project risk management- pmp.pptdbmanagement.info/books/mix/project_risk_management.pdfthe severity...

��

SECTION 3 - CHAPTER 11

© 2009 - Ashraf Makram, PMP®

��

� The purpose of risk management is to make decisions, not to sit round and admire the risks.

� Risk Management helps people to:� avoid disasters


� avoid disasters� avoid rework � encourage win-win situations.

� Risk Management reduces a project’s risk exposure,Prevents problems before they occur, enables better use of resources, and promotes teamwork.

�

RISK DEFINITION� Includes the processes concerned with conducting risk management

planning, identification, analysis, response, monitoring and control on a project, most of these processes are updated throughout the project.

� Risk = An uncertain event or condition that, if it occurs, has a Positive or Negative effect on at least one of the project objectives.


objectives.� The severity of any risk can be defined in terms of two parameters:

• �� ): The extent to which the risk effects are likely to occur�

• �� The effect that a risk will have on the project if it occurs.

�

PROJECT RISK MANAGEMENT

� Is the systematic process of Identifying, Analyzing, and Responding to project risks.

� Should be performed for every project.

� Maximizing the probability and consequences of


� Maximizing the probability and consequences of positive events (Opportunities) to Project Objectives

&� Minimizing the probability and consequences of

negative events (Threats) to Project Objectives

�

��

��

��

��

��

��

��

��

��

��

��

��

��!��"��

�� #��$��!��

"� ��#��

�%�&�$� ��

�%��'��(��

�%��%��()��*��+�,��)��$%��

&


��(��

�%��!��"��*��+�,��)��-. ��

*��+�,��)��$%��

��/�!��)��$��+�

��$��+�!��"��

��()��$��+�

�� $��+��

�� $��+��

��&��$��+�$��

$$��#��&��

��

��)��

��)��

��$'��

11.1. PLAN RISK MANAGEMENT

� The process of deciding how to approach and conduct the riskmanagement activities for a project

� To be successful the organization should be committed to addressingthe management of risk proactively and consistently throughout theproject.


� Every stakeholder should participate in Risk identification.

� Risk management should be completed early during project planningsince it is crucial to successfully performing the other risk managementprocesses.

/

Inputs

1. Project scope statement

2. Cost management plan

3. Schedule management plan

Inputs

1. Project scope statement



Tools & Techniques1. Planning meetings &

analysis

Tools & Techniques1. Planning meetings &

analysis


© 2009 - Ashraf Makram, PMP®0


4. Communication management plan

5. Enterprise environmental factors

6. Organizations process assets


4. Communication management plan

5. Enterprise environmental factors

6. Organizations process assetsOutputs

1. Risk Management

Plan

Outputs1. Risk Management

Plan


� Describes how to conduct risk management for a project.

� Should start early during project planning.

� Careful and explicit planning enhances the opportunity of success for the other five risk management processes.


the other five risk management processes.

� Risk is always in the future, it must be planned.

� It is important to provide sufficient resources and time for risk management activities.

�

11.1. PLAN RISK MANAGEMENT: INPUTS

� Enterprise Environmental Factors:• Risk attitudes.• Risk tolerances of the organization.• Company policies.


� Organizational Process Assets:� Organizations may have pre-defined approaches to risk Management.� Standard templates, forms, terms and conditions.� Authority levels for decision making.� Roles and responsibilities.

�

11.1. PLAN RISK MANAGEMENT: OUTPUTS RISK MANAGEMENT PLAN

� Methodology� Approaches, tools (software, ….) , and data sources that might be used

to perform risk management� Roles & Responsibilities

� Lead and support roles for each type of action in the response plan� Budgeting:

� Assign resources, estimate funds needed for Risk Management to beincluded in the project budget (cost baseline).


� Assign resources, estimate funds needed for Risk Management to beincluded in the project budget (cost baseline).

� Timing� How often risk management process will be performed (depends on the

size and complexity of the project).� Definitions of risk probability & impact

� Risk Categories.� Categorization of risk by source, internal, external.

� Organization may use Risk Breakdown Structure (RBS) and categoriesfrom past projects which may need adjustment.

�%

11.2. IDENTIFY RISKS

� Involves determining which risk events might affect the

project and documenting their characteristics.

� Everyone should be involved in risk identification.

Stakeholders outside the project team may provide


� Stakeholders outside the project team may provide

additional objective information.

