Project Risk Management
Part I – Project Risk Management
Concepts
Project Risk Management
What is Project Risk?
“An uncertain event or condition that, if it
occurs, has a positive or negative effect on a
project’s objectives.”
– ANSI/PMI-99-001-2008 Glossary
• Negative Risks are considered “Threats.”
• Positive Risks are “Opportunities.”
Project Risk Management
What is Project Risk Management?
“Project Risk Management includes the processes
concerned with: conducting risk management planning;
identification; analysis; responses; and monitoring and
control on a project.”
ANSI/PMI-99-001-2008 Glossary
Project Risk Management
What is Enterprise Risk?
“A term that encompasses all major risks faced
by a business, including pure risk, speculative
risk, strategic risk, operational risk, and
financial risk.”
– Web Definition
Project Risk Management
Which Industry Standard Applies to Project Risk
Management?
–ANSI/PMI 99-001-2012
(Aka. “The PMBOK Guide”)
Project Risk Management
Why Perform Project Risk Management?
• “Risk exists the moment a project is conceived. Moving
forward on a project without a proactive focus on risk
management increases the impact that a realized risk can
have on the project and can potentially lead to project
failure.”
ANSI/PMI-99-001-2008, Chapter 11
• “While there will probably always be vigorous debate
over the details of what comprises the best approach to
managing risk, few will disagree that effective risk
management is critical to program and project success and
affordability.”
Preface, NASA Risk Management Handbook
Project Risk Management
Project Risk Management
Why Start Project Risk Management as Early as
Possible?
• Because Scope is defined early while the cost of
change grows exponentially as a project
progresses through its Lifecycle from concept to
construction. Active risk management involves
varying degrees of analysis and planned change
that are most cost effective when defined and
implemented early.
Project Risk Management
Cost Effective Risk Management
“Since the process of implementing an RM approach in
itself introduces cost to the project, it is essential that the
approach be used in a cost-effective manner. To this end, the
methods advocated in this handbook rely on a graded
approach to analysis, to manage analysis costs. Because
analysis cost is optimized using this approach, the savings
achieved by resolving risks before they become problems
invariably exceeds the cost of implementing the approach.”
NASA Risk Management Handbook; NASA/SP2011-3422
NOTE 1: The “analysis cost” of a risk management program is separate and distinct from the
cost of corrective actions to mitigate risks or exploit opportunities.
NOTE 2: NASA uses a “RIDM” (“Risk Informed Decision Making”) process. “RBDM” (“Risk
Based Decision Making”) is more common and less analysis intensive than RIDM.
Project Risk Management
What types of analysis are available to support Project
Risk Management?
• Qualitative Risk Analysis
– “Perform Qualitative Risk Analysis is the process of
prioritizing risks for further analysis or action by
assessing and combining their probability of
occurrence and impact.” ANSI/PMI-99-001-2008
• Quantitative Risk Analysis
– Perform Quantitative Risk Analysis is the process of
numerically analyzing the effect of identified risk on
overall project objectives.” ANSI/PMI-99-001-2008
Project Risk Management
What are the available risk management techniques?
Threats can be managed by:




Avoiding the risk
Mitigating the risk
Transferring the risk
Accepting the risk (passive)
Opportunities can be managed by:




Accepting the opportunity (passive)
Exploiting the opportunity
Enhancing the opportunity
Sharing the opportunity
Project Risk Management
What types of risk are there?
 Risks sources depend on the nature of the project. Scope,
Schedule, Cost and Quality risk categories are common to all
projects.
 The two broadest classifications of risk are the:
o “Known Unknowns” – the risks that have been identified and
documented during the risk management process.
o “Unknown Unknowns” – Unidentified risks that may manifest
themselves unexpectedly.
o Only “identified risks” can be proactively managed.
o The purpose of the “Identify Risks” process is to transform as many
“Unknown Unknowns” into “Known Unknowns” in as cost-effective a
manner as possible.
Project Risk Management
Is Risk an “absolute concept?”
• No. Risk is a matter of both perspective and risk
tolerance. What is a threat for one company can
be an opportunity for another. Prior experience
also usually increases risk tolerance. Risk
management theory treats threats and
opportunities as different sides of the same coin.
Project Risk Management
• What is Organizational Risk Tolerance and how is It
measured?
“Risks are prioritized according to their potential
implications for having an effect on a project’s
objectives. A typical approach to prioritizing risks is to
use a look-up table or a Probability and Impact Matrix.
The specific combinations of probability and impact
that lead to a risk being rated as “high”, “moderate”, or
“low” importance, with the corresponding importance
for planning responses to the risk “are usually set by
the organization,” Chapter 11
Project Risk Management
Fig. 11-5 Defined Conditions for Impact Scales of a Risk on Major Project Objectives
(Shown for Risks Only)
Project
Objective
Very
Low/0.05
Relative & Numerical Scales are shown
Moderate/0.
Low/0.10
High/0.40
20
Very
High/0.80
Cost
Insignifican
t Cost
Increase
< 10% Cost
Increase
10%-20% Cost
Increase
20%-40% Cost
Increase
> 40% Cost
Increase
Time
Insignifican
t Time
Increase
< 5% Time
Increase
5% - 10% Time
Increase
10% - 20%
Time Increase
>20% Time
Increase
Scope
Decrease
Barely
Noticeable
Minor areas of
Scope
affected.
Major Areas
of Scope
Affected
Quality
Degradatio
n Barely
Noticeable
Only very
demanding
applications
are affected.
Quality
Reduction
Requires
Sponsor/Clien
t Approval
Scope
Quality
Scope
Reduction
Unacceptable
to Sponsor or
Client
Quality
Reduction
Unacceptable
to Sponsor or
Client
Project EndItem is
effectively
useless
Project EndItem is
effectively
useless
Project Risk Management
How does Project Risk Tolerance differ from
Organizational Risk Tolerance?
• Stakeholder risk tolerances may be revised
during the “Plan Risk Management” process.
• For example, risk tolerance is often a function
of experience. Greater experience of a project
team with a particular type of project risk will
often increase the tolerance level
Project Risk Management
• How Are Project Risks Prioritized?
Risks are prioritized or “ranked” using a probability &
impact matrix. The highest ranked risks can be further
prioritized based on “Urgency” or “Severity.” The highest
ranked risks with the shortest time horizon are considered
most “severe.”
Project Risk Management
Part I
Questions?
JavTex Engineering & Consulting LLC