8/6/2019 RM Module 1 S2011
1/47
Project Risk Management
Module 1
Introduction to RiskManagement
8/6/2019 RM Module 1 S2011
2/47
Introductions
Instructor: Hamid Faridani. PhD, PMP
Email: [email protected]: 416 577 9331
mailto:[email protected]:[email protected]8/6/2019 RM Module 1 S2011
3/47
Project Management Processes & Knowledge Areas
Closing
12.6 Close
Procure-
ments
4.6 Close
Project
Executing4.3 Direct & Manage
Project Execution
9.2 Acquire
Project Team
10.2 Distribute
Information10.4 Manage
Stkhldr Expect
9.3 DevelopProject Team
9.4 ManageProject Team
8.2 Perform QA12.2 Conduct
Procurements
Planning
5.1 Collect
Requirement
6.3 Estimate
Act. Res.
6.4 Estimate
Act. Duration
5.2 Define
Scope
6.1 Definie
Activities
7.1 Estimate
Cost
6.5 Develop
Schedule
11.1 Plan
Risk Mgmt
7.2
Determine
Budget
4.2 Develop
Project Mgmt
Plan
8.1 Plan
Quality
12.1 Plan
Procurement
10.1 Plan
Comm.
11.2 Identify
Risks
11.3 Perform
Qual. Risk
Analysis
11.4 Perform
Quant. Risk
Analysis
11.5 Plan Risk
Resp.
12.2 Plan
Contracting
5.3 Create
WBS
6.2 Sequence
Activities
9.1 Dev. HR
Plan
Initiating
4.1 Dev. Prj
Charter
10.1 Id.
Stakehldrs
Monitoring and Controlling
4.4 Monitor &
Control Work
4.5 Perform
Int. Chg. Ctl
5.4 VerifyScope
5.5 Control
Scope
7.3 ControlCosts
8.3 Perform
Quality Cont.
12.3 Admin.
Procurement
6.6 Control
Schedule
10.3 Report
Performance
10.4 Manage
Stakeholders
.
11.6 Mon +Ctl Risks
8/6/2019 RM Module 1 S2011
4/47
Managed andMitigatedProject Risks
High qualityProjectProcesses and
Practices
Successful
Projects
The Link between Project Risk and Quality
Management and Project Success
8/6/2019 RM Module 1 S2011
5/47
Measures of Projects Success
Plan & execute
Project to deliver
Project Success: Level 1Was the project done right?
Project Success: Level 2Was the right project done?
Project Success: Level 3Were the right projects done right,
time after time?
Product Value or
Benefit
Use product to
produce
8/6/2019 RM Module 1 S2011
6/47
Measures of Projects Success
Success Level Typical Criteria forSuccess
Possible Critical Success Factors
(Inputs)
OrganizationalAccountability
Level 1: ProjectManagement Success
Was the project done
right?
Time
Cost
Quality
Scope
Safety
Clear & doable goals
Effective project team
Adequate resources
Clear technical performancerequirements
Effective planning & control Risk & quality management
Project Manager
PMO
Level 2: Project Success
Was the right project
done?
ROIC
IRR
Other financialindicators
Stakeholderssatisfaction
Clear & doable goals
Stakeholders commitment &attitude
Effective benefits realization andmanagement
Appropriate operational strategy
Project sponsor
Client, owner oroperator
Level 3: ConsistentProjects Success
Were the right projects
done right, time aftertime?
Maturity of PM cultureand practices
Incorporation ofknowledge management
Productivity ofcorporate resources
Incorporation of qualitymanagement culture inorganization
Effective portfolio management
Comprehensive use of metrics
Shareholders
Seniormanagement
Portfoliomanagers
Project Success Indicators and Factors
8/6/2019 RM Module 1 S2011
7/47
Risk in Projects: The Why Question
Uniqueness: There arealways some projectcomponents or sub projectsthat have not been donebefore.
Deliverables: Products orservices developed oftencannot meet shiftingcustomer expectations
Assumptions: By their very
nature, involve uncertainty,and hence risks
Stakeholders: Theconflicting expectations ofvarious stakeholdersrepresent risk factors
Conflicting Constraints oftime, cost and scope.
Organizations and People:The unpredictable andconflicting needs of teams
working on projects Project Environment and
Change: Change involvesuncertainty and risk
8/6/2019 RM Module 1 S2011
8/47
The Nature of Risk
Risks are associated withuncertainty concerning theassumptions made about
projects activities such as theirduration, cost and performancerequirements.
