1. Don Cole Risk Assessment and Mitigation Project Management for ARA Engineers and Scientists

2. Copyright 2009. All rights reserved. Applied Research Associates, Inc. 2 Overview  What types of risks are of concern to Project Manager?  How do you identify the risks?  What are the potential impacts? To the project To the company  How are risks eliminated or mitigated?  Where do you first assess risks? Economics of Risk Cost (U) Ps*Ps* Reliability (P s ) Total Lifetime Costs U = U i + (1 - P s ) U f {min U} U i = Initial System Cost (1 – P s ) U f = Expected Cost of System Failure What are some Quality Implications?

3. Copyright 2009. All rights reserved. Applied Research Associates, Inc. 3 Desired Learning Objectives  Risk Assessment and mitigation/elimination is a management function  Why include Risk Assessment in proposal response?  How to identify and assess risks  How to monitor risks as the project proceeds  How failure to address risks can have serious impacts beyond the quality of the project performance Roswell 250 miles NO! Your OTHER left …

4. Copyright 2009. All rights reserved. Applied Research Associates, Inc. 4 Risk Mitigation is a Management Function  Planning Identify risk elements Characterize impact (failure to mitigate) Eliminate where possible by adjusting approach Mitigate where elimination is impossible  Evaluation and Reassessment during execution Plan revision Staff supervision Risk Assessment Plan

5. Copyright 2009. All rights reserved. Applied Research Associates, Inc. 5 Understanding Risk 1.What can go wrong? 2.How likely is it? 3.What are the consequences? 4.How can the risk be eliminated or mitigated? Four Principal Questions:

6. Copyright 2009. All rights reserved. Applied Research Associates, Inc. 6 Risk Defined What type of risks get the most publicity? What types of risks most often affect project performance? What types of risks are the most demanding to identify for experimental programs? Example Types of Risks: Low probability and high consequence Frequent events and low consequences Moderate probability and moderate consequences Very low probability and very high consequences

7. Copyright 2009. All rights reserved. Applied Research Associates, Inc. 7 Two Categories of Risk  Project Risks Technical Financial Schedule  Company Risks Safety Security Small Business Requirements

8. Copyright 2009. All rights reserved. Applied Research Associates, Inc. 8 Assessing and Mitigating Project Risk  Performance Risk Is desired outcome clear? Does customer recognize risk? What confidence objective can be met?  Cost Risk Is the approach in each task clear enough to price with confidence? Does our approach allow an adequate management reserve?  Schedule Risk Does PM control all elements effecting the schedule? Is there adequate lag time before each milestone?

9. Copyright 2009. All rights reserved. Applied Research Associates, Inc. 9 Characterizing and Tracking Risks  Identified risks should be assessed in two dimensions Likelihood of Occurrence ▪How likely is it that this risk will actually happen? Impact of Occurrence ▪How drastically will project be affected if the risk does occur?  Both dimensions typically assessed using high/medium/low categories Overall assessment determined by combining the two dimensions ▪Risk with an overall assessment of medium or high should have a risk mitigation plan Overall Risk AssessmentLikelihood of Occurrence LowMediumHigh Impact of Occurrence Low Medium LowMediumHigh MediumHigh

10. Copyright 2009. All rights reserved. Applied Research Associates, Inc. 10 Elements of a Risk Mitigation Plan  Risk Name & Description Briefly describe the risk and identify it as one or more types (e.g. cost, schedule, technical, safety, security, etc.)  Assessment Identify likelihood of occurrence as high, medium or low ▪Defend assessment with 1-2 sentences/bullets Identify likelihood of occurrence as high, medium or low ▪Defend assessment with 1-2 sentences/bullets  Mitigation Plan Describe the steps to be taken now that will reduce the likelihood of the risk occurring Describe the steps to be taken now that will reduce the impact if the risk does occur  Indicator/Observation Plan Describe key triggers that will indicate the identified risk has occurred or is about to occur  Contingency Plan Describe the work around to be performed after the risk does occur

