When you know a thing, to hold that you know it, and when you do not know a thing, to allow that you do not know it—this is knowledge. —Confucius The

When you know a thing, to hold that you know it, and when you do not know a thing,to allow that you do not know it—this is knowledge. —Confucius

The problem with the future is that more things might happen than will happen. —Plato

Presented By

Alfonso Bucero, PMPBUCERO PM Consulting

www.abucero.com

Presented By

Alfonso Bucero, PMPBUCERO PM Consulting

www.abucero.com

Risk Management

Risk Management

2© 2009 Randall L. Englund www.englundpmc.com

Presentation Objectives

This case study highlights steps in a process to facilitate and roll out an improved risk management process within a professional culture [biotechnology] and identify strategies for success…or not.

Purpose:

• Present a viable approach to risk management implementation that can be

readily applied in any environment. Lessons to be illustrated:

• Identify clear roles and responsibilities for risk management at all levels

across the organization

• Address the terms and drivers that teams can use to improve risk planning

• Develop meaningful action plans and get commitment to follow them

• Explore steps to follow through on risk implementations

• Explore the use of case studies and live examples in training as a key

ingredient of a risk management initiative.

Risk Management

Risk Management


Problem Statement

Have you ever had :

• Team members question the value of risk analysis

• Team be unprepared for a risk

• Difficulty with the risk analysis process

• Looked back on a project and thought “hum….could we

have prevented that?”

• Wondered if “Could we have reacted differently?”

Risk Management

Risk Management


Corporate Response

Management picked Risk Management as one of three

initiatives to focus on for the current year

Sponsor and project team assigned

Contracted Englund Project Management Consultancy

• not to train on risk management, but to

• facilitate application of the process

Conducted initiative as a project

Met regularly to design, develop, and deliver training.

Risk Management

Risk Management


Risk Management

Risk Management


My Approach - Assessment on Risk Management

Interviewed a cross-section of managers (18) to elicit inputs about the process and

how to improve it

Sample findings:

• Current forms appear bulky, are barely useable, and are not required during review

proceedings. Consequently, few projects use them. Forms need to be easily

accessible and streamlined to guide teams through key items impacting projects,

utilizing XXX terminology.

• Current process conducted at superficial level; concerned about pushing through

w/o considering resource issues

• Need business rules of governance; have agreement on process by management

& teams

• Focus on fewer but deeper, tangible items that can do something about

• Keep it simple and visible

• Cover how to conduct risk management and provide examples.

Risk Management

Risk Management


Reasons to Have a Risk Management Plan

Part of good planning

• Principal benefit: engaging in a productive process

• Unknown risks cannot be managed proactively

• Preliminary read on feasibility

Life with a good risk management plan in place

• Increased likelihood of success

• Time is on your side = less stress

• External benefits (outside team).

Risk Management

Risk Management


Overcoming the Perception that “There is No Time” for Risk Management

Educate the team about how formulating a risk

management plan is implicit to good planning

Benefits of proactive plans vs reactive actions

Best illustration: relevant, real life examples

• Meaningful to them (WIIFM)

• Motivation.

Risk Management

Risk Management


Purpose of Workshop

Improve the risk management process used within the

XXX organization

Roll out a refined, simple process that can be easily duplicated

across all project teams

Reduce ambiguity about risk management terms and process

Ensure that risk analysis and plans are conducted, communicated

and updated on project teams in a consistent manner

Provide simple tools that allow project managers to work with your

teams and prepare consistent, value-add risk management plans

Identify roles and responsibilities of all stakeholders.

Risk Management

Risk Management


Workshop Outline

Module One –Risk Definition, Identification

Define risk and risk management process consistently

Identify risks

Module Two—Risk Qualification

Capture risk probability and impact

Develop risk register

Prepare to develop action plans to address high priority risks

Module Three—Risk Planning

Prepare action plans

Plan monitoring mechanisms

Module Four—Risk Communication

Monitor and control risks

Communicate and manage the risk management process.

Risk Management

Risk Management


Define Terms: What is Risk?

A risk is an uncertain event or condition which, if it occurs, will have a positive

or negative effect on a project’s objectives

All projects have risks

All assumptions are risks

Risks cannot be eliminated but can be understood

Components of a risk:

• Uncertain event; probability; impact

• Time driven; consequence

Risk management addresses events that may adversely impact a project’s

stated outcome.