Uncertainty will eventually affect
a projects objectives and henceits success: Negatively, resulting in threats
Positively, resulting inopportunities
Thinking outside thebox involves uncertaintyand risks
8/6/2019 RM Module 1 S2011
9/47
The Dimensions of Risk
Impact
Cause orTrigger
Risk Driver: Definitefact about the project orits environment
Risk Event: Uncertainsituation that if it occurscan have an impact onthe projects objectives
Risk Effect:Contingent effect of riskon project objectives
Trigger: Use ofunionized workers in aconstruction project
Risk Event: Unionstrike during projectimplementation
Impact: Delay in projectschedule and possibleassociated penaltiesand costs
Risk
Impact
8/6/2019 RM Module 1 S2011
10/47
Sources of Uncertainty in Projects
Level 0 Level 1 Level 2 Level 3
ProjectRisk
Management Corporate Experience Organizational & Financial Culture
Customer History & Requirements
Loyalty
External NaturalEnvironment
Physical Environment
Facilities & Services
Socio-Cultural Government and Politics
The Legal Environment
Economic Structure of the Economy
Labour and Financial Markets
Technology Requirements &Performance
Scope uncertainty & Complexity
Technology Maturity and Limits
Applications Organizational Experience
Physical Infrastructure
Personnel Experience
8/6/2019 RM Module 1 S2011
11/47
Relationship between Risk and Objectives
Type of Risk Corresponding Objectives
Project Risk is any uncertainty that, ifoccurs, would affect one or more of theprojects objectives.
Scope, time, cost, performance, quality and clientsatisfaction
Business Risk is any uncertainty that,if occurs, would affect one or more of thebusiness objectives.
Profitability, market share, competitiveness,Internal Rate of Return IRR, reputation, repeatbusiness, share price and others
Safety Risk is any uncertainty that, ifoccurs, would affect one or more of thesafety objectives.
Low accident rate, minimal lost days, reducedinsurance premiums, regulatory and legalcompliance
Product Technical Risk is anyuncertainty that, if occurs, would affectone or more of the product technicalobjectives.
Performance, functionality, serviceability reliability,and maintainability of the product
Security Risk is any uncertainty that, ifoccurs, would affect one or more of thesecurity objectives.
Physical plant security, personnel and assetsecurity, and information security
8/6/2019 RM Module 1 S2011
12/47
Project Risk Management (PMBoK)
Project Risk Management PRM is thesystematic process of identifying,analyzing, and responding to project risks.It includes
PRM includes maximizing the probability
and consequences of positive events(opportunities); and minimizing theprobabilities and consequences of negativeevents (threats)
An Opportunity is not the absence of theabsence of threat. Distinctive opportunities
exist in their own right presenting a chanceto deliver the projects product early, at a
lower cost and, therefore, increasingcustomer satisfaction.
8/6/2019 RM Module 1 S2011
13/47
Threats and Opportunities in Projects
ProjectObjectives:Cost orSchedule
20
40
80
100
60
Target value
Normal VariationsOpportunity
Zone
ThreatZone
8/6/2019 RM Module 1 S2011
14/47
The Definition of Risk
ThreatAny uncertainty that, if itoccurs, would affect one
or more of the projectsobjectives negatively
OpportunityAny uncertainty that, ifit occurs, would affect
one or more of theprojects objectivespositively
RiskAny uncertainty that, if it occurs,would affect one or more of the
projects objectives
8/6/2019 RM Module 1 S2011
15/47
Uncertainty in Project Activities Risks in a project arise because the cost, duration and
outcome of projects activities involve a degree ofuncertainty. The uncertainty is defined in terms of aprobability distribution.
Probability
Cost or Duration Estimate x
10Least
Likely x1
15Most
Likely x2
25Least
Likely x3
The estimated value is a function ofx1, x2 and x3
8/6/2019 RM Module 1 S2011
16/47
Risk and Decision Making Cost Benefit Analysis: A risky
course of action should only betaken when the potential benefitand chance of winning exceed theremedial cost of an unsuccessfuldecision and chances of loosing bya acceptable margin
The risk taker should obtainanswers to: Why should the risk be taken? What will be gained? What could be lost?
What are the chances of success andfailure?
What can be done if the desired result
is not achieved? Is the potential reward worth the risk?
8/6/2019 RM Module 1 S2011
17/47
Risk and Decision MakersRisk elements that tend to
Attract and/or determine the
Response attitudes of decision
makers include:
Potential frequency of loss
Amount and reliability ofinformation available
Severity of potential loss
Vividness of the consequences
Potential for (adverse) publicity
Ability to measure theconsequences
8/6/2019 RM Module 1 S2011
18/47
Risk Management is Proactive
Project risk management should beadvance preparation for possible adverseevents, rather than responding as theyhappen though both may be needed.
