Risk Management

for
Projects

Scott Morrison

1
 Project Risk Management
Session Logistics

 3.5 hour class

 We will take several breaks throughout the session
 Please put cell phones on mute or turn off
 Feel free to send me an email to talk project
management topics: scott-morrison@comcast.net
 Ask questions, actively participate, and try to have some
fun!!!

2
 Project Risk Management
Introductions

 About the facilitator

– Born in Columbus, Ohio, moved to Denver in 1979
– Worked at Mountain Bell/US West/ Qwest from 1981 to 2001
 Held several positions with Qwest (Call center operations, product management, database development,
technical project manager, business project manager, program manager, director)
– Ran own consulting firm providing project management and management consulting services
– Worked at WellPoint (Anthem/Blue Cross Blue Shield) as a Business and IT project manager
– B.S. at Regis University (CIS major, Business minor)
– Program Management certification at US West/University of Denver Center for Program Management
– PMP
– Developed and delivered the following Saturday Workshop classes for the Mile High PMI Chapter:
 Project Risk Management (2010, 2013, and December 2016)
 Project Organizational Design (2011)
 Program Risk Management (2012)
 Leadership for Project Managers (2013)
 Communications for Project Managers (2014)
 Project Management Tools (2015)
 Project Kick Offs and Team Building Tools (2016)
 Fun with MS Project (planned for 2017)
3
 Project Risk Management
Session Agenda

 Review risk concepts

– Risk Management Overview and the Risk Management Plan
– Risk Identification
– Risk Quantification
– Risk Response
– Risk Control

 Team exercise
 Team exercise readout
 Closing items

4
 Project Risk Management

Risk Management Overview

and the Risk Management Plan

5
 Project Risk Management
Risk Management Overview

 What is risk?
Risk: An uncertain event or condition that, if it occurs, has a positive
or negative effect on a project’s objectives

VENTURE OUTCOME
(Project) (Products)

FAVORABLE
UNKNOWNS (Opportunity)
(Uncertainty)
UNFAVORABLE
(Risks)

6
 Project Risk Management
Risk Management Overview

Project Lifecycle
Risk vs. Amount at Stake

I
CONCEPT DEVELOPMENT IMPLEMENT CLOSE
N
PHASE PHASE PHASE PHASE
C
R $
OPPORTUNITY AND RISK
E
A V
S A
PERIOD WHEN
I HIGHEST RISKS L
N ARE INCURRED U
G E

PERIOD OF
R HIGHEST
I RISK IMPACT
AMOUNT AT STAKE
S
K
7
 Project Risk Management
Risk Management Overview

 What is risk management?

– Identifying, analyzing, prioritizing, and responding to
risk events
– Integration of risk management activities into your
other project management functions
– Developing responses to risk to meet your project
objectives
– Project risk management is PROACTIVE

8
 Project Risk Management
Risk Management Overview

INTEGRATING RISK WITH OTHER PROJECT MANAGEMENT FUNCTIONS

PROJECT
MANAGEMENT
INTEGRATION
INFORMATION /
SCOPE
COMMUNICATIONS
Life Cycle and
Expectations Environment Variables
Ideas, Directives, Data
Feasibility
Exchange Accuracy

QUALITY
Requirements PROJECT Availability HUMAN
Standards RISK Productivity
RESOURCE

Services, Plant, Materials:

Time Objectives, Performance
Cost Objectives,
Constraints Restraints

CONTRACT /
TIME
COST PROCUREMENT

9
 Project Risk Management
Risk Management Overview

 Components of the Risk Management Plan

– Methodology
– Roles and responsibilities
– Budgeting
– Timing
– Risk categories
– Definitions of risk probability and impact
– Probability and impact matrix
– Stakeholder’s tolerances
– Reports
– Tracking
10
 Project Risk Management
Risk Management Overview

