Project Risk Planning
Chapter 10
Contemporary Project Management
Kloppenborg
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
Chapter
Vignette
Texas Medical Center
• TMC is composed of 49 not-for-profit institutions
dedicated to the highest standards of patient
care, research, and education.
• Currently 11 major construction projects are
underway.
• TMC forms the seventh largest downtown
business district in the United States.
• Contractors must have a plan in place detailing
how they are going to secure their construction
sites in the event of a hurricane.
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
At the end of this chapter…
• Describe risk management planning, risk
identification, risk analysis, and risk response
planning.
• Identify and classify risks for a project.
• Populate a risk register.
• Describe various risk assessment techniques
and tell when each is appropriate to use.
• Prioritize each risk on a project using an
appropriate assessment technique.
• Develop and defend at least one strategy for
each of the high priority risks on a project.
• Compare and contrast the various strategies for
dealing with risks.
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
The purpose of risk management is to
reduce the overall project risk to a level
that is acceptable to the project sponsor
and other stakeholders.
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
Plan Risk Management
• First understand the project’s objectives
• Realize what project success is
• Project success measures include:
Plan risk management – “the process of defining how to
conduct risk management activities for a project.”
PMBOK® Guide
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
Plan Risk Management
• Planning requires an understanding of project success
• Project success measures include:
Meeting Agreements
Cost, schedule, and specifications met
Customer’s Success
Needs met, deliverables used, customer
satisfied
Performing Organization’s Success
Market share, new products, new technology
Project Team’s Success
Loyalty, development, satisfaction
Plan Risk Management
• Did the project help the performing
organization?
Performing organization – “the enterprise whose
personnel are most directly involved in doing the work of
the project.” PMBOK® Guide
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
Specific Project Stakeholder Priorities
Risk Management Planning and
Stakeholder Priorities
• Understand what the project plan calls for
• Understand in what area would the most
important stakeholders like to improve
• Understand where stakeholders are willing to
sacrifice to enable improvements
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
Understanding the Project Risk
• A risk is anything that may impact the project
team’s ability to achieve the general project
success measures and the specific project
stakeholder priorities.
• A negative impact poses a threat
threat – “a condition or situation unfavorable to the
project…a risk that will have a negative impact on a
project objective if it occurs.” PMBOK® Guide
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
Understanding the Project Risk
• A positive impact poses an opportunity
• A project manager proactively seeks to
eliminate/reduce the impact of threats and
capitalize on opportunities
opportunity – “a condition or situation favorable to the
project … a risk that will have a positive impact on a
project objective if it occurs.” PMBOK® Guide
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
Risk Management Planning
• The risk management plan is useful for
communicating with project stakeholders and for
follow up analysis
Risk management plan– “the document describing how
project risk management will be structured and
performed on a project.” PMBOK® Guide
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
Risk Management Plan Guidance
for an IT Consulting Company
Risk management includes guidance on how to
perform three risk management activities:
1. Decide what level of risk premium to charge for the
project. The team must rate factors such as project size,
complexity, technology, and type. The combined ratings
will dictate that a risk premium of 0, 10, or 20 percent be
added to the estimated project cost or, for very risky
projects, executive approval is mandated.
2. Mitigate risk external to the firm through contract clauses
and risk internal to the firm through agreements.
3. Manage the risk very carefully through specifically
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
designed
conference
call meetings and reports.
to a publicly
accessibleweekly
website, in whole
or in part.
Roles and Responsibilities
• Encourage wide participation in risk
management activities
• The more perspectives considered, the more
likely important risks will be uncovered
• Participation in project risk planning encourages
buy-in to a risk management approach
• The risk management plan defines who has
responsibility for each risk management activity
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
Categories and Definitions
• Risks may be considered by association with a
specific project life cycle stage
• More project risks are uncovered early in the life
of a project
• The cost per risk discovered early is less
• Risks discovered late in a project can be
expensive
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
Risks Over the Project Life Cycle
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
Categories and Definitions
• Risks may be categorized by their impact on a
project objective (cost, schedule, scope, quality)
• Risks may be classified as external/internal to
the organization
• Risks may be classified by what is known about
each
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
International Construction Project Risk
Factors
Information Systems Project Risk
Factors
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
Information Systems Project Risk
Factors
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
Information Systems Project Risk
Factors
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
Categories and Definitions
Cement will
harden
Bad weather
will happen
100-year
flood
• A “known known” can be planned and managed
with certainty
• “Known unknowns” can be identified and may or
may not happen
– Identify the risk and establish contingency reserves
• “Unknown unknowns” are true uncertainties
– Negotiate a management reserve based on project
manager and key stakeholders understanding of the
project
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
Identify Risks
•
•
•
•
Information gathering
Reviews
Understanding relationships
Risk register
Identify risks – “the process of determining which risks
might affect the project and documenting their
characteristics.” PMBOK® Guide
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
Information Gathering
• A brainstorming activity considering “what
could go wrong”
• Use classic rules for brainstorming
• Variations and extensions of possible risks
can help to identify additional risks
• Interview stakeholders
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
Information Gathering
SWOT analysis – “an information gathering technique
used to examine the project from perspectives of each
project’s strengths, weaknesses, opportunities, and
threats to increase the breadth of risks considered.”
PMBOK® Guide
• Use a SWOT analysis
• Use the Delphi technique
• Use a structured review – review a variety of
project and other documents to uncover
possible risks
Delphi technique– “an information gathering techniques
used as a way to reach a consensus of experts on a
subject … Responses are summarized and recirculated
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
further
comment.”
