risk mgmt v5

PROJECT RISK MANAGEMENT

STUDY NOTES

In Preparation ForPMP® Certification Exam

IBM Education and TrainingWorldwide Certified Material

This publication has been produced using Lotus Word Pro 96.

Publishing Information

Trademarks

The following are trademarks of International Business Machines Corporation in the UnitedStates, or other countries, or both: IBM

Lotus, Lotus Notes, Lotus Word Pro, and Notes are trademarks of Lotus DevelopmentCorporation in the United States, or other countries, or both. Microsoft, Windows, Windows NT, and the Windows logo are trademarks of MicrosoftCorporation of the United States, or other countries, or both.

The following are certification, service, and/or trademarks of the Project Management Institute,Inc. which is registered in the United States and other nations: “PMI” is a service andtrademark, PMI® Logo and "PMBOK", are trademarks, “PMP” and the PMP® logo arecertification marks.

Other company, product, and service names may be trademarks or service marks of others.

DisclaimerPMI makes no warranty, guarantee, or representation, express or implied, that the successfulcompletion of any activity or program, or the use of any product or publication, designed to preparecandidates for the PMP® Certification Examination, will result in the completion or satisfaction of any PMP® Certification eligibility requirement or standard., service, activity, and has not contributed anyfinancial resources.

Initially Prepared By: Kim Ulmer

Edited By: Peter Dapremont

December 2000 Edition

The information contained in this document has not been submitted to any formal IBM test and isdistributed on an “as is” basis without any warranty either express or implied. The use of this informationor the implementation of any of these techniques is a customer responsibility and depends on thecustomer’s ability to evaluate and integrate them into the customer’s operational environment. Whileeach item may have been reviewed by IBM for accuracy in a specific situation, there is no guarantee thatthe same or similar results will result elsewhere. Customers attempting to adapt these techniques to theirown environments do so at their own risk.

© Copyright International Business Machines Corporation 1999. All rights reserved. IBM and itslogo are trademarks of IBM Corporation. This document may not be reproduced in whole or inpart without the prior written permission of IBM.Note to U.S. Government Users--Documentation related to restricted rights--Use, duplication ordisclosure is subject to restrictions set forth in GSA ADP Schedule Contract with IBM Corp.

Project Risk ManagementStudy Notes

Reference Material to study:

ü A Guide to the Project Management Body of Knowledge (PMBOK Guide), Chapter 11(1996 edition)

ü Project and Program Risk Management, A Guide to Managing Project Risks andOpportunities, PMI, Edited by R. Max Wideman, 1992

ü Project Management, A Managerial Approach, Meridith, Jack R. 1995, Chapter 2, 2.4ü Project Planning, Scheduling and Control, Lewis, James P., 1995ü PMP Challenge, ESI International, Risk Managementü PMBOK Q&A, PMI, Risk Management

What to Study?

ü The PMBOK phases of Project Risk Management: Risk Identification, RiskQuantification, Risk Response Development, and Risk Response Control (Be familiarwith Inputs, Tools and Techniques, and Outputs for each phase)

ü The three components of risk: Risk Event, Probability of Risk Event, and Impact ofRisk Event (Risk Event Value) and the relationship between the components (R=P*I)

ü The relationship of risk and the project life cycle: the amount of uncertainty and risk ishighest at the start of the project and lowest at the end of the project

ü The types of risk: Business, Pure, Known, Unknown ü Risk assessment using Decision Trees and Expected Monetary Valueü Monte Carlo Analysis

"PMBOK" is a trademark of the Project Management Institute, Inc. which is registered in the United States and other nations. “PMI” is a service and trademark of the Project Management Institute, Inc. which is registered in the United States and other nations.“PMP” and the PMP logo are certification marks of the Project Management Institute which are registered in the United States and othernations.

Project Risk Management

Project Risk Management 8-3© Copyright IBM Corp. 2000 Course materials may not be reproduced in whole or in part

without the prior written permission of IBM.

Key Definitions

A schedule risk assessment technique that performs a projectsimulation many times in order to calculate a distribution of likelyresults. Monte Carlo simulation is the best risk analysis tool.

Monte Carlo Analysis

Taking steps to lessen risk by lowering the probability of a riskevent’s occurrence or reducing its effect should it occur.

