Project Management
Risk Management
After completing this chapter, you should be able to:
• Define project risk.
• Recognize four key stages in project risk management and the steps
necessary to manage risk.
• Understand five primary causes of project risk and four major
approaches to risk identification.
• Recognize four primary risk mitigation strategies.
• Explain the Project Risk Analysis and Management (PRAM) process.
2
Copyright ©2016 Pearson Education, Ltd.
Risk Management
Risk management – the art and science of identifying,
analyzing, and responding to risk factors throughout the
life of a project and in the best interest of its objectives.
Project risk – an uncertain event or condition that, if it
occurs, has a negative (or sometimes positive) effect
on one or more project objectives such as scope,
schedule, cost, or quality.
Risk = (Probability of Event) * (Consequences of Event)
3
Copyright ©2016 Pearson Education, Ltd.
Questions to Consider in Risk Management
• What is likely to happen (the probability and
impact)?
• What can be done to minimize the probability or
impact of these events?
• What cues will signal the need for such action (i.e.,
what cues should I actively look for)?
• What are the likely outcomes of these problems
and my anticipated reaction?
4
Copyright ©2016 Pearson Education, Ltd.
Risk versus Amount at Stake:
Challenge in Risk Management
(Figure 7.2)
5
Copyright ©2016 Pearson Education, Ltd.
Four Stages of Risk Management
1. Risk identification
2. Analysis of probability and consequences
3. Risk mitigation strategies
4. Control and documentation
6
Copyright ©2016 Pearson Education, Ltd.
1. Risk Identification
Risk Clusters
• Financial (the investment requirement)
• Technical (unproven technology)
• Commercial (customer acceptance)
• Execution (any unique circumstances)
• Contractual or legal risk (strict terms and conditions)
7
Copyright ©2016 Pearson Education, Ltd.
The Spanish ship-builder Navantia is currently wrestling with serious performance problems in its
newest generation of submarine, the S-80 class, because of the decision to include too many
ground-breaking technical upgrades in one ship. The problems with the S-80 were so severe that
the submarine ended up 70 tons overweight and was considered unsafe (i.e., there was a serious
risk that it could not resurface once it submerged). Already behind schedule, the S-80 went
through an additional three years of delays and redesigns before its approval for sea trials.
8
Another example is the recently-built London skyscraper at 20 Fenchurch Street, so oddly-
shaped that it has been nicknamed the “Walkie-talkie” building. The unique design has led to
unforeseen problems, including magnifying the sun’s rays to dangerous temperatures on the
street in front of the building and generating wind tunnel-like air gusts that can push people
off the sidewalks and into the road.
9
10
Copyright ©2016 Pearson Education, Ltd.
Common Types of Risks
• Absenteeism
• Resignation
• Staff pulled away
• Time overruns
• Skills unavailable
• Ineffective training
• Specs incomplete
• Change orders
11
Copyright ©2016 Pearson Education, Ltd.
Risk Factor Identification
• Brainstorming meetings
• Expert opinion (Delphi Method)
• Past history, risk register (database)
• Multiple (or team based) assessments
Supplementary Tools:
• Cause-Effect (Fishbone) diagram
• SWOT Analysis
• Risk Breakdown Structure
12
Copyright ©2016 Pearson Education, Ltd.
Fishbone Diagram
13
SWOT Analysis
14
Risk Breakdown Structure (RBS)
(Figure 7.4)
An RBS is a source-oriented grouping of project risks that organizes
and defines the total risk exposure of the project.
15
Copyright ©2016 Pearson Education, Ltd.
2. Analysis of Probability and Consequences
• Risk Impact Matrix
• FMEA
• Decision Tree
16
Copyright ©2016 Pearson Education, Ltd.
Risk Impact Matrix
(Figure 7.5)
17
Copyright ©2016 Pearson Education, Ltd.
Risk Impact/Probability Chart
High Moderate High Critical
Likelihood
Moderate Low Moderate High
Low Low Low Moderate
Low Moderate High
Consequence (Impact)
18
Risk Impact/Probability Chart
B A
High
Likelihood
C
Moderate D
Low
Low Moderate High
Consequences (Impact)
Software Development Project
• A: Rival releases their product earlier
• B: Experienced programmer leaves
• C: Budget cut
• D: Hardware order arrives late
19
A More Detailed Evaluation
20
Copyright ©2016 Pearson Education, Ltd.