Crisis Management (reactive mode)consists of taking the appropriateresponse if an event occurs.
Anticipation and Planning (proactivemode) makes it possible we hope to
avoid this situation in the first place byplanning an appropriate response shouldthe adverse event take place.
8/6/2019 RM Module 1 S2011
19/47
Venture Risk vs. Project RiskVenture Risk:
Analyzing informationand selecting the rightproject
Will the project results beas effective as originallyplanned?
Will the market for theproduct/service exist tothe same degree thatwas forecast?
Project Risk:
Managing uncertainty tomeet the projectobjectives
Can we complete theproject on schedule?
Will the project results
meet the agreedrequirements?
Can we remain within theapproved budget?
8/6/2019 RM Module 1 S2011
20/47
The Dimensions of Risk
Probability
Statistical likelihood of aspecific event taking place
Impact Damage or benefits that will
result if that event occurs
Conditions or Context Timing and situation should
the event occur
8/6/2019 RM Module 1 S2011
21/47
Probability of a Risk Event
Expresses the likelihood of an eventtaking place
Based on scientific observation ofsimilar events, review of scenarios,
analysis of a situation, etc. Useful in many business areas,
including insurance, investments,gaming, etc.
Dependent on accuracy of the
information available: Weatherforecast compared to gambling odds Can be expressed as a percentage or
a decimal Often expressed in relative terms
(likely unlikely)
P(6 and 4) = P(6). P(4)= (1/6).(1/6)= 1/36= 2.7 %
8/6/2019 RM Module 1 S2011
22/47
Probability as a Measure of Uncertainty
Uncertainty in commonterminology is oftenexpressed by phrases suchas: not very likely or highly unlikely
better than even or probable
for sure or highly likely
Probability is stated on a
scale from 0 to 1 0 probability indicates an event has
no chance of occurring
1 probability indicates an event isabsolutely sure to occur
P( Rain) > 90% during themonsoon season in SouthAsia
P (Rain) < 10% in the summer
in North Africa
8/6/2019 RM Module 1 S2011
23/47
The Risk Value
Impact: The magnitude of consequences
The amount at stake; the extent of adverse orpositive consequences which might affect the
projects objectives of: Scope (S), Cost (C),Schedule (T) and Quality (Q)
Probability: The likelihood of occurrence
The ratio of the number of chances that an event
may happen, to the sum of the chances of it bothhappening and not happening
Risk Value = Probability x Impact
8/6/2019 RM Module 1 S2011
24/47
Impact of a risk event Description of the consequences (benefit or
loss) that will result, should the event takeplace: Impact is not related to theprobability of that event
Often expressed in financial terms, but can
also affect other aspects of the organizationor project:Cost impact is expressed in sameunits as the budget.
Estimate is based on scientific observationof similar events, review of scenarios,analysis of a situation
May be easy or difficult to estimate thedegree of impact Estimate assumes that only normal
safeguards are in place Depends on the conditions in effect
when/if the event occurs
8/6/2019 RM Module 1 S2011
25/47
Simple Risk Assessment Matrix
Low priorityrisks
Third priorityrisks
Second priorityrisks
First priorityrisks
Probability
ImpactLow
Low
High
High
8/6/2019 RM Module 1 S2011
26/47
Risk Factors in the Project Life Cycle
Project risk factors changeduring the life cycle
During project planning, theprobability of opportunity orthreat remain high, but the
amount at stake (investment)is low
During projectimplementation, theprobability of opportunity orthreat progressively falls as
the unknowns becomeknowns, but the amount atstake rises steadily asresources are invested
Highest vulnerability to risk isduring the last two phases ofthe life cycle
Opportunity and Risk
Amount at Stake
Plan Accomplish
Phase 1CONCEPT
Conceive (C)
Phase 2DEVELOPMENT
Develop (C)
Phase 3IMPLEMENTATION
Execute (E)
Phase 4TERMINATION
Finish (F)
TIME
INCREASINGR
ISK
$VALUE
Total Project Life Cycle
R. M. Wideman, 1992
8/6/2019 RM Module 1 S2011
27/47
Life Cycle Risk Analysis
Typical Life Cycle Risks
Phase 1
Conceptualization
Phase 2
Development
Phase 3
Implementation
Phase 4
Termination
Unavailable Experts
Poor Definition ofProblem
No or Poor Feasibility
Study
Unclear Objectives
Lukewarm Support fromSponsor
Unproven Technology
Poor Market Intelligence
No Risk ManagementPlan
Hasty and PoorPlanning
Poor Specifications
Unclear WBS & SOW
Unclear Definition ofRoles andResponsibilities
LukewarmManagement Support
Inexperienced PM andProject Team
Unskilled Labour
Unreliable Suppliers
Quality and Availabilityof Materials
Changes in Scope
Changes in Costs andSchedules
Labour Strikes
Weather Conditions
Changes in RegulatoryRequirements
Environmental or OHSCompliance
Inadequate MonitoringControl Systems
Poor Performanceand Quality ofProduct or Service
Changes in
CustomersExpectations
Cash FlowProblems
8/6/2019 RM Module 1 S2011
28/47
Effective Risk Management
Open Communication
Enabling formal, informal andimpromptu communication and flowof information.