Risk Management

Risk Management


Risk, Outcomes, & Issues

A risk is an uncertain event or condition, if which it occurs, will have a positive or

negative effect on a project’s objectives

An outcome is the result of a risk event

An issue has 100 percent certainty; risks are uncertain

The risk management process seeks to identify and act on cause elements or

drivers rather than outcomes or effects

For example:

• Instead of, “Agency does not agree that safety data is sufficient.”

• State,“As a result of the trial design selected, there is a chance that the safety

database may fail to meet Agency requirements; the need for additional studies will

cause a 6-12 month delay and increase costs.”

“As a result of <an existing condition>, there is a <probability> that an

<uncertain event> may occur, which would result in <impact on objectives>.”

Risk Management

Risk Management


The Risk Management Process

Do Something Now

Avoid

Mitigate (Minimize)

Possible Risk

Event

Trigger Happens

Do Something Later

AcceptDo Nothing

Mitigate Issue (Minimize Impact)

Resolve Issue

Prevent

Contingency Plan, Trigger Points

“As a result of <an existing condition>, there is a <probability> that an

<uncertain event> may occur, which would result in <impact on objectives>.”

Probability

Impact

Risk Management

Risk Management


Risk, Impact, & Timing Priority: Prob/Impact Response

1: Safety DatabaseR: M/H

2: Patient EnrollmentY: M/M

3: Device DesignY: M/M

As a result of <an existing condition>, there is a <probability> that an <uncertain event> may occur,

which would result in <impact on objectives>.

OWN: J___PRE: Contract with collaborator's experienced with these patient populations.TRG: 25% of target patients not enrolled by Jun 30, 200xMIT: Add more sites

OWN: J___PRE: Submit current safety data from ongoing studies for each individual molecule to FDATRG: End of Phase II Meeting MIT: Estimate costs using x00 patients. Include contract terms for XXX to terminate if the study becomes significantly large and costly

OWN: Owner PRE: Prevent TRG: Trigger MIT: MitigateR: Red Y: Yellow G: Green H: High M: Medium L: Low

The proposed device design is entirely new to this patient population and may not be successful in user studies. Result is up to 2 Qtr delay for redesign

OWN: J___PRE: Test concepts with users prior to developing a working prototype TRG: Device fails the first user studyMIT: Plan for at a redesign in the timeline and in the vendor contract. Gate high cost activities (i.e. scale-up) to a successful user study.

A lack of regulatory precedent with combination biologics means FDA may require a larger safety database (x000 patients) than the y00 patients currently included in the clinical program. Above x00 patients, XXX would kill the program (low value), but collaborator would likely want to continue program (market valuation is higher than XXX's)

Since we are dealing with a new patient population, Phase III enrollment may go slower than estimated, resulting in a 1-2 Qtr delay and 10% increase in trial costs

Develop Simple Tools: Risk Register

Risk Management

Risk Management


Establish Roles & Responsibilities (1)

Project Team Leaders

• PTLs are accountable for risk management, ensuring a plan is

created and implemented; this accountability is a key step to ensure

suitable emphasis on risk management is present.

Project Managers

• PMs are accountable for creating and implementing the risk

management plan (by using the pre defined process), ensuring that

initial risk analysis happens early in the project and thereafter, is

presented for review, executed, and tracked aggressively during the

project. They accurately reflect technical risks in the PTS and non

technical risks in final asset valuation (FAV).

Risk Management

Risk Management


Roles & Responsibilities (2)

Core Team Members

• Team members are accountable for identifying risks, preparing

action plans, getting buy-in from functional area management,

executing plans as required, identifying triggers for risk elements

and contingency plans for dealing with risks if they occur, report

accurate status regularly.

Directors/Senior Managers

• Directors and Senior Managers are accountable to review and

approve functional risk management plans per the PDP process.

Risk Management

Risk Management


Roles & Responsibilities (3)

Facilitator

• The facilitator is accountable to get a thorough job done most

efficiently and to stay on track.

• The PM facilitates the risk analysis process or may want to be

more of a participant. In that case, bring in an outside facilitator

familiar with the risk management process.

• The facilitator may come from another project, a different group, or

be an external consultant.

