Project Risk ManagementA Tool to Deliver Projects

On Time and Within Budget

NK ShrivastavaPMP, PMI-RMP

Consultant/CEO - RefineMVP – PMI South Missouri Chapter

nks@refinem.com http://www.linkedin.com/in/nkshrivastava @justrightpm

January 16, 2012

PMI KC Chapter Meeting Jan 2012

Project Risk Management

Learning's

1. Develop better understanding of Project Risk Management What is a risk? The difference between risks & issues? The positive and negative risk concepts

2. Identify, analyze and prioritize risks and develop risk responses for their projects, programs and portfolios

3. Develop a graph/chart-based communication strategy to clearly and quickly communicate the project status at various points in time to stakeholders

Project Risk ManagementAgenda

• What is a Risk? Understanding Risk

• Why Manage Project Risks?

• PMI’s Practice Standard for Risk Management

• Risk Management Process

• Communicating Risks

• Q & A

Project Risk Management

What picture comes to your mind when you hear the word “Risk”?

Project Risk Management

What is a Risk?

Project Risk Management

What is a Risk?

Project risk is an uncertain event or condition that, if it occurs, has a positive or a negative effect on a project's objectives.

- From PMI's Practice Standard for Project Risk Management - Chapter2 , Page 9

More on RisksRisk Synonyms Risk Antonyms

accident, contingency, danger, exposedness, exposure, flyer, fortuity, fortune, gamble, hazard, header, jeopardy, liability, liableness, luck, openness, opportunity, peril, plunge, possibility, prospect, shot in the dark, speculation, stab*, uncertainty, venture, wager

certainty, safety, sureness, surety

Source : http://thesaurus.com/browse/risk

Project Risk Management

Is it necessary to manage project risks? Yes, Absolutely

Why? To increase predictabilityTo improve probability of success(SPI ~1, CPI ~1)

PMI’s Practice Standard For Project Risk Management

Practice

Standard

A guide to the Project Management Body of

Knowledge

Handbooks Textbooks Courses

Principles of Specialization

Processes

Theory Tools/ Techniques

Adapted from PMI’s Practice Standard for Project Risk Management

Project Risk Management

Risk Management Process

Risk Management Process

Plan Risk Management

Identify Risks

Perform Qualitative Risk Analysis

Perform Quantitative Risk Analysis

Monitor and Control Risks

Plan Risk Responses

Adapted from PMI’s Practice Standard for Project Risk Management

Plan Risk Management

Plan Risk Management

Identify Risks

Perform Qualitative Risk Analysis

Perform Quantitative Risk Analysis

Monitor and Control Risks

Plan Risk Responses

• Risk Mgmt Plan • Tailored Process• Risk Thresholds•

Roles/Responsibilities• Risk Register

Template

Adapted from PMI’s Practice Standard for Project Risk Management

Risk Identification

Plan Risk Management

Identify Risks

Perform Qualitative Risk Analysis

Perform Quantitative Risk Analysis

Monitor and Control Risks

Plan Risk Responses

• Risk Register• List of risks• Risk Owners

Adapted from PMI’s Practice Standard for Project Risk Management

Risk Qualitative Analysis

Plan Risk Management

Identify Risks

Perform Qualitative Risk Analysis

Perform Quantitative Risk Analysis

Monitor and Control Risks

Plan Risk Responses

• Updated Risk Register• Probability & Impact• Root Causes• Prioritized List of Risks• Watch List

Adapted from PMI’s Practice Standard for Project Risk Management

Risk Quantitative Analysis

Plan Risk Management

Identify Risks

Perform Qualitative Risk Analysis

Perform Quantitative Risk Analysis

Monitor and Control Risks

Plan Risk Responses

• Updated Risk Register• Numerical models• Sensitivity analysis (Monte Carlo Simulation)• Re-prioritized list

Adapted from PMI’s Practice Standard for Project Risk Management

Plan Risk Responses

Plan Risk Management

Identify Risks

Perform Qualitative Risk Analysis

Perform Quantitative Risk Analysis

Monitor and Control Risks

Plan Risk Responses• Updated Risk Register • Strategies/Responses• Actions/Action

Owners• Contingency Reserves

Adapted from PMI’s Practice Standard for Project Risk Management

Monitor & Control Risks

Plan Risk Management

Identify Risks

Perform Qualitative Risk Analysis

Perform Quantitative Risk Analysis

Monitor & Control Risks

Plan Risk Responses

• Updated Risk Register• Variance Analysis• Risk Audit• Trends in risk exposure

Adapted from PMI’s Practice Standard for Project Risk Management

Project Risk ManagementSo what is it?