Using processes that value theindividual voice and insight intoidentifying and managing projectrisks
Integrated Management Making risk management an integral
and vital part of project management
Adapting risk management tools andmethods to the project management
infrastructure and culture
8/6/2019 RM Module 1 S2011
29/47
The PMI Risk management
Processes
Plan Risk Management meetings to develop a risk management plan
Identify Risks determining project risks and their characteristics
Perform Qualitative Risk Analysis assessing relative impact and likelihood of identified risks
Perform Quantitative Risk Analysis numeric analysis of probability and consequences
Plan Risk Responses developing options to enhance opportunities, reduce threats
Monitor and Control Risks tracking identified risks, executing risk plans and contingency plans
8/6/2019 RM Module 1 S2011
30/47
The Risk Management Processes
*Guide to Project Management Body of Knowledge (PMBOK): Fourth Edition. The Project Management Institute PMI
8/6/2019 RM Module 1 S2011
31/47
The Risk Management Processes
*Guide to Project Management Body of Knowledge (PMBOK): Fourth Edition. The Project Management Institute PMI
8/6/2019 RM Module 1 S2011
32/47
The Risk Management Processes
*Guide to Project Management Body of Knowledge (PMBOK): Fourth Edition. The Project Management Institute PMI
8/6/2019 RM Module 1 S2011
33/47
The Risk Management Processes
*Guide to Project Management Body of Knowledge (PMBOK): Fourth Edition. The Project Management Institute PMI
8/6/2019 RM Module 1 S2011
34/47
The Risk Management Processes
*Guide to Project Management Body of Knowledge (PMBOK): Fourth Edition. The Project Management Institute PMI
8/6/2019 RM Module 1 S2011
35/47
The Risk Management Processes
*Guide to Project Management Body of Knowledge (PMBOK): Fourth Edition. The Project Management Institute PMI
8/6/2019 RM Module 1 S2011
36/47
Risk Conditions in PM Knowledge Areas
KnowledgeArea Risk Conditions
Integration Inadequate planning; poor resource allocation; poor integrationmanagement; lack of post-project review
Scope Poor definition of scope or work packages; incomplete definition ofquality requirements; inadequate scope control
Time Errors in estimating time or resource availability; poor allocation andmanagement of float; early release of competitive products
Cost Estimating errors; inadequate productivity, cost, change, or contingencycontrol; poor maintenance, security, purchasing, etc.
Quality Poor attitude toward quality; substandarddesign/materials/workmanship; inadequate quality assurance program
HumanResources
Poor conflict management; poor project organization and definition ofresponsibilities; absence of leadership
Communications Carelessness in planning or communicating; lack of consultation withkey stakeholders
Risk Ignoring risk; unclear assignment of risk; poor insurance management
Procurement Unenforceable conditions or contract clauses; adversarial relations
8/6/2019 RM Module 1 S2011
37/47
Attributes of the Effective Risk
Management Process (RMP)
Value Added: The RMP should be seen toprovide value to the project team but simple
to use and implement, without undueadministrative burden.
Structured and Generic: The processshould be a structured and generic but
readily adaptable to sector-specific projects Scalable: RMP should be readily scalable to
projects of different scope.
8/6/2019 RM Module 1 S2011
38/47
Elements of an Appropriate RMP
Infrastructure Project Management Information System
Risk Management Information System Performance Failure Information System Lessons Learned Information System Earned Value Information System
Risk Analysis Software Tools Simulation Tools Decision Analysis Tools
Risk Resources Policies and Procedures Standards and Templates Risk Experts Training for Project Team Networking with Relevant External Bodies
8/6/2019 RM Module 1 S2011
39/47
Risk Strategies and Organizational
Environment
High LowRisk Tolerance
Project
RiskManagementPolicies&
Procedures
Guidelin
es
Rigid
Acceptance
Mitigation orEnhancement
Transferring orSharing
Avoidance orExploitation
Project Management: A Systems Approach, Harold Kerzner, J Wiley & Sons
8/6/2019 RM Module 1 S2011
40/47
Organizations Risk Culture
Risk Averse: Organizations that have low riskthreshold
Risk Taker: Organizations that have a high riskthreshold and track record of managing risky
projects. Risk Ignorant/Hostile: Organizations that, because
of the nature of their sector, have arrogant orignorant attitude towards risk.
