Chapter 7
MANAGING RISK
Chapter Outline
*Every Project Manager must understand that “risks” are inherent in all projects. No amount of planning can overcome risk. Risk is an uncertain event or condition that, if it occurs, has a positive or negative effect on project objectives. It has a cause and, if it occurs, a consequence.
Risk management attempts to recognize and manage potential and unforeseen trouble spots that may occur when the project is implemented. Risk management identifies as many risk events as possible (what can go wrong), minimizes their impact (what can be done about the event before the project begins), manages responses to those events that do materialize (contingency plans), and provides contingency funds to cover risk events that actually materialize.
1. Risk management process
Risk management is a proactive approach rather than reactive. It is a preventative process designed to ensure that surprises are reduced and that negative consequences associated with undesirable events are minimized. It also prepares the project manager to take a risk when a time, cost, and/or technical advantage is possible. Note though that the cost impact of a risk event in the project is less if the event occurs earlier rather than later.
2. Risk Identification
The risk management process begins by trying to generate a list of all possible risks that could affect the project. Typically, the project manager, during the planning phase, will pull together a risk management team consisting of team members and other relevant stakeholders. The team will use brainstorming and other problem identifying techniques to identify potential problems. Participants are encouraged to keep an open mind and generate as many probable risks as possible.
Many organizations use the “Risk Breakdown Structure” (RBS), to help the management team identify and eventually analyze risks.
A Risk Profile is another useful tool. A risk profile is a list of questions that address traditional areas of uncertainty on a project. These questions are usually developed and refined from previous, similar projects.
Although the RBS and Risk Profiles are useful tools, the risk identification process should not be limited to just the core team. Input from customers, sponsors, subcontractors, vendors, and other stakeholders should be solicited. Not only do these players have a valuable perspective, but by involving them in the risk management process they also become more committed to the project’s success.
3. Risk Assessment
Note: not all risks listed deserve attention. Some are trivial and can be ignored, while others pose serious threats to the welfare of the project. Project managers will have to develop methods for sifting through the list of risks and determining which ones warrant the need for attention.
- Scenario Analysis / Probability Analysis: is the easiest and most commonly used technique for analyzing risks. Here, team members assess the significance of each risk event in terms of:
- Probability of the event.
- Impact of the event.
Simply stated, risks need to be evaluated in terms of the likelihood the event is going to occur and the impact or consequences of its occurrence.
Because impact ultimately needs to be assessed in terms of project priorities, Impact Scales may be introduced. These are typically used in rank-order descriptors, such as: “low” = 1, “moderate” = 2, “high” = 3, and “very high” = 4. .
When Impact scales are used with a Risk Assessment Form, a project manager can detect which risk event is more than likely going to occur and possibly begin taking mitigating actions early.
4. Risk Response Development
When a risk event is identified and assessed, a decision must be made concerning which response is appropriate for the specific event. Responses to risk can be classified as mitigating, avoiding, transferring, sharing, and retaining.
- Mitigating risk
There are two basic strategies for mitigating risk: (1) reduce the likelihood that the event will occur, and (2) reduce the impact that the adverse event would have on the project.
Ex. If rain can delay a project, can parts of the project be brought indoors under a more climate controlled setting in order to mitigate the risk?
- Avoiding
Risk avoidance is changing the project plan to eliminate the risk or condition. Although impossible to eliminate all risk events, some specific risks may be avoided before you launch the project.
Ex. If political unrest may delay the delivery of a key component of your project, maybe changing your source might help avoid the possible delay.
- Transferring risk
Passing risk to another party is common, however, it almost always results in paying a premium for the exemption.
Ex. Insurance is a good way to transfer risk; so is Performance bonds, warranties, guarantees, etc.
- Sharing risk
Risk sharing allocates proportions of risk to different parties.
Ex. The entertainment industry formed an agreement to define a common format for (DVD) Digital Video Disc, in order to ensure compatibility across products.
- Retaining risk
Some risks are so large that it is not feasible to consider transferring or reducing the event, such as earthquake of flood. The project owner will assume the risk because the chance of such an event occurring during the life of the project is slim. So the risk is retained by developing a contingency plan to implement if the risk materializes.
5. Contingency Planning
A contingency plan is an alternative plan that will be used if a possible foreseen risk event becomes a reality. The contingency plan represents actions that will reduce or mitigate the negative impact of the risk event. Early contingency planning facilitates a smooth transition to the remedy or work around plan. The availability of a contingency plan can significantly increase the chances for the project’s success.
- Technical risks
Technical risks are problematic and can often be the cause for shutting down a project. As a contingency, the project manager should identify the high-risk technical areas, then build models or design experiments to resolve the risk as quickly as possible.
- Schedule risks
Reducing the project duration can be used as a contingency. This is done by shortening or compressing one or more activities on the critical path. Here contingency funds are set aside to expedite the project to get it back on track.
- Cost risks
Projects of long duration need some contingency for price changes. The important point to remember when reviewing price is to avoid the trap of using one lump sum to cover price risks. Prices should be evaluated item by item.
- Funding risks
What if funding for the project is cut by 25 percent or completion projections indicate that costs will greatly exceed the available funds? Project managers must recognize that a complete risk assessment must include an evaluation of funding supply. Ex. If a homeowner announces to the contractor that they will not be able to continue the construction of their house because of loss of employment, the contractor may have a contingency plan to finish the house and then sell it on the open market in order to recover his losses.
6. Contingency Funding and Time Buffers
Contingency funds are established to cover project risks – identified or unknown. When, where, and how much money will be spent is not known until the risk event occurs. Project owners are often reluctant to set-up a project contingency fund that seem to imply that the project may be a bad one. Some perceive it to be an add-on slush fund. Others say they will face the risk as it materializes. This reluctance can be minimized with documented risk identification and planning for when and how the funds will be disbursed.
- Budget reserves: these reserves are identified for specific work packages or segments of a project found in the baseline budget or work breakdown structure.
- Management reserves: these reserves are needed to cover major unforeseen risks and are applied to the entire project.
- Time buffers: just as contingency funds are used to absorb unplanned costs, project managers use Time Buffers to cushion against potential delays in the project. And like contingency funds, the amount of time is dependent upon the inherent uncertainty of the project.
7. Risk Response Control
Project managers need to establish an environment in where the team players feel comfortable raising concerns and admitting mistakes. The norm should be that mistakes are acceptable, hiding mistakes are intolerable. Problems should be embraced not denied.
8. Change Control Management
No project plan will materialize as expected. Coping with and controlling project changes present a formidable challenge for most project managers. Changes can come from many sources and fall into (3) main categories:
1) Scope changes in the form of design or additions.
2)When risk events occur; there will be an implementation of the contingency plan.
3)Improvement changes.
Change control systems are designed to accomplish the following:
1) Identify proposed changes.
2)List expected effects of proposed changes on the schedule and budget.
3)Review, evaluate, and approve/disapprove changes.
4)Negotiate and resolve conflicts of change.
5)Communicate changes to affected parties.
6)Assign responsibility for implementing changes.
7)Adjust master schedule and budget.
8)Track all changes that are to be implemented.
9. Summary
* Risk management is used to identify and compensate for the uncertainty inherent in all projects and that things never go according to plan. It reduces the number of surprises and leads to a better understanding of the most likely outcomes of negative events.
*Contingency plans provide a sense of insurance that if in fact a risk event does occur, then there is a plan ready to go in order to mitigate the negative event.
7-1