Mitigation

A separately planned quantity used to allow for future situationswhich are impossible to predict. Management reserves areintended to reduce the risk of missing cost or schedule objectives.Use of management reserves requires a change to the project’scost baseline. Management reserves are not included in theproject’s cost and schedule baseline. This is also referred to as“unknown unknowns”.

Management Reserve

A particular type of risk which can be covered by an insurancepolicy. Also referred to as a pure risk.

Insurable Risk

The mathematical examination of the nature of individual risks onthe project, as well as potential arrangements of interdependentrisks. It includes the quantification of their respective impactseverity, probability, and sensitivity to changes in related projectvariables, including the project life cycle. Impact (High,Medium,Low) = Effect on project x probability

Impact Analysis

The product of an event’s probability of occurrence and the gainor loss that wil result. Expected Monetary Value = Money atRisk x probability. For example, if there is a 50% probability it willrain, and rain will result in a $100 loss, the expected monetaryvalue of the rain event is $50 (.5 * $100).

Expected MonetaryValue

The act of transferring all or part of a risk to another party, usuallyby some form contract provision, insurance policy, or warranty.

Deflection

A separately planned quantity used to allow for future situationswhich may be planned for only in part. Contingency reserves areintended to reduce the impact of missing cost or scheduleobjectives. Contingency reserves are normally included in theproject’s cost and schedule baselines. This is also referred to as“known unknowns”.

Contingency Reserve

The development of a management plan that identifies alternativestrategies to be used to ensure project success if specified riskevents occur.

Contingency Planning

The inherent chances for both profit or loss associated with aparticular endeavor.

Business Risk

The extent of adverse consequences which could occur to theproject. (Also referred to as risk impact).

Amount at Stake


© Copyright IBM Corp. 20008-4 Project Risk ManagementCourse materials may not be reproduced in whole or in part


Key Definitions, continuedKey Definitions, continued

A response to a negative risk event. Distinguished fromcontingency plan in that a workaround is not planned in advanceof the occurrence of the risk event.

Workaround

The possibility that events may occur which will impact the projecteither favorably or unfavorably. Uncertainty gives rise to bothopportunity and risk.

Uncertainty

No information is available and nothing is known. By definition,total uncertainty cannot be envisaged.

Total UncertaintyAll information is known.Total CertaintyAs related to risk, negative outcomes of risk.Threats

Defining enhancement steps for opportunities and mitigation stepsfor threats.

Risk ResponseDevelopment

Responding to changes in risk over the course of the project.Risk ResponseControl

Evaluating the probability of risk event occurrence and effect.Risk Quantification

A subsidiary element of the overall project plan which documentsthe procedures that will be used to manage risk throughout theproject. Also covers who is responsible for managing various riskareas; how contingency plans will be implemented, and howreserves will be allocated.

Risk ManagementPlan

Is proactively planning for possible positive and negative events,avoid risk where possible.

Risk Management Determining which risk events are likely to affect the project.Risk Identification

A discrete occurrence that may affect the project for better orworse.

Risk Event

Includes the processes concerned with identifying, analyzing, andresponding to project risk.

Project RiskManagement

The likelihood of occurrence. The ratio of the number of chancesby which an event may happen or not happen to the sum of thechances of both happening and not happening.

Probability

Future events or series of events that if they occur will have apositive impact on the project. Benefits which can be realized fromundertaking a project. As related to risk, positive outcomes of riskevents.

Opportunities




Project Risk Management Processes

Risk Identification (11.1): (Process Group: Planning)

� The process of determining which risks are likely to affect the project and documentingthe characteristics of each.

� Inputs include: � product description� other process outputs such as WBS, cost estimates, staffing plan, procurement

management plan, etc. (whatever should be used to identify risks) � Historical information such as project files, commercial databases, and project

team knowledge (lessons learned, etc.)� Methods used during risk identification: checklists, flowcharting, and interviewing (risk

oriented interviews with various stakeholders)� Outputs include:

� Sources of risk (categories of possible risk events such as changes inrequirements, design errors, poor estimates, etc.)� Potential risk events including probability of occurrence, alternative possible

outcomes, expected timing of the events, and anticipated frequency.� Risk symptoms (indirect manifestations of actual risk events)� Inputs to other processes: The risk identification process may identify a need for

work in other areas. For example, the WBS may be insufficient.