Risk Mature: Organizations that recognize and
accept uncertainty as inevitable, and are prepared todevelop mature risk management processes tomanage the negative impact of threats and reap thebenefits of opportunities.
8/6/2019 RM Module 1 S2011
41/47
Risk Attitudes and Drivers of Behaviour
Attitude Neutral
Environment
Behaviour
Attitudesdrive
behaviour ina neutral orpositiveenvironment
Attitude Hostile
Environment
Behaviour
Hostileenvironmentdrives
behaviour
Uncertainty Uncertainty
8/6/2019 RM Module 1 S2011
42/47
Individuals Risk Attitudes
Risk Averse (RA) Uncomfortable with uncertainty and has low tolerance for
ambiguity
Practical, accepting, has common sense approach to issues,
and enjoys working with facts rather than theories. Threats are more readily perceived by the RA, while opportunities
are underrated. RAs tend to over react to threats and under reactto opportunities
Risk Tolerant (RT) Takes uncertainty in a stride as a normal feature of project work
Has a laissez-faire approach that may lead to failure to assessthe potential impact of both threats and opportunities
May appear to have a balanced attitude towards risk, but outlookcan have negative long term effects
8/6/2019 RM Module 1 S2011
43/47
Individuals Risk Attitudes
Risk Neutral (RN) Sees risk taking as a price worth paying for future payoffs They think abstractly and creatively and are not afraid of
dealing with uncertainty
RNs have mature attitudes towards threats andopportunities
Risk Seeking (RS) Welcomes the challenge of dealing with risks, and the thrill
of garnering potential payoffs. Risk seekers tend to be adaptable and resourceful, enjoy
lifes challenges and are driven by the promise of payoffs RSs tend to under estimate the consequences of threats
and over estimate the benefits of opportunities
I di id l Ri k Attit d
8/6/2019 RM Module 1 S2011
44/47
Individuals Risk Attitudes
Attribute Risk Averse Risk Neutral Risk Tolerant Risk Seeking
Attitudetowardsthreats
Over sensitiveand aware
Aware Unconcernedand cavalier
Underestimatesimportance
Actionstowardsthreats
Aggressivelyavoids and/orminimizes theirconsequences
Respondsproportionately
Does notrespond
Accepts orignores them
Attitudetowards
opportunity
Under sensitiveand/or unaware
Seek strategiesthat have highfuture payoff
Unconcernedand cavalier
Overestimatestheir importance
Actionstowardsopportunity
Under reactand/or ignore
Respondsproportionately
None Aggressivelyexploit and/orenhance
8/6/2019 RM Module 1 S2011
45/47
Tolerance for Risk
Risk Seeker
Risk Neutral
Value at stake
Satisfaction
Low High
Low
High
Risk Averter
8/6/2019 RM Module 1 S2011
46/47
Behaviour Modification of Risk
Attitudes Risk attitudes are not hard wired in the human brain. All attitudes
are chosen situational responses driven by subtle and complex set offactors, some of which are subconscious and deep rooted.
Project team members through reflection and the use of various
available psychometric self assessment instruments (EmotionalIntelligence Individual Diagnostic IQ) can raise their self awareness,which can lead to self-regulation, behaviour modification andmanagement.
Behaviour modification involves understanding of which attitudes willproduce the desired effect in a given situation, and consciouslymodifying ones attitude as appropriate, even if it means adopting an
approach that is counterintuitive Project team members can also be trained to look actively for
opportunities rather than only for threats, and adopt a more positivethinking frame of mind that recognizes that opportunities exist, haveto be proactively identified and effectively managed.
8/6/2019 RM Module 1 S2011
47/47
The Risk-Balanced Project Team Team Work is essential in the risk
management process, where theattributes of each member contribute tothe overall capacity of the team
The risk averse person can be reliedupon to challenge plans and strategieslooking for threats and testing thefeasibility of proposed solutions.
The risk seeker colleague can look moreproactively for opportunities for doing
work better, faster and cheaper. The risk neutral team member can test
all strategies for their long term benefits tothe project and the organization.
The risk tolerant can offer an overall