Project 3

CEPM503_printable.pdf

Home >Business & Finance homework help >Project 3

CEPM503: Assessing, Managing, and Mitigating Project Risk

What you'll do

Define project risks and iterative process for the identification of evolving risks Employ practical tools to assess the likelihood and probable consequences of risks Evaluate possible responses and mitigations Use strategies for evaluating risk with an objective eye, overcoming commonplace mental biases that may cloud judgment

Course Description

The term "risk" is used loosely in many contexts. For project managers, project risks relate not just to delays and to cost overruns but to anything that will pose a

threat to the work or to the organization meeting its goals. It's important for project managers to be able to understand risk and to apply strategies to mitigate its negative effects and manage risk effectively. In this course, from Linda K. Nozick, director and professor of Civil and Environmental Engineering at Cornell, students will examine risk specifically in terms of the threats that can lead to undesirable outcomes on their projects. Students will examine risk through two lenses: the probability that the threat will become reality and the expected consequences if it does.

This course is designed as a high-level introduction to risk assessment and control for seasoned project managers who seek better practical results for their teams and organizations. The tools and strategies presented here will help project managers start to think about risks in terms of the likelihood of occurrence and probable consequences, and try to develop their thinking about what they can do in response. This course

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

does assume that you have formal project management experience as well as familiarity with standard tools, such as project networks and work breakdown structures.

Linda K. Nozick Professor and Director of Civil and Environmental Engineering College of Engineering, Cornell University

Linda K. Nozick is professor and director of Civil and Environmental Engineering at Cornell University. She is a past director of the College Program in Systems Engineering, a program she co-founded. She has been the recipient of several awards including a CAREER award from the National Science Foundation and a Presidential Early Career Award for Scientists and Engineers from President Clinton for "the development of innovative solutions to problems associated with the transportation of hazardous waste." She has authored over 60 peer-reviewed publications, many focused on transportation, the movement of hazardous materials and the modeling of critical infrastructure systems. She has been an associate editor for Naval Research Logistics and a member of the editorial board of Transportation Research Part A. She has served on two National Academy Committees to advise the US Department of Energy on renewal of their infrastructure. During the 1998-1999 academic year, she was a visiting associate professor in the Operations Research Department at the Naval Postgraduate School in Monterey, California. Professor Nozick holds a BS in Systems Analysis and Engineering from George Washington University and a MSE and PhD in Systems Engineering from the University of Pennsylvania.

Author Welcome

The ability to make good decisions when there is risk is critical to good project planning and scheduling. In fact, it's critical to sound decision- making in many business contexts. This course discusses qualitative and quantitative tools for risk analysis, as well as some actions you can take to stem the biases that arise from cognitive heuristics that we subconsciously employ to speed decision-making.

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

Table of Contents

Module 1: Assess Risk

1. Module One Introduction: Assess Risk 2. Watch: What Risk Is 3. Read: Types of Risk (and Your Response) 4. Your Experience with Risk 5. Watch: Risk Analysis 6. Read: Using Decision Trees to Compute Value Across Options 7. Course Project, Part One: Assessing Risk 8. Module One Wrap-up: Assess Risk

Module 2: Examine Risk

1. Module Two Introduction: Examine Risk 2. Watch: Using a Stoplight Chart 3. Read: Illustrated Stoplight Chart Example 4. Tool: Create a Stoplight Chart for Your Project 5. Watch: How Does this Apply to Project Management? 6. Activity: Apply to a Sample Project 7. Read: Analyzing that Risk 8. Watch: Looking at Risk Analysis in Project Scheduling 9. Watch: What are Risk Attitudes? 10. Read: Why People's Risk Attitudes Matter to You 11. Tool: Discussing Risk Attitudes 12. Course Project, Part Two: Examining Risk 13. Module Two Wrap-up: Examine Risk

Module 3: Manage Risk

1. Module Three Introduction: Manage Risk 2. Watch: Heuristics and Biases 3. Watch: Availability Heuristic

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

4. Watch: Representation Heuristic 5. Watch: Anchoring and Adjustment Heuristic 6. Watch: Confirmation Trap Heuristic 7. Heuristics and You 8. Tool: Working with Heuristics 9. Course Project, Part Three: Managing Risk 10. Module Three Wrap-up: Manage Risk 11. Read: Thank You and Farewell

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

Module 1: Assess Risk 1. Module One Introduction: Assess Risk 2. Watch: What Risk Is 3. Read: Types of Risk (and Your Response) 4. Your Experience with Risk 5. Watch: Risk Analysis 6. Read: Using Decision Trees to Compute Value Across Options 7. Course Project, Part One: Assessing Risk 8. Module One Wrap-up: Assess Risk

