IRIS & @RISK
Presentation Overview
The Challenges (Colin Wheeler, Istria Ltd)
– Background
– The Challenge: Aligning Quantitative and Qualitative
Techniques
– Our Solution: IRIS Software
– Client Benefits
The Implementation
About Istria
• Established in 1985
• 20 years experience in project risk management
• Provides Consultancy, Software and Training Solutions
• IRIS (Istria Risk & Issue Support) Software developed in 2004-5
to embed the Istria Risk Management Method
• Alignment of Qualitative and Quantitative Risk Management
Techniques
• Clients Include:
OCCAR
The Challenge
• IRIS Software featured best in class qualitative risk management
techniques
– Dynamic risk matrices
– Automated email triggers
– Link to MS Project
– Full suite of customisable reports
• Project Managers frequently use inaccurate or misleading quantitative
techniques
– “Finger in the air” estimates of impact
– Multiplication of Probability x Impact Assessment
• These lead to problems establishing
– Discrete values for probability; and
– Precise impact assessments for cost, time or performance
Combining robust statistical analysis with the leading edge qualitative
techniques would generate enormous benefits for clients
Our Solution (1)
Organisational Hierarchy
The software is designed to manage risks across an entire organisation, or
specific departments, programmes or projects
The hierarchy is tailored to the client organisation on implementation of the
tool. The front screen allows navigation to any level in the hierarchy.
In this example,
strategic planning
(corporate level)
and programme
level are used, but
additional levels
can be added
A full help guide is
also available
Our Solution (2)
Dynamic Risk Matrix
The risk matrix provides an instant snapshot of the high priority risks for the
organisation. Separate risk matrices are available for each project, along
with an overall enterprise wide risk matrix
Icons illustrate how
the status of the
risk has changed
during the period
Clicking on the icon
displays the full
Risk Action Plan for
that risk (see next
page)
Clicking the Risk ID
displays the risk
description only
Our Solution (3)
Risk Action Plan & Impact Assessment
The risk action plan contains the detailed information for each risk. The
probability and impact of each risk is assessed, and each risk is allocated a
risk owner.
The next review date
has a default setting
(e.g. 28 days) but can be
overwritten.
Emails are sent to the
risk owner when action
is required (e.g. 3 days
in advance) and to the
programme manager if
action is overdue
Parameters for the impact
of risks are tailored for
each level of the hierarchy
Our Solution (4)
Monte Carlo Simulations
Palisade’s @Risk statistical analysis package is embedded within the IRIS
software. The impact assessments from the Risk Action Plan provide three
data points (Best Case, Worst Case, Most Likely Scenarios).
@Risk generates
thousands of
iterations in a
few seconds to
provide
statistical
confidence on
the risk
exposure level.
The relative
cost/benefit of
risk mitigating
activity can then
be ascertained
Risk Exposure
Reduction
Costs of Risk
Mitigating
Activity
Statistical
Confidence
Level
Creating the Analytical Model
This risk will have
occurred in this
iteration
P
r
o
b
a
b
i
l
i
t
y
High
0.75
2nd - Risk
Random
Number
1st- Iteration
Random Number
0.65
Monte Carlo
analysis tool
generates two
random numbers
i.e. no risks will
occur with P < 65%
50%
Medium
20%
Low
The simulation consists of
1,000 iterations and the sum
of the impacts is shown as a
Cumulative Probability Curve
showing Risk Exposure
Creating the Analytical Model
This risk will have
occurred in this
iteration
P
r
o
b
a
b
i
l
i
t
y
High
0.75
2nd - Risk
Random
Number
BC €0
1st- Iteration
Random Number
0.65
ML €10,000
Impact Range in Cost (or Time)
i.e. no risks will
occur with P < 65%
50%
Medium
20%
Low
WC €100,000
Aligning Qualitative &
Quantitative Techniques
Step 1: New risk identified and
added to the Risk Matrix
Step 2: Quantitative Impact
Limits standardise assessments
of High, Medium, Low
Step 3: Three point estimates are
auto-populated. Can over-write Best
Case & Worst Case, but Most Likely
must be within parameters
Step 4: @RISK engine runs statistical analysis to
quantify overall risk exposure. Target values
provide a cost benefit analysis of risk mitigating
activity. Can prioritise activity based on
Risk Reduction Ratio (RRR)
Benefits of the Approach
Istria developed the IRIS software to embed best practice risk management
techniques into a single user-friendly application.
Utilise best practice quantitative and qualitative techniques
Instant visibility of high priority risks through Risk Matrix
Quantified cost-benefit analysis of Risk Mitigation Activity
Integration with other Project Management Tools
Automated Email Triggers to help embed Risk Management
Secure Audit Trail for Internal & External Assurance
Strategic Alignment
Strategic Objectives
Success Criteria
Strategic Risks
Strategic
Operational
Risk Mitigating
Actions
Programmes
Project Objectives
Projects
Success Criteria
Project Risks
Actions Risk
Mitigating
Istria’s Risk Management Approach
Determine Risk
Management
Structure
Risk & Issue
Identification
Management
Reporting
Risk Action Plans
Management &
Control
Evaluation &
Planning
Project Scope
Maintenance
• Identify the
scope and
boundaries of
responsibility
• Obtain
agreement
Food
Suppliers
Business
Agreement
ACME
Catering
H&S
Executive
Organisation
Risk Register
Scopes
• .
Risk Identification
• Use the cause effect diagram to identify the future
and current problems that will prevent the successful
completion of the success criteria.
– Lack of Staff (numbers, availability, skills)
– Technical problems
• Requirements definition problems
• Tools
• Scoping
–
–
–
Operational requirements
Operational problems
• Contractual problems
Cause/Effect Diagrams
Suppliers
People
Availability
Timeliness
Numbers
Food Quality
Plan to
prepare food
Skills
Cooking Utensils
Provides food
to an
acceptable
standard
Success criteria
Storage
(Refrigerators)
Process
Equipment
Risk Index
Risk Matrix
Links to MS Project
Risk Quantification Data
Risk Data sheet
Risk Exposure
Target Risk Exposure
Where Next?
• Need to exploit the
functionality of @RISK
(RDK)