mini pram

8/6/2019 Mini Pram

1/11

Project Risk Analysis & Management

PROJECT RISK ANALYSIS AND

MANAGEMENT

A GUIDE BY

THE ASSOCIATION FOR PROJECT MANAGEMENT

(formerly The Association Of Project Managers)

Compiled from information provided by members ofthe Special Interest Group on Risk Management

Catriona Norris - UMISTProfessor John Perry - The University of Birmingham

Peter Simon - CPS Project Management

8/6/2019 Mini Pram

2/11

8/6/2019 Mini Pram

3/11

Project Risk Analysis & Management3

PROJECT RISK ANALYSIS AND

MANAGEMENT1. Introduction

This Guide provides an introduction to theprocesses involved in Project Risk Analysis andManagement, offering a simple but robust andpractical framework to help new users get started.It is not a definitive explanation of all thetechniques and methods that can be used in theprocess.

Project Risk Analysis and Management canbe used on all projects, whatever the industry orenvironment, and whatever the timescale orbudget.

2. What Is Project Risk Analysis AndManagement?

Project Risk Analysis and Management is aprocess which enables the analysis andmanagement of the risks associated with aproject. Properly undertaken it will increase thelikelihood of successful completion of a project tocost, time and performance objectives.

Risks for which there is ample data can beassessed statistically. However, no two projectsare the same. Often things go wrong for reasonsunique to a particular project, industry orworking environment. Dealing with risks inprojects is therefore different from situationswhere there is sufficient data to adopt an actuarialapproach. Because projects invariably involve astrong technical, engineering, innovative orstrategic content a systematic process has proven

preferable to an intuitive approach. Project RiskAnalysis and Management has been developed tomeet this requirement.

3. What Is Involved

The first step is to recognise that risk existsas a consequence of uncertainty. In any projectthere will be risks and uncertainties of varioustypes as illustrated by the following examples:

the management and financial authoritystructure are not yet established

a the technology is not yet proven industrial relations problems seem likely

resources may not be available at therequired level.

All uncertainty produces an exposure to riskwhich, in project management terms, may cause afailure to:

keep within budget

achieve the required completion date

achieve the required performance objective.

Project Risk Analysis and Management is aprocess designed to remove or reduce the riskswhich threaten the achievement of projectobjectives. The next section of this Guidedescribes the benefits which Project Risk Analysisand Management can bring to a project and alsothe wider benefits to the organisation and itscustomers. It should be regarded as an integralpart of project or business management and notjust as a set of tools or techniques.

The Project R isk A nalysis and Man agement

Process

Experienced risk analysts and managers holdperceptions of this process which are subtle anddiverse. In order to simplify the process thisGuide divides the overall process into twoconstituents or stages:

Risk Analysis

Risk Management.

Risk Analysis

This stage of the process is generally splitinto two 'sub-stages'; a qualitative analysis 'sub-

stage' that focuses on identification and subjectiveassessment of risks and a quantitative analysis'sub-stage' that focuses on an objective assessmentof the risks.

Qualitative Analysis

A Qualitative Analysis allows the main risksources or factors to be identified. This can bedone, for example, with the aid of check lists,interviews or brainstorming sessions. This isusually associated with some form of assessmentwhich could be the description of each risk and its

impacts or a subjective labelling of each risk (e.g.

8/6/2019 Mini Pram

4/11


high/low) in terms of both its impact and itsprobability of occurrence.

A sound aim is to identify the key risks,perhaps between five and ten, for each project (orpart-project on large projects) which are then

analysed and managed in more detail.Quantitative Analysis

A Quantitative Analysis often involves moresophisticated techniques, usually requiringcomputer software. To some people this is themost formal aspect of the whole processrequiring:

measurement of uncertainty in cost andtime estimates

probabilistic combination of individualuncertainties.

Such techniques can be applied with varyinglevels of effort ranging from modest toextensively thorough. It is recommended thatnew users start slowly, perhaps even ignoringthis 'sub-stage', until a climate of acceptability hasbeen developed for Project Risk Analysis andManagement in the organisation.

An initial qualitative analysis is essential. Itbrings considerable benefit in terms ofunderstanding the project and its problemsirrespective of whether or not a quantitative

analysis is carried out. It may also serve tohighlight possibilities for risk 'closure' i.e. thedevelopment of a specific plan to deal with aspecific risk issue.