 Results from developing the Risk Management Plan

– You have a written plan

– You know what actions you have to do

– You know who is responsible for what

– You can track your work

– You can learn from your risk activities and help others with
their risk

11
 Project Risk Management
Risk Management Overview

 Risks vs Issues
– Many projects use risk and issue logs. Sometimes the management of
issues and risks can become confusing.
– The PMBOK definition of an Issue:
 A point or matter in question or in dispute, or a point or matter that
is not settled and is under discussion or over which there are
opposing views or disagreements.
– If you have the freedom to define these items and their logs and the
subsequent management of risks and issues, then great. Handle risks and
issues as you desire. My suggestion is to follow as closely as possible the
PMBOK guidelines.
– If you are dictated by the company, organization, or management team to
handle risks and issues in a particular manner, then follow these
guidelines. Document in your Project Management Plan, Risk
Management Plan, and or Issue Management Plan how you will handle
12 risks and issues.
 Project Risk Management

Risk Identification

13
 Project Risk Management
Risk Identification

 Risk in corporate business is typically divided into 2 basic

types
 Business Risk: Chances of profit or loss associated with a business
endeavor
 Business employs a staff of qualified workers to increase profit and reduce
chances of loss

 Pure or Insurable Risk: Divided into 4 categories

 Direct property: Destruction of property by fire, etc.
 Indirect property: Extra expenses associated with rental property or loss due
to a business interruption
 Liability: Chance of a lawsuit of bodily injury, damages, etc.
 Personnel: Injuries to workers (Worker’s Comp)
14
 Project Risk Management
Risk Identification

 Risk in project management

– Usually not enough attention is paid to risk on projects
– All risks are not independent and frequently the greatest risk on
a project comes from a series of related/integrated events
– Ultimate responsibility of risk management resides with the
project sponsor
– As the project manager representing the sponsor, risk
management becomes a large responsibility for you

15
 Project Risk Management
Risk Identification

 Risk identification is never done

 Risk identification is performed throughout the life of the

project

 The process for identifying risk

– Understand the project

– Identify the risk event

– Document the results and take appropriate actions

16
 Project Risk Management
Risk Identification

 Types of risk
– Technical
– External
– Organizational
– Project Management
Note: These are example types of risk and this list can be modified to
meet the needs of your project

 Developing a project RBS (Risk Breakdown Structure) is

an excellent tool to help identify risks
17
 Project Risk Management
Risk Identification

PROJECT
RBS

PROJECT
TECHNICAL EXTERNAL ORGANIZATIONAL
MANAGEMENT

SUBCONTRACTORS PROJECT
REQUIREMENTS ESTIMATING
& SUPPLIERS DEPENDENCIES

TECHNOLOGY REGULATORY RESOURCES PLANNING

COMPLEXITY &
MARKET FUNDING CONTROLLING
INTERFACES

PERFORMANCES
& RELIABILITY CUSTOMER PRIORITIZATION COMMUNICATIONS

The Risk Breakdown Structure (RBS) lists categories

QUALITY WEATHER and sub-categories for project risk. The actual
18 categories will vary across different types of projects.
 Project Risk Management
Risk Identification

 What you need to identify risk

– Product description
– Planning documents
 Project scope statement
 Cost mgt plan
 Schedule mgt plan
 Communications mgt plan
 Enterprise environmental factors
 Stakeholder register
 Quality mgt plan
 Organizational process assets
– Historical Information
 Previous project data
 Expert knowledge
19
 Project Risk Management
Risk Identification

 In your risk identification meeting

– Validate RBS with core team

– Identify risks by source (RBS)

– Identify risks by level of uncertainty:

Known Known / Unknown Unknown / Unknown

Situation with no Situation with an Situation whose
uncertainty identifiable uncertainty existence we cannot
imagine

20
 Project Risk Management
Risk Identification

 Conduct a risk identification meeting

– Gather all relevant data

– Schedule a risk management meeting with your core team members

– Use a structured approach: Brainstorming, Nominal Group Technique, Delphi

Technique, Mind Mapping, Project Lessons Learned

– Focus on identifying risk only

 Schedule risk identification meetings in your project plan

– After certain milestones: Requirements complete, design complete, etc.