11. Copyright 2009. All rights reserved. Applied Research Associates, Inc. 11 Example: Cost Overrun Risk  Risk name: cost overrun on CPFF effort  Assessment: high Effort divided between three divisions and a subcontractor Customer has only vaguely defined expectations  Impact: high Customer will have to seek additional funds or reduce requirements Will reduce fee percentage  Mitigation Plan Work with customer to establish expectations within budget Provide clear requirements, budget and schedule to each division and subcontractor Track cost/performance monthly ▪Assure separate phase in BST for each performer/task ▪Establish milestones and associated costs with Task Leaders  Indicator/Observation Plan Look for significant cost or schedule variance by task  Contingency Plan Reserve a portion of the budget for contingencies (Management Reserve)

12. Copyright 2009. All rights reserved. Applied Research Associates, Inc. 12 Who is Responsible for Risk Reduction Activities?  What process will you use to periodically assess the status of your proposed risk reduction action plans?  How and how often will you communicate the progress to the customer? Communicate in your proposal how your management approach addresses the cost, schedule and performance risks

13. Copyright 2009. All rights reserved. Applied Research Associates, Inc. 13 What are Some Things that Can Go Wrong?  Communication Large staff, including multiple divisions Solve the wrong problem (generally task and subtask level)  Staff Changes New project absorbs your key staff, staff turnover Staff preoccupied with other “higher priority” short-term projects  Underestimate effort needed to develop/use computer models Using new models New bugs found in current models Model needs to be adapted – new code written, integrated and tested

14. Copyright 2009. All rights reserved. Applied Research Associates, Inc. 14 What are Some Things that Can Go Wrong? (cont.)  Equipment breakdowns  Accessibility to site, data, other models  Takes longer than expected to get clearances  Customer CTR is replaced by new person ▪On VERTEC’s ARTS program, 4 CTRs and 5 COs in five years and numerous logistics and engineering POCs changes – increased risk Requirements change Customer is non-responsive to needed decisions

15. Copyright 2009. All rights reserved. Applied Research Associates, Inc. 15 Assessing and Mitigating Company Risk  Safety Risk Are personnel or property exposed to hazards? Can these hazards be avoided by revising approach? Can remaining hazards be successfully mitigated?  Security Risk Are we physically equipped to meet security requirements? Are our personnel adequately trained? Do we have a plan for comprehensive review?  Subcontractor Risk Geographical separation, lack of adequate cost/schedule/performance feedback, lack of timely billing, etc. Is our approach compatible with contract SB requirements and with company SB plan requirements?

16. Copyright 2009. All rights reserved. Applied Research Associates, Inc. 16 Costs to Recover from Major Quality Problems Costs to Fix Major Quality Problems     020406080100% 1 2 3 4 Time Error Detected/Project Period of Performance ARA Milestones 1. Project Plan 2. 35% Review 3. 65% Review 4. Deliverables Review “Kickoff” Meeting Project Team Meetings, Reviews “Project staff must identify and fix errors, oversights and poor design problems early.”

17. Copyright 2009. All rights reserved. Applied Research Associates, Inc. 17 Why Include Risk Assessment in Proposal Response?  Often required in large procurements  Demonstrates and understanding of processes necessary to meet procurement requirements Associated uncertainties that can impact quality, cost and schedule  Allows incorporation of risk mitigation in technical and management approach Structure approach to eliminate or minimize significant risks Include contingencies for conditions beyond control  Allows client recognition of risks and acknowledgement of potential outcomes

18. Copyright 2009. All rights reserved. Applied Research Associates, Inc. 18 Summary  Risk assessment/mitigation is a management function  Risks can have impact well beyond the life of a project  Risk assessment and development of mitigation plan at proposal stage provides client confidence you can meet requirements on schedule and within budget Allows client recognition of factors beyond control Affects likely quality of final product  Early risk mitigation provides lowest cost Importance of milestones