Experience has shown that qualitativeanalysis - Identifying and Assessing Risks -usually leads to an initial, if simple, level ofquantitative analysis. If, for any reason - such astime or resource pressure or cost constraints -both a qualitative and quantitative analysis areimpossible, it is the qualitative analysis that

should remain.It should be noted that procedures for

decision making will need to be modified if riskanalysis is adopted. An example which illustratesthis point is the sanction decision for clients,where estimates of cost and time will beproduced in the form of ranges and associatedprobabilities rather than single value figures.

Risk M anagement

This stage of the process involves theformulation of management responses to the

main risks. Risk Management may start duringthe qualitative analysis phase as the need to

respond to risks may be urgent and the solutionfairly obvious. Iteration between the RiskAnalysis and Risk Management stages is likely.

Risk Management can involve:

identifying preventive measures to avoid a

risk or to reduce its effect establishing contingency plans to deal with

risks if they should occur

initiating further investigations to reduceuncertainty through better information

considering risk transfer to insurers

considering risk allocation in contracts

setting contingencies in cost estimates, floatin programmes and tolerances or 'space' inperformance specifications.

Section 6 of this Guide considers some of the

techniques of Project Risk Analysis andManagement in more detail.

4. Why Is It Used?

There are many reasons for using ProjectRisk Analysis and Management, but the mainreason is that it can provide significant benefitsfar in excess of the cost of performing it.

Benefits

The benefits gained from using Project RiskAnalysis and Management techniques serve not

only the project but also other parties such as theorganisation and its customers. Some examples ofthe main benefits are:

an increased understanding of the project,which in turn leads to the formulation ofmore realistic plans, in terms of both costestimates and timescales

an increased understanding of the risks in aproject and their possible impact, whichcan lead to the minimisation of risks for aparty and/or the allocation of risks to the

party best able to handle them an understanding of how risks in a project

can lead to the use of a more suitable typeof contract

an independent view of the project riskswhich can help to justify decisions andenable more efficient and effectivemanagement of the risks

a knowledge of the risks in a project whichallows assessment of contingencies thatactually reflect the risks and which alsotends to discourage the acceptance of

financially unsound projects

8/6/2019 Mini Pram

5/11


a contribution to the build-up of statisticalinformation of historical risks that willassist in better modelling of future projects

facilitation of greater, but more rational,risk taking, thus increasing the benefits thatcan be gained from risk taking

assistance in the distinction between goodluck and good management and bad luckand bad management.

W ho benefits from its use?

an organisation and its senior managementfor whom a knowledge of the risksattached to proposed projects is importantwhen considering the sanction of capitalexpenditure and capital budgets

clients, both internal and external, as theyare more likely to get what they want,

when they want it and for a cost they canafford

project managers who want to improve thequality of their work i.e. they want to bringtheir projects in to cost, on time and to therequired performance.

W hat are the costs of using it?

The costs of using Project Risk Analysis andManagement techniques vary according to thescope of the work and the commitment to theprocess. Below are some example costs, time-

scales and resource requirements for carrying outthe process.

Cost

The cost of using the process can be as littleas the cost of one or two days of a person's timeup to a maximum of 5-10% of the managementcosts of the project, even this higher cost, as apercentage of the total project cost, is relativelysmall. It can be argued that the cost incurred is aninvestment if risks are identified during theprocess that may otherwise have remained

unidentified until it was too late to react.

Time

The time taken to carry out a risk analysis ispartially dependent upon the availability ofinformation. A detailed cost and time riskanalysis usually requires anywhere from one tothree months depending upon the scale andcomplexity of the project and the extent ofplanning and cost preparation already carriedout. However, as indicated above, a usefulanalysis can take as little as one or two days.

Resources

The minimum resource requirement isobviously just one person within a organisationwith experience of using Project Risk Analysisand Management techniques. However, if

expertise does not exist within the organisation itcan be readily acquired from outside consultants.It is likely that once Project Risk Analysis andManagement has been introduced to anorganisation, in-house expertise will developrapidly.

As stated in Section 3, Project Risk Analysisand Management is relevant to all projects and isan integral part of project management. This canmake it very difficult to separate the costs ofperforming it. Some organisations treat thesecosts as an overhead to the organisation, and notto the project.

5. When Should It Be Used and WhoShould Do It?

Project Risk Analysis and Management is acontinuous process that can be started at almostany stage in the life-cycle of a project and can becontinued until the costs of using it are greaterthan the potential benefits to be gained. As timeprogresses, the effectiveness of using Project RiskAnalysis and Management tends to diminish,

therefore it is most beneficial to use it in theearlier stages of project.

