Download risk management workshop

Risk & Issue

Management

Workshop

Version 1.0

Prepared by: Iain Aitken

7th July 2009

Workshop objectives

To become familiar with:

• Risk & Issue Management best practices

• The Risk Management Approach, to be incorporated into the

Project Brief/Charter

• Applying Risk & Issue Management to projects

2 © Bestoutcome Limited 2009

Key learning

• The importance of Risk & Issue Management to projects

• The value of a standardised terminology and approach

• Key principles of Risk & Issue Management


Scope

In scope

• Risk & Issue Management

Out of scope

• Project Management methods generally

• Systems Development methods generally

• Quality/Control Gates methods generally


What do we mean by ‘risks’ & ‘issues’?

• Definitions:

Something which might happen which would

threaten the project’s achievement of its

objectives. A potential issue.RISK

Something which has happened which

threatens the project’s achievement of its

objectives. A risk which has materialised.ISSUE



• Example:

I’m planning a day’s cycling in the New Forest…

I might get a puncture.

(I’ll carry a repair kit – or maybe I’ll just

chance it!)

RISK

I already have a puncture.

(I’ll need to repair it before I can set out.)ISSUE



• Definitions:

• the inverse of a risk – missing an opportunity is like allowing a

risk to materialise

Something which might happen

which would improve the project’s

chances of success.OPPORTUNITY



Two types of risk/issue

• There are 2 ways in which a project is exposed to potential failure

1. Delivery Risk/Issues: risks/issues that might impact our ability to

deliver the project to scope, budget, schedule targets

2. Value Risk/Issues: risks/issues that might impact our ability to deliver

the promised organisational benefits/outcomes of the project

Why manage risks & issues?

• All projects involve a degree of risk. Most projects will be affected

by issues.

• Proactive management is essential to minimise the damage done

• Visibility is important – the risks/issues faced and the measures

taken to address them should be communicated to stakeholders

• The project manager should not carry the risk alone

• Key project decisions need to be informed regarding risks & issues


Risk & Issue Management in context

• Risk & Issue management is a fundamental discipline of

project/programme/portfolio management – it should not be

addressed in isolation

• The ODPM Project Management Framework recognises risk & issue

management as essential to project success, e.g.

• IP3: Define Project Business Case

• PL4: Develop Risk/Issue Logs

• CS1: Manage Change and progress


How do we manage risks & issues?

• Definitions:

The repository of all information

regarding risks & issues.

RISK & ISSUE

REGISTERS

The process (within risk & issue

management) of reviewing the

current status of risks (issues).

RISK / ISSUE

REVIEW

The discipline of proactively

addressing risks and issues, in

order to minimise damage to

the project.

RISK & ISSUE

MANAGEMENT

Sub-discipline of risk

management which addresses

the identification &

evaluation of risks.

RISK

ASSESSMENTACTION

PLANNING


How do we prioritise risks & issues?

• Definitions:

The probability that a risk will occur –

usually expressed as ‘LIKELY’, ‘POSSIBLE’

or ‘REMOTE’LIKELIHOOD

A combination of severity and likelihood –

reflects the importance we will place on

itPRIORITY

The effect upon the project of an issue or

materialised risk. Could affect delivery to

time, budget or quality. Expressed as

‘CRITICAL’, ‘MAJOR’ or ‘MANAGEABLE’

SEVERITY RISK &

ISSUE

RISK

ONLY

RISK &

ISSUE


Evaluating Risks – the priority grid

SEVERITY

CRITICAL

MAJOR

MANAGEABLE

LIKELIHOOD

LIKELYPOSSIBLEREMOTE

MEDIUMLOWLOW

HIGHMEDIUMLOW

HIGHHIGHMEDIUM


Policy keynotes

• Approach to managing risks & issues to be documented in the

Project Brief/Charter

• Risk Assessment to be carried out during Project Planning phase

• High priority risks & issues to be communicated to stakeholders

and reported regularly

• Risk & Issue Registers to be maintained throughout

• Risks & Issues to be monitored throughout


The Risk & Issue Management Process

Tasks

Establish

Approach

Identify

and Analyze

Action

Plans

Monitor

Review

Report

Improvement

Information



Tasks

Establish

Approach

Identify

and Analyze

Action

Plans

Monitor

Review

Report

Improvement

Information


Project/Programme/Portfolio relationships

• Projects define Risk (& Issue) Management Approach

• Projects within programmes are likely to inherit standards from

programme level

• Standards for escalation of risks/issues to programme level should

be defined

• Reporting of risk/issue status to programme/portfolio management

or programme office should be defined

• ‘dashboard’ reports show top priority risks & issues



Tasks

Establish

Approach

Identify

and Analyze

Action

Plans

Monitor

Review

Report

Improvement

Information


Risk Assessment

• Covers risk identification and evaluation

• Issues also need to be evaluated – but tend to identify themselves!