� An iterative process as new risks may become known as the

project progresses through it’s lifecycle.

��

RISK SOURCES

� ��

� ��

� !��

� �� "��

� #��#��#��#��

� �� $��%��$�� &��

� �� &��'��


� �� &��'��

� ��%��

� (��&��(��&��(��&��(��&��

� '��))��

� ��)��&��

� '��

� ��

� '��)��$��%��

� *��)��

��

RISK SOURCES (ANOTHER VIEW)

INTERNAL� Financial� R & D� Production� Human Resources

EXTERNAL� Economical� Competition� Social/Cultural


� Human Resources� Administrative� Strategic Preference

� Regulatory� Political� Environmental

��

11.2. IDENTIFY RISKS

Inputs

• Risk Management Plan

• Activity cost estimates

• Activity duration estimates

• Scope baseline

Inputs

• Risk Management Plan

• Activity cost estimates

• Activity duration estimates

• Scope baseline

Tools & Techniques

• Documentation reviews

• Information-gathering

techniques

• Checklists analysis

Tools & Techniques

• Documentation reviews

• Information-gathering

techniques


© 2009 - Ashraf Makram, PMP®��

• Scope baseline

• Stakeholder register

• Cost management plan

• Schedule management plan

• Quality management plan

• Project documents

• Enterprise environmental factors

• Organizations process assets

• Scope baseline

• Stakeholder register

• Cost management plan

• Schedule management plan

• Quality management plan

• Project documents

• Enterprise environmental factors

• Organizations process assets


• Assumptions analysis

• Diagramming techniques

• SWOT analysis

• Expert judgment


• Assumptions analysis

• Diagramming techniques

• SWOT analysis

• Expert judgment

Outputs• Risks register

Outputs• Risks register

11.2. IDENTIFY RISKS��INPUTS

� Risk management plan.� Activity cost estimates.

� Provide a quantitative assessment of the likely cost to complete scheduled activities.

� Activity cost estimates reviews may indicate the estimate is either


Activity cost estimates reviews may indicate the estimate is either sufficient or insufficient and hence pose a risk to the project.

� Activity duration estimates.� Scope baseline.� Stakeholder register� Quality management plan

� The project-specific approach to quality management may generate risks in the project.

�&

11.2. IDENTIFY RISKS��TOOLS AND TECHNIQUES

� Documentation reviews:� A structured reviews of project documentation may be required

including plans , assumptions, prior files and any other information.

� The quality of the plans, and documentation, as well as


� The quality of the plans, and documentation, as well as consistency with the requirements can be an indicator for risk in the project “customer name, titles,..”.

� Review of RFP’s for the project prior to proposal submission.

�/

11.2. IDENTIFY RISKS��TOOLS AND TECHNIQUES�

� �� Brain Storming sessions

� Obtaining a Comprehensive list of project risks� Project team and stakeholders� The most frequently method used


� Root cause identification� Inquiry into the essential causes of project risks

� Interviewing with:� Project managers in and out of the organization� Experienced professionals, subject matter experts “SME”

� Delphi technique� Collect and manipulate inputs from experts located in

different places, anonymously, helps reduce bias.�0


� Checklists analysis� Can be developed based on historical information.� Care should be taken to explore items not in the

checklist.� Actual risks should be more specific and clear


� Assumptions analysis� Every project is conceived, developed based on a set

of Hypotheses, Scenarios and Assumptions.� What assumptions have been made and if they are still

valid.� It identifies risks to the project due to inaccuracy,

inconsistency, and in completeness.

��


� Diagramming technique� Cause and effect diagram

Fishbone diagram, Ishikawa diagram

� System or process flow charts.These show how various elements of a system interrelate,


These show how various elements of a system interrelate,

� Influences diagramsGraphical representations of situations showing casual influences, time ordering of events, and other relationships among variables and outcomes.

��

11.2. IDENTIFY RISKS��TOOLS AND TECHNIQUES:

� ��

� SWOT Analysis

Examination of project from each of the SWOT perspectives.

© 2009 - Ashraf Makram, PMP®�%

1��+��213*��"�,��2*3External factors

2143�� 2*43�5�6�,4 ��243

21�3�!��"��2*�3��'��,��2�3

Internal Factors

11.2. IDENTIFY RISKS��OUTPUTS

� Risk register• List of identified risk• List of potential responses• Updated risk categories (for future projects)


• Updated risk categories (for future projects)

��

11.3 PERFORM QUALITATIVE RISK ANALYSIS

� Method for prioritizing the identified risks for

further analysis by assessing and combining

their probability of occurrence and impact.