Risk Management

Risk Management


Identify Challenges of Risk Management

Organizational resistance

• Resistance to the process

• Question the value of risk analysis

• Busy dealing with “real” issuesOperational pitfalls

• Ignoring team preferences /cultural norms

• Universal risks

• Focused on outcome, not drivers

• Not tying risk to tangible outcome

• Not keeping plan “alive”

Look at total project risks but especially emphasize risks getting to next stage gate or milestone

Risk Management

Risk Management


Clarify Results of Good Risk Management

Increase PTS and overall project success:

• All risk management practices that increase Probability of Technical Success (PTS) are of interest to upper management

• Risk management, however, also applies to elements beyond technical factors

Gate overall investment:

• Consistent risk analysis indicate where investments need to be made to improve project success

• High risks integrated into development plans and other standard processes

Drive focus on essential value drivers (instead of “all inclusive" lists):

• Focus on risks that have a significant impact to the next project milestone

• Present a few key factors considered with well thought through mitigation and contingency plans that directly relate to value-generating activities.

Risk Management

Risk Management


Establish Standards

Each project Core Team develops and maintains standard risk

management plans in accordance with this process.

Through well defined roles and responsibilities with regards to risk, all

individuals accept accountability for the overall success of the project.

Risk management impact, probabilities, triggers, and mitigation or

contingency plans are near term, realistic, and based on expert

judgment and historical data, with input from operational experts.

Each risk has an owner.

Risk management is a continuous process; focus is on next milestone.

Risk Management

Risk Management


Focus on Drivers

As a consequence of [driver], there is [probability] that

[result] will happen, causing [impact].

Not effective Better Best

Phase I clinical

trial may take too

long.

Phase I clinical trial

may not meet

enrollment target in

desired time frame.

As a consequence of low enrollment

rates, there is an 80% chance that

Phase I clinical trial may not meet

enrollment target by Q3 200x, which

will delay Phase 2 startup activities by 3

months.

Risk Management

Risk Management


Understanding Risk Events

Ask probing questions:

• “Why?”

• “What makes you think that?’

• “Why do think this is important?”

• “Who else would be impacted?”

• “Have we encountered this before?”

–“If so, what was done?”

Think about root cause(s)

• What drives the risk to occur?

• When evaluating risks, other follow on risks may be identified.

Risk Management

Risk Management


How to Write Better Risk Statements

Don’t focus on undesirable outcome

Instead, identify specific drivers

• An undesirable outcome, many different drivers

• Different drivers can lead to same outcome

• Different drivers, different response plansWord risks such that response plans

(mitigation/contingency) can be crafted

Elucidation can be challenging

• Ask “Why?” repeatedlyPractice.

Risk Management

Risk Management


Risk Identification Brainstorming Tools

Technique Works Best When:

1. Group Discussion• PM facilitates an open group discussion• or PM can come prepared with a list of risks based on prior

team discussions and ask the group to comment on the list

There are a only few major risks that are commonly known on the project and can quickly be discussed. If there are too many risks this discussion will consume a lot of time.

2. Post-It Notes Hand out 3-5 post-it notes to each team member. Write down 1 risk per note and hand them back to the PM. This can be done at the end of the meeting (and then continued in subsequent meeting) or at the start of a risk assessment meeting

Either to save time or if you have strong personalities that tend to quiet other team members from openly stating risks

3. E-mail to PM prior to meetingTeam members requested to send risks to PM in advance of the meeting

Can save time and if team members are good about e-mailing responses

4. 1:1 Meetings with technical expertsMeet with sub-team leaders individually or in small groups to generate a list of risks for their function and for the overall project.

Time intensive for PM, but minimizes team time. Enables a more in-depth discussion of a specific function’s risks. Also works well for quiet team members or if strong personalities tend to overpower the group

5. Good Questions to ask to elicit risks• What keeps you up at night?• What worries you the most on this project?

Always

Risk Management

Risk Management


Why Do We Prioritize?

We:

Categorize risk events based on their probability of occurrence AND

the magnitude of the impact if they do occur

So that we can:

Compare risks

Identify which risk events must be acted upon vs. those that merely

need monitoring

Focus efforts on the more critical risks.