There are five points in a project whereparticular benefits can be achieved by using it.

Feasibility Study - At this stage the project ismost flexible enabling changes to be madewhich can reduce the risks at a relativelylow cost. It can also help in decidingbetween various implementation optionsfor the project.

Sanction - The client can make use of it to

view the risk exposure associated with theproject and can check that all possible stepsto reduce or manage the risks have beentaken. If a quantitative analysis has beencarried out then the client will be able tounderstand the 'chance' that he has ofachieving the project objectives (cost, timeand performance).

Tendering - The contractor can make use ofit to ensure that all risks have beenidentified and to help him set his riskcontingency or check his risk exposure.

8/6/2019 Mini Pram

6/11


Post Tender - The client can make use of it toensure that all risks have been identified bythe contractor and to assess the likelihoodof tendered programmes being achieved.

At Intervals During Implementation - It canhelp to improve the likelihood ofcompleting the project to cost and time-scale if all risks are identified and arecorrectly managed as they occur.

W hich projects are suit able?

Many experienced users of Project RiskAnalysis and Management would say 'any andall' in answer to this question, and experiencedoes show that this is the case - the reasons werestated earlier in the Guide. All projects containrisk and risk analysis and management is anintegral part of project or business management.

Attend any conference or read any literatureon risk and it is clear that the most extensiveapplications have occurred on large capitalprojects such as defence, oil and gas, aerospaceand civil engineering - these projects have beenthe proving ground for many of the techniques.However the process has been applied to smallerconstruction projects such as a water supplyrehabilitation project in West Africa and theproposed construction of a gas pipeline acrossHampstead Heath in London.

In other fields there are examples of riskanalysis and management applied to insurance,IT projects and software development andprojects for organisational change.

The only general guidance is that the morethe risks or more innovative the project thegreater will be the benefits. On small projects, thebudget will probably justify only a low level ofapplication, perhaps omitting the quantitativeanalysis.

W hat t ype of project?

It can be used on any type of project, but it ismore beneficial for some projects than others.Some examples of projects which would benefitfrom Project Risk Analysis and Management are:

innovative, new technology projects

projects requiring large capital outlay orinvestment

fast-track projects

projects which interrupt crucial revenuestreams

unusual agreements (legal, insurance orcontractual)

projects with sensitive issues(environment/ relocation)

projects with stringent requirements(regulatory/safety)

projects with important

political/economic/ financial parameters.W hen should it be done?

There are a few circumstances when it isparticularly advisable to use Project Risk Analysisand Management techniques, these are:

when there are specific targets that must bemet

when there is an unexpected newdevelopment in a project

at points of change in the life-cycle of aproject.

W hen shouldn't it be done?

There are no particular circumstances underwhich Project Risk Analysis and Managementtechniques should not be used except perhaps forrepeat projects, where such analyses have alreadybeen carried out, unless, of course, there arespecific differences between the projects.

In the presence of uncertainty, where severeconstraints give rise to significant risk, theabsence of relevant data may make a quantitativeassessment not worthwhile. However, such

circumstances must never prevent a rigorousqualitative analysis being carried out.

W ho should do it?

Many people advocate the use of anindependent expert or external consultant toensure that they receive an unbiased view,whereas others suggest that Project Risk Analysisand Management support should be an internalfunction. Opinions differ widely at this stage butessentially anyone can do it providedconsideration is given to the 'angle' from which

they are viewing the project. In any event, theproject management team should be closelyinvolved in the analytical process to ensurevalidity of the analysis and also to allow them tobelieve in the results.

6. How To Do It - Techniques AndMethods

As outlined in Section 3, Project RiskAnalysis and Management can be split into itstwo constituents or stages - Risk Analysis(Qualitative and Quantitative) and Risk

Management. There is no one technique ormethod for carrying out either stage of the

8/6/2019 Mini Pram

7/11


process. Some of the techniques and methods thatcan be employed are detailed below.

Qualitativ e Risk Analysis

The first phase of the qualitative analysis isidentification. This is considered by some as the

most important element of the process since oncea risk has been identified it is possible to dosomething about it. Identification can be achievedby:

interviewing key members of the projectteam

organising brainstorming meetings with allinterested parties

by using the personal experience of the riskanalyst

reviewing past corporate experience if

appraisal records are kept.All of the above methods are greatly

enhanced by the use of check lists which caneither be generic in nature i.e. applicable to anyproject or specific to the type of project beinganalysed.