 Event driven
– A risk event happens and becomes part of the risk register

21
 Project Risk Management
Risk Identification

 Brainstorming

– Chose a facilitator (best if other than the project manager)

– Chose a scribe to capture the risks

– Use a category or categories to start the creativity flowing

– Do not judge or analyze during this effort

– Focus on getting the universe of risks for your project

22
 Project Risk Management
Risk Identification

 Nominal Group

– Gather the core team for a risk workshop

– Use flip charts or a whiteboard to collect info

– Begin by having each person identify potential areas of risk

– Then within each area have each person write at least 3-5 risk

events

– Repeat until everyone has listed their risks

23
 Project Risk Management
Risk Identification

 Delphi technique
– Identify a facilitator
– The facilitator then identifies qualified experts to participate
– The facilitator poses questions to the experts individually
– The facilitator then analyzes the results to identify common
themes
– The results are then shared with the experts for validation
– The list is then refined and again shared with the panel
– The facilitator the creates a single results document
24
 Project Risk Management
Risk Identification

 Mind mapping
– Begin with a category of risk in the center represented by a circle

– Major risks for that category are represented by lines connecting

with the circle

– For each major risk identify smaller risks that are part of that risk

– Do not judge or evaluate at this time

– Continue until no more risks can be identified

25
 Bonus Slide
Scott’s 3 Rules of Project Management

1. Don’t hurt anyone

• People, animals, or the environment

2. Do the right thing

• Follow all legal, regulatory, and compliance rules

• Ethical behavior and honesty are the most important things you
can ever do

• Give credit where credit is due

3. Just deliver, baby!

26
 Project Risk Management

Risk Quantification

27
 Project Risk Management
Risk Identification

 Identify your risks in a risk register or a risk log

Functional Area Identify the functional business areas

potentially impacted by the risk

Risk Category Cost; External; Schedule; Technical;

Resources; Operational

Risk Description Description of the risk and the impact of it

Date Identified Date the risk was identified

Raised By Who identified the risk

28
 Project Risk Management
Risk Quantification

 What are the right risks to manage

– Analyzing risks for probability and impact
– Developing a risk profile for your project
– Prioritizing your risks
 When to quantify risks
– Whenever a new risk is created
– An existing risk changes
– Influential factors change
– New information surfaces
– A change is proposed by the sponsor
– Market conditions change
– Significant personnel leave the project
29
 Project Risk Management
Risk Quantification
 Quantitative Analysis
– Relies on a numeric value
– Uses objective data
– Requires understanding of
probability theory
– Removes some uncertainty
– Should be based on
historical data
– Some examples are:
sensitivity analysis,
expected monetary
analysis, and modeling and
simulation
30
 Qualitative Analysis
– Uses subjective values:
Green, Amber, Red
– Requires common
understanding of ordinal
ranking system
– May be less precise than
quantitative analysis
– Should be defined in terms
of the parameters of the
project
 Project Risk Management
Risk Quantification

31
 Project Risk Management
Risk Quantification

 Probability
– Can be done in a basic approach by developing a simple estimate of the probability that an
event will be late in delivery
 Ed says it is 50% likely this task will be late
 Probability of Event 1 x Probability of Event 2 = Probability
– Can be done in a more complex manner by using weighted averages
 Joe says 35% chance of being late
 Mary says 40% chance of being late
 Ed says 50% chance of being late
 Joe gets twice as much credit because he knows more about the situation
 The probability is: ((2 x 35) + (40) + (50)) / 4 = 40%
– Quantifying risk probability can become quite complex, there are many resources to assist
you with more detailed approaches (books, internet research, multi-day training,
consultants).
32
 Project Risk Management
Risk Quantification

 Assessing Impact
– Schedule Tools:
 Network analysis (relationships, durations, critical path(s),
near critical paths, hard constraints)
 Resources (availability, competency, productivity)
 Estimates (accuracy, source, method)
– Cost tools:
 WBS
 Requirement definition
 Estimating methodologies
 Expected monetary value
 Decision trees
33  Financial analysis
 Project Risk Management
Risk Quantification

 Assessing Impact (cont.)

