Risk Managem

ent Part 1 – Risk Identification,

Documentation and Classification

byDonald E. Shannon, PMP, CFCM, CPCM, DMLThe Contract Coach, Albuquerque, NM

DisclaimerInformation in this presentation makes reference to various software products. This should not be interpreted as a recommendation or endorsement by any of the sponsors of any one product. Individuals should conduct appropriate research to identify a product that best meets their specific needs. Where appropriate, credit has been given to the software OEM especially where screen shots of their products have been used. A listing of the products commonly used to accomplish the simulation and scheduling functions described herein is included at the end of this presentation

Series OverviewRoadmap to this series of four presentations

Welcome

This will be a 4-part series of presentations concerning risk management June 19 – 9am to 11am July 8 – 9am to 11am July 29 – 9am to noon August 12 – 9am to noon

While primarily focused on risk we will also touch on The Work Breakdown Structure Project Schedules Performance baselines Risk adjusted estimates of cost to complete and

cost at completion.

Where I’m Coming From

Managing projects/programs/contracts requires expertise in many areas

Typical approach is “stove piping” expertise into silos of knowledge Project Management – organizing, scheduling,

directing and monitoring performance Financial Management – accounting, project

control and cash flow Risk Management – identifying potential risks and

planning actions to avoid them or minimize the impact

Contract Management – compliance with laws and contract terms and conditions, reporting, and deliverable management

Where I’m Coming From

The silo approach permits the existence of multiple views of “reality”: where you stand depends on where you sit.

The preferred approach is via an integrated project team comprised of various specialists Each is expert in their own area (PM, Contracts,

Finance etc.) Each understands the overall process and how they fit

into the team Boundaries are blurred; barriers torn down. Improved communication, better decisions, and better

support for team decisions

Part 1:Risk Management Overview

Establishing a firm foundation ….

Types of Risk

• Risk is event related – no event, no consequences.

• Technical (Performance) Risk – the risk that the design or techniques selected will not work satisfactorily or cannot be sufficiently developed or employed to meet requirements.

• Cost Risk – The risk that the cost of successfully completing the project will exceed the budgeted (or allotted) cost.

• Schedule Risk – The risk that the time required to successfully complete the project will exceed the time allotted.

Interrelationship of Risk Factors

• Technical risk influences both project cost and project duration.

• Cost risk can influence technical risk e.g., a less desirable technology or material must be used to stay within budget

• Schedule risk is influenced by both cost and technical risks and can have significant impact on cost.

Managing Risk

Classic (Qualitative Assessment) approach from PMI Identify Document Characterize Prioritize Strategize Monitor & Control

Few travel beyond this point – but we will!

Project

Risks

Identify Risks

Team brainstorming session Focus on eliciting as

many risks as possible No attempt to judge or

narrow list at this point All ideas are good

Record on whiteboard or easel

Stop when no one else can contribute to list.

Filter Risks

Review brainstorming list and: Eliminate or combine

duplicates Revise or restate

questionable risks to make them more definite and actionable

Split complex risks into smaller, more manageable items

Obtain group consensus as to final form of risk

Start Risk Register

# Risk +/- Prob.

Impact

Score

1 Customer requirements may change

1a Customer asserts requirement change does not constitute a “change” and will not pay for “additional work”

1b Requirement change is covered by changes clause and results in a change order

2 Inability to obtain project financing

3 Loss of key staff during project

4 Bad weather closes office

5 Flu epidemic impacts workforce availability

6 Inability to manufacture critical optical assembly chassis to specifications

The Three Dimensions of Risk

Polarity Is risk a positive (opportunity) or a negative (determent) to the

program

Likelihood What is the probability that the risk event will actually occur? Can be stated adjectively (very low, low, medium, high, very likely)

(Qualitative Analysis) Can be stated as a number or probability (Quantitative Analysis)

Impacts If this event happens what will be the consequence

Schedule Delay Cost Injury or death Project failure

Ranked as very minor, minor, medium, serious, very serious (Qualitative Analysis)

Dollar cost and actual number of days/weeks delayed (Quantitative Analysis)

Perform Qualitative Risk AnalysisDefine Risk Polarity

# Risk +/- Prob.

Impact

Score

1 Customer requirements may change

1a Customer asserts requirement change does not constitute a “change” and will not pay for “additional work”

-

1b Requirement change is covered by changes clause and results in a change order

+

2 Inability to obtain project financing -

3 Loss of key staff during project -

4 Bad weather closes office -

5 Flu epidemic impacts workforce availability

-

6 Inability to manufacture critical optical assembly chassis to specifications

-

Perform Qualitative Risk Analysis

Assess each risk for Likelihood of occurring

Use 1 to 5 scale 1 = unlikely to

occur 5 = very likely to

occur Impact of occurrence

1 = low impact 5 = very serious

impact

Perform Qualitative Risk AnalysisRecord Probability and Impact Values

# Risk +/- Prob.

Impact

Score

1 Customer requirements may change

1a Customer asserts requirement change does not constitute a “change” and will not pay for “additional work”