Once identified, the risks are then subjectedto an initial assessment that categorises the risksinto high/low probability of occurrence andmajor/ minor impact on the project should therisk materialise. It is often advisable to prepare

initial responses to each identified risk, especiallyif risks are identified that require urgentattention. The analysis may be terminated duringthis phase if the assessment immediately suggestsa way in which many identified risks can bemitigated.

It may be necessary to revisit theidentification phase after the assessment phase tosee if any consequential 'secondary' risks can beidentified: a secondary risk may result from a

proposed response to an initial risk and mighttherefore lead to the response being unsuccessful.The necessity of doing this will largely bedependent on the size and/or complexity of theproject.

Quantitative Risk AnalysisOnce all risks have been identified, during

the qualitative analysis, it may be appropriate toenter into a detailed quantitative analysis. Thiswill enable the impacts of the risks to bequantified against the three basic project successcriteria: cost, time and performance. Severaltechniques have been developed for analysing theeffect of risks on the final cost and time-scale ofprojects. However, such techniques do not alwaysreadily apply themselves to the analysis ofperformance objectives.

The main techniques currently in use are:

Sensitivity Analysis, often considered tobe the simplest form of risk analysis.Essentially, it simply determines the effecton the whole project of changing one of itsrisk variables such as delays in design orthe cost of materials. Its importance is thatit often highlights how the effect of a singlechange in one risk variable can produce amarked difference in the project outcome.

In practice, a sensitivity analysis will be

performed for more than one risk, perhaps allidentified risks, in order to establish those whichhave a potentially high impact on the cost ortime-scale of the project. The technique can alsobe used to address the impact of risk on theeconomic return of a project. Figure 1 shows anexample of a sensitivity diagram.

8/6/2019 Mini Pram

8/11


Sensitivity Diagram for a manu facturing P lant

-100

-50

0

50

100

150

-40% -20% 0% 20% 40%

% Change in Variables

%C

hangeinIRR

Dem a nd for prod uct Co s t o f Ra w Ma teria ls

Revenu e from Product Ene rg y Cos ts

Figure 1 Sensitivity Diagram for a New Manufacturing Plant

This diagram shows that the project is verysensitive, as measured against the internal rate ofreturn, to any changes in both the demand for theproduct and the revenue from the product, however,changes in energy costs or the cost of raw materialhave much less impact.

Probabil istic Analysis specifies aprobability distribution for each risk andthen considers the effect of risks incombination. This is perhaps the mostcommon method of performing aquantitative risk analysis and is the onemost people consider, incorrectly, to besynonymous with the whole Project RiskAnalysis and Management process. In fact,as this Guide illustrates, it is but one facetof that process.

The most common form of probabilisticanalysis uses 'sampling techniques', usuallyreferred to as 'Monte Carlo Simulation'. Thismethod relies on the random calculation of valuesthat fall within a specified probability distribution

often described by using three estimates:minimum or optimistic, mean or most likely andmaximum or pessimistic. The overall outcome forthe project is derived by the combination ofvalues selected for each one of the risks. Thecalculation is repeated a number of times,perhaps between 100 and 1000, to obtain theprobability distribution of the project outcome.

It is usual to carry out a probabilistic timeanalysis with the aid of a CPM network to modelthe project schedule. The same method can beused for probabilistic cost analysis especiallywhen the cost estimate can be broken down intothe same categories or activities as the scheduleand when cost risks are related to time risks. If anindependent cost analysis is undertaken then

It may be appropriate to use a spreadsheetmethod. Figure 2 shows an example of ahistogram and cumulative curve derived from aprobabilistic time analysis using a model basedon a CPM network.

8/6/2019 Mini Pram

9/11


0

1

2

3

4

5

6

31 Mar 90 30 Apr 90 30 May 90 29 Jun 90 29 Jul 90 28 Aug 90

Period Ending

%Frequency

0

20

40

60

80

100

120

Based on 1000 trials

Mean = 29 Jun 90Standard deviation = 25 days

Each bar represents 3 days

%Cumulative

An Oilfield Development

Early Finish Histogram for Activity G44 (First Oil)

Figure 2 Time Probability Histogram and S-curve for a New Oil Field Development

This diagram shows the distribution of finishdates for the achievement of first oil. It is based on1000 iterations using Monte Carlo Sampling. Theactual finish date of this particular project wasachieved within 2 days of the mean.

Another technique is the Controlled Intervaland Memory Method for combining probabilitydistributions which provides an alternative toMonte Carlo Simulation. This technique can offergreater precision for much less computerisedeffort if either complex CPM networks or'feedback loops' are not involved.

