of an opportunity by another

part of the organisation.

Opportunities and threats are not distinct event risks.

They are aspects of uncertainty. An important feature of

this perspective is the view that ‘opportunities’ are not

just good luck capitalised or potential favourable events

made more likely.

Opportunities are all feasible ways of improving the expected

outcome in terms of all relevant attributes without increasing

associated risk in an inappropriate manner.

Value management [12] and all other aspects of best

practice project management are clearly part of this.

Defining risk management to fully embrace opportunity

management in this sense requires a risk efficiency per-

spective, although for some organisations it might be

useful to depart from tradition and refer to ‘risk effi-ciency’ as ‘opportunity efficiency’ or ‘risk-reward effi-

ciency’.

Full integration of opportunity management in this

sense clearly takes project risk management beyond

many descriptions of what project risk management is

about, along lines explored by [13], but users of project

risk management who do not see this as a goal are never

going to achieve full project risk management maturityin a best practice sense in the authors’ view.

4. Non-linear cumulative probability distributions

Linear cumulative probability distributions, like those

of Figs. 2 and 4, provide a useful conceptual simplifica-

tion. This linearity can also be useful at an operationallevel, for simple tactical decisions like our photocopier

example, or for a first cut analysis of strategic decisions

[7,11,14–16]. But generalising the direct use of figures like

2 and 4 to direct use of figures like 1 poses no difficulties

beyond getting used to the implications of more complex

shapes. This is in stark contrast to generalising Marko-

witz’s two moment (mean–variance) approach to ac-

commodate asymmetric distributions [5].Direct visualisation of risk and risk efficient choices in

a cumulative probability framework is a key ingredient

in the ‘constructively simple’ approach to decision

making involving risk and uncertainty, which overcomes

barriers to practical operational tools to exploit risk ef-

ficiency in a financial portfolio context as well as a pro-

ject management context [7]. In these and other contexts

risk efficiency is essential ‘useful theory’, in the sense thatit provides a conceptual framework to understand in ‘big

picture’ terms what we are trying to do. It is also the basis

of associated operational tools and rules of thumb.

‘Constructive simplicity’ can be related to risk efficiency

in terms of a ‘simplicity efficiency’ concept [7], a frame-

work for thinking about what level of simplicity is ap-

propriate, and never using complexity which is not

constructive, explored briefly later in this paper.The framework for making risk efficient choices a

practical proposition in the context of non-linear cumu-

lative probability distribution curves is a well developed

understanding of the relationship between Figs. 1–5, a

conceptual risk management education issue of relevance

to everyone involved in project management. The tool

used on an operational basis is diagrams of the Fig. 1

form, reflecting the issues discussed in terms of Figs. 2–5.An example of a related rule of thumb is

always try to identify at least one general response, which will

deal with any combination of earlier specific sources of risk give

the best specific responses, including specific sources we failed to

identify.

The 3 m barge example of Section 2 can be seen as ageneral response in this sense, and this rule of thumb

was the explicit basis of the success achieved in the

National Power example.

5. Non-quantified conditions or assumptions

If a choice between tactics like replacing a failedphotocopier is made in terms of a quantification of

uncertainty like that of Fig. 2, there may be no associ-

ated conditions (assumptions) which matter, in the sense

that the uncertainty associated with all decision options


can be quantified in probability distributions using the

same assumptions, and they are equally robust in terms

of relaxation of those assumptions. However, if a stra-

tegic choice like getting oil to market via pipelines or

ships is involved, using a diagram like Fig. 1, importantassumptions which are robust to different degrees for

different choices may be important. If the choice is ‘de-

velop the oil field or not’, important assumptions which

matter to a different extent for each choice are inevita-

ble. At a conceptual level, risk efficient choices must be

made assuming a common set of conditions apply, or

obvious problems arise. Stand-alone cost estimates

(which are not comparative) always involve assumptionswhich condition the estimate – scope assumptions which

may not hold for example.