Risk Quantification (11.2): (Process Group: Planning)

� The process of evaluating risks and risk interactions to assess the range of possibleproject outcomes.

� Inputs include: stakeholder risk tolerances, sources of risk, potential risk events, costestimates, and activity duration estimates.

� Methods used during risk quantification: include:� Expected monetary value: risk event probability * risk event value� Statistical sums: used to calculate a range of total project costs from the cost

estimates for individual work items.� Simulation: Uses a representation or model of a system to analyze the behavior

or performance of the system.� Decision trees: a diagram that depicts key interactions among decisions and

associated chance events as they are understood by the decision maker.� Expert judgment: can be applied in lieu of or in addition to the mathematical

techniques. (For example, risk events could be described as having a high,medium, or low probability of occurrence and a severe, moderate, or limitedimpact.

� Outputs include: � Opportunities to pursue, threats that require attention� Opportunities to ignore, threats to accept




Project Risk Management Processes, continued

Risk Response Development (11.3): (Process Group: Planning)

� The process of defining enhancement steps for opportunities and responses to threats.� Inputs include:

� Opportunities to pursue, threats that require attention� Opportunities to ignore, threats to accept

� The methods used in risk response development include: procurement, contingencyplanning, alternative strategies, and insurance.

� Outputs from risk response development: � Risk Management Plan: documents the procedures that will be used to manage risk

throughout the project. Also documents who is responsible for managing various areas ofrisk; how contingency plans will be implemented, and how reserves will be allocated. � Inputs to other project management processes such as contingency plans, alternative

strategies, anticipated procurements, etc.� Contingency plans: pre-defined action steps to be taken if an identified risk event should

occur.� Reserves: provisions in the project plan to mitigate cost and/or schedule risk. The term is

often used with a modifier such as management reserve, contingency reserve, orschedule reserve to provide further detail on what types of risk are meant to be mitigated.(the specific meaning of the modifier and the word reserve varies with the applicationarea) � Contractual agreements (to avoid or mitigate threats)

Risk Response Control (11.4): (Process Group: Controlling)

� The process of responding to changes in risk over the course of the project.� Inputs to risk response control include:

� Risk Management Plan� Actual risk events: identified risk events that have occurred� Additional risk identification

� Methods used during risk response control: workarounds and additional risk responsedevelopment.

� Outputs include: corrective action (implementing contingency plans and/orworkarounds) and updates to risk management plan




Project Risk Management Concepts

Expected Monetary Value:

� A Risk Quantification Tool� EMV is the product of the risk event probability and the risk event value� Risk Event Probability: An estimate of the probability that a given risk event will occur� Risk Event Value:

� An estimate of the gain or loss that will be incurred if the risk event does occur� Risk event values must reflect both tangibles and intangibles in order to compare

risks. (Otherwise, the risks are not equivalent)� EMV is generally used in further analysis such as decision trees

Decision Trees:

� A diagram that depicts key interactions among decisions and associated chance eventsas understood by the decision maker.

� Decision tree analysis attempts to break down a series of events into smaller, simpler,and more manageable segments

� The branches of the tree represent either decisions, shown as boxes, or chanceevents/occurrences, shown as circles

� Can be used in conjunction with EMV since risk events can occur individually or ingroups and in parallel or in sequence.

Probability:

� Probability = (Frequency of events) / (Total number of possible events)� Probability of 2 events happening simultaneous is the PRODUCT of the 2 probabilities

(AND)� Probability of 2 independent events is the SUM of the probabilities (OR)

Scope of Project Risk Management: (ref: I-2) in Risk Management Book from PMI

� Scope of project risk management lies somewhere between the two extremes of totalcertainty and total uncertainty

� Spectrum: Total Uncertainty, General Uncertainty, Specific Uncertainty, and TotalCertainty

� Spectrum: Unknown Unknowns (no information), Known Unknowns (partialinformation), and Knowns (complete information)

� Management Reserves handle unkown unknowns while contingency reserveshandle known unknowns




Project Risk Management Concepts, continued

Categories of Risk Response:

� Avoidance � Eliminate a specific threat, usually by eliminating the cause. � Examples: Don’t do the project; or do the project in a different way such that the

risk is no longer a risk� Mitigation

� Reduce the expected monetary value of a risk event by reducing the probabilityof occurrence or reducing the risk event value (impact of the risk)� Example: Using proven technology to lessen the probability that the product will

not work� Mitigation includes transferring the risk by buying insurance.

