Project Risk Management Technical Paper - …. Risk...THE UNIQUE NATURE OF PROJECT RISK MANAGEMENT TECHNICAL PAPER Presented by: Terence Murasiki Chief Advisory Consultant Treten Enterprise

THE UNIQUE NATURE OF PROJECT RISK MANAGEMENT

TECHNICAL PAPER

Presented by:

Terence Murasiki

Chief Advisory Consultant

Treten Enterprise Support

Gauteng, South Africa

+27(0) 83 465 6970 | [email protected]

© Copyrights exist

Treten Enterprise Support

Infinite solutions | Infinite possibilities


1 The unique nature of project risk management

Contents

Preface 3

1. The need for project risk management 4

Strategic relevance of projects 4

What is a Project? 4

What is Project Management? 5

The Life of a Project 5

Key Elements in the Project Life 6

Why do projects fail? 7

2. A framework for project risk management 8

Definition 8

Main Elements of Project Risk Management 9

Three-pillar approach to project risk management 10

Initial stages (Concept and Initiation) – Risk checklist 11

Design stages and ongoing – Risk assessment and management 13

Implementation and final stages – Issues management 15

Roles and Responsibilities 17



DISCLAIMER

This report has been prepared for the exclusive and confidential use of the company and specifically targeted audiences. It should not be disclosed to third parties without written approval from the authors, Treten Africa Investments (Pty) Limited and in any event, no third party may act or claim to have acted, in reliance on the information, conclusions or recommendations contained in this report. Any recipient is expected to make such independent assessment, as it may deem necessary, for its decision.

Any distribution or reproduction of all or any part of this document, or the divulgence of its contents other than as specifically set forth herein, is unauthorised.



Preface

Taking a page out of the recent state of the nation address by the President of South Africa and looking at historic aspects within government, it is clear that projects play a pivotal role in service delivery enhancement.

The value of risk management and internal audit as a critical component of corporate governance and risk management is an undisputed fact. However, within an increasing level of scope, there is need to ensure that the associated risks that are most often the causes of project failure are addressed. The first section of this two part presentation, introduces the need for oversight and monitoring of project risk. The final part of the series discusses what possible frameworks can be adopted for the management and control of project risk and the respective roles in this area.

Having worked within the areas of risk management, audit and projects for a considerable time, I have safely learnt that none of the answers to the great unknowns can hold true to all project scenarios. No two projects are ever the same, and nothing rings truer than the concept that projects are consistently evolving. For one to remain in touch with the risk management aspects within projects, it is imperative that a proper understanding of the project environment is attained. An effective risk management programme would then be designed on the basis of commonly understood project management and risk management principles.

Why is project risk management necessary and why is there so much emphasis on effective project risk management yet the very basics of risk management appear to be normal everyday intuitions? In this paper, I will try to set a platform ad foundation from which an effective risk management process for projects can be formulated and implemented.

This paper [these guidelines] provides an insight into the knowledge gained by experienced project risk managers within the South African environment. They are not an attempt to provide the definitive answer to project risk management, as there is none, but a chance to enable organisational learning through drawing on the experiences of others.

These Guidelines have been modified to identify the common elements that exist in all projects no matter what the size and complexity. This still requires a level of judgment and provides an appropriate starting point for thinking of relevant issues and initiating important project risk management tasks. The Guidelines are designed to be a working reference, and not intended to be read as a complete text.

- Terence Murasiki

Chief Advisory Consultant: Treten Enterprise Support



1. The need for project risk management

This section of the project risk guide includes:

� Strategic relevance of projects. � What is a project? � What is project management? � What are the Key Elements of a project? � A generic high-level conceptual view of the life of a project. � Why do projects fail?

Strategic relevance of projects

Projects are the ground level initiatives through which specific change as embodied in strategy is actually delivered. There is much confusion at times between the term “project” and “programme”. There is a simple linkage between strategy, programmes and projects as depicted in the diagram below.

Strategic Objectives

Programme1

Project A Project B

Programme2

Project C

Figure 1: High-level conceptual view of the relationship between strategy and projects

What is a Project?

A project involves a group of inter-related activities that are planned and then executed in a certain sequence to create a unique product or service within a specific time frame.

Projects are often critical components of an organisation's business strategy or relate directly to policies and initiatives of Government.



What is Project Management?