A direct operational approach to ensure a compara-

ble set of assumptions or no overlooked conditions as-

sociated with a stand-alone estimate can be provided

using what the authors call a ‘cube factor’ [7,11,14]. In

brief, any estimator’s expected value should be inter-

preted using three adjustments, which can be defined interms of an expected value and associated variability.

One adjustment is for known unknowns – explicit as-

sumptions which have been identified via a risk man-

agement process but not quantified, treated as

conditions. A second is for unknown unknowns – im-

plicit assumptions which have not been identified. A

third is for bias – a tendency to optimism or pessimism,

conscious or unconscious. The ‘cube factor’ designationis a simplification of known unknowns, unknown un-

knowns, and bias, kuuub, reflecting a convenient three

dimensional portrayal [7,11]. The technicalities of how

this can be made operational are not relevant here.

What is relevant is the need to adjust judgements for

different assumptions or conditions and the availability

of a framework to address this issue if it matters. In

effect we need a device to ensure that all decision optionsconsidered involve the same conditions (assumptions) or

suitable adjustments are made to reflect the differences.

A cube factor provides a direct approach. Indirect ap-

proaches are also possible [7], like looking at the

quantified difference and a list of non-quantified factors

and asking which seems bigger. The US defence secre-

tary Donald Rumsfeld may have won a Plain English

Campaign ‘Foot In Mouth trophy’ for his description of‘unknown unknowns’ [17], but he is right to point out

that they matter.

An example use of the cube factor concept in practice

involved a railway infrastructure project due diligence

process. One party said the project will cost X, based on

their risk analysis. Another party said the project will

cost Y, based on their risk analysis, where Y was sig-

nificantly larger than X. Chapman was asked to assesswhere reality lay, anticipating a response somewhere

between X and Y. The answer was Z, where Z was

substantially greater than Y. A cube factor was used to

explain why, in terms of scope assumptions associated

with both approaches to risk analysis, modelling bias,

and proposed contractual arrangements. Chapter 5 in

[7] discusses a variant of this assessment, transformed

into a property development tale.The Green Book [18] adjustment for optimistic bias

currently advocated by the UK Treasury can be inter-

preted as a rather crude cube factor, and such adjust-

ments arguably make more sense in a cube factor

framework. Ignoring a cube factor can be interpreted as

ignoring all the risk events which frequently matter most

– the assumptions which condition a numeric estimate

failing to hold.The cube factor is both a conceptual device and an

operational tool for dealing with assumptions or con-

ditions used to quantify uncertainty which may not

hold.

6. Choices involving multiple attributes

To start with an example context drawing on a case

just touched on, consider a railway infrastructure pro-

ject. Say the capital cost uncertainty measurement pro-

cess has to relate that uncertainty to time (delay)

uncertainty. But assume for the moment that quality (all

other measures of performance) uncertainty can treated

as a separate pre-specified set of conditions. Generalis-

ing the risk efficiency concept to accommodate thiscontext has to be based on an understanding of appro-

priate trade-offs between cost and time. Most option

choices will impact on both, but even if they do not,

both need to be considered when seeking a risk efficient

set of choices. In effect, the two dimensional Fig. 3 has

to take a three dimension form, with an additional axis

for time, assuming risk associated with cost and time is

portrayed in one dimension. The feasible solution areabecomes a three dimensional space. The risk efficient

boundary line becomes a surface. In conceptual terms

we need to locate the point on this surface which pro-

vides the most appropriate trade-off between minimising

expected cost and minimising expected time, and be-

tween these two expected outcomes and associated risk.

In practical terms we need to judge any two options in

terms of two diagrams like Fig. 1, one for cost and an-other for time, implicitly using attribute trade-offs when

necessary, because we have not explicitly predefined

appropriate attribute trade-offs, and attribute trade-offs

may be crucial if one choice does not dominate the other

in terms of both attributes. Two figures like Fig. 1

provide a practical operational view of a three dimen-

sional version of Fig. 3.