Back to Table of Contents

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

Module One Introduction: Assess Risk

As individuals, we deal with personal risks every day, and we make decisions on a regular basis to try to manage those risks. Every time you get into a car, there's a possibility you'll get into an accident. We try to mitigate the consequences should an accident occur. We might

wear seat belts; we might make sure children are properly restrained in the back seat. We pay money on a regular basis for auto insurance to enjoy the ability to transfer the implications of the financial risk of an accident from us to our insurance carrier. When we think about our retirement accounts, we decide where to invest our money. We generally don't keep it in cash under our mattress; we put it in a financial instrument of some sort. And that financial instrument carries the promise of a positive return and the risk of a negative return, or a loss. In this module, you will examine the nature of risks and consequences in the specific context of project management. What are the risks that are present in project work, and how do project managers identify and assess them?

Back to Table of Contents

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

Watch: What Risk Is

Professor Nozick will begin with a discussion of what risk is in the context of project management work, and the considerations that go into how we think about the risks facing our projects.

The domain that you're in will dictate the nature of the consequences you face and whether they're relevant to you. When you think about financial investments, you think about economic risks, but there are all kinds of other risks. If you're thinking about implementing an environmental technology, there are risks associated with environmental well-being, for example: chemical risks, social risks, and so on. And many times, it's not a single kind of consequence that you're dealing with; the consequences are multi-dimensional. There will be a mix of economic and environmental risks, for example, or a mix of social and environmental risks.

Transcript

Risk is a very commonly used term. Let's talk very specifically about what it means. Risk is a threat, or a set of threats, that can lead to undesirable outcomes. Sometimes those threats can be mitigated by taking some kind of protective or preemptive action that will insulate us from the consequences of those risks.

There are two core elements to risk. One is the probability of something occurring, how likely is it? The other thing is, what exactly could occur? What are the consequences? There's a very commonly used formula, and you'll see it very frequently, that says risk equals the product of probability and consequences. One of the positive sides of this formula is that it emphasizes two notions; for a risk to be real, the probability has to exist. It has to be possible for something to happen. And, the consequences have to be real, they have to exist. There must be some negative consequence associated with its occurrence, the event happening. Sometimes, there may be multiple possible consequences which could occur, some of which are positive, and some of which are negative.

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

For example, think about the risks associated with an investment. When you make an investment, there is a positive probability that you'll get some positive, some return, some positive return. There's also likely to be a positive probability that you'll lose some money, a negative return. Okay, so when you think about an investment, you often think of positive consequences and their probabilities of occurrence, and the negative consequences and their probabilities of occurrence. From a financial perspective, we think about dividing those into upside and downside risks. Okay, upside is the risk associated with positive returns and downside is the risk associated with negative returns, or losing money.

This formula, risk equals probability times consequences, is very commonly used. I think it's important to think carefully about that formula in that it does have a weakness. It doesn't differentiate between a high probability outcome with very modest consequences, and a low probability outcome with very drastic consequences. It's very likely that you might feel quite different about each of those. You might be more accepting of a risk that has a high probability of occurring, but a relatively modest consequence versus something with a low probability of occurrence, but a very drastic consequence. Generally, the focus in risk analysis is controlling the possibility of negative consequences. You think of these as pure risks, only losses are possible. It's important to realize that in many situations in which risk is a key concern, there's also benefits.

So, there's a speculative, or opportunity risks, both losses or gains are possible. Now the domain is going to dictate the nature of the consequences. When we talk about financial investments we think about economic. But there are also risks associated with environmental well being for example. You could be thinking about an environmental technology and implementing something and it may have different possibilities for how effective it will be. Chemical, social, there's all kinds of different risks out there. And it depends on the domains which ones are relevant. And many times its not a single kind of consequence you're dealing with, but the consequences are multidimensional. It's a mixture of economic and environmental for example, social and environmental. We deal with personal risks every day. We make decisions on a regular basis to try to manage those risks.

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

A common risk we take, and every one of us takes who drives, is the risk of having an accident. Okay, every time you get into a car there's a possibility you'll get into an accident. How do we guard against that risk? Well, we do somethings to try to mitigate the consequences should an accident occur. Example of that might be wearing seat belts. Making sure children are properly restrained in the backseat. There are other things we do to transfer the financial implications of that risk. So we buy automobile insurance. It doesn't take away the financial consequences of a car accident in a concrete sense. If an accident occurs there will be damage to the vehicle, it could be health insurance issues But it does transfer who pays for those. It transfers the risk from us to our insurance carrier and we pay some money on a regular basis to enjoy that ability to transfer that risk.