Risk Management

Risk Management


Use a Common Risk Probability Chart

Likelihood of Risk Occurring Probability

High ≥ 75%

Medium > 25% to < 75%

Low ≤ 25%

Risk Management

Risk Management


Probability Estimation Tools

Technique Works Best When

1. Group Consensus You have a small group and the issue is not contentious. Also works well when further discussion is required to understand the risk and assign it a probability

2. Silent Vote (post-its) The issue is contentious and subject to argument. Also makes the vote more “official.”

3. Voice vote Team members are comfortable expressing their assessment openly in front of the group. Requires strong facilitation to avoid discussions breaking out

4. E-mail vote You don’t have time to hold a meeting and the risk requires no / minimal further discussion.

Risk Management

Risk Management


Use Common Risk Impact Chart [EXAMPLE ]

Impact of Risk

TimelineDelay

DevelopmentCost Increase

Value Loss

High > 2 Qtr > 50% of Budget> 50%

Medium < 2 Qtr < 30% of Budget < 25%

Low < 1 Qtr < 10% of Budget < 10%

Strategic context: fast time to market

Risk Management

Risk Management


Impact Assessment Methods

Technique Works Best When

1. Back of the Envelope, on the spot An order of magnitude estimate is needed and precision is not important. Useful in moving rapidly through the risk assessment and in setting priorities.

2. Off-Line by sub-team leaders A deeper dive is needed and precision is important. Works well in preparing recommendations for senior management approval, for assessing highly complex risks, or for high priority risks

Risk Management

Risk Management


Develop a Risk Matrix [WHAT IF?]

Probability of Occurrence (%)

Imp

act

of

Occ

urr

ence

Ris

k G

rou

p:

High

Medium

Low

0 < Low ≤ 25% 25 < Med < 75% 75 ≤ High < 100%

RED Assign owner and develop action plan to be implemented immediately as part of the PDP.

YELLOWYELLOW Assign owner, develop a contingent action plan, define trigger points that signalactivation of the plan. Include in PDP as possible requirement. Monitor the situation.

GREEN Monitor and address if classification changes.

124

35

78 910

1112

1314

15

6

# = Risk Identification number

Risk Management

Risk Management


Managing Risks (1)

Avoidance and prevention plans normally affect probability of

risk event drivers

• Avoid the risk by reversing decisions that involve unnecessary risks

that do not offer potential benefit

• Transfer, subcontract, or outsource the risk to another entity

• Plan actions that minimize probability of risk occurring

• Design redundant, duplicate, parallel solution, or alternative path(s)

For example,

• “Avoid risk by choosing not to pursue device”

• “Prevent risk by testing concepts with users prior to developing a

working prototype”.

Risk Management

Risk Management


Managing Risks (2)

Contingency plans normally affect impact

• Identify triggers that warn the risk is about to occur or indicate it has occurred

• Mitigate risks (make less severe) through response plans (contingencies)

• Target root causes

• Prepare preliminary cost and resource requirements for contingency plan

• Decide who is risk owner and how to monitor the risk

For example,

• “Device fails the first user study” is a triggering event

• “Gate high cost activities to a successful user study” is a contingency plan.

Risk Management

Risk Management


Considerations

Be realistic and careful in planning project objectives, costs, and

deadlines

Address Red risks immediately as part of the development plan

Focus detailed planning on Yellow risks

Consider :

• Unknown risks that may occur

• Issues that still occur despite prevention and contingency plans

• Low priority risks that received little action

• Accepted risks that occur

Even with good prevention plan, still need a contingency plan.

Risk Management

Risk Management


Develop Action Plan

An objective

Means of measuring when the objective is achieved

Completion date

Owner

Prepare budget requirements

Adequate funding and resources available.

Risk Management

Risk Management


Plan Monitoring Mechanisms

Include Risk Register in project documentation

Decide how to report regular risk status

Make risk triggers meaningful and visible

Make commitments to:

• Engage in regular dialogue about risks

• Present at management reviews

• Focus on value-generating activities.

Risk Management

Risk Management


Identify Next Steps (1)

The Risk Register is complete - now what?

• Red risks: Incorporate into plans (schedule, budget,

and collaborator contracts). All timelines presented to

review committees must incorporate activities required

to resolve red risks

• Yellow risks: Prepare contingency plans with impact to

cost and timeline understood

• Green risks: Do nothing - monitor for changes.

Risk Management

Risk Management


Next Steps (2)

Review risks at phase change and/or when new data becomes

available

• Is this risk still a risk?