Guide
to a for
publicly
accessible
website, in whole PMBOK®
or in part.
Reviews
Understanding Relationships
• Learn the cause and effect relationships of risk
events
– Use a flow chart that shows how people, money,
data, or materials flow from one person/location to
another
• Consider why a certain risk event may happen
through root cause analysis
– “Why might this happen?”
Root cause analysis – “an information gathering
techniques used as a way to reach a consensus of
experts on a subject … Responses are summarized and
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
recirculated for further comment.” PMBOK® Guide
to a publicly accessible website, in whole or in part.
Understanding Relationships
• Understand triggers
• A trigger may be specific to an individual risk
• Triggers can be general indications of problems
for the project as a whole
Triggers – “indications that a risk has occurred or is
about to occur.” PMBOK® Guide
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
Triggers for a Project as a Whole
• Project manager displays lack of self-esteem.
• Team members do not show enthusiasm for
project.
• Project was started with inadequate time for
planning.
• Communications are overly general, with little
focus.
• Reports yield little information about true project
status.
• Little effort has been given to risk management.
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
Risk Register
• The primary output of risk identification is the
risk register
• The risk register includes risk categories,
identified risks, potential causes, potential
responses
• The risk register is a living document
Risk register – “the document containing the results of the
qualitative risk analysis, quantitative risk analysis, and risk
response planning. The risk register details all identified
risks, including description, category, cause, probability of
occurring, impact(s) on objectives, proposed responses,
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
andwebsite,
current
status.”
to aowners,
publicly accessible
in whole
or in part. PMBOK® Guide
Partial Risk Register
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
Risk Analysis
• Perform qualitative risk analysis
• Perform quantitative risk analysis
• Risk register updates
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
Qualitative Risk Analysis
•
•
•
•
How likely is a risk to happen?
How big will the impact be?
When is the risk likely to occur?
How easy will it be to notice and correctly
interpret the trigger?
Perform qualitative risk analysis – “the process of
prioritizing risks for subsequent further analysis or action
by assessing and combining their probability and
impact.” PMBOK® Guide
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
Qualitative Risk Assessment
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
Qualitative Risk Analysis
• Determine cause and effect relationships
– Part of root cause analysis
– It may be easier to change the effect by changing the
underlying cause
– Use a cause and effect diagram (fishbone diagram)
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
Cause and Effect Diagram
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
Cause and Effect Diagram
• List the risk as the effect in a box at the head of
the fish
• Name the big “bones”
• Complete the smaller “bones” as responses to
asking why the big “bones” may be a problem
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
Perform Quantitative Risk Analysis
• Bigger, more complex, riskier, more expensive
projects may benefit from the rigor of
quantitative structured techniques
• Use when it is critical to predict the probability of
completing a project on-time, on-budget, at the
agreed upon scope and/or agreed upon quality
Quantitative risk analysis – “the process of numerically
analyzing the effect of identified risks on overall project
objectives.” PMBOK® Guide
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
Common Quantitative Risk Analysis
Techniques
Criteria for Selecting a Quantitative
Risk Technique Methodology
• Use the explicit knowledge of the project team
members.
• Allow quick response.
• Help determine project cost and schedule
contingency.
• Help foster clear communication.
• Easy to use and understand.
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
Risk Register Updates
• Add the probability of each risk occurring and its
impact to the register
• Document results of quantitative risk analysis in
the risk register
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
Plan Risk Responses
• Strategies for Responding to Risks
• Risk Register Updates
Plan risk responses – “the process of developing
options and actions to enhance opportunities and
reduce threats to project objectives.” PMBOK® Guide
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
Strategies for Responding to Risks
• Project risk response strategy decisions must be
made with a thorough understanding of the
priorities key stakeholders have for cost,
schedule, scope, and quality
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
Common Project Risk Strategies
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
Risk Register Updates
• The project manager sees that the risk register
is updated with the results of the response
planning
• For each risk the response strategy is noted
• Assign a single person as the “owner” of each
risk
• Include any changes to the project schedule,
budget, resource assignments and
communications plan
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
Summary
• All projects have some risks
• Risk planning should use an appropriate
level of detail to plan for major risks
• Risk planning begins with an
understanding of project success
• Risk management planning is part of the
overall project management plan
• Risk identification includes gathering
information on potential risks
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
Summary
• Identified risks are documented in a risk
register
• Identified risks are next analyzed
• Risk response planning involves
determining how to respond to each of the
major risks
• Risk response strategies include avoid,
transfer, mitigate, accept, research, and
exploit
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
Risk Management on a Satellite
Development Project
Systematically working with the risks of the project allowed us
to prepare responses to the risks if and when they occurred.
Planning
Execution
• Establish the process for
dealing with risk and
change
• Day-long clinic
• Criteria for evaluating
probabilities of
occurrence
• Compared methods to
industry standards
• Integrated approach to
identification, analysis,
and response to risks
• Using a risk management
database tool to log each
risk as a record in the
database
PM in Action Example
Risk Management Worksheet
PM in Action Example
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.
Risk Management on a Satellite
Development Project
Risk management reviews
• Review logged risks, actions and impacts of
risks
• Review prioritized report of all project’s risks
• Avenue to resolve high-priority risks of the
project
• Identification of potential risks for related
projects
PM in Action Example
© 2012 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted
to a publicly accessible website, in whole or in part.