� Acceptance� Accepting the consequences of the risk.� Acceptance can be active: Developing a contingency plan should the risk occur� Acceptance can be passive: Accepting a lower profit is some activities overrun




Sample Questions

1. Which of the following processes is not part of Project Risk Management? A. Risk Quantification B. Risk Identification C. Risk Analysis D. Risk Response Development

2. Using the PMBOK definition of contingency reserve, which of the following statementsabout contingency reserves is false? A. A contingency reserve is a separately planned quantity used to allow for future

situations which may be planned for only in part. B. Contingency reserves may be set aside for known unknowns. C. Contingency reserves may be set aside for unknown unknowns. D. Contingency reserves are normally included in the project’s cost and schedule

baselines.

3. Which of the following is not a tool or technique used during the Risk QuantificationProcess? A. Expected monetary value B. Contingency planning C. Decision Trees D. Statistical sums

4. Which of the following is true about pure risk? A. The risk can be deflected or transferred to another party through a contract or

insurance policy. B. Pure risks involve the chance of both a profit and a loss. C. No opportunities are associated with pure risk, only losses. D. a and c

5. A contingency plan is: A. A planned response that defines the steps to be taken if an identified risk event should

occur. B. A workaround C. A reserve used to allow for future situations which may be planned for only in part. D. a and b

6. The normal risk of doing business that carries opportunities for both gain and loss is called: A. Favorable risk B. Opportunity risk C. Pure risk D. Business risk




Sample Questions, continued

7. A risk response which involves eliminating a threat is called: A. Mitigation B. Deflection C. Avoidance D. Transfer

8. Deflection or transfer of a risk to another party is part of which of the following riskresponse categories? A. Mitigation B. Acceptance C. Avoidance D. Analysis

9. When should risk identification be performed? (select best answer) A. During Concept Phase B. During Development Phase C. During Implementation Phase D. Risk identification should be performed on a regular basis throughout the project.

10. Which of the following statements is false? A. Uncertainty and risk are greatest at the start of the project and lowest at the end. B. The amount at stake is lowest at the end of the project and greatest at the start. C. Expected monetary value can be expressed as the product of the risk event probability

and the risk event value. D. Opportunities are positive outcomes of risk.

11. A contingency plan is executed when: A. A risk is identified. B. An identified risk occurs. C. When a workaround is needed. D. All of the above

12. Management reserves are used to handle which type of risk? A. Unknown unknowns B. Known unknowns C. Business risks D. Pure risks

13. Which of the following techniques accounts for path convergence and generally estimatesproject durations more accurately? A. CPM B. PERT C. Schedule simulation D. Path convergence method





14. Most schedule simulations are based on some form of which of the following? A. Delphi B. PERT C. CPM D. Monte Carlo Analysis

15. When should a risk be avoided? A. When the risk event has a low probability of occurrence and low impact. B. When the risk event is unacceptable -- generally one with a very high probability of

occurrence and high impact. C. When it can be transferred by purchasing insurance. D. A risk event can never be avoided.

16. A contingency plan has a 20% chance of failing. The corresponding risk event has a 30%chance of occurring. What’s the probability for the risk to occur AND the contingency planto fail? A. 50% B. 25% C. 6% D. 10%

17. The independence of two events in which the occurrence of one is not related to theoccurrence of the other is called: A. Event phenomenon B. Independent probability C. Statistical independence D. Statistical probability

18. The one document that should always be used to help identify risk is the: A. Risk Management Plan B. WBS C. Scope Statement D. Contingency Plan

19. Risks are accepted when: A. You start to calculate expected monetary value for that risk. B. You accept the consequences of the risk. C. You transfer the risk to another party. D. You reduce the probability of the risk event occurring.





