PMI KC Chapter Meeting Jan 2012 Project Risk Management A Tool to Deliver Projects On Time and Within Budget NK Shrivastava PMP, PMI-RMP nks@refinem.com Consultant/CEO - RefineM VP – PMI South Missouri Chapter http://www.linkedin.com/in/nkshrivastava January 16, 2012 @justrightpm Project Risk Management Learning's 1. Develop better understanding of Project Risk Management What is a risk? The difference between risks & issues? The positive and negative risk concepts 2. Identify, analyze and prioritize risks and develop risk responses for their projects, programs and portfolios 3. Develop a graph/chart-based communication strategy to clearly and quickly communicate the project status at various points in time to stakeholders Project Risk Management Agenda • What is a Risk? Understanding Risk • Why Manage Project Risks? • PMI’s Practice Standard for Risk Management • Risk Management Process • Communicating Risks • Q&A Project Risk Management What picture comes to your mind when you hear the word “Risk”? Project Risk Management What is a Risk? Project Risk Management What is a Risk? Project risk is an uncertain event or condition that, if it occurs, has a positive or a negative effect on a project's objectives. - From PMI's Practice Standard for Project Risk Management - Chapter2 , Page 9 More on Risks Risk Synonyms Risk Antonyms accident, contingency, certainty, safety, sureness, danger, exposedness, surety exposure, flyer, fortuity, fortune, gamble, hazard, header, jeopardy, liability, liableness, luck, openness, opportunity, peril, plunge, possibility, prospect, shot in the dark, speculation, stab*, uncertainty, venture, wager Source : http://thesaurus.com/browse/risk Project Risk Management Is it necessary to manage project risks? Yes, Absolutely Why? To increase predictability To improve probability of success (SPI ~1, CPI ~1) PMI’s Practice Standard For Project Risk Management Principles of Specialization Processes Handbooks Adapted from PMI’s Practice Standard for Project Risk Management Textbooks Courses Theory Tools/ Techniques Project Risk Management Risk Management Process Risk Management Process Plan Risk Management Identify Risks Perform Qualitative Risk Analysis Perform Quantitative Risk Analysis Plan Risk Responses Monitor and Control Risks Adapted from PMI’s Practice Standard for Project Risk Management Plan Risk Management • Risk Mgmt Plan • Tailored Process • Risk Thresholds • Roles/Responsibilities • Risk Register Template Plan Risk Management Identify Risks Perform Qualitative Risk Analysis Perform Quantitative Risk Analysis Plan Risk Responses Monitor and Control Risks Adapted from PMI’s Practice Standard for Project Risk Management Risk Identification Plan Risk Management • Risk Register • List of risks • Risk Owners Identify Risks Perform Qualitative Risk Analysis Perform Quantitative Risk Analysis Plan Risk Responses Monitor and Control Risks Adapted from PMI’s Practice Standard for Project Risk Management Risk Qualitative Analysis Plan Risk Management • Updated Risk Register • Probability & Impact • Root Causes • Prioritized List of Risks • Watch List Identify Risks Perform Qualitative Risk Analysis Perform Quantitative Risk Analysis Plan Risk Responses Monitor and Control Risks Adapted from PMI’s Practice Standard for Project Risk Management Risk Quantitative Analysis Plan Risk Management Identify Risks • Updated Risk Register • Numerical models • Sensitivity analysis (Monte Carlo Simulation) Perform Qualitative Risk Analysis Perform Quantitative Risk Analysis • Re-prioritized list Plan Risk Responses Monitor and Control Risks Adapted from PMI’s Practice Standard for Project Risk Management Plan Risk Responses Plan Risk Management Identify Risks Perform Qualitative Risk Analysis Perform Quantitative Risk Analysis • Updated Risk Register • Strategies/Responses • Actions/Action Owners • Contingency Reserves Plan Risk Responses Monitor and Control Risks Adapted from PMI’s Practice Standard for Project Risk Management Monitor & Control Risks Plan Risk Management Identify Risks Perform Qualitative Risk Analysis Perform Quantitative Risk Analysis Plan Risk Responses • Updated Risk Register • Variance Analysis • Risk Audit • Trends in risk exposure Adapted from PMI’s Practice Standard for Project Risk Management Monitor & Control Risks Project Risk Management So what is it? Identify What can go wrong? What can go right? Prioritize