– Quality
 Ask yourself the question “What if the project fails to
perform as expected during its operational life?”
 Of all the project objectives, conforming to quality objectives
is the one most remembered
 Therefore, this is one of the most important dimensions
impacting your project
 You can use financial analysis to identify risk for poor quality
by quantifying long term activities that will impact the
product lifecycle for your analysis
34
 Project Risk Management

Risk Response

35
 Project Risk Management
Risk Response

 Risk response is:

– Defining steps for responses to opportunities and threats
– Assigning responsibility
– Developing responses for negative risks:
 Avoiding: Changing the project mgt plan to eliminate the risk.
Could involve changing the objective, modifying the
schedule, or reduction in scope.
 Mitigating: A reduction in the probability or impact to the
project. Taking early action to reduce the probability,
adopting less complex processes, or conducting more tests.
 Transferring: Shifting the risk to a third party for the
management of the risk. Does not eliminate the risk, could
involve insurance, warranties, bonds.
 Insurance: Purchase insurance to reduce/eliminate risk – an
athlete may purchase insurance against injury to guarantee
their income.
36
 Project Risk Management
Risk Response

 Risk response is:

– Developing responses for negative risks(cont.):
 Accepting: It is possible that the risk cannot be eliminated or
managed. Can be active or passive in approach – a
contingency reserve in time, money, or resources.
– Developing responses for positives risks or opportunities
 The strategies for managing positive risks are:
– Exploit the situation. We will do whatever we can to
make sure the event does happen so we can enjoy the
rewards of the event.
– Enhance the probability and positive impacts of the
event.
– Share the ownership with a third party who can better
enhance the situation.
– Accept the opportunity, take the advantages provided by
the event, but do not actively pursue the event.
37
 Project Risk Management
Risk Response

 Approach response development from a project wide

perspective
 Consider related risks
 Stay within your project scope on your responses
 Consider the following for contingency planning:
– The management of a contingency budget
– The development of schedule alternatives and work-arounds
– Complete emergency responses to deal with major areas of risk
– An assessment of project shut-down liabilities

38
 Project Risk Management

Risk Control

39
 Project Risk Management
Risk Control

 Actively work your risk register/log

 Update risks as needed (data, new resources,
new/changing requirements)
 Review the log in status calls, set and use due dates for
active contingency plans
 Hold assigned resources accountable for their action
items
 Engage sponsor when invoking contingency plans to
ensure they know a risk has happened and the team is
actively working the response plan
40
 Project Risk Management
Risk Control
Example Log
Risk ID
Functional Area
Risk Category
Risk Description
Date Identified
Raised By
Date Assigned
Assigned To
Probability
Potential Impact
Risk Factor (P*I)
Positive or Negative Impact
Response Category
Status/Comments
Trigger
Proposed/Actual Resolution
41 Contingency Plan
Sequential number assigned
Identify the functional business areas potentially impacted by the risk
Cost; External; Schedule; Technical; Resources; Operational
Description of the risk and the impact of it
Date the risk was identified
Who identified the risk
Date the risk was assigned
Who the risk was assigned to
1, 2, 3, 4
1, 2, 3, 4
Probability * Impact
Will the potential impact of the risk have a Positive, Negative, Both or Unknown impact if realized?
Acceptance; Mitigation; Transfer; Avoidance
Status of risk and update/comments about it
Preliminary event that will indicate the risk is about to take place
Risk Response plan
Alternate Plan if Risk Response fails
 Project Risk Management

Small Team Exercise

42
 Project Risk Management
Small Team Exercise

 Your task, should you choose to accept it, and you must,
is to develop a risk plan for your project
 The group will break into 3-5 person teams to work on
their project
 There are 2 projects, a construction project and a new
product development effort
 You will develop your risk plan, then the similar project
teams will get together (all the construction teams in one
group and all the product development teams in another)
and develop a summary of what happened, then each
large project group will present to the whole class their
experiences
43
 Project Risk Management
Small Team Exercise

 Product Development Project

– This is a telecommunications product
– The team will develop and deploy a new feature to be used on
your home or work phone called “Phone Buzz”
– There is an estimated customer base of 6M consumer users and
1M business users across the 50 states
– Revenue for the consumer base is estimated to be $720M per
year and revenue for the business segment is estimated at
$180M per year.
– The base telecommunications technology for the application is
proven, but must be combined with a new technology that has
never been utilized on the current telecommunications system
architecture

44
 Project Risk Management
Small Team Exercise

 Product Development Project (cont.)

– The VP of Marketing is planning on announcing the new
product at the industry’s largest trade show in 6 months
– The budget for the project is currently set at:
 $ 25M for technology
 $ 1M for business project costs
 $ 5M for marketing
– Initial estimates are 12 – 18 months to complete the project
– The project has been approved to start, and the following
assets have been developed
 High level business requirements
 A preliminary technical feasibility assessment
 Secondary market research has been performed
 The sponsor and initial core team have been identified
45
 Project Risk Management
Small Team Exercise

 Product Development Project (cont.)