- 4 4

1b Requirement change is covered by changes clause and results in a change order

+ 4 3

2 Inability to obtain project financing - 1 5

3 Loss of key staff during project - 2 4

4 Bad weather closes office - 3 3

5 Flu epidemic impacts workforce availability

- 3 3

6 Inability to manufacture critical optical assembly chassis to specifications

- 3 5

Perform Qualitative Risk AnalysisCalculate Score (Probability x Impact)

# Risk +/- Prob.

Impact

Score

1 Customer requirements may change

1a Customer asserts requirement change does not constitute a “change” and will not pay for “additional work”

- 4 x

4 = 16

1b Requirement change is covered by changes clause and results in a change order

+ 4 3 12

2 Inability to obtain project financing - 1 5 5

3 Loss of key staff during project - 2 4 8

4 Bad weather closes office - 3 3 9

5 Flu epidemic impacts workforce availability

- 3 3 9

6 Inability to manufacture critical optical assembly chassis to specifications

- 3 5 15

Perform Qualitative Risk Analysis

Calculate Risk Score Score = Probability x

Impact Record result in Risk

Register Plot results on Risk

Matrix (optional)

Perform Qualitative Risk AnalysisSort Scores High to Low

# Risk +/- Prob.

Impact

Score

1a Customer asserts requirement change does not constitute a “change” and will not pay for “additional work”

- 4 4 16

6 Inability to manufacture critical optical assembly chassis to specifications

- 3 5 15

1b Requirement change is covered by changes clause and results in a change order

+ 4 3 12

4 Bad weather closes office - 3 3 9

5 Flu epidemic impacts workforce availability

- 3 3 9

3 Loss of key staff during project - 2 4 8

2 Inability to obtain project financing - 1 5 5

Identify Risk Strategy

Strategy will depend on organization’s risk tolerance Many organizations are

‘risk adverse’ and will want to control every risk

Other organizations are less adverse and will only seek to control significant risks

Everything has a cost Most benefit for least

cost

Risk Strategies

AvoidanceAcceptanceTransferenceMitigationExploit

Avoidance

If activity has risk that cannot be Accepted Transferred Mitigated

Risky activity / process is not performed

Substitute another low risk activity in its place if possible

Acceptance

Low impact / low likelihood risks might be acceptable

Cost or effort involved in planning strategy exceeds likely downside

May still have response plan

Transference

Transfer activity or risk to another (third) party Subcontractor

May be experts at the risky activity

Delta between make and buy is cost of mitigation

Insurance policy or bonds Allow surety to

absorb risk Cost is bounded by

premium costs Currency contract

Similar to insurance except protects against exchange rate fluctuations

Mitigation

Identify Risk Analyze risks to

determine likely cause Evaluate process or

procedures to isolate causation factor(s) Insufficient training Lack of inspection Material Quality

Modify process to eliminate cause or reduce likelihood of event

Repeat as necessary

Mitigation Example 1

Risk: Installation team would not be able to meet stringent schedule requirements

Risk: Robot kit as delivered to site could be incomplete

Risk: Install team spare parts kit lacking critical items.

Strategy Simulate shipping and

installation of three systems Accomplish installation and

testing under field conditions Redeploy systems as

production items following test

Estimated cost $200,000 Results: All 100 systems

deployed and accepted per schedule

Robotic Containerization System

Produced by ABB Inc. - 100 Systems (Phase 1)- Contract value $66M + add-ons = $84M- Installed at 65 US Locations- Install, test and accept in 2 weeks

Mitigation Example 2

Risk: Facility infeed conveyor system not ready to connect in time for acceptance testing Site-specific hardware

provided by 3rd party under a separate contract

Multiple controls typologies necessitated custom integration

Strategy: Obtain portable infeed capable of supporting test. Ship to site as needed Remove following acceptance

and redeploy as needed Strategy: Develop and

promulgate 3rd party universal interface standard.

Exploit

Maximize an opportunity to your advantage

New business opportunity Add value to existing

contract Follow-on opportunity

Must analyze upside potential vs. additional risk Don’t put too much on

your plate May compromise

performance on existing project

Exploit Example

Risk: Facility infeed conveyor system not ready to connect in time for acceptance testing

Strategy: Offer temporary infeed as permanent solution Easily integrated into existing

facility conveyor without additional programming

Standardized Modular product Installation and integration

accomplished simultaneously with robot

Result: Up-sales to facility, increased revenue, improved presence in automation market.

