PMI KC Chapter Meeting Jan 2012
Project Risk Management
A Tool to Deliver Projects
On Time and Within Budget
NK Shrivastava
PMP, PMI-RMP
nks@refinem.com
Consultant/CEO - RefineM
VP – PMI South Missouri Chapter
http://www.linkedin.com/in/nkshrivastava
January 16, 2012
@justrightpm
Project Risk Management
Learning's
1. Develop better understanding of Project Risk Management
What is a risk? The difference between risks & issues? The positive and negative risk concepts
2. Identify, analyze and prioritize risks and develop risk
responses
for their projects, programs and portfolios
3. Develop a graph/chart-based communication strategy
to clearly and quickly communicate the project status at various points in time to stakeholders
Project Risk Management
Agenda
•
What is a Risk? Understanding Risk
•
Why Manage Project Risks?
•
PMI’s Practice Standard for Risk Management
•
Risk Management Process
•
Communicating Risks
•
Q&A
Project Risk Management
What picture comes to your mind when
you hear the word “Risk”?
Project Risk Management
What is a Risk?
Project Risk Management
What is a Risk?
Project risk is an uncertain event or condition
that, if it occurs, has a positive or a negative
effect on a project's objectives.
- From PMI's Practice Standard for Project Risk Management - Chapter2 , Page 9
More on Risks
Risk Synonyms
Risk Antonyms
accident, contingency,
certainty, safety, sureness,
danger, exposedness,
surety
exposure, flyer, fortuity,
fortune, gamble, hazard,
header, jeopardy, liability,
liableness, luck, openness,
opportunity, peril, plunge,
possibility, prospect, shot
in the dark, speculation,
stab*, uncertainty, venture,
wager
Source : http://thesaurus.com/browse/risk
Project Risk Management
Is it necessary to manage project risks?
Yes, Absolutely
Why?
To increase predictability
To improve probability of success
(SPI ~1, CPI ~1)
PMI’s Practice Standard For
Project Risk Management
Principles of Specialization
Processes
Handbooks
Adapted from PMI’s Practice Standard for Project Risk Management
Textbooks
Courses
Theory Tools/ Techniques
Project Risk Management
Risk Management Process
Risk Management Process
Plan Risk Management
Identify Risks
Perform Qualitative Risk
Analysis
Perform Quantitative Risk
Analysis
Plan Risk Responses
Monitor and Control Risks
Adapted from PMI’s Practice Standard for Project Risk Management
Plan Risk Management
• Risk Mgmt Plan
• Tailored Process
• Risk Thresholds
• Roles/Responsibilities
• Risk Register Template
Plan Risk Management
Identify Risks
Perform Qualitative Risk
Analysis
Perform Quantitative Risk
Analysis
Plan Risk Responses
Monitor and Control Risks
Adapted from PMI’s Practice Standard for Project Risk Management
Risk Identification
Plan Risk Management
• Risk Register
• List of risks
• Risk Owners
Identify Risks
Perform Qualitative Risk
Analysis
Perform Quantitative Risk
Analysis
Plan Risk Responses
Monitor and Control Risks
Adapted from PMI’s Practice Standard for Project Risk Management
Risk Qualitative Analysis
Plan Risk Management
• Updated Risk Register
• Probability & Impact
• Root Causes
• Prioritized List of Risks
• Watch List
Identify Risks
Perform Qualitative
Risk Analysis
Perform Quantitative Risk
Analysis
Plan Risk Responses
Monitor and Control Risks
Adapted from PMI’s Practice Standard for Project Risk Management
Risk Quantitative Analysis
Plan Risk Management
Identify Risks
• Updated Risk Register
• Numerical models
• Sensitivity analysis
(Monte Carlo Simulation)
Perform Qualitative Risk
Analysis
Perform Quantitative
Risk Analysis
• Re-prioritized list
Plan Risk Responses
Monitor and Control Risks
Adapted from PMI’s Practice Standard for Project Risk Management
Plan Risk Responses
Plan Risk Management
Identify Risks
Perform Qualitative Risk
Analysis
Perform Quantitative Risk
Analysis
• Updated Risk Register
• Strategies/Responses
• Actions/Action Owners
• Contingency Reserves
Plan Risk Responses
Monitor and Control Risks
Adapted from PMI’s Practice Standard for Project Risk Management
Monitor & Control Risks
Plan Risk Management
Identify Risks
Perform Qualitative Risk
Analysis
Perform Quantitative Risk
Analysis
Plan Risk Responses
• Updated Risk Register
• Variance Analysis
• Risk Audit
• Trends in risk exposure
Adapted from PMI’s Practice Standard for Project Risk Management
Monitor & Control Risks
Project Risk Management
So what is it?