� The organization can improve project’s


� The organization can improve project’s

performance effectively by focusing on high

priority risks.

� Should be revised during the project life cycle.

��

11.3 PERFORM QUALITATIVE RISK ANALYSIS

Inputs1. Risk register

2. Risk Management Plan

3. Project scope

statement



3. Project scope

statement

Tools & Techniques1. Risk probability & impact

assessment

2. Probability & impact matrix

Tools & Techniques1. Risk probability & impact

assessment

2. Probability & impact matrix


statement

4. Organizations process

assets

statement

4. Organizations process

assets

3. Risk data quality assessment

4. Risk categorization

5. Risk urgency assessment

6. Expert judgment

3. Risk data quality assessment

4. Risk categorization

5. Risk urgency assessment

6. Expert judgmentOutputs

1. Risk register updatesOutputs

1. Risk register updates

PERFORM QUALITATIVE RISK ANALYSIS: TOOLS AND TECHNIQUES PROBABILITY & IMPACT ASSESSMENT

$��+�-�� '�'�� (� ��

*��)�� ! #

*� ��)��

7 !


��

��)��,��)��8��)��

7 #

1�+�,� �)�6��"��

7 !

��

PROBABILITY & IMPACT MATRIX

��

#

© 2009 - Ashraf Makram, PMP®�&

��

7

7

!

! #

11.3 PERFORM QUALITATIVE RISK ANALYSIS: TOOLS AND TECHNIQUES

� Risk data quality assessment:� Qualitative risk analysis requires accurate and unbiased data.

� Analysis involves examining the degree to which the risk is understood, and the accuracy, quality, reliability, and integrity of the


data about risk.

� The use of low-quality risk data does not benefit the project.

� Collection of information about risk is difficult and usually requires more time than planned.

�/

PLOTTING RISK EVENTS ON THE MATRIX

��

#

© 2009 - Ashraf Makram, PMP®�0

��

7

7

!

! #

11.3 PERFORM QUALITATIVE RISK ANALYSIS : OUTPUTS

� Risk register (updates)� Relative ranking or priority list of project risks.

� Risks grouped by categories.


� List of risks requiring response in the near-term.

� List of risks for additional analysis and response.

� Watch lists of low priority risks (residual risks).

� Trends in qualitative risk analysis results.

��

11.4. PERFORM QUANTITATIVE RISK ANALYSIS

� Is performed on the risks that have been prioritizedby the Qualitative Risk Analysis process.

� Present a quantitative approach to make decisions inthe presence of uncertainty.

� Analyzes the effect of those risk events and assignsa numerical rating to those risks.


a numerical rating to those risks.

��

11.4 PERFORM QUANTITIVE RISK ANALYSIS







Tools & Techniques

1. Data gathering and

representation

Tools & Techniques

1. Data gathering and

representation

Outputs1. Risk register

updates


updates


4. Schedule management

plan

5. Organizational process

assets

4. Schedule management

plan


assets

representation

techniques

2. Quantitative risk

analysis and

modeling techniques

3. Expert Judgment

representation

techniques

2. Quantitative risk

analysis and

modeling techniques

3. Expert Judgment

11.4 PERFORM QUANTITIVE RISK ANALYSIS

� The perform quantitative risk analysis process usestechnique such as decision tree analysis to:� Quantify the possible outcomes for the project and their

probabilities.� Identify realistic and achievable cost, schedule or scope

targets, given the project risks.


targets, given the project risks.� Identify risks requiring the most attention by quantifying

their relative contribution to overall project risk.� Determine the best project management decision when

some conditions are uncertain.

��

11.4 PERFORM QUANTITIVE RISK ANALYSIS TOOLS AND TECHNIQUES�

� Data gathering and representation techniques• Interviewing

• Interviewing relevant stakeholders helps determine the three point estimates for each WBS element

WBS Element Low Most Likely High


• Probability distributions

• Expert judgment

��

Design L.E 4M L.E.6M L.E.10M

Build L.E.16M L.E.20M L.E.35M

Test L.E.11M L.E.15M L.E.23M

Total Project L.E.31M L.E.41M L.E.68M

11.4 PERFORM QUANTITIVE RISK ANALYSIS TOOLS AND TECHNIQUES

� Quantitative risk analysis and modeling techniques� Sensitivity analysis� Expected Monetary Value analysis� Decision tree analysis



1. Sensitivity Analysis

� Helps to determine which risks have the most potential

impact on the project.