Response Planning

• Not an actual “strategy” Adjunct to mitigation

• Trigger event detection What event or situation

will initiate plan Who has decision

authority• “What do we do if?”

Preplanned response may reduce impact

May include materials or equipment

Response Example

Risk: Facility closed due to inclement weather

Strategy: Enable telecommuting for project team Replace desktop computers

with laptops and docking stations at next replacement cycle

Enable secure log-in from off site using VPN

Enable video conferencing via FaceTime or Skype

Enable call forwarding from desk phone to company cell phones as required.

Document and Implement Your Strategy

Document Update risk register Produce, edit, and

publish formal response plans

Implement Obtain official review

and approval Obtain or authorize

program funds Promulgate guidance

to the team via program directives

Update the Risk Register(Excel Example)

Update the Risk Register(Risk Software Example)

Quantitative Assessment

Using mathematic or statistical techniques to: Quantify the likelihood of

risk events (Probability) Quantify the impact of risk

events Expected Value $$$ Schedule delay

Perform sensitivity analysis Risk impact(s) on entire

project Risks considered apart

from other risks for their unique contribution to overall risk

Image from Careercast.com

Assign Values to Risks

Historical Data Preferred method Extract impact data

from historical data Cost Schedule delay Litigation Injury

Identify frequency of occurrence (i.e., probability)

Identify trigger events or precursors

Separating Wheat from the Chaff

Historical data often combines inputs from multiple sources The true cost / duration of the

work Cost of the various risk events

Separating these data is necessary to identify the true cost of the work and the impact of the risk

The cost of the work, if repetitive, can be easily approximated and subtracted to leave the risk cost behind.

If necessary some approximation may be done to segregate the two cost sources

Assign Values to Risks

Expert Opinion to identify likelihood and impact Acceptable method but

may be less precise than historical data

Must control optimism bias Use Delphi

technique if possible (next slide)

Obtain consensus Express estimate as

value plus/minus a range

Delphi Technique

Named for the Oracle of Delphi

Relies on a group of experts

Iteratively come to a consensus through following process Facilitator asks each

expert to estimate some parameter or value

Results are anonymized and then shared with the group for a second round of estimates

Process continues until some consensus is reached

Assign Values to Risks

Use pre-established values to translate words to values Least Preferred (also

least precise) Method Values based on

organization’s risk tolerance

May be subjective and skew results

Only use if no other data available

Determine Cost of Mitigation Strategy

Gross cost of mitigation strategy estimated using normal procedures Labor Hours Material Costs Other direct costs

May still have some residual risk If less than cost of

additional mitigation efforts the best strategy may be to accept

Compare Mitigation Cost to Risk Impacts

Estimate the cost for each risk First determine the full value of labor

and material associated with the risk

Then calculate the weighted value = full value x probability of risk…. This is the likely impact to the program.

Compute weighted cost of risk if mitigated (reduced likelihood, reduced impact, or both) … this is the likely cost to the program post mitigation

Compare net reduction to cost of mitigation effort Is cost reduction more than the

estimated cost of the mitigation effort?

Is there a social or other reason for mitigating beyond this point?

Conduct Sensitivity Analysis

Identifies cost factors that will pay biggest rewards for controlling

Recompute cost model Vary each factor through its

possible range Monitor the total value for

change Note which factor(s) induce

the largest change in the total cost

Display results in ‘tornado’ diagram Rank order results with

largest contributor at top

Sensitivity Analysis of Cost Risk Factors – Tornado Diagram

Document and Implement Your Revised Strategy

Document Update risk register Produce, edit, and

publish formal response plans

Implement Obtain official review

and approval Obtain or authorize

program funds Promulgate guidance

to the team via program directives

Periodically Review and Update

Schedule periodic reviews of risks and strategies Recommend monthly for

initial reviews Quarterly once program is

established During review look for

New or emerging risks Risks that have passed

and may be dropped Currency of plans or

strategies Update risk register and

plans as required.

Summary

Risk effects both cost and schedule Increased performance

time uses more labor and increases the lease period for rented equipment

Risk events can have associated costs (material, equipment, etc.)

Delays may incur liquidated damages

Cost overruns damaging to the company

Risks can be managed using appropriate strategies

Produced by: The Contract Coach

The Contract Coach5338 La Colonia Dr NWAlbuquerque, NM 87120(505) 259-8485http://www.contract-coach.com

Monte Carlo Simulation Software

MS Excel Add-in @Risk Oracle Crystal Ball Risk Solver

General Purpose Products Analytica GoldSim Reno Oracle Crystal Ball SPSS

MS Project Add-in Full Monty Risky Project (also

supports Primavera P6) Enterprise Systems

Risk+ (Deltek) Primavera EPPM &

Primavera Risk (Oracle)