• Has this risk increased/decreased in priority, probability, or impact?

• Have new risks emerged? (and how to manage these new risks)

Step back and look at overall risk profile for the strategy being followed:

• How many red risks have been identified?

• How do these red risks affect the timeline and costs?

• Is this project worth pursuing?

Risk Management

Risk Management


Develop Communications Plan

Integrate risk management plan into communication tools

Update Risk Register and review with teams

• Monthly for short term risks/milestones

• When something happens

• Quarterly for long term milestones

• Annually

Reports

• Weekly reports in news or issues section - changes only

• Monthly tracking sheets/reports

• Product development plans.

Risk Management

Risk Management


Presenting to Review Committees

Portfolio Committee – Focus on strategic impact (not tactical)

• Red Risks Included in Currently Proposed Timeline and Budget

1. …

2. …

3. …

• Yellow risks – Contingency Plan Costs:

– Identify the Risk

– Summarize approach of the Risk Response Plan

– Identify incremental costs of the Contingency Plan

– List triggers, timing, and/or gating factors

– Identify benefits of the response plan

- Consequences if not done.

Risk Management

Risk Management


Example Case Study

XXX is exploring two molecules with different Mechanisms of Action

(MOA’s) along the same metabolic pathway to take into

development for the treatment of cancer. Both molecules appear to

have some promise, but data from YYY models is highly variable. A

strong competitor in this indication was expected to get approval

next year with a molecule that shares one of the MOA’s, but it failed

to reach its primary endpoint in a pivotal Phase III study. In three

weeks, upper management would like to be able to report to the

Board of Directors (BOD) that a molecule has been selected.

What are the risks?

XXX Confidential – For Internal Use Only

Risk Management

Risk Management


Risk Identification Exercise

For the case study assigned to your team:

• Decide what Risk Categories apply

• Brainstorm potential risks (~5–10)

• Identify drivers of each risk event

• Describe impact if the risk occurred

• Identify potential timing of risk

Look for:

• Factors that may decrease (or increase) PTS

• Known events that could impact project value

• Known unknowns that may require investment to avoid or overcome

• Unknown unknowns that jeopardize project success

Be prepared to:

• Fully describe the risk event

• Characterize why the risk was identified (historical data, experience, trends, …)

Risk Management

Risk Management


Risk Prioritization Exercise


• Define criteria for probability and impact

• Select probability and impact for each risk

• Prioritize the risks by assigning to a Risk Group

• Rank the risks within the Red group

• Fill in the template

Look for:





Be prepared to:

• Fully describe the risk impact

• Characterize what drives risk likelihood (historical data, experience, trends, …)

Risk Management

Risk Management


Risk Planning Exercise


• Discuss overall risk response

• Develop prevention steps for top priority (~1-3) risk drivers

• Identify triggers that the risk is occurring

• Develop contingency plans to mitigate impact

• Consider alternatives

• Make recommendation

• Fill in the template

Look for:





Be prepared to:

• Fully describe the risk response plan

• Provide justification for action (losses, benefits, drive value…)

Risk Management

Risk Management


Risk Action Item Exercise

For your project(s) at XXX:

• Prepare an action plan

–How you will integrate risk management into team activities

–How to overcome implementation hurdles

• Example:

–Objective: Implement a more effective and efficient risk management process utilizing a

consistent tool set

–How: Plan a risk management agenda for next team meeting; put together slide set to introduce

the process, combining material from workshop with project specific materials; share the

distinction between reducing probability of risk occurring and minimizing impact once the risk has

occurred; commit to presenting high impact plan to review committee, focusing on top three

risks; monitor other risks at monthly meeting

–Hurdles: Need to work with “Jack” to develop a positive attitude about the process

Be prepared to:

• Share your approach; receive answers; give feedback to others

• Fully describe the risk management action plan

• Identify areas needing further assistance

Risk Management

Risk Management


Risk Communication Exercise

Using a knowledge café approach, brainstorm with team members, addressing the topics:

• Ways to monitor and control risks?

• Hurdles to implementing risk management?

• How to measure successful risk management?

Directions:

• Add the assigned topic to the top of a flipchart.