� Involve making all risk variables at their baseline and study


Involve making all risk variables at their baseline and study

impact on the project objectives when only one variable is

changed.

��


+�Expected Monetary Value (EMV)

• Expected Monetary Value “EMV” analysis is a statistical concept that calculates the average outcome when the future includes scenarios that may or may not happen (analysis under uncertainty).

• The EMV of opportunities will be represented in positive values, while those of risks will be negative.

© 2009 - Ashraf Makram, PMP®�&

those of risks will be negative.• Requires risk neutral assumption.• EMV is calculated by multiplying the value of each possible outcome by

it’s probability of occurrence and adding the products together.• A common use of this analysis is the decision tree analysis.


,�*��-��

Build New Plant

Strong

� ��

��

��

��

© 2009 - Ashraf Makram, PMP®�/

Build or Upgrade?

Upgrade Existing

Plant

Weak

Strong

Weak

� �

��

�

��

��

��

��


*��-��

Build New Plant

Strong

Product Demand EGP36M

� ��

��

��

��

��

��

© 2009 - Ashraf Makram, PMP®�0

Build or Upgrade?

Upgrade Existing

Plant

Weak

Strong

Weak

Decision EGP46M

Product Demand EGP46M� �

��

� �

��

�

��

��

��

��

��

��

��

��

11.4 PERFORM QUANTITIVE RISK ANALYSIS OUTPUTS

� Risk register updates� Probabilistic analysis of the project.� Probability of achieving cost and time objectives.� Prioritized list of quantified risks.


� Trends in quantitative risk analysis results.

��

11.5 PLAN RISK RESPONSES

� The process of developing options and determining actions to enhance opportunities and reduce threats to the projects objectives.� Risk response plan must be:

• Appropriate to the significance of the risk

Cost effective in meeting the challenge


• Cost effective in meeting the challenge

• Timely to be successful

• Realistic within the project context

• Agreed upon by all parties involved

• Owned by a responsive person

��

11.5 PLAN RISK RESPONSES


2. Risk

management


2. Risk

management

Tools & Techniques1. Strategies for negative risk

or threats

2. Strategies for positive risk

or opportunities

3. Strategies for both threats

Tools & Techniques1. Strategies for negative risk

or threats

2. Strategies for positive risk

or opportunities



updates

2. Risk-related

Contractual


updates

2. Risk-related

Contractual


planplan 3. Strategies for both threats

and opportunities

4. Expert judgment


and opportunities

4. Expert judgment

Contractual

decisions

3. Project

management plan

updates

4. Project document

updates

Contractual

decisions

3. Project

management plan

updates

4. Project document

updates

11.5 PLAN RISK RESPONSES TOOLS AND TECHNIQUES

� Strategies for Negative risks (Threats) • Avoidance• Mitigation• Transfer


• Acceptance (valid for threats and opportunities) • Can we select only one response plan??• Is there a RISK-FREE project??

��


� -%��-%��-%��-%��

• Risk prevention • Changing the plan to eliminate a risk by avoiding the

cause/source of riskProtect project from impact of risk


• Protect project from impact of risk• Examples:

• Do it ourselves (do not subcontract)• Reduce scope to avoid high risk deliverables• Adopt a familiar technology or product

��


� .��&��.��&��.��&��.��&��

� Seeks to reduce the impact or probability of the risk event to an acceptable threshold

� Take early action to reduce probability and / or impact of risks and don’t be reactive.


risks and don’t be reactive.� Examples:

� Staging - More testing - Prototype� Redundancy planning� Use more qualified resources

��


� ��)��)��)��)��

� Shift responsibility of risk consequence to a third party� Does not eliminate risk.� Most effective in dealing with financial exposure


� Examples: � Buy/subcontract: move liabilities � Selecting type of Procurement contracts: Fixed Price Contract� Insurance, bonds, Warranties

��


� Acceptance• Used when it is not possible to change project plan or

unable to use other risk response strategy• Active Acceptance

• Develop a contingency plan to execute if the risk occur • Contingency plan = be ready with “Plan B”