Project Management is a formalised and structured method of managing change in a rigorous manner. It focuses on achieving specifically defined outputs that are to be achieved by a certain time, to a defined quality and with a given level of resources so that planned outcomes are achieved. Effective project management is essential for the success of a business project.

The application of any general project management methodology requires an appropriate consideration of the corporate and business culture that forms a particular project's environment.

The Life of a Project

A high-level project management approach that fits most projects at a macro level is presented diagrammatically in Figure 1. It should be emphasised that this model represents an over-simplification of most projects, but is included to make sense of what can be a quite messy and non-linear process in reality.

Concept & Initiation

Design

Implementation

Benefits Realisation

Figure 2: High-level conceptual view of the generic life of a project

CONCEPT & INITIATION

Project initiatives may originate directly from strategic policy or from corporate and business unit planning processes that in turn are driven by Government policy. At this stage, projects are justified in terms of connect with strategy.



DESIGN

This is perhaps one of the most under-utilised project phases which, if well done simplifies project implementation. This stage involves high level as well as detailed planning which will guide outcomes and initiatives through-out the project. Design may change as the project progresses but such levels of change should be limited.

IMPLEMENTATION

Ongoing management of the various elements of project management, including stakeholders, risks, quality, resources, issues, and work of the project is indicative of this period in the life of the project. It is necessary in this phase of the project that the project team slowly eases the business into the process of taking over the project outcomes for easier transition.

BENEFITS REALISATION

At the stage a project is closed, the project outputs are passed onto the Business Owner for utilisation. Effective change management through-out the course of the project ensures that this benefits realization process is optimised. There should be a reliable measure of benefits as well as reporting there-on. After project handover and (hopefully) success has been assessed, the project Steering Committee formally closes the project.

Key Elements in the Project Life

The list below details the Key Elements that the Project Manager needs to consider no matter what the size or complexity of the project. The extent to which each of these is documented depends once again upon the size and complexity of the project. Many of these Key Elements exist in an embryonic state in the Concept and Initiation Phase and are further developed if the project progresses through the other subsequent phases.

1. Planning and scoping 2. Governance 3. Organisational change management 4. Stakeholder management 5. Risk & issues management 6. Resource management 7. Quality management 8. Reporting 9. Project evaluation 10. Project closure



Why do projects fail?

There’s an old saying about how there are a million ways to fail, but only one way to be right. When it comes to projects, nothing’s further from the truth. Projects fail the same few ways over and over again. Recent studies have demonstrated that about 10 percent of all major initiatives are actually completed on time and on budget to the required standard. On average, projects scheduled to take one year actually took two, and some overruns went much longer. Other projects saw a doubling of their original budget projections. Approximately a third of all projects, were canceled prior to completion due to a loss of direction and inability to deliver required benefits. Projects fail because the inherent risks have not been effectively managed. Nobody sets out to fail on projects but for some cause, people have learnt to accept project failure as routine.

The failure to manage risk is the single key reason why projects fail. Listed below are some of the key reasons why most projects fail. Some of them may be familiar. See how many of these you are familiar with.

1. Project sponsors are often not committed to the objective. 2. Some projects do not meet the strategic vision of the company. 3. Projects are started for the wrong reasons. 4. Inadequate staffing and skills for projects 5. Incomplete project scoping. 6. Lack of formal and practical project planning. 7. Poor financial management in projects. 8. Insufficient funding and incorrect budgeting. 9. No formal project management methodologies and practices. 10. Not all projects are going through a formal sign-off process.

A successful project requires a clear picture of potential risks and a consistent and efficient process for managing and mitigating them. Organisations that deliver their projects on time and under budget gain an advantage over their less-effective peers and competitors. These organisations generally assess risk on both an inherent and a residual basis and ensure ongoing management of these risks to project completion.

Failure to effectively manage risks in projects manifests in four distinct manners:

1. Benefits are delayed or reduced; 2. Timeframes are extended; 3. Outlays are advanced or increased; and/or 4. Output quality (fitness for purpose) is reduced.



2. A framework for project risk management

Project risk has a number of different definitions depending on the audience. The business and its customers have a relatively simple, clear-cut view of a project's success: Did it deliver the benefits? The project manager's concern is more pragmatic: Was the initiative completed on time and on budget? The risk manager and internal auditor's view must encompass all of those factors besides the traditional concerns of compliance and regulatory standards.

Several distinct challenges face risk managers and internal auditors attempting to identify and help manage project risk. This paper seeks to bring some structure to the process of risk management and assurance within projects.