20. Which is not an example of risk mitigation: A. Using proven technology in the development of a product to lessen the probability that

the product will not work B. Purchasing insurance C. Eliminating the cause of a risk D. Increasing staffing levels during critical project phases

21. By using Project Risk Management techniques, project managers can develop strategiesthat do all but which of the following: A. Significantly reduce project risks B. Eliminate project risks C. Provide a basis for better decision making on overruns D. Identify risk, their impact(s) and any appropriate responses

22. In the following network, all three tasks, A, B and C, each have a duration 5 days. Thevalue ‘p’ indicates the probability of each task finishing on schedule. If all 3 tasks start onday 1, what is the probability that all 3 tasks will finish in 5 days? A. p = .45 B. p = .003 C. p = .014 D. Probability cannot be determined from the data given

23. A risk event is defined as : A. The severity of the consequences of a loss B. How likely the event is to occur C. A discrete occurrence that may affect the project for better or worse D. A symptom of a risk





24. An analysis has identified four different options for reducing project costs. Based uponEMV, which option should be selected ?

A. Option A B. Option B C. Option C D. Option D

25. Risk avoidance involves: A. Accepting the consequences B. Developing a contingency plan C. Eliminating a specific threat, usually by eliminating the cause D. Reducing the expected monetary value of the risk event by reducing the probability of

the occurrence

26. In Risk Identification, what other planning outputs should be reviewed as inputs: A. Staffing plan B. Cost estimates and duration estimates C. Work breakdown structure

D. All of the above

27. Pure risks differ from business risks because pur risks: A. Include the chance of both profit or loss for the business B. Include potential loss and no chance of business profit C. Must incur personal loss with business liability D. Must incur purely business profit and no liability losses





28. Risk Identification outputs include all of the following except: A. Decision trees B. Inputs to other processes C. Risk symptoms D. Potential risk events

29. What is risk event probability? A. The value used in mitigation and deflection B. An estimate of the probability that a given risk will occur C. The probability of the risk not occurring at this time D. An estimate of the probability that an uncontrollable event will occur

30. A project of $1.5 million has an adverse event that has a probability of 0.07 of occurringand a potential loss of $15,000. This represents an expected negative monetary value ofhow much? A. $100,500 B. $105 C. $1,050

D. $15,000




Answer SheetAnswer Sheet

dcba30.

dcba29.

dcba28.

dcba27.

dcba26.

dcba25.

dcba24.

dcba23.

dcba22.

dcba21.

dcba20.

dcba19.

dcba18.

dcba17.

dcba16.

dcba15.

dcba14.

dcba13.

dcba12.

dcba11.

dcba10.

dcba9.

dcba8.

dcba7.

dcba6.

dcba5.

dcba4.

dcba3.

dcba2.

dcba1.




Answers

$15,000 x .07 = $1,050C30PMBOK Guide, pg. 115, Wideman pg. VII-2B29PMBOK Guide, pg. 114, Wideman pg. I-1A28Wideman pg. III-1, Thomas pg 3-67B27PMBOK Guide, pg. 113D26PMBOK Guide, pg. 119C25

a. Option A EV = (.4)(.7)($100) = $ 28c. Option B EV = (.4)(.1)($1000) = $ 40b. Option C EV = (.4)(.2)($5000) = $ 400d. Option D EV = (.6)($2000) = $1200

D24Wideman pg. VII-6C230.1 x .2 x .15 = .003B22PMBOK Guide, pg. 121 Risks can never be eliminatedB21PMBOK Guide, pg. 119C20PMBOK Guide, pg. 119B19PMBOK Guide, pg. 113B18

C170.2 x 0.3 = 0.06C16

B15PMBOK Guide, pg. 117D14PMBOK Guide, pg. 117C13PMBOK Guide, pg. 165A12PMBOK Guide, pg. 120B11

B10PMBOK Guide, pg. 111D9PMBOK Guide, pg. 119A8PMBOK Guide, pg. 119C7

D6

A workaround is an unplanned response to a negative risk event. Option C isthe definition of contingency reserve.

A5D4

PMBOK Guide, pg. 115B3PMBOK Guide, pg. 160C2PMBOK Guide, pg. 111C1




PMP® Certification Exam Preparation

What did I do wrong ?

_________Total

_________10. NOT rushed to finish

_________9. Reviewed my answer after reading the other questions

_________8 Used the PMI® rather than my own perspective

_________7. Checked the mathematics

_________6. Known the PMBOK® definition

_________5. Known the formula

_________4. Used a strategy of elimination

_________3. Read ALL the answers before answering the question

_________2. Read the answer properly and identified the keywords

_________1. Read the question properly and identified the keywords

NumberI would have answered a larger number of questionscorrectly if I had ___________.




risk mgmt v5

Documents