21
Copyright ©2016 Pearson Education, Ltd.
FMEA (Failure Mode and Effect Analysis)
1. Identify the threats that may cause the project to fail.
2. (S)everity: Score the impacts of these threats by using 1 – 10
scale. (1 = no effect, 10 = very important effect)
3. (L)ikelihood: Score the likelihood of these threats by using 1 – 10
scale (1 almost impossible, 10 almost certain)
4. Inability to (D)etect: Score the lack of ability to detect these
threats when they happen by using 1 – 10 scale (1 = threat can be
detected almost certainly, 10 = almost impossible to detect the
threat)
5. Calculate the Risk Priority Number – RPN
RPN = S x L x D
6. Try to make improvements in severity, likelihood or inability to
detect threats that have high risk priority number.
22
Copyright ©2016 Pearson Education, Ltd.
FMEA
Threat Severity Likelihood Inability to Risk Priority
(S) (L) Detect (D) Number
(RPN)
Limited Budget 6 7.5 2 90
Unable to acquire
technical 8.5 5 4 170
knowledge
Scope Change 4 8 5 160
Increased Costs 3 2 6 36
Economic Crisis 4 2.5 7 70
23
Copyright ©2016 Pearson Education, Ltd.
Decision Tree
• A useful decision support tool for sequential decisions in the
future.
• Composed of probabilities and decisions. General
representation:
• Circles for probabilities
• Squares for decisions
24
Decision Tree Example
0.8*60+0.2*15=51
51-15=36
0.3*20+0.7*10=13
0.3*36+0.6*0+0.1*0=10.8 0
0.1*-15+0.9*-60=-55.5
10.8-6=4.8
0
R.E. Hodgett, Multi-Criteria Decision-Making in Whole Process Design, Ph.D. Thesis, School of 25
Chemical Engineering and Advanced Materials Newcastle University, 2013.
3. Risk Mitigation Strategies
Four main strategies:
• Accept (the risk is unlikely and/or consequences are small, or
it is part of the business)
• Minimize (actively use strategies)
• Share (partnerships, risk sharing with suppliers and
customers)
• Transfer (through contracts, insurance)
26
Copyright ©2016 Pearson Education, Ltd.
Other approaches to handle risk:
• Contingency Reserves
• Task contingency (time and cost buffers for difficult
tasks)
• Managerial contingency (for external risks, changes in
customer requirements)
• Workarounds (ad hoc solutions when plans do not work)
• Mentoring new project managers and team members
• Cross training project team personnel
• Control and Documentation
• Change management
27
Copyright ©2016 Pearson Education, Ltd.
4. Control & Documentation
Helps managers classify and codify risks, responses, and
outcomes
A report form answers:
• What? – Identify risk
• Who? – Assign a responsible
• When? – Establish a clear time frame for mitigation
• Why? – Identify the causes for the risk
• How? – Create a detailed plan
28
Copyright ©2016 Pearson Education, Ltd.
Sample Risk Management Report Form
29
Copyright ©2016 Pearson Education, Ltd.
Project Risk Analysis & Management (PRAM)
PRAM presents a generic methodology that can be applied to
multiple project environments, and encompasses the key
components of project risk management. (European Association
for Project Management)
Key Features of PRAM
• Risk management follows a life cycle.
• Risk management strategy changes over the
project life cycle.
• Synthesized, coherent approach of multiple
relevant tools
30
Copyright ©2016 Pearson Education, Ltd.
Nine Phases of the PRAM Approach
1. Define - make sure the project is well-defined
2. Focus - plan the risk management process as a project
3. Identify - assess the specific sources of risk at the start
4. Structure – search for commonalities, prioritize
5. Clarify ownership of risks
6. Estimate - estimate the impacts of risks and proposed solutions
7. Evaluate – evaluate the results of the estimate phase
8. Plan - produce a project risk management plan
9. Manage – monitor, control
31
Copyright ©2016 Pearson Education, Ltd.