Which ones have the potential of impacting the most? Do something about it Exploit/Avoid or Enhance/Mitigate or Share/Transfer Or Accept (Passive/Active) Project Risk Management Communicating Risks Risk Behavior Over Time 108.95 108.95 Total Risk Magnitude – SBR Project 80.45 79.75 42.95 39.25 33.75 27.75 22 17.35 11 13 13 12 12 12 12 11 10 10 8.65 3.85 9 Jan-10 Feb-10 Mar-10 Apr-10 May-10 Jun-10 Risk Magnitude Jul-10 Aug-10-1 # of Risks Aug-10-2 Sep-10 Oct-10 5 Nov-10 3.85 5 Dec-10 Risk Impact on the Project Jun 2010 Project Risk Management How does it impact you? If you are the Project Manager… It makes YOU powerful ! You may know this … Risk Management Makes YOU Powerful Right Level of Risk Management No Risk Management Covey’s habit #1 – Be Proactive Being Reactive Project Risk Management What does the research say? • Research of failed software projects showed that “their problems could have been avoided or strongly reduced if there had been an explicit early concern with identifying and resolving their high-risk elements. • Effective risk management is the most important management tool a project manager can employ to increase the likelihood of project success. • Since risk management is not widely used and understood, this could be a significant competitive advantage to those that implement the risk management processes in their projects. Risk Management makes YOU powerful ! Project Risk Management Project Risk Management Summary • Risk is an uncertain event, that if occurs, may impact project objectives in positive or negative manner. • It is extremely important to manage project risks – to reduce uncertainty • PMI’s six step Project Risk Management Process • How to communicate Risks? – Thru pictures/graphs, on regular basis Risk Management makes YOU powerful ! Risk Register Template Id Risk Event P/N Likely Probabil Impact Probab Impact EMV Respon Risk Event ity (H/M/L) ility % (Delay/ (Prob*I se Date/ (H/M/L) Days) mpact) Strateg Timefr y ame Response Project Risk Management Status Check Project Risk Management Supporting Slides Risk Identification Tool Project Creativity Technique Current Assessment Historical Review Past Adapted from PMI’s Practice Standard for Project Risk Management Present Future Risk Monitoring & Control Risk Response Monitoring Project Management Plan Risk Registe r Status Reviews Additional risk information Audits Major project events Risk Response Control Invoke contingency plans Perform additional risk identification, analysis & response planning Integrated Change Control Updates Adapted from PMI’s Practice Standard for Project Risk Management Trigger conditions Stakeholder Communicatio ns Lessons Learned Risk Identification Example Id Risk Description Event Date 1 Performance issues due to redesign of batch (splitting into 4 concurrent jobs) are not handled before Sep-10 the cycle testing begins in September 2 Server performance issues are not handled before the cycle testing begins in September Sep-10 3 Unanticipated table changes occur after the coding has been completed in August Aug-10 4 The testing environment chosen could interfere with other high priority projects Sep-10 5 Priority to implement non-rating mod may go up due to NJ coming up right after IOWA. Aug-10 6 Impact Analysis brings up something that we are not thinking of now (on both mainframe and PARIS Jun-10 sides), that may result in pushing the project dates 7 Coding may take longer than expected Jul-10 8 Finding too many differences between SBR and Mainframe rating of a policy during Integration Aug-10 Testing may longer to complete, pushing the dates for cycle testing and the project. 9 Daily business functions could be interrupted for Production Problems - taking the resources away Anytime from this project Ex: HSM, GA Home/ROP, Claims Splitting, RCT Changes 10 Other new product (MA Auto, NJ Auto, Company8, Chrome Expansion) - Taking resources away from Anytime this project 11 System upgrades (Rating Engine 4.0, end of VB6…) may be pushed on us right in the middle of this Jun-10 project Generic risks are actually issues, they normally need a different action plan Qualitative Analysis Example Id Risk Description Event Date Probability 1 Performance issues due to redesign of batch (splitting into 4 concurrent Sep-10 jobs) are not handled before the cycle testing begins 2 Server performance issues are not handled before the cycle testing begins in Sep-10 September 3 Unanticipated table changes occur after the coding has been completed in Aug-10 August 4 The testing environment chosen could interfere with other high priority Sep-10 projects 5 Priority to implement non-rating mod may go up due to NJ coming up Aug-10 right after IOWA. 6 Impact Analysis brings up something that we are not thinking of now (on both Jun-10 mainframe and PARIS sides), that may push the project dates 7 Coding may take longer than expected Jul-10 8 Finding too many differences between SBR and Mainframe rating of a policy Aug-10 may push the dates for cycle testing and the project. 