Managing Project Risk
Project Risk “…an uncertain event or condition that, if it occurs, has a positive or a negative effect on a project objective.”
Information Systems Associated Risks Technology and project management related Positive Availability of new project management tools Negative Rate of change in technologies Upgrades and new releases Assumptions computer-generated output is always correct Formation of teams
Risk & Project Life Cycle Initiation stage Identification and selection of specific projects Inside or outside of organization’s core competencies Planning stage Procurement Unreliability of new technology delivery timeframe Development of accurate project schedule
Risk & Project Life Cycle (cont.) Execution stage Missed scheduled delivery date Technology upgrades Control stage Implementation of risk plan Modification of project schedule Closing stage Acceptance of project as finished
Project Risk Examples New or different project management methodologies Different: Cultures Organization structures Human resources
General Categories of Project Risk Ongoing changes to technology/materials Finding, assigning, and retaining skilled personnel Gaining user acceptance Choosing the correct development methodology Choosing correct manufacturing tools/materials
Outsourcing / Offshoring Positives: Expanded skill set availability Cheaper labor Reduced requirements for non-core competencies Negatives: Internal resistance Possible solutions to reduce risk: Ensure strong upper management support Select the right personnel Involve managers early in the outsourcing process Educate and reassure internal employees
Outsourcing / Offshoring (cont.) Negatives (cont.): Increased security and privacy concerns Possible solutions to reduce risk: Increase physical security measures Use software event logging and monitoring tools Intrusion detection systems and firewalls Encryption hardware/software
Top Five Project Risks Lack of top management commitment to the project Failure to gain user commitment/acceptance Misunderstanding the requirements Lack of adequate user/consumer involvement Failure to manage end user expectations
Risk Management Planning A systematic approach to planning the risk management activities of a given project
Risk Management Planning – Inputs Enterprise environmental factors Attitudes toward risk and risk tolerance Organizational process assets Processes in place to handle risk Project scope statement Defining the project Project management plan Project summary document
Risk Management Planning – Tools & Techniques Risk planning meetings Senior managers, project team leaders, stakeholders, project members with decision-making responsibilities Development of specific risk management plans Inclusion of risk-related items in budget and schedule Creation of risk management templates
Risk Management Planning – Outputs Methodology or approach to risk management Roles and responsibilities of project members Risk management budget Integration of risk management activities into project life cycle Scoring and interpretation of risk analysis Risk thresholds Reporting formats Tracking
Risk Identification The process of identifying potential risks to a project and documenting them
Risk Identification – Inputs Enterprise environmental factors Organizational process assets Project scope statement Project management plan Risk management plan
Risk Categories Defined in a Risk Register A formal recording of all project risks, explaining the nature of the risk and management of the risk
Risks
Risk Identification – Tools & Techniques Documentation reviews The review of organizational information to aid during risk identification May include: Project profiles (previous project information and related lessons learned) Published information Articles/studies/benchmarking information
Risk Identification – Tools & Techniques (cont.) Information gathering techniques Brainstorming Delphi technique Interviewing Strengths, weaknesses, opportunities, and threats (SWOT) Checklists
Risk Identification – Tools & Techniques (cont.) Diagramming techniques Cause and effect (Fishbone) System or process flowcharts Influence diagrams
Risk Identification – Output
Qualitative Risk Analysis Establishment of probabilities regarding both the impact and likelihood of specific risk occurrences
Qualitative Risk Analysis – Inputs Organizational process assets Project scope statement Risk management plan Risk register
Qualitative Risk Analysis – Tools & Techniques Risk probability and impact assessment Probability/impact risk rating matrix Risk data quality assessment Risk categorization Risk urgency assessment
Probability/Impact Risk Rating Matrix A technique used to analyze project risk in terms of its probability of occurrence and its impact on project outcomes
Risk Data Quality Assessment Assessment of the quality of the data used to assess risk May include: Extent to which a risk is understood Available risk data Data quality Data integrity and reliability
Qualitative Risk Analysis – Outputs Updated risk register
Quantitative Risk Analysis Analysis of the probability of occurrence and impact of risk on project objectives using numerical techniques
Quantitative Risk Analysis – Inputs Organization process assets Project scope statement Risk management plan Risk register Project management plan
Quantitative Risk Analysis – Tools & Techniques Data gathering through interviewing Quantitative procedures Sensitivity analysis Technique used to examine the potential impact of specific risks to a project (Tornado analysis) Decision tree analysis Diagramming technique used to evaluate courses of action in terms of their potential cost and benefits relative to other courses of action
Quantitative Risk Analysis – Tools & Techniques (cont.) Expected monetary value analysis (EMV) Statistical technique which captures the average value of potential projects by analyzing the likelihood of possible project outcomes as well as each outcome’s financial consequences Simulation Statistical technique where what-if analyzes are run to determine the impact of a given situation on a project objective (Monte Carlo)
Tornado Analysis
Expected Monetary Value + Decision Tree Analysis
Quantitative Risk Analysis – Outputs Updated risk register
Risk Response Planning The process of developing methods for responding to project risks
Risk Response Planning – Inputs Risk management plan Risk register
Risk Response Planning – Tools & Techniques Avoidance Identified risks are avoided through a different course of action Transference Transfer of risk to another party through the use of contracts Mitigation Steps are taken to reduce the occurrence or impact of stated risks Acceptance Risks are accepted and contingency strategies are planned
Risk Response Planning – Outputs Updates to: Risk register Project management plan Risk-related contractual agreements
Risk Response Plan Contents (Project Management Institute) Any risks that have been identified along with a description and the areas and objectives the identified risk may affect The roles and responsibilities of any risk owners Qualitative and quantitative risk analysis results as well as any trends identified during either of these processes A description of the risk response strategies including avoidance, transference, mitigation, and acceptance, and the risk that the strategies will be applied to An acknowledgement of any residual risk projected to remain after any risk response strategies have been applied A list of actions to be used to implement the risk response strategies Budget and schedule information in terms of risk response Any contingency plans used as part of an active response to accept risks
Additional Risk Terms Residual risks Secondary risks Any risks remaining after risk response strategies have been applied Secondary risks Any risks resulting from the application of a risk response strategy Contractual agreements Any contracts for the purpose of risk transference during the project
Risk Monitoring & Control The process of monitoring identified risks for change and controlling those changes
Questions?