Risk Management
What is Risk?
Your definition:
...............................................................................
What is risk? Where is risk?
What is risk? Where is risk?
What is risk?
A risk is a possibility of loss
Undesirable outcome
Missed opportunity
Risk is both positive and
negative
Anatomy of a Risk
Probability of occurrence
Risk
Consequence: size of loss
Definitions
Risk:
Any uncertainty that, if it occurs, would affect one or more objectives. Risk
is the product of probability and consequence.
Threat:
Opportunity:
Any uncertainty that, if it occurs,
Any uncertainty that, if it occurs,
would affect one or more objectives
negatively
would affect one or more objectives
positively
David Hillson Effective opportunity management for projects
Defining risk in projects
• ‘An uncertain event or condition that, if it occurs,
has a positive or negative effect on a project
objective’ (Silvers, JR (2007)
• The potential of an action or event to impact on the
achievement of objectives. PMBOK 6
Defining Risk Management
• A process that allows individual risk events and overall risk to be
understood and managed proactively, optimising success by minimising
threats and maximising opportunities. PMBOK 6
The Purpose of Risk Management
•
•
•
•
•
•
•
•
Risk management defines the way risk is handled.
Using a formal risk management process allows planning
processes to be applied at the beginning of the project
It encourages reflection and learning
Prepares managers for things going wrong
Ensures shared vision of what to do if a risk materialises.
Risk management prepares a common reference point for audit and assurance processes
Enables an organisation to begin projects with a clear idea of the risks and reassures it
that problems and risks should be reduced
The benefits of risk management
• Risk management prepares a common reference point for audit and assurance
processes
• Enables an organisation to begin projects with a clear idea of the risks and
reassures it that problems and risks should be reduced
Nature of construction Risk
Contract risks include
construction risks,
design risks, project
risks, client’s specific
risks, cost and time
overruns (Saito, 1999).
Key Drivers of Risk
RISKS
EXTERNAL
DRIVERS
Legislation
Regulation
Politics
Economy
Competition
Industry
Suppliers
Customers
Recruitment
Strategic
INTERNAL
DRIVERS
Operational
Projects
Financial
Hazard
Environmental
Reputational
Compliance
Culture
The Board
Shareholders
Employees
Procedures
Systems
R&D
The Risk Appetite
Can we manage risk?
•
the probability of a risk event occurring; and
•
the consequences or impact of a particular risk event
Responses to negative risks (threats)
• Accept
• Avoid
• Transfer
• Reduce
Responses to positive risks (opportunities)
• Reject
• Enhance
• Exploit
• Share.
5 Key Process steps in Risk Management
.
• Identify the risk
• Analyse the risk
• Evaluate/Rank the risk
• Control the risk
• Monitor and Review the Risk
Identify the Risk
• We cannot manage a risk we do not recognise – the ‘black swan’
• The first thing we need to do is to get the team together and try to discern
the risks to our project
• Useful sources of information are previous experience and expert opinion as
well as practical analysis of our objectives
• We may structure the risk into catagories
Analyse the Risk
• We analyse the risk in terms of its
• Probability of occurrence
• Impact on objectives if it does happen
We need to attach numbers or words to indicate probability and impact. Numbers
are better than words as we can manipulate them more easily.
Risk is seen as the product of probability and impact.
Evaluate/Rank the Risk
• Once we have ‘scored the risk’ i.e. given it a risk number that is the product
of chance and impact we can rank the risk.
• Ranking risks means putting them in order of risk number from the highest
risk to the lowest.
• This ranking allows us to determine where the risk is ‘significant’ and tells us
which are the more important of the risks.
Control the Risk
• Once we have determined which risks need to be controlled we have to determine
what the controls could be.
• For say a fire risk the controls might be: fire alarms; fire drills; escape routes; fire
extinguishers; building controls etc
• Risk controls cost money so they have to be determined via a cost/benefit analysis
• Risk controls reduce impact or probability
Monitor and Review the Risk
• Once the risk controls are in place we have to determine if there are any
secondary risks deriving from the risk control
• We also need to determine the residual risk score since risk controls are
seldom perfect risk eliminators
• Risks need then to be recorded, monitored and review constantly during the
project.
Ranking Risks
• Determining risk
Impact
Probability
1
2
3
4
5
1
1
2
3
4
5
2
2
4
6
8
10
3
3
6
9
12
15
4
4
8
12
16
20
5
5
10
15
20
25
Risk Exercise