A proposed framework for effective risk management requires that Issues management be combined with normal risk management initiatives.

This section of the project risk guide includes:

� A definition of risk and risk management � The main elements of risk management � A proposed framework for project risk management � Roles and responsibilities in ensuring successful project risk management

Definition

Risk refers to any factor (or threat) that may adversely affect the successful completion of the project in terms of achievement of its outcomes, delivery of its outputs, or adverse effects upon resourcing, time, cost and quality.

Successful projects try to resolve risks before they impact the project, and alternatively have sufficient plans to address the impact of risk when it occurs.

It should be noted that sometimes risks may also be associated with opportunities, such as the use of a new technology, and acceptance of the risk needs to be based upon the costs of rectifying the potential consequences versus the opportunities afforded by taking the risk.

Risk Management describes the processes concerned with identifying, analysing and responding to project risk. It consists of risk identification, risk analysis, risk evaluation and risk treatment including issues management. The processes are ongoing throughout the life of the project and should be built into the project management activities.

Risk Management is conducted initially as part of the assessment of the project's viability and is conducted throughout the project to ensure that changing circumstances are tracked and managed.



All projects require a degree of risk management, but the effort expended will depend on the size and scope, including outcomes, customers, outputs, work and resources. Larger projects involving significant investment and/or major outcomes require formal and detailed risk management activities on an ongoing basis.

Issues Management and Risk Management are closely linked, as some issues may become risks. This is why it is recommended that major issues are also identified and managed as part of the same holistic risk framework.

Main Elements of Project Risk Management

The main elements of the Risk Management Process can be illustrated as below.

Project Control Environment & Governance

Project Planning

Risk Identification

Risk Assessment

Risk Response Strategy

Ongoing Communication

Issues management

Monitoring & review

Risk Management Plan

To drive project risk and issue management, a formal

risk management plan should be formulated at project business plan stage.

Figure 3: Suggested holistic framework for risk and issues management

The above framework is in alignment with a typical approach to enterprise-wide risk management. Its application practically can be simplified in the form of a three-pillar approach to risk management.



Three-pillar approach to project risk management

In order to simplify the application of the risk framework and to maintain focus on the risk management and issues management processes through-out the life of the project, the following 3-pillar process to risk management shows practically how the risk management process may then be executed during the various phases of the project.

Figure 4: Suggested 3-pillar risk management process in project phases

In the ensuing pages, I will explain each block above in further detail.



Initial stages (Concept and Initiation) – Risk checklist

At the initial stages of the project and possibly as part of input into the business decision to adopt a project, a high level risk checklist is completed. This checklist is a list of pre-listed questions, each answered with a simple “yes” or “no” answer. These answers typically then drive a risk rating for the project under specific pre-listed categories. In the first stage, this checklist will look as follows:

Figure 5: Initial assessment process

The specific aspects are summarised as follows:

� Detailed questions listed under each category � Sections/ categories should be weighted depending on project � Checklist also suggest solutions against any question that suggests increased risk for the

project � These checklists can provide guidance to Internal Audit for projects to focus on � Checklist sections should be adapted to organisation as relevant



In terms of look and feel, such a questionnaire would look as follows:

# Questions and possible considerations

Answer(Y/N)

3001 Has the Project leader's authority been established?

3002 Is the core team appointed?

3003 Does the core team understand the project purpose?

3004Have the project stakeholders been clearly

identified?

Figure 6: Initial assessment process – example of checklist questions



Design stages and ongoing – Risk assessment and management

Before risks can be properly managed, they need to be identified. Perhaps as early as the first couple of project meetings, a facilitated risk assessment should be conducted. This risk assessment will focus on the specific objectives of the project and the relative risks linked to each of these objectives. Risk identification is usually done initially by involving key stakeholders, including Steering Committee members. Brainstorming sessions to identify and clarify the main risks, which may prevent the project achieving its stated outcomes, are one way of doing this.

Figure 7: Risk assessment and management process – project execution phases

It is important to have clearly defined the scope of the project at this stage so that the identification of risks can remain focused on what potentially threatens the achievement of outcomes, delivery of outputs, level of resourcing, time, cost and quality. Risks can also be categorised, for example in terms of type (i.e. Corporate Risks, Business Risks, Project Risks, and System Risks). These can be broken down into other categories including Diseases, Economic, Environmental, Financial, Human, Natural Hazards, Occupational Health and Safety,



Public Liability etc. Establishing categories can assist in making sure all relevant risks are identified.