Identify
What can go wrong? What can go right?
Prioritize
Which ones have the potential of impacting the most?
Do something about it
Exploit/Avoid or Enhance/Mitigate or Share/Transfer
Or Accept (Passive/Active)
Project Risk Management
Communicating Risks
Risk Behavior Over Time
108.95
108.95
Total Risk Magnitude – SBR Project
80.45
79.75
42.95
39.25
33.75
27.75
22
17.35
11
13
13
12
12
12
12
11
10
10
8.65
3.85
9
Jan-10
Feb-10
Mar-10
Apr-10
May-10
Jun-10
Risk Magnitude
Jul-10
Aug-10-1
# of Risks
Aug-10-2
Sep-10
Oct-10
5
Nov-10
3.85
5
Dec-10
Risk Impact on the Project
Jun 2010
Project Risk Management
How does it impact you?
If you are the Project Manager…
It makes YOU powerful !
You may know this …
Risk Management
Makes YOU Powerful
Right Level of Risk Management
No Risk Management
Covey’s habit #1 – Be Proactive
Being Reactive
Project Risk Management
What does the research say?
•
Research of failed software projects showed that “their
problems could have been avoided or strongly reduced
if there had been an explicit early concern with
identifying and resolving their high-risk elements.
•
Effective risk management is the most important
management tool a project manager can employ to
increase the likelihood of project success.
•
Since risk management is not widely used and
understood, this could be a significant competitive
advantage to those that implement the risk
management processes in their projects.
Risk Management makes YOU powerful !
Project Risk Management
Project Risk Management
Summary
•
Risk is an uncertain event, that if occurs, may impact
project objectives in positive or negative manner.
•
It is extremely important to manage project risks – to
reduce uncertainty
•
PMI’s six step Project Risk Management Process
•
How to communicate Risks? – Thru pictures/graphs,
on regular basis
Risk Management makes YOU powerful !
Risk Register Template
Id
Risk Event
P/N Likely Probabil Impact Probab Impact EMV Respon
Risk Event
ity
(H/M/L) ility % (Delay/ (Prob*I
se
Date/ (H/M/L)
Days) mpact) Strateg
Timefr
y
ame
Response
Project Risk Management
Status Check
Project Risk Management
Supporting Slides
Risk Identification Tool
Project
Creativity Technique
Current
Assessment
Historical Review
Past
Adapted from PMI’s Practice Standard for Project Risk Management
Present
Future
Risk Monitoring & Control
Risk Response Monitoring
Project
Management
Plan
Risk
Registe
r
Status
Reviews
Additional
risk
information
Audits
Major
project
events
Risk Response Control
Invoke
contingency
plans
Perform additional
risk identification,
analysis &
response planning
Integrated Change Control
Updates
Adapted from PMI’s Practice Standard for Project Risk Management
Trigger
conditions
Stakeholder
Communicatio
ns
Lessons
Learned
Risk Identification Example
Id
Risk Description
Event Date
1 Performance issues due to redesign of batch (splitting into 4 concurrent jobs) are not handled before Sep-10
the cycle testing begins in September
2 Server performance issues are not handled before the cycle testing begins in September
Sep-10
3 Unanticipated table changes occur after the coding has been completed in August
Aug-10
4 The testing environment chosen could interfere with other high priority projects
Sep-10
5 Priority to implement non-rating mod may go up due to NJ coming up right after IOWA.
Aug-10
6 Impact Analysis brings up something that we are not thinking of now (on both mainframe and PARIS Jun-10
sides), that may result in pushing the project dates
7 Coding may take longer than expected
Jul-10
8 Finding too many differences between SBR and Mainframe rating of a policy during Integration
Aug-10
Testing may longer to complete, pushing the dates for cycle testing and the project.
9 Daily business functions could be interrupted for Production Problems - taking the resources away Anytime
from this project Ex: HSM, GA Home/ROP, Claims Splitting, RCT Changes
10 Other new product (MA Auto, NJ Auto, Company8, Chrome Expansion) - Taking resources away from Anytime
this project
11 System upgrades (Rating Engine 4.0, end of VB6…) may be pushed on us right in the middle of this Jun-10
project
Generic risks are actually issues, they normally need a different action plan
Qualitative Analysis Example
Id
Risk Description
Event Date Probability
1 Performance issues due to redesign of batch (splitting into 4 concurrent Sep-10
jobs) are not handled before the cycle testing begins
2 Server performance issues are not handled before the cycle testing begins in Sep-10
September
3 Unanticipated table changes occur after the coding has been completed in
Aug-10
August
4 The testing environment chosen could interfere with other high priority
Sep-10
projects
5 Priority to implement non-rating mod may go up due to NJ coming up
Aug-10
right after IOWA.