IdentifyWhat can go wrong? What can go right?

PrioritizeWhich ones have the potential of impacting the most?

Do something about itExploit/Avoid or Enhance/Mitigate or Share/Transfer

Or Accept (Passive/Active)

Project Risk Management

Communicating Risks

Risk Behavior Over Time

Jan-10 Feb-10 Mar-10 Apr-10 May-10 Jun-10 Jul-10 Aug-10-1 Aug-10-2 Sep-10 Oct-10 Nov-10 Dec-10

79.75

108.95 108.95

80.45

42.9539.25

33.7527.75

2217.35

8.653.85 3.85

11 13 13 12 12 12 12 11 10 10

95 5

Total Risk Magnitude – SBR Project

Risk Magnitude # of Risks

Risk Impact on the Project Jun 2010

Project Risk Management

How does it impact you? If you are the Project Manager…

It makes YOU powerful !

You may know this …

Risk ManagementMakes YOU Powerful

Right Level of Risk Management No Risk Management Covey’s habit #1 – Be Proactive Being Reactive

Project Risk Management What does the research say?• Research of failed software projects showed that “their

problems could have been avoided or strongly reduced if there had been an explicit early concern with identifying and resolving their high-risk elements.

• Effective risk management is the most important management tool a project manager can employ to increase the likelihood of project success.

• Since risk management is not widely used and understood, this could be a significant competitive advantage to those that implement the risk management processes in their projects.

Risk Management makes YOU powerful !

Project Risk Management

Project Risk ManagementSummary

• Risk is an uncertain event, that if occurs, may impact project objectives in positive or negative manner.

• It is extremely important to manage project risks – to reduce uncertainty

• PMI’s six step Project Risk Management Process

• How to communicate Risks? – Thru pictures/graphs, on regular basis

Risk Management makes YOU powerful !

Risk Register Template

Id Risk Event P/N Risk

Likely Event Date/

Timeframe

Probability

(H/M/L)

Impact (H/M/L)

Probability %

Impact (Delay/ Days)

EMV (Prob*Impact)

Response

Strategy

Response

 

   

                

   

                

   

               

Project Risk ManagementStatus Check

Project Risk Management

Supporting Slides

Risk Identification Tool

Cur

rent

A

sses

smen

t

Past Present Future

ProjectHistorical Review Creativity Technique

Adapted from PMI’s Practice Standard for Project Risk Management

Risk Monitoring & Control

Trigger conditions

Major project events

Additional risk

information

Risk Response Monitoring

Status Reviews Audits

Risk Response Control

Invoke contingency

plans

Perform additional risk identification,

analysis & response planning

Integrated Change Control

Project Management

Plan

Risk Registe

r

Stakeholder Communicatio

ns

Lessons Learned

Updates

Adapted from PMI’s Practice Standard for Project Risk Management

Risk Identification Example

1 Performance issues due to redesign of batch (splitting into 4 concurrent jobs) are not handled before the cycle testing begins in September

Sep-10

2 Server performance issues are not handled before the cycle testing begins in September Sep-103 Unanticipated table changes occur after the coding has been completed in August Aug-104 The testing environment chosen could interfere with other high priority projects Sep-105 Priority to implement non-rating mod may go up due to NJ coming up right after IOWA. Aug-106 Impact Analysis brings up something that we are not thinking of now (on both mainframe and PARIS

sides), that may result in pushing the project datesJun-10

7 Coding may take longer than expected Jul-108 Finding too many differences between SBR and Mainframe rating of a policy during Integration

Testing may longer to complete, pushing the dates for cycle testing and the project.Aug-10

9 Daily business functions could be interrupted for Production Problems - taking the resources away from this project Ex: HSM, GA Home/ROP, Claims Splitting, RCT Changes

Anytime

10 Other new product (MA Auto, NJ Auto, Company8, Chrome Expansion) - Taking resources away from this project

Anytime

11 System upgrades (Rating Engine 4.0, end of VB6…) may be pushed on us right in the middle of this project

Jun-10

Id Risk Description Event Date

Generic risks are actually issues, they normally need a different action plan

Qualitative Analysis Example

1 Performance issues due to redesign of batch (splitting into 4 concurrent jobs) are not handled before the cycle testing begins