Passive Acceptance


• Passive Acceptance• Deal with the risks as they occur = No Plan B prepared

� Contingency allowance/ reserve• Established amount of reserve (e.g.: time and/or money) to

account for the identified known risks that couldn't be avoided, mitigated or transferred

• Amount is decided based on probability and impact

�&

11.5 PLAN RISK RESPONSES OUTPUTS

� Risk register updates including:• Identified Risk, their description• Risk owners and assigned responsibilities• Results from qualitative and quantitative risk

analysis processes


• Agreed response• Specific action to implement the chosen response

strategy• Residual and secondary risk• Budget and time of responses• Contingency plan and triggers

�/

• Risk response plan• List of critical risks and the plan towards them• Budget required to mitigate/transfer/avoid risks• Contingency plans and the needed contingency reserve

• List of residual risks


• List of residual risks• Those neglected risks will be reviewed throughout the

project execution (in case impact/probability increases)

• Secondary risks• Those new risks that arise from implementing a risk

response. • They should be monitored and included in the risk

response plan

�0

11.6 MONITOR AND CONTROL RISKS

� Is the process of implementing risk response plans.� Tracking of the previously identified risks and those on the

watch list.� Reanalyzing existing risks, monitoring risk triggers.� Reviewing the execution of risk response and evaluating


� Reviewing the execution of risk response and evaluating their effectiveness.

� Checking if project assumptions are still valid.� If proper risk management procedures are followed.� Contingency reserves of cost or schedule should be

modified in alignment with the current risk assessment

��

11.6 MONITOR AND CONTROL RISKS


2. Project

management plan


2. Project

management plan

Tools & Techniques1. Risk reassessment.

2. Risk Audits

3. Variance and trend analysis

4. Technical Performance

Tools & Techniques1. Risk reassessment.

2. Risk Audits

3. Variance and trend analysis


Outputs1. Risk register updates


assets updates.

3. Change requests

Outputs1. Risk register updates


assets updates.

3. Change requests


management plan

3. Work performance

information

4. Performance

reports

management plan

3. Work performance

information

4. Performance

reports


Measurements

5. Reserve analysis

6. Status meetings


Measurements

5. Reserve analysis

6. Status meetings

3. Change requests

4. Project management plan

updates.

5. Project document updates

3. Change requests

4. Project management plan

updates.

5. Project document updates

11.6. MONITOR & CONTROL RISKS INPUTS

� Risk register

� Work performance information:� Including project deliverable’s status, corrective actions,

performance reports.


� Performance reports:� Provide information on project work performance, such as an

analysis that may influence the risk management process.

&%

11.6 MONITOR & CONTROL RISKS TOOLS AND TECHNIQUES.

� Risk reassessment:• Requiring new information of new risks, and reassessing the previously

identified risks.• Risk reassessment should be scheduled regularly.

• Risk Audits:Examines and documents the effectiveness of risk responses in dealing with


• Examines and documents the effectiveness of risk responses in dealing with identified risks and their root causes

• Variance and trend analysis:• Trends in projects execution should be reviewed using performance

information data.• Earned value analysis and other trend analysis may be used for monitoring

overall project performance.

&�

RISK MONITORING & CONTROL TOOLS AND TECHNIQUES

� Reserve Analysis:� Comparing the amount of contingency reserve remaining

to the amount of risk remaining at any time in the project, in order to determine if the remaining reserve is adequate.

© 2009 - Ashraf Makram, PMP®&�

MONITOR & CONTROL RISKS OUTPUTS

� Risks register updates• Outcomes of risk reassessment, and periodic risk reviews.

• Includes identification of new risk events, updates to probability, impact, priority, response plans, ownership.


impact, priority, response plans, ownership.

• Closing risks that are no longer applicable and releasing their associated reserves.

• The completed records of risks on a project becomes a part of project closure documents, and to plan risks throughout future projects.

&�

��

� Risk events are unknown, if we identified them they become Known.

� Contingency Reserve� Known unknown – identified risks� Accounts for:

� Amounts dedicated for contingency plans identified in the risk management process


management process

� Management Reserve� Unknown unknown – un-identified risks� Accounts for items that we did not or could not identify in the risk

management process, and arise during project life cycle.

&�

project risk management- pmp.pptdbmanagement.info/books/mix/project_risk_management.pdfthe severity...

Documents