Another personal risk we take all the time is when we think about our retirement accounts and we decide where to invest our money. We generally don't keep it in cash under our mattress. We put it in a financial instrument of some sort. And that financial instrument carries the promise of a positive return and the risk of a negative return, or a loss.

Back to Table of Contents

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

Read: Types of Risk (and Your Response)

• All businesses face risks that can affect productivity and profitability

• By considering the risks your organization faces, you can plan mitigation strategies

• There are many risks that run through business enterprises. Let's examine some of them.

Competitive Risk

One of the key risks is competitive or innovative risk. This is about making sure you have the right product at the right time. Maybe one of your rivals develops a better product or a better innovation than you're able to produce. Companies that fail to mitigate competitive risks often suffer fairly negative consequences. Think about the transition to the digital camera from film that changed an entire industry, or likewise, the iPhone and the creation of smartphones, which also changed an entire industry. Competitive risk refers to the threats posed by the actions of your rivals in the industry, as well as how you respond to them.

Reputation Risk

Reputation risk is another critical risk that businesses face. Customers have to believe in you to be willing to purchase your product, so your reputation is really worth a lot. Risks to reputation must be taken very seriously. A simple example of a risk to a company's reputation is a restaurant that is found to be in serious violation of health codes; the restaurant will lose customers. A famous example of reputation risk was the poisoning of Tylenol pain-medication capsules on US store shelves in 1982. Seven people died as a result of an unknown person tampering with the products and adding cyanide. The crisis that followed resulted in

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

not only huge losses for the company and damage to Tylenol's reputation and the public's trust, but improvements to tamper-resistant seals on medication bottles. (Tylenol's subsequent handling of that crisis has become a textbook study in crisis management.)

Operational Risk

In order to be effective in business, you have to be able to produce the product or the service on time, and this is operational risk. There are lots of reasons why you might run into operational issues. For instance, your supplier might have delivery problems. They may have manufacturing problems themselves. Just-in-time delivery practices can sometimes cause quite a lot of problems when a natural hazard occurs, like a hurricane or an earthquake. Also, projects can fail. Your product may be the the delivery of an intellectual product. If that project doesn't come to fruition, you've now got a big operational problem to handle and it's a big negative to address.

Technological Risk

Information technology, while it's helped businesses move forward at leaps and bounds, also poses risks. You could make a mistake and invest in the wrong hardware or software, in which case your investment is worthless and you now need to go move to some other platform. That causes tremendous business interruption issues. You could also have a security breach into your information system. That certainly happened to quite a few companies with individuals' personal information. That poses a big risk to the organization's reputation and it's a tremendous financial issue for security. Viruses can come in and infect your systems. Information technology is a huge financial exposure and also it can cause tremendous issues if it isn't managed well.

Human Resource Risk

This includes a hiring risk: you've hired the wrong people. People are at the center of every company. You need the right people for innovation, you need the people to actually produce the product or the services. Sometimes, it's a few key people that can really make the difference in

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

innovation. Losing them can be catastrophic. So, the loss of some individuals is a risk. Human resources can also pose liability issues, if they act in a way that's inconsistent with the law, for example, or they create an environment which is not conducive to being productive. Another human resources risk relates to workplace safety; someone can get hurt on the job.

Regulatory Risk

All businesses must comply with legal requirements. Even someone who makes an innocent mistake can cause regulatory issues, but this could also involve someone choosing not to comply with legal requirements, which is another level of exposure. Another risk: new government regulations can be issued that can have a dramatic effect on your business and the way that you operate.

Financial Risk

Insufficient revenues are a financial risk. You have to have enough money coming in to actually operate. Currency: in the worldwide currency market, currencies fluctuate. Depending on how your business is organized, those could hurt you. Some of the costs for your raw materials, for instance, may rise, if you're procuring them abroad and your country's currency has declined, for example. You may be unsuccessful in attracting sufficient capital. Inflation can happen. It could have nothing to do with you, but if there's financial hardship in the greater economy, people may not buy your product at the rate you need them to.

The Drivers of Reputation Risk

Research has shown that organizations across industries and across the globe consider a few things to be the most important drivers of reputation risk. When organizations look at reputation risk, these are the top areas in which people are concerned and they seek to mitigate those risks:

Ethics and the integrity of your employees, (that is, that your employees stay clear of fraud, bribery, corruption; that they're doing the right thing);

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

That the actual product or service you are providing is safe, that it does no harm to people or to the environment; And the organization's security (both physical and cyber systems).

There is also some focus on financial issues tied to reporting and accounting, especially in the financial services sector.

Response to Risk

We begin with the idea that you would do something to try to respond: to try to curtail these risks and try to control them. Mitigation is our opportunity to try to control the risks. What are some common mitigations?