9 Daily business functions could be interrupted for Production Problems Anytime taking the resources away from this project 10 Other new product (MA Auto, NJ Auto, Company8, Chrome Expansion) - Anytime Taking resources away from this project 11 System upgrades (Rating Engine 4.0, end of VB6…) may be pushed on us Jun-10 right in the middle of this project Impact High Medium Low Medium Low Low Low Medium Medium High Medium Medium High Medium Medium Medium Medium Medium High High Low Medium Quantitative Analysis Example Id Risk Description Event Probabili Impact Magnit (days) Date ty ude 10.5 Sep-10 H 70% M 15 1 Performance issues due to redesign of batch (splitting into 4 concurrent jobs) are not handled before the cycle testing 2 begins Server performance issues are not handled before the cycle Sep-10 testing begins in September 3 Unanticipated table changes occur after the coding has been Aug-10 completed in August 4 The testing environment chosen could interfere with other high Sep-10 priority projects 5 Priority to implement non-rating mod may go up due to NJ Aug-10 coming up right after IOWA. 6 Impact Analysis brings up something that we are not thinking of Jun-10 now (on both mainframe and PARIS sides), that may push the 7 project Codingdates may take longer than expected Jul-10 8 Finding too many differences between SBR and Mainframe Aug-10 rating of a policy may push the dates for cycle testing and the project. 9 Daily business functions could be interrupted for Production Anytime Problems - taking the resources away from this project L 10% M 10 L 10% 5 L 10% M 10 1 M 25% H 40 10 M 25% M 15 3.75 H M 50% M 30% M 20 15 10 4.5 M 30% M 10 3 L 1 0.5 10 Other new product (MA Auto, NJ Auto, Company8, Chrome Expansion) - Taking resources away from this project Anytim e H 70% H 45 31.5 11 System upgrades (Rating Engine 4.0, end of VB6…) may be pushed on us right in the middle of this project 11 Total Risk Magnitude for the Project Jun-10 L 20% M 20 4 79.75 Risk Behavior Over Time Total Risk Manitude - MLDW Project 33.25 34.25 22.5 19.25 7 8 Oct-09 Jan-10 Risk Magnitude 5 7.25 5 6 Feb-10 Mar-10 Apr-10 # of Risks - Staging Risk Breakdown Structure (RBS) RBS Level 0 RBS Level 1 1. TECHNICAL RISK 2. MANAGEMENT RISK ALL SOURCES OF PROJECT RISK 3. COMMERCIAL RISK 4. EXTERNAL RISK Adapted from PMI’s Practice Standard for Project Risk Management RBS Level 2 1.1 Scope Definition 1.2 Requirement Definition 1.3 Estimates, Assumptions, and constraints 1.4 Technical processes 1.5 Technology 1.6 Technical Interfaces Etc. 2.1 Project Management 2.2 Program/Portfolio Management 2.3 Operations Management 2.4 Organization 2.5 Resourcing 2.6 Communication Etc. 3.1 Contractual terms and conditions 3.2 Internal Procurement 3.3 Suppliers and vendors 3.4 Subcontracts 3.5 Client/Customer Stability 3.6 Partnership and joint ventures Etc. 4.1 Legislation 4.2 Exchange rates 4.3 Sites/Facilities 4.4 Environmental/weather 4.5 Competition 4.6 Regulatory Etc. Risk Mitigation Strategies Negative Risks Positive Risks (Threats) (Opportunities) • Avoid • Mitigate • Transfer • Exploit • Enhance • Share Accept Probability/Impact Matrix Probability Impact High Medium Low High H H M Medium H M L Low M L L Quantitative Analysis Techniques Sensitivity Analysis • Determines which risks have the most potential impact on the project • What-if scenarios • Utilizes the tornado diagram Expected Monetary Value (EMV) Analysis EMV=Impact*Probability • Calculates the average outcome of uncertain scenarios • Positive values = opportunities • Negative values = threats Modeling and Simulation • Translates uncertainties into potential impact on project outcomes such as schedule • Uncertainties are specified at a detailed level of the project • Typically performed using the Monte Carlo techniques