Million

A New Office BuildingProject Cost

0%

20%

40%

60%

80%

100%

120%

Pro

ba

bilityo

fComp

letingw

ithina

Cos

t

85% - upper limit 22.1m

15% - lower limit 13.1m 70%

ConfidenceInterval

Accuracy Range

+ve -ve

54% - expected cost 17.4m

41% - unadjusted cost 16.1m

Unallocated Provision

Figure 3 Cost Probability S-curve for a New Office Building

This diagram shows the distribution around acost estimate for the final, out-turn cost for a newbuilding. It is based on 1000 iterations using MonteCarlo Sampling. The highlighted figures represent theunadjusted cost i.e. the sum of all the cost elementswithout any risk treatment, the expected cost derivedfrom the statistical mean and a suggested accuracyrange. The difference between the unadjusted cost and

the expected cost is considered to be an unallocatedprovision.

8/6/2019 Mini Pram

10/11


Influence Diagrams are a relatively newtechnique for risk analysis. They provide apowerful means of constructing models ofthe issues in a project which are subject torisk. As a result influence diagrams arenow used as the user interface to acomputer based risk modelling tool thusallowing the development of very complexrisk models that can be used to analyse thecost, time and economic parameters ofprojects.

Decision Trees are another graphicalmethod of structuring models. They bringtogether the information needed to makeproject decisions and show the presentpossible courses of action and all futurepossible outcomes. Each outcome must be

given a probability value indicating itslikelihood of occurrence. This form of riskanalysis is often used in the cost riskanalysis of projects.

Risk M anagement

Risk management uses the informationcollected during the risk analysis phase to makedecisions on how to improve the probability ofthe project achieving its cost, time andperformance objectives. This is done by reducingthe risk where advantageous to do so andmonitoring and managing the risk which

remains.

The project manager uses the informationat his disposal to choose between the feasibleresponses to each risk identified during thequalitative phase. This may involve amending theproject plans to reduce the risk e.g. moving highrisk activities off the critical path, developingcontingency plans to allow rapid response ifcertain risks occur or setting up monitoringprocedures for critical areas in order to get earlywarning of risks occurring.

There are two types of response to a riskimmediate and contingency which can be definedas follows:

immediate response: an alteration to theproject plan such that the identified risk ismitigated or eliminated

contingency response: a provision in theproject plan for a course of action that willonly be implemented should the adverseconsequences of the identified riskmaterialise.

Responses to risks can do one or acombination of five things:

remove - risks that can be eliminated fromthe project and therefore no longer proposea threat

reduce - risks that can be decreased bytaking certain actions immediately

avoid - risks that can be mitigated by takingcontingency actions should they occur

transfer - risks can be passed on to otherparties, unfortunately this does notnormally eliminate the risk it just makessomeone else worry about it

acceptance - the benefits that can be gainedfrom taking the risk should be balancedagainst the penalties.

The risk management phase beginsimmediately the qualitative analysis is completeand is then a continuing process through thecomplete life-cycle of the project. The informationgained during the quantitative analysis allows theproject manager to trade off taking actions nowagainst the likelihood and impact of riskoccurring. The project manager may choose toimmediately amend his overall time and cost planin order to increase the probability of achievinghis time and cost objectives.

7. What Experience Is Available?

The majority of the methods, techniques and

processes described in this Guide have been usedin a number of industries since the early 1970s.Project Risk Analysis and Management hashistorically been associated with very large, highcapital projects in specific industries such asdefence, oil and gas, aerospace and civilengineering. The experience gained in theseindustries since the 70s has now begun todisseminate through other industries such asinformation technology and manufacturing.

The number of companies practisingProject Risk Analysis and Management is

continuing to increase due to the realisation thatthe methods, techniques and processes involvedform an integral part of project and businessmanagement. The increase in its use has led notonly to expertise being gained by individualswithin companies but the arrival of specialistconsultancies that can train, advise and carry outProject Risk Analysis and Management for theirclients. Project Risk Analysis and Managementhas also established itself as an important elementin the syllabuses of many universities and highereducational establishments.

8/6/2019 Mini Pram

11/11


!

Further information regarding computersoftware available to assist in performingquantitative risk analysis and references tofurther information, papers and publications can

be obtained from:

The SecretaryThe Association of Project Managers

85 Oxford Road, High WycombeBuckinghamshire HP11 2DX

mini pram

Documents