• An ongoing project activity – risks (& issues) can arise at any time

• Too many projects only carry out risk assessment at the beginning,

and fail to follow through with actions


Risk Assessment

• Risks may be identified at any time during the life of a project

• Typically a major exercise in identifying and evaluating risks is carried out during Project Planning phase

• Similar exercises may be valuable later in the life cycle

• Risks could also be identified during project meetings or informal conversations

• Project Manager’s responsibility to ensure risks recorded and assessments conducted


Risk Assessment workshops

• Facilitate workshops across the business

• Identifying risks & issues

• Evaluating severity & likelihood

• Assigning responsibilities

• Initiating action planning

• Various tools & supporting material available

• ODPM Project Management Framework

• PM3 tool (Risk/Issue Management tabs)

• Other risk assessments, e.g. IT security, testing


When to carry out Risk Assessment?

• Must be carried out during Project Planning phase

• Further workshops may be held at key review points

(Quality/Control Gates)

• Usually more limited in scope

• Ensure these are included in plan

• All risks need to be evaluated (and the evaluation agreed) as they

arise



Tasks

Establish

Approach

Identify

and Analyze

Action

Plans

Monitor

Review

Report

Improvement

Information


Managing Risks & Issues

• Ongoing identification and evaluation

• New risks & issues

• Re-evaluation of known risks/issues

• Developing action plans to address

• Monitoring actions taken

• Recording details and status in the register

• Reporting

• Periodic reviews

• Escalating to higher authority

• Closure


Action planning – what can we do?

• Reduce the likelihood (risks)

• Reduce the severity (risks and issues)

• Transfer the risk (e.g. insurance)

• Refer or escalate to higher authority

• Accept (risks) – do nothing

• Countermeasures (preventive)

• Contingencies (recovery)


Action planning – mitigating risk

SEVERITY

CRITICAL

MAJOR

MANAGEABLE

LIKELIHOOD

LIKELYPOSSIBLEREMOTE

RISK

RISK

RISK


Planning and taking action

• Define and agree actions

– Allocate responsibility

– Assign due dates

– Is the risk worth the cost?

• Update project plans

– Cross-refer to Risk & Issue Registers

• Monitor

– Check that actions are taken

– How effective were the actions?


Reviews

• Structured

– As part of Quality/Control Gate review

– Regular, scheduled sessions

– Extraordinary sessions at Project Manager’s discretion

• Ad hoc

– Typically held to address a limited subset of risks or issues

• Risks & issues sometimes reviewed separately

• Reviews policy & process guidance available


Reviews

• Review sessions should

– Follow the Approach defined in the Project

Brief/Charter

– Work from the Risk & Issue Registers

• Check for anomalies (missing or inconsistent information)

• Look for outstanding actions

• Review prioritisation (has anything changed?)

• Agree closure, transfer or escalation

– Update the Registers

– Consider possible risks (maybe issues) not yet addressed

– Produce minutes as necessary


Closure

• A risk is closed when:

– The likelihood has reduced to (near) zero

– It no longer affects the project

– It has materialised, and become an issue

– It is transferred to some other responsibilit,y e.g. programme management

• An issue is closed when:

– It has been resolved

– It is transferred to some other responsibility


Reporting

• Project/Programme/Portfolio reporting standards

• Project reporting, e.g.

– PM3 Issues & Risks ‘traffic light’ delivery status indicators

– PM3 top 5 issues/risks in Dashboard

• Programme reporting, e.g.

– PM3 risks/issues promoted to programme level


Other considerations

• Confidentiality

– Do some risks or issues need to be addressed in a confidential fashion?

(commercial issues, personal issues)

• Opportunities vs. risks

– An opportunity is the inverse of a risk

– Should we try to avoid missing an opportunity via risk management?



Tasks

Establish

Approach

Identify

and Analyze

Action

Plans

Monitor

Review

Report

Improvement

Information


Using PM3 Risk & Issue Registers

• Advantages for project, programme & portfolio managers

• Standardised format

• ‘Top five’ risks & ‘Top five’ issues generated automatically

• Can be tailored/adapted if necessary



Tasks

Establish

Approach

Identify

and Analyze

Action

Plans

Monitor

Review

Report

Improvement

Information


What happens at the end of the project?

• Formal closure

• Post Implementation Review (PIR)

• Then manage Value Risks/Issues of live/delivered project

• Residual risks?

• Outstanding issues?

• Should be transferred to …


Capturing knowledge & lessons learned

• How successful were we at managing risks & issues?

• Statistics?

• Qualitative judgements?

• What have we learned?

• New types of risk to look out for?

• New countermeasure/contingency tactics?

• Improvements to the process?

• Have key project deliverables been stored on SharePoint?



www.bestoutcome.com