Overview
Learning Objectives
After studying in this chapter, you should be able to:
Describe the project risk management planning framework
introduced in this chapter.
Apply risk identification tools and understand the causes,
effects, and the integrative nature of project risks.
Apply several qualitative and quantitative analysis
techniques that can be used to prioritize and analyze various
project risks.
Describe the various risk strategies, such as insurance,
avoidance, or mitigation.
Describe risk monitoring and control.
Describe risk evaluation in terms of how the entire risk
management process should be evaluated in order to learn
from experience and to identify best practices.
Contents
• Introduction
PMBOK® Risk Management Processes
• Plan Risk Management
• Determining how to approach and plan the project risk management activities. An
output of this process is the development of a risk management plan.
• Identify Risks
• Deciding which risks can impact the project. Risk identification generally includes
many of the project stakeholders and requires an understanding of the project’s
goal, as well as the project’s scope, schedule, budget, and quality objectives.
• Perform Qualitative Risk Analysis
• Focusing on a qualitative analysis concerning the impact and likelihood of the risks
that were identified.
• Perform Quantitative Risk Analysis
• Using a quantitative approach for developing a probabilistic model for
understanding and responding to the risks identified.
• Plan Risk Responses
• Developing procedures and techniques to reduce the threats of risks, while
enhancing the likelihood of opportunities.
• Monitor and Control Risks
• Providing an early warning system to monitor identified risks and any new risks.
This system ensures that risk responses have been implemented as planned and
had the effect as intended.
Common Mistakes in Managing
Project Risk
• Not understanding the benefits of risk
management
• Not providing adequate time for risk
management
• Not identifying and assessing risk using a
standardized approach
Effective & Successful Risk Management
Requires
•Commitment by all stakeholders
•Stakeholder responsibility
•Different risks for different types of
projects
Definition of Risk (PMBOK® Guide)
• An uncertain event or condition that, if occurs, has a
positive or negative effect on one or more of the project
objectives such as scope, schedule, cost, and quality.
• Project Risk Management (PMBOK®)
• Includes the processes of conducting risk management
planning, identification, analysis, response planning, and
monitoring and control on a project; most of these
processes are updated throughout the project. The
objectives of Project Risk Management are to increase the
probability and impact of positive events and decrease
the probability and impact of events adverse to the
project.
Project Risk Management Processes
Step 1 – Create A Risk Plan
• Requires firm commitment by all stakeholders
to the entire Risk Management (RM) approach
• RM should align throughout the organization
• Risk Planning focuses on preparation
• Systematic preparation and planning can help
minimize adverse effects on the project while
taking advantage of opportunities as they arise
STEP 2 – Identify Risks through a
Project Risk Identification Framework
STEP 2 – Identify Risks through Risk
Identification Tools & Techniques
• Learning Cycles
• Brainstorming
• Nominal Group Technique
• Delphi Technique
• Interviews
• Checklists
• SWOT Analysis
• Cause & Effect (a.k.a. Fishbone/Ishikawa)
• Past Projects
STEP 2 – Identify Risks through Risk
Identification Tools & Techniques –
Nominal Group Technique (NGT)
1. Each individual silently writes their ideas on a piece of
paper
2. Each idea is then written on a board or flip chart one at a
time in a round-robin fashion until each individual has
listed all of his or her ideas
3. The group then discusses and clarifies each of the ideas
4. Each individual then silently ranks and prioritizes the
ideas
5. The group then discusses the rankings and priorities
6. Each individual ranks and prioritizes the ideas again
7. The rankings and prioritizations are then summarized for
the group
STEP 2 – Identify Risks through Risk
Identification Tools & Techniques – Risk
Check List
• Funding for the project has been secured.
• Funding for the project is sufficient
• Funding for the project has been approved by senior
management
• The project team has the requisite skills to complete the project
• The project has adequate manpower to complete the project
• The project charter and project plan have been approved by
senior management or the project sponsor
• The project’s goal is realistic and achievable
• The project’s schedule is realistic and achievable
• The project’s scope has been clearly defined
• Processes for scope changes have been clearly defined.