Another way of establishing categories is to take each of the Key Elements of project management as outlined in the preceding section and identify which risks may impinge upon the application of each of these.

The results of this exercise should be documented in a risk register for the Project. The specific characteristics of the risk register are as follows:

� a unique identifier for each risk; � a description of each risk and how it will affect the project; � an assessment of the likelihood it will occur and the possible seriousness if it does occur

(low, medium, high); � a grading of each risk according to a risk assessment table; � a description of the mitigation strategies that can include preventative (to reduce the

likelihood), and contingency actions (to reduce the seriousness); � who is allocated responsibility; and � in larger projects, costings of each mitigation strategy.



Implementation and final stages – Issues management

An issue can be defined as a concern that may impede the progress of the project if not resolved. Issues management is one of the skills that all Risk and Project Managers must master. Projects of any size have to deal with issues. If issues are not addressed they may become a risk to the project. Issues must be resolved quickly and effectively.

Figure 8: Issues management process – project execution phases

Issues Management involves monitoring, reviewing and addressing issues or concerns as they arise through the life of a project. Issues can be raised by anyone involved with the project including Business Owners, Steering Committee members, Reference or Working Group members, the Project Manager, Project Team members and other key stakeholders.

An Issues Register should be established as part of the ongoing project management activities. The Project Manager and team need to have a process for capturing issues as they arise, updating and reviewing them so that they can be managed and resolved as the project moves forward. Once a resolution is agreed on, the appropriate activities are added to the project work plan to ensure the issue is resolved and to the project budget, if appropriate.



An Issues Register is basically a systematic record of issues. It usually contains the following for each issue:

� a unique number; � a description; � who raised the issue; � date reported; � severity/ priority rating; � the person or group who is responsible for resolving the issue; � how resolved; � status, usually open or closed; and � date resolved.

Tips for Managing Issues

� Solve the root cause of the issue � Resolve issues quickly to proceed as quickly as possible. � It is good practice to encourage people to help identify solutions along with the Issues. � Engage the Project Sponsor/Steering Committee in the resolution of issues from very

early in the project. � If a large issue looks too difficult to be resolved in a timely manner, break it down into

logical sub-issues. � Inter-related issues should be resolved simultaneously � Resolve major issues before POINT OF NO RETURN



Roles and Responsibilities

The project manager is responsible for monitoring and managing all aspects of the risk management process, including:

� the development of the risk register and plan; � the continual monitoring of the project to identify any new or changed risks; � continual monitoring of the effectiveness of the Risk Management Plan; and � regular reports on status of risks to the Project Sponsor and the Steering Committee.

In large projects, the Project Manager may choose to assign risk management activities to a separate Risk Manager, but the Project Manager should still retain responsibility. It should be noted that large projects are a risk in themselves and the need for the Project Manager to reassign this integral aspect of project management may be an indication that the project should be re-scoped or divided into several sub-projects overseen by a Project Director.

It is also important to remember that the person directly responsible for risk management does not generally conduct all risk management assessments themselves, but facilitates them by involving relevant people, particularly key stakeholders, and by providing appropriate mechanisms for their discussion and documentation.

The other Project Team members are some of the people who can assist with the identification, analysis and evaluation of risks and can assist in the development of the Risk Management Plan. They can also be responsible for risk mitigation actions.

Project Stakeholders, reference groups, external consultants, and importantly, the business owners should provide input into the Risk Management Plan, especially assessment of potential risks and risk mitigation actions. They may also be responsible for some risk mitigation actions.

The Steering Committee oversees the Risk Management Plan and its periodic review. They are responsible for ensuring an effective risk management plan is in place throughout the life of the project.

The Project Sponsor has ultimate accountability for risk management. They ensure there are adequate resources for managing the project's risks and there is adequate active participation in the risk management process by a wide cross-section of stakeholders. They also monitor the progress and effectiveness of the Risk Management Plan.

It is important to remember risk management cannot be entirely the responsibility of one person and that it is a communal activity involving a range of people associated with the project.

Documents

Project Risk Management Technical Paper - …. Risk...THE UNIQUE NATURE OF PROJECT RISK MANAGEMENT TECHNICAL PAPER Presented by: Terence Murasiki Chief Advisory Consultant Treten Enterprise