A big element of mitigation is investing in people: people must understand what they should be doing (and should not be doing). This relates to choosing people who are qualified to do their jobs well and training and supervising them on the job so that they can perform their jobs properly and ethically. Another mitigation strategy is investing in data. This means making sure that you're monitoring things properly, that confidential information is protected, that social media is being used properly, that surveying is done well. Another element is investing in technologies to try to address reputation risk. Is your equipment up to date, safe to use, and functioning properly? Are facilities and work areas well maintained and protected? Are people following procedures and protocols? And then, another element is trying to further refine the risk processes so that you have good processes in place to address risks. Finally, on the back end of this is to work on crisis management. When negative things happen, how effective are you at responding?

Back to Table of Contents

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

Your Experience with Risk

Instructions:

You are required to participate in both of the discussions in this course.

Discussion topic:

Risk is ubiquitous in project work and in all business. Create a post in which you respond to the following:

1. In your experience, are project managers and teams in the habit of identifying and discussing risks to their project work?

2. Is it your common practice to think about or develop mitigation plans for likely risks? Briefly share your experience.

To participate in this discussion:

Click Reply to post a comment or reply to another comment. Please consider that this is a professional forum; courtesy and professional language and tone are expected. Before posting, please review eCornell's policy regarding plagiarism (the presentation of someone else's work as your own without source credit).

Back to Table of Contents

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

https://s3.amazonaws.com/ecornell/global/eCornellPlagiarismPolicy.pdf

Watch: Risk Analysis

So far, you have looked at what risk is and some of the different ways that risks present threats in different areas. It's not enough to know that risks exist; you need to be able to analyze the risks that are present and make good mitigation decisions. Professor Nozick explains more.

Transcript

Risk analysis is the process of defining and analyzing adverse events that may occur with the goal of making good mitigation decisions. Ideally, it's a quantitative process so that the connection between the risk and the mitigation impacts can be clearly understood. Quantitative risk analysis is often referred to a probabilistic risk assessment, or probabilistic risk analysis, or PRA. In some domains, it's hard to quantify some of the elements of the situation, so a more qualitative approach needs to be taken.

Either approach is valid, it just depends on the situation you're in as to which one can actually be executed well. So the steps in risk analysis, whether it's quantitative or qualitative, they're the same. You need to identify the risks, you need to figure out how likely each risk is. It may be possible to come up with an actual number. It may not be, and you may have to categorize the risk as, for instance, rare, likely, unlikely, very likely. For each one of the consequences you have, for each one of the risks, you then have to identify the consequences. Then, you need to identify what mitigation options are available for each risk or collection of risks. Then, you need to decide whether or not to mitigate. And if you are going to mitigate, how are you going to mitigate.

Back to Table of Contents

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

Read: Using Decision Trees to Compute Value Across Options

• Decision trees are graphs that help you weigh choices

• Decision trees help you compute expected value across options

A decision tree is a very useful technique used in risk analysis. It's a graph that makes it easy to compute the expected value across all of the options that you have and to identify which of those available choices is associated with the highest expected value. It shows decision points over time, and the points at which uncertainty is resolved. A decision tree can be augmented to include things like options for mitigation, so that you can decide which mitigations make the most sense in the expected value context.

An Illustrated Example of a Decision Tree

Let's explore how a decision tree works within the context of an example. Suppose there are two pieces of property that you are (or your organization is) considering purchasing, and there's a rumor that a large entertainment complex might be developed near one or the other of them. We'll call the two sites A and B. Having a large entertainment complex built near a property would certainly drive the value up. It's also possible, though, that this entertainment company will choose not to locate its complex near either site A or B.

Several things could happen:

If the complex locates near A, then A will increase in value. If the complex locates near B, then B will increase in value. If the complex doesn't locate near either site A or B, then the hoped- for increase in value will not come to fruition. A's value will fall from its

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

purchase price, and B's value will fall from its purchase price.

Suppose site A costs $6 million to purchase, and site B costs $7 million to purchase.

It's important to notice that, in this example, there's the possibility for both positive and negative returns. For the sake of this examination, let's attach some likelihoods to different outcomes. Suppose there's an 80% chance that the complex will be located near one of the two sites, A or B. Further suppose that if the complex is located near one of the two sites, there's an 80% chance that site A will be selected, and a 20% chance site B will be selected. Using that information, you can create a decision tree.

On the left hand side are the four choices you are confronted with:

1. You could buy property A; 2. You could buy property B; 3. You could buy both properties, A and B; 4. You could walk away and purchase neither A nor B.

Regardless of which decision you make, uncertainty will reveal itself: the entertainment complex will locate near site A, near site B, or near