STEP 2 – Identify Risks through Risk
Identification Tools & Techniques – SWOT
Analysis
STEP 2 – Identify Risks through Risk
Identification Tools & Techniques – Cause
& Effect Diagram
STEP 3 – Analyze Risks
•Risk = f(Probability * Impact)
• Risk assessment focuses on prioritizing risks so
that an effective strategy can be formulated for
those risks that require a response.
Depends on
Can’t respond to
Stakeholder risk
all risks!
tolerances
STEP 3 – Analyze Risks Qualitative
Approaches
•Expected Value & Payoff Tables
•Decision Trees
•Risk Impact Table & Ranking
•Tusler’s Risk Classification
Which risks require a response?
Decision Tree Analysis
STEP 3 – Analyze Risks – Risk
Impact Table
Risk Rankings
STEP 3 – Analyze Risks Quantitative
Approaches
• Quantitative Probability Distributions
• Discrete
• Binomial
• Continuous
• Normal
• PERT
• TRIANG
Binomial Probability Distribution
Normal Distribution
Normal Distribution
• Rules of thumb with respect to observations
• Approximately….
68% + 1 standard deviations of mean
95% + 2 standard deviations of the mean
99% + 3 standard deviations of the mean
PERT Distribution
PERT MEAN = (a + 4b + c)/6
Where:
a = optimistic estimate
b = most likely
c = pessimistic
PERT Distribution
Triangular Distribution
Simulations
• Monte Carlo
• Technique that randomly generates specific values
for a variable with a specific probability
distribution
• Goes through a number of trials or iterations and
records the outcome
• @RISK6®
• An MS Project® add in that provides a useful tool
for conducting risk analysis of your project plan
• [Link]
Monte Carlo Simulation
Cumulative Probability Distribution
Sensitivity Analysis Using a Tornado Graph
STEP 4 – Develop Risk Strategies –
Risk Strategies Depend On
• The nature of the risk itself
• Really an opportunity or threat?
• Impact of the risk on the project’s MOV and objectives
• Likelihood? Impact?
• The project’s constraints in terms of scope, schedule,
budget, and quality requirements
• Successful response possible with available
resources?
• Risk tolerances or preferences of the project
stakeholders
STEP 4 – Develop Risk Strategies
Strategies to respond to opportunities with
potential positive impacts on the project goal and
objectives
•Exploitation – attempt to take advantage of the
situation
•Sharing of Ownership – e.g. joint partnerships or joint
ventures with customers or vendors
•Acceptance – PM and project team members’ minds are
open in order to take advantage of opportunities as
they arise
STEP 4 – Develop Risk Strategies
• Accept or Ignore
• Management Reserves
• Released by senior management
• Contingency Reserves
• Part of project’s budget
• Contingency Plans
• Avoidance
• Mitigate
• Reduce the likelihood or impact (or both)
• Transfer
• E.g. insurance
STEP 5 – Monitor and Control Risk
• Risk Audits
• External to project team
• Risk Reviews
• Internal
• Risk Status Meetings & Reports
STEP 5 – Respond and Evaluate Response to
Risk through a Risk Response Plan that
includes:
• A trigger which flags that the risk has occurred
• An owner of the risk (i.e., the person or group
responsible for monitoring the risk and ensuring that the
appropriate risk response is carried out)
• A response based on one of the four basic risk strategies
• Adequate resources
STEP 5 – Respond and Evaluate Response
to Risk through Risk Evaluation
• Lessons learned and best practices help us to:
• Increase our understanding of IT project risk in
general.
• Understand what information was available to
managing risks and for making risk-related decisions.
• Understand how and why a particular decision was
made.
• Understand the implications not only of the risks, but
also the decisions that were made.
• Learn from our experience so that others may not have
to repeat our mistakes.