6 Impact Analysis brings up something that we are not thinking of now (on both
Jun-10
mainframe and PARIS sides), that may push the project dates
7 Coding may take longer than expected
Jul-10
8 Finding too many differences between SBR and Mainframe rating of a policy
Aug-10
may push the dates for cycle testing and the project.
9 Daily business functions could be interrupted for Production Problems Anytime
taking the resources away from this project
10 Other new product (MA Auto, NJ Auto, Company8, Chrome Expansion) - Anytime
Taking resources away from this project
11 System upgrades (Rating Engine 4.0, end of VB6…) may be pushed on us
Jun-10
right in the middle of this project
Impact
High
Medium
Low
Medium
Low
Low
Low
Medium
Medium
High
Medium
Medium
High
Medium
Medium
Medium
Medium
Medium
High
High
Low
Medium
Quantitative Analysis Example
Id
Risk Description
Event Probabili Impact Magnit
(days)
Date
ty
ude
10.5
Sep-10 H 70% M 15
1 Performance issues due to redesign of batch (splitting into
4 concurrent jobs) are not handled before the cycle testing
2 begins
Server performance issues are not handled before the cycle
Sep-10
testing begins in September
3 Unanticipated table changes occur after the coding has been
Aug-10
completed in August
4 The testing environment chosen could interfere with other high
Sep-10
priority projects
5 Priority to implement non-rating mod may go up due to NJ Aug-10
coming up right after IOWA.
6 Impact Analysis brings up something that we are not thinking of Jun-10
now (on both mainframe and PARIS sides), that may push the
7 project
Codingdates
may take longer than expected
Jul-10
8 Finding too many differences between SBR and Mainframe
Aug-10
rating of a policy may push the dates for cycle testing and the
project.
9 Daily business functions could be interrupted for Production
Anytime
Problems - taking the resources away from this project
L
10% M
10
L
10%
5
L
10% M
10
1
M
25% H
40
10
M
25% M
15
3.75
H
M
50% M
30% M
20
15
10
4.5
M
30% M
10
3
L
1
0.5
10 Other new product (MA Auto, NJ Auto, Company8, Chrome
Expansion) - Taking resources away from this project
Anytim
e
H
70% H
45
31.5
11 System upgrades (Rating Engine 4.0, end of VB6…) may be
pushed on us right in the middle of this project
11 Total Risk Magnitude for the Project
Jun-10
L
20% M
20
4
79.75
Risk Behavior Over Time
Total Risk Manitude - MLDW Project
33.25
34.25
22.5
19.25
7
8
Oct-09
Jan-10
Risk Magnitude
5
7.25
5
6
Feb-10
Mar-10
Apr-10
# of Risks - Staging
Risk Breakdown Structure (RBS)
RBS Level 0
RBS Level 1
1. TECHNICAL RISK
2. MANAGEMENT RISK
ALL SOURCES OF
PROJECT RISK
3. COMMERCIAL RISK
4. EXTERNAL RISK
Adapted from PMI’s Practice Standard for Project Risk Management
RBS Level 2
1.1 Scope Definition
1.2 Requirement Definition
1.3 Estimates, Assumptions, and constraints
1.4 Technical processes
1.5 Technology
1.6 Technical Interfaces
Etc.
2.1 Project Management
2.2 Program/Portfolio Management
2.3 Operations Management
2.4 Organization
2.5 Resourcing
2.6 Communication
Etc.
3.1 Contractual terms and conditions
3.2 Internal Procurement
3.3 Suppliers and vendors
3.4 Subcontracts
3.5 Client/Customer Stability
3.6 Partnership and joint ventures
Etc.
4.1 Legislation
4.2 Exchange rates
4.3 Sites/Facilities
4.4 Environmental/weather
4.5 Competition
4.6 Regulatory
Etc.
Risk Mitigation Strategies
Negative Risks
Positive Risks
(Threats)
(Opportunities)
• Avoid
• Mitigate
• Transfer
• Exploit
• Enhance
• Share
Accept
Probability/Impact Matrix
Probability
Impact
High
Medium
Low
High
H
H
M
Medium
H
M
L
Low
M
L
L
Quantitative Analysis Techniques
Sensitivity Analysis
• Determines which risks have the most
potential impact on the project
• What-if scenarios
• Utilizes the tornado diagram
Expected Monetary
Value (EMV) Analysis
EMV=Impact*Probability
• Calculates the average outcome of uncertain
scenarios
• Positive values = opportunities
• Negative values = threats
Modeling and Simulation
• Translates uncertainties into potential impact on
project outcomes such as schedule
• Uncertainties are specified at a detailed level of the
project
• Typically performed using the Monte Carlo techniques