Sep-10 High Medium

2 Server performance issues are not handled before the cycle testing begins in September

Sep-10 Low Medium

3 Unanticipated table changes occur after the coding has been completed in August

Aug-10 Low Low

4 The testing environment chosen could interfere with other high priority projects

Sep-10 Low Medium

5 Priority to implement non-rating mod may go up due to NJ coming up right after IOWA.

Aug-10 Medium High

6 Impact Analysis brings up something that we are not thinking of now (on both mainframe and PARIS sides), that may push the project dates

Jun-10 Medium Medium

7 Coding may take longer than expected Jul-10 High Medium8 Finding too many differences between SBR and Mainframe rating of a policy

may push the dates for cycle testing and the project.Aug-10 Medium Medium

9 Daily business functions could be interrupted for Production Problems - taking the resources away from this project

Anytime Medium Medium

10 Other new product (MA Auto, NJ Auto, Company8, Chrome Expansion) - Taking resources away from this project

Anytime High High

11 System upgrades (Rating Engine 4.0, end of VB6…) may be pushed on us right in the middle of this project

Jun-10 Low Medium

ImpactId Risk Description Event Date Probability

Quantitative Analysis Example

1 Performance issues due to redesign of batch (splitting into 4 concurrent jobs) are not handled before the cycle testing begins

Sep-10 H 70% M 15 10.5

2 Server performance issues are not handled before the cycle testing begins in September

Sep-10 L 10% M 10 1

3 Unanticipated table changes occur after the coding has been completed in August

Aug-10 L 10% L 5 0.5

4 The testing environment chosen could interfere with other high priority projects

Sep-10 L 10% M 10 1

5 Priority to implement non-rating mod may go up due to NJ coming up right after IOWA.

Aug-10 M 25% H 40 10

6 Impact Analysis brings up something that we are not thinking of now (on both mainframe and PARIS sides), that may push the project dates

Jun-10 M 25% M 15 3.75

7 Coding may take longer than expected Jul-10 H 50% M 20 108 Finding too many differences between SBR and Mainframe

rating of a policy may push the dates for cycle testing and the project.

Aug-10 M 30% M 15 4.5

9 Daily business functions could be interrupted for Production Problems - taking the resources away from this project

Anytime M 30% M 10 3

10 Other new product (MA Auto, NJ Auto, Company8, Chrome Expansion) - Taking resources away from this project

Anytime

H 70% H 45 31.5

11 System upgrades (Rating Engine 4.0, end of VB6…) may be pushed on us right in the middle of this project

Jun-10 L 20% M 20 4

11 79.75

Magnitude

Impact (days)

Total Risk Magnitude for the Project

Id Risk Description Event Date

Probability

Risk Behavior Over TimeTotal Risk Manitude - MLDW Project

33.25 34.25

19.25

7.25

22.5

7 85 5 6

Oct-09 Jan-10 Feb-10 Mar-10 Apr-10

Risk Magnitude # of Risks - Staging

Risk Breakdown Structure (RBS)RBS Level 0 RBS Level 1 RBS Level 2

ALL SOURCES OF PROJECT RISK

1. TECHNICAL RISK

1.1 Scope Definition1.2 Requirement Definition1.3 Estimates, Assumptions, and constraints1.4 Technical processes1.5 Technology1.6 Technical InterfacesEtc.

2. MANAGEMENT RISK

2.1 Project Management2.2 Program/Portfolio Management2.3 Operations Management2.4 Organization2.5 Resourcing2.6 CommunicationEtc.

3. COMMERCIAL RISK

3.1 Contractual terms and conditions3.2 Internal Procurement3.3 Suppliers and vendors3.4 Subcontracts3.5 Client/Customer Stability3.6 Partnership and joint venturesEtc.

4. EXTERNAL RISK

4.1 Legislation4.2 Exchange rates4.3 Sites/Facilities4.4 Environmental/weather4.5 Competition4.6 RegulatoryEtc.

Adapted from PMI’s Practice Standard for Project Risk Management

Risk Mitigation StrategiesNegative Risks

(Threats) Positive Risks

(Opportunities)

• Avoid• Mitigate• Transfer

• Exploit• Enhance• Share

Accept

Probability/Impact Matrix

  Probability

Impact   High Medium Low

High H H M

Medium H M L

Low M L L

Quantitative Analysis Techniques

Sensitivity Analysis • Determines which risks have the most potential impact on the project• What-if scenarios• Utilizes the tornado diagram

Expected Monetary Value (EMV) AnalysisEMV=Impact*Probability

• Calculates the average outcome of uncertain scenarios• Positive values = opportunities• Negative values = threats

Modeling and Simulation • Translates uncertainties into potential impact on project outcomes such as schedule • Uncertainties are specified at a detailed level of the project• Typically performed using the Monte Carlo techniques