To continue with the railway infrastructure projectillustration, if other measures of performance also

require joint consideration, operating costs and safety

Complexity

Insi

ght

a-b ineffective level of insightb-d effective and efficient boundaryb-c first pass range for models (target - may not be achieved)c-d last pass range for models when more insight is useful (target)e inefficient approach

Key:

Simplicity

e

d

c

ba

feasible alternatives

Fig. 6. Simplicity efficiency boundary.


for example, then further dimensions become relevant

in Fig. 3 conceptual terms, and further versions of

Fig. 1 become necessary in operational terms. For

example, a change in contract strategy might increase

expected capital cost and expected operating cost,decrease expected time, and increase expected safety,

with no significant change in associated risk. To make

a choice, the differences in the expected outcomes can

be compared, and implicit or explicit preferences used

to make a choice. If associated risks are also different,

four figures like Fig. 1 would have to be consulted to

make a choice.

Explicit consideration of appropriate trade-offs be-tween capital cost, operating cost and time generally

provides more effective management of these trade-offs.

In the limit such joint management can lead to the

equivalent of a conversion of the multiple attribute de-

cision problem into a single attribute decision problem.

A failure to consider such trade-offs explicitly can be

interpreted as a failure to manage such trade-offs. Sim-

ilar arguments can be applied to safety, although thisraises a range of ethical issues outlined in [7, Chapter 7],

involving another railway case.

Sometimes a balanced scorecard approach [19] is

appropriate, involving a range of attribute measures

which are not usually converted to a single measure like

cost or considered explicitly in terms of trade-offs.

However, trade-offs still underlie the choices made, and

it can be useful to consider them indirectly [7].In principle, all decision choices could be reduced to a

single attribute choice in a Fig. 5 framework if appro-

priate trade-offs are identified, via a goal programming

approach for example [20]. In practice it is not sensible

to attempt this directly, but it is clearly important to

avoid choices like A, which will be inevitable if trade-offs

are not considered in an effective manner. The project

risk management processes embedded in general cor-porate decision making processes must confront the

question of trade-offs between multiple attributes in an

effective manner if outcomes like A in Fig. 5 are to be

avoided. All those involved in projects who have any say

in the operation and use of such processes need to un-

derstand this. It is not just an issue for specialist project

risk management staff. It is a holistic project manage-

ment issue which affects everyone involved in projectsand everyone concerned with their outcomes. The six

Ws framework discussed in [11] provides an operational

framework to assist with the analysis of these issues, and

[7] provides further operational frameworks and tools.

Best practice project risk management insists that the

project team as a whole confronts the issue of trade-offs

between attributes, and a risk efficient perspective as

outlined in [7] provides the conceptual framework andbasic tools to do so recognising uncertainty about the

trade-offs as well as uncertainty about our ability to

measure the appropriate attributes.

7. Further project and process objectives, including

cultural changes

If everyone involved in a project visualises themselves

at a point like B in Fig. 5, seeking opportunities to moveto E, a rich range of objectives which build on this po-

sition can follow, as discussed in Chapter 3 of [11]. In

contrast, organisations which effectively operate at a

point like A in Fig. 5 usually have a complex set of

cultural conditions which can be treated via appropriate

process changes [7]. This section outlines some of the

further objectives that can be pursued in the framework

of a risk efficiency perspective, finishing with a culturechange example.

Once it is clear there are many ways to perform a

project which need to be avoided because they are not

risk efficient, and we need to seek an ‘efficient frontier’ in

terms of our approach to each project, it follows that a

similar argument applies to the processes used to plan

and manage projects. This involves a need for what the

authors call ‘simplicity efficiency’, ‘the minimum level ofcomplexity for any given level of insight, choosing an

appropriate level of insight for each pass of every pro-

cess’, a reinterpretation of ‘KISS’ as Keep it Simple

Systematically [7]. Fig. 6 illustrates this concept in a

manner comparable to Fig. 3.