– Core team members
 Required
– Business Project Manager
– Technical Project Manager
– Project Sponsor
 Optional
– Operations Manager
– Training Project Manager

46
 Project Risk Management
Small Team Exercise

 Construction Project
– This project will develop a combined residential and commercial
community in southern Louisiana, the community will be called
“Southern Comfort”
– Planned activities are:
 300 Residential Condos (Targeted sales price $100K to $150K each)
 100 Residential Homes (Targeted sales price $350K to $500K each)
 A small office complex (50,000 sq. ft.)
 2 convenience stores, each with a gas station
 4 recreational areas:
– 2 open space areas: Also used for youth soccer and football
– 1 area with tennis courts and basketball courts
– 1 area with 6-8 baseball/softball fields

47
 Project Risk Management
Small Team Exercise

 Construction Project (cont.)

– The current project budget is $47M, targeting 3 years to
complete the entire effort
Unit Type Quantity Sq. Ft (tot) Cost Cost per Unit
Condos 300 360,000 21,600,000 72,000
Houses 100 200,000 18,000,000 180,000
Commercial 1 50,000 6,500,000 6,500,000
Stores 2 8,000 1,040,000 520,000

Fields 4 100,000 25,000

47,240,000

48
 Project Risk Management
Small Team Exercise

 Construction Project (cont.)

– So far the following has happened:

 The land has been purchased

 The property is located next to a protected wildlife area and had wonderful

views and access to good shopping and restaurants

 35 condos have been built or are in progress

 10 homes have been built or are in progress

 The zoning for the commercial lots has not yet been completed

49
 Project Risk Management
Small Team Exercise

 Construction Project (cont.)

– Core team members
 Required
– Business Project Manager
– Construction Project Manager
– Project Sponsor
 Optional
– Sales Manager
– Supplier/Materials Project Manager

50
 Project Risk Management
Small Team Exercise

 Your assignment, as the new Business Project Manager is to:

– Develop a Risk Management Plan
– Develop an RBS
– Conduct a Risk Identification meeting
– After the identification meeting is complete, quantify your risks
– Develop risk responses for your significant risks
– Prepare a summary sheet on your findings to share with the other small
teams in your project type
– Develop a summary sheet with the similar projects to present to the
entire class
– Notes:
 Each small team will call for 2 reviews, one for their Risk Management Plan
and one for their Risk Register once they complete their risk responses from
the facilitator
 Updates to the project information will be provided during the exercise

51
 Project Risk Management
Small Team Exercise

 Conclusions
– What worked well?
– What did not work so well?
– What happened during the process that you found
interesting?
– How well were you able to manage your risk?
– What would you do differently?
– Is there anything you would now do differently on
your project based on this experience?

52
 Project Risk Management
Conclusion

Conclusion

53
 Project Risk Management
Conclusion

 Risk management requires:

– Planning

– Structure

– Analysis

– Creativity

– Constant attention

– Flexibility

– Communications, communications, communications!!

54
 Project Risk Management
Conclusion (cont.)

 The PMBOK has a lot of great reference materials to

assist you with your Risk Management planning activities
 Whatever you do, just do SOMETHING to address risk on
your projects – and do it in a structured manner
 If your company/organization does not have templates or
a process in place, develop your own tools.
– Use the PMBOK for ideas on the approach and build a risk
register in Excel.
– A tab in Excel identifying your “plan” and another tab with the
Risk Register will work much better than nothing.

55
 Project Risk Management
Conclusion (cont.)

 Program Risk Management

– Project risk management principles can be applied to
programs
– Use of an RBS will be helpful for programs
– Project risks will roll up to the program
– Program risks will take on a more global nature in
addition to the project risks within the program
 External events, company profits, legal/compliance issues,
political issues, company strategies
– Communication with your sponsors is even more
critical on programs than on projects
56
 Project Risk Management

References

57
 Project Risk Management
References

 PMBOK Fifth Edition

 Book – “Project and Program Risk Management”,
R. Max Wideman
 PMI Seminar – “Managing Risk on Projects”,
Jimmie West

58