• Brainstorm the topic and record your response on the flipchart. (Approximately 10 minutes)

• Rotate (clockwise) to the next chart. Brainstorm the new topic and add your responses. (Approximately 5 minutes)

• Rotate (clockwise) to the next chart. Review the information on the flipchart, brainstorm, summarize key points, and record responses. (Approximately 10 minutes)

Debrief the topic in summary form

Other concerns?

Risk Management

Risk Management


What to Expect

This risk management process is a first step

Do it, see what works well, what to improve – your involvement and

feedback are crucial

• Share risk experiences with other PMs

• Address best and worst practices at Forums

Potential future enhancements:

• More sophisticated risk management tools and tracking

–Improve online reporting tools

–Establish relational database

• Process refinement

• …

Risk Management

Risk Management


Conduct Summary Quiz

Why is risk management important for projects at XXX?

• Since only 10-25% of projects in clinical development reach market, risk management is an effective tool to minimize risks, increase probability of projects reaching market and coming in on budget and on schedule

• All projects have risks; we have to manage them better to achieve our commitments

What three areas does senior management want teams to focus on for risk management planning?

1. Improve probability of technical success

2. Gate overall investments

3. Focus on key value drivers

What elements go into a complete risk statement?

• “As a result of <an existing condition>, there is a <probability> that an <uncertain event> may occur, which would result in <impact on objectives>.”

How do you plan for a potential risk?

• Analyze, avoid, prevent, mitigate; prepare action plan with triggers & contingences; communicate

Risk management is a one time exercise? (True/False)

Risk Management

Risk Management


Ensure that the Risk Management Plan Stays “Alive”

A risk management plan is created

• Beginning of project

• Beginning of given phase Living document - valuable reference / guide

• Celebrate successes in averting disasters

• Analyze potential plan improvements real-time

• Incorporate as part of daily lives

• Share examples Reviewed/revised

• Whenever there is a change

• Pre-determined review schedule

• Part of “business as usual.”

Risk Management

Risk Management


Reminders

All projects have risk; our mission is to manage the risks

Avoid or prevent risks by focusing action on what drives risks to occur

For risks you cannot prevent, identify clear triggers to warn when risks

are about to or have occurred

Develop a contingency plan to minimize impacts of risks that occur

Focus on near term, actionable risks

Document alternative approaches in a Risk Register

Communicate about risks with all stakeholders

Be willing to speak truth to power

Make the commitment to manage risks, achieve greater project

success, and improve the risk management process.

Risk Management

Risk Management


Looking Forward[PROPOSAL to Management]

• Express interest• Ask questions• Expect focused,

detailed analysis• Follow through

• Overview training at staff meeting(s)

• Share ways to encourage compliance

• Updates on progress

• Sponsor training sessions

• Be present• Use appropriate risk

terminology

• Enthusiastic about risk management contribution

• Expect template use• Expect results

PBO,Upper Mgrs

PTL,Program Mgrs

ProjectManagers

• Accept & demonstrate accountability for better RM practices

• Participate• Inquire about status

• Overview training session

• Review available materials

• Support teams to conduct risk analysis

• Provide feedback on risk analysis & reports

• Update PDF forms

• Reinforce necessity to improve RM practices

• Reward effective & efficient practices

• Lead by example in using appropriate risk management terminology and applying techniques on all projects

• Facilitate effective and efficient risk management sessions

• Attend risk management training session• Participate in refresher session• Share practices in Forum sessions• Read about risk examples in memos,

reports, reviews, …

• Training reference documents• Risk Register• Online examples & ease in reporting• Time allocated to risk discussions• Management expectations

• Training provides the L2M2 to adopt, adapt, & apply risk management techniques

• Believe results are worth the effort• Positive consequences from management

attention & rewards

LeadershipLeadership

LearningLearning

MeansMeans

MotivationMotivation

Risk Management

Risk Management


Conclusions

Facilitating Risk Management into a Corporate Culture

requires:

• Upper management support

• Clear roles and responsibilities across the organization

• Common terminology, simple templates

• Focus on drivers

• Meaningful case studies, tailored to the organization

• Practice, with feedback

• Reinforce through periodic forums

• Follow through.

Risk Management

Risk Management


References

Englund Project Management Consultancy

[email protected]

Documents

When you know a thing, to hold that you know it, and when you do not know a thing, to allow that you do not know it—this is knowledge. —Confucius The