This has a number of implications for best practice

risk management processes.

First, best practice risk management processes mustbe highly iterative, with early passes designed to corre-

spond to point ‘b’ in Fig. 6 used to discover where un-

certainty matters, sizing it in rough terms at a low cost in

terms of effort and complexity. Later passes can then

focus more time and effort effectively and efficiently,

using processes designed to correspond to points be-

tween ‘b’ and ‘d’ like ‘c’. We want to spend 80% of our

time on the 20% of the project that matters most, orsome variant of this 80:20 rule. Single pass processes

5th yearMar NovDec Jan Feb Apr May Jun Jul Aug Sep Oct

Pro

babi

lity

of a

chie

vem

ent b

y da

tes

indi

cate

d

0.2

0.4

0.6

0.8

1

0

0.3

0.5

0.7

0.9

0.1

Base plancompletion date

1 2 34

5

6

Probability curves show the cumulative effect of the following issues:

1. yard not available, or mobilisation delays2. construction problems / adverse weather3. subcontracted nodes delivery delays

Notes:1. the curves assume a minimum fabrication period of 20 months2. no work is transferred offsite to improve progress3. no major fire, explosion or other damage

6. delayed award of fabrication contract

4. material delivery delays5. industrial disputes

Fig. 7. Initial level output for an offshore project.


cannot be efficient or effective in comparison to well

designed iterative processes. Single pass processes cor-

respond to a point like ‘e’.

Second, early passes must identify what matters in a

simple unambiguous manner, and facilitate further more

refined analysis in a consistent framework. The use of

cumulative probability distributions in a Fig. 7 frame-work provides the basic tool here, this example involv-

ing time uncertainty for the jacket fabrication activity of

a BP North Sea project.

The curve labelled 1 reflects issue 1 on its own, the

curve labelled 2 reflects 1+2, the curve labelled 3 reflects

issues 1+2+3, and so on. The small gap between issues 1

and 2 shows we do not need to worry about issue 2, but

the large gap between curves 4 and 5 shows we do needto worry about issue 5, given the low chance of

achieving the base plan completion date (about 0.15

probability, associated with the intersection of the dot-

ted line and curve 6). As explained in [11], if an early

pass shows this result when all the risk events involved

have been estimated simply and directly without any

attempt to gather data or think about alternative re-

sponses, the next pass might look for data to confirm theseriousness of industrial disputes, or it might look for

better ways to manage this issue, or both. Very early

passes can use linear cumulative distributions which are

directly comparable to a probability-impact grid except

that a minimum and maximum probability and impact

box is specified for each risk event instead of insisting on

a common box structure, and there is no need for an

ambiguous ‘risk index’ [7,14–16]. Each curve in Fig. 2

can be interpreted as an equivalent to a probability-

impact grid in this sense – uncertainty about the number

of copies is the only risk event equivalent, it is certain to

occur, and plausible minimum and maximum numbers

define the end points of each curve. Diagrams like Fig. 7are used to understand how risk and uncertainty builds

up, from a bottom level of risk events and other sources

of local uncertainty, to a top level of project completion

date, cost and quality measures. And they are used to

explain it top down. Diagrams like Fig. 1 are used to

make decisions during the process of building it up,

starting with tactical decisions, then moving on to

strategic decisions, which are always conditioned bylower level tactical decisions. Trade-offs between attri-

butes must be considered as part of this process as ap-

propriate.

Third, when this approach to analysis is adopted the

importance of treating dependence properly becomes

inescapable, a key aspect of best practice. There are

simple ways of modelling widespread dependence based

on covariance, correlation or percent dependence.Portfolio theory, the birthplace of risk efficiency, is

usually couched in these terms [5]. There are simple ways

of modelling a limited number of dependence relation-

ships in a more detailed and less restrictive manner using

conditional probability specifications. Decision theory

[8] can be interpreted as the home of the probability

trees which underlie this approach. Causal modelling of

relationships provides the greatest insight when it isfeasible, one of the key motives for the modelling of

sources of risk and responses in [9] and all subsequent

derivatives of this approach. Chapter 10 of [7] considers

all three in a portfolio management context, to clarify

how they can be used for different ends, jointly or sep-

arately. One or more of these approaches needs to be

selected for project risk management processes, with a

clear understanding of what is needed and how theseneeds are best served. Simply assuming independence is

generally not a viable option, and it routinely leads to

grave misjudgements, often involving understatements

of uncertainty by an order of magnitude.

Fourth, once this kind of analysis is common place

and widely understood within a risk efficiency perspec-

tive, it becomes sensible to distinguish between ‘targets’

which should be aspired to, expected values whichshould be the basis of most decisions, and commitments

which involve an appropriate contingency, with respect

to all relevant attribute measures. Further, it becomes

obvious how this framework can be used to manage

good and bad luck, ensure ownership of contingencies

and provisions is appropriate, and ensure contracts are

effective and efficient [11].

Fifth, once this kind of approach is clear it becomesobvious why the PRAM [2] process uses a ‘focus the

process phase’ to tailor the generic risk management

process to the context of the particular project being


addressed. The BP barge selection example and the

National Power example both involved processes de-

signed for particular types of projects for particular

organisations. Organisations can now base a compara-

ble process on generic best practice processes [11], butthey will still need the equivalent of a PRAM focus

phase, and they need to avoid using any guideline in a

manner which reflects common practice rather than best

practice.

Finally, within this kind of process it is feasible to

select and manage specific culture change objectives.

For example, the hook-up discussed earlier in this

paper actually took place in late October, the weatherwas very good at the time, and it became clear after-

the-fact that they could have got away with the 1.6 m

barge. Reflecting on these facts, it became clear that

the decision to use a more expensive barge was ap-

propriate, the project manager had done well to com-

plete the hook-up by the end of October, and everyone

involved had been lucky with the weather. Further,

because there was an effective risk management processbased on risk efficiency in place, it was clear the project

manager was both effective and lucky, but if the same

project manager had made the same choice without

formal risk analysis support, his career prospects

would have looked decidedly different. He would have

been accused of being a ‘wimp’ and wasting money. It

was understood that experienced project managers

would anticipate this, and go for the 1.6 m bargechoice in such circumstances, because the organisation

was incapable of distinguishing between good luck and

good management, bad luck and bad management.

More generally, the wrong risks would be taken, the

wrong risks would be avoided, and a blame culture

would shape behaviour in a way which accelerates the

movement in Fig. 5 from B to A and beyond, unless

the culture change implications of the ability to dis-tinguish good luck and good management, bad luck

and bad management, are exploited for all levels of

decision making, including those when formal risk

management processes are not appropriate.

Risk efficiency at a conceptual level has cultural im-

plications of immense practical importance. Best prac-

tice projects have to address these implications. The

IBM culture change programme mentioned earlier wascentred on these ideas.

Whether culture change is seen as part of the sim-

plicity efficiency concept portrayed by Fig. 6 or not, it

should be clear that simplicity efficiency is a necessary

aspect of risk efficiency broadly defined.

8. Some further implications of a central role for riskefficiency

The operational definition of ‘risk’ which [11] uses is

the implications of uncertainty about the level of performance

achievable, portrayed by adverse variability relative to expected

outcomes, assessed for each performance attribute using com-

parative cumulative probability distributions when measure-

ment is appropriate.

This captures what BP and IBM and others using a

risk efficiency based approach to project risk manage-

ment have been doing for years, and it is a clear gen-

eralisation of a Markowitz perspective. It is implicit inthe earlier discussion in this paper. But it is substan-

tially different to the definitions of risk adopted by

PIMBOK 2000 [1] and PRAM 1997 [2]. Indeed, their

definitions of risk are not really compatible with a risk

efficiency perspective. The process recommended in

PRAM 1997 in Chapter 3 is consistent with risk effi-

ciency concept, as is its elaboration in [11] and the 1997

first edition of this book, but these books need to beunderstood to interpret the PRAM process in these

terms. Both guides need to change their definition of

risk to accommodate a risk efficiency interpretation of

their process. The 1997 PRAM Guide is currently be-

ing revised, and as currently drafted this change has

been made, along with a number of other useful

changes which follow on from this change in perspec-

tive, outlined in Chapter 4 of [11].Key implications if all these changes are made include

linked shifts in emphasis:

1. from a bottom-up focus on events which generate

risk, to a top-down focus on the implications of the

accumulated effects of all sources of uncertainty;

2. from a focus on responses to specific events, to a

focus on responses which deal with collections of

sources of uncertainty, building flexibility into aproject;

3. from qualitative probability-impact grid portrayals of

events which generate risk given specific responses, to

quantitative portrayals using Figs. 2 and 4 equiva-

lents initially, Fig. 1 equivalents when uncertainty

clearly matters;

4. from processes based on probability-impact grid or

conventional probability distribution approacheswhich are iterative to a limited extent, to highly iter-

ative approaches which bridge the qualitative-quanti-

tative uncertainty and risk evaluation gap in a

smoother manner;

5. from constraining the scope of ‘project’ and ‘risk’ def-

initions to keep ‘project risk management’ processes

simple and self-contained, to enlarging the scope of

these definitions to interface and integrate project,programme, strategic and operations management;

6. from a focus on threats, to a focus on opportunity,

taking more risk in order to be more successful,

knowing which risks to take and which to avoid;

7. from a focus on technical fixes for technical prob-

lems, to culture changes which pay dividends which

are subtle but substantial.


All of these implications increase the tension between

simple entry level tools/training and sophisticated

practice/education, unless sound conceptual links be-

tween effective novice best practice and effective mature

best practice are developed, the focus of what con-structive simplicity [7] attempts to deliver. The way

guides like PRAM and PMBOK accommodate this

tension is a big issue for all those interested in best

practice project management. It also has implications

for what we mean by project risk management maturity

[21,22] and linked broader project management maturity

concepts.

9. Implications for project risk management process

choices

Not all projects need formal project risk management

processes. However, when deciding a project does or

does not need a formal process, big mistakes may be

made if a best practice project risk management process

is not one choice being considered, and the implications

of either choice is not clear. Project management edu-

cation does not need to include a detailed technical

understanding of project risk management for everyone,but it does require a conceptual understanding of what

best practice project risk management involves, and the

basic tools. Central to this is the role of trade-offs be-

tween attributes like cost, time and quality – always

uncertain but usually critical. In the authors’ view key

implications if this understanding is developed include:

1. informal use of best practice project risk management

concepts in an effective manner for very simple

projects;

2. formal use of best practice project risk management

concepts on a much wider scale than is currently the

case;

3. best practice for project risk management being under-

stood in terms of a very much wider scope than some

current guidelines suggest.

10. Some concluding comments

Not everyone who reads this paper will wish to be

involved in project risk management. But in the authors’

view, everyone who wants to be involved in a best

practice approach to project management needs to un-

derstand what this paper is saying, following up on thereferences provided where an inevitably concise ap-

proach is too terse.

At a conceptual level, risk efficiency and associated

stochastic dominance ideas are generic to all decision

making involving uncertainty and risk, and they are

key to an ‘optimum seeking’ perspective which is es-

sential to avoid a ‘satisficing’ perspective which lacks

ambition. Projects involve significant inherent uncer-

tainty which often implies risk. Explicit understanding

of what is involved is essential for competent man-

agement of it. The only way project risk management

processes can avoid confronting this issue is to definerisk in a restrictive manner, as a limited form of add-

on for projects defined in a limited manner, as distinct

from a comprehensive add-in. All guidelines need en-

couragement to avoid such a stance, because simplic-

ity is an attractive and understandable goal, but

simplistic approaches to complex issues will inevitably

fail.

At a practical working tool level, Figs. 1 and 2, usedto implement choice processes reflecting the ideas asso-

ciated with Figs. 3–5 including the generalisations dis-

cussed in later sections of this paper, is both simple and

flexible, free from implicit assumptions which lead to

interpretations lacking in robustness. Practical concepts

and tools for best practice projects must be simple, but

not simplistic, and robustness is a key aspect of avoiding

simplicity which is not appropriate.

Acknowledgements

A number of UK colleagues helped to shape this

paper via feedback on an early version for the APM/

Project Manager Today 6th Risk Conference, From Di-

agnosis to Delivery, 28 November 2003, London. Several

US colleagues also shaped it via discussions about a

version of this paper given as an opening keynote ad-

dress for the IRR/PMI Project Risk Symposium 2004,

16–19 May 2004, Anaheim CA. The authors are verygrateful for their help. The authors would also like to

thank John Wiley and Sons Ltd, Chichester, for per-

mission to use Figs. 1–7 from [11].

References

[1] PMI A Guide to the Project Management Book of Knowledge

(PMBOK). ProjectManagement Institute,UpperDarby, PA, 2000.

[2] Simon P, Hillson D, Newland K. PRAM project risk analysis and

management guide. Association for Project Management, Nor-

wich, 1997.

[3] Hillson D. Effective opportunity management for projects: risk

can be good for you. New York: Marcel Dekker; 2003.

[4] Institution of Civil Engineers and the Faculty and Institute of

Actuaries. RAMP Risk Analysis and Management of Projects.

Thomas Telford, London, 1998 and 2002.

[5] Markowitz H. Portfolio selection: efficient diversification of

investments. New York: Wiley; 1959.

[6] Brealey AR, Myers SW. Principles of corporate finance. 5th ed.

Singapore: McGraw Hill; 1996.

[7] Chapman CB, Ward SC. Managing project risk and uncertainty: a

constructively simple approach to decision making. Chichester:

Wiley; 2002.

[8] Goodwin P, Wright G. Decision analysis for management

judgement. 2nd ed. Chichester: Wiley; 1998.


[9] Chapman CB. Large engineering project risk analysis. IEEE

Trans Eng Manage 1979;26:78–86.

[10] Cooper DF, Chapman CB. Risk analysis for large projects.

Chicester: Wiley; 1987.

[11] Chapman CB, Ward SC. Project risk management: processes,

techniques and insights. 2nd ed. Chichester: Wiley; 2003.

[12] Green SD. Towards an integrated script for risk and value

management. Project Manage 2001;7(1):52–8.

[13] Ward SC, Chapman CB. Transforming project risk management

into project uncertainty management. Int J Project Manage

2003;21:97–105.

[14] Chapman CB, Ward SC. Constructively simple estimating: a

project management example. J Operat Res Soc 2003;54:1050–8.

[15] Chapman CB, Ward SC. Estimation and evaluation of uncer-

tainty: a minimalist first pass approach. Int J Project Manage

2000;18:369–83.

[16] Chapman CB, Ward SC, Bennell JA. Incorporating uncertainty

in competitive bidding. Int J Project Manage 2000;18:337–

47.

[17] Ezard J. Rumsfeld’s unknown unknowns takes prize. The

Guardian. 2 December 2003.

[18] HM Treasury. The Green Book, Appraisal and Evaluation in

Central Government. HM Treasury, London, 2003.

[19] Kaplan RS, Norton DP. The balanced scorecard: translating

strategy into action. Boston, MA: Harvard Business School Press;

1996.

[20] Cochrane JL, Zeleny M. Multiple criteria decision making.

Columbia: University of South Carolina Press; 1973.

[21] Hillson D. Towards a risk management maturity model. Int J

Project Business Risk Measurement 1997;1:35–45.

[22] Hopkinson M. Maturity models in practice. Risk Manage Bull

2002;5(4).

why risk efficiency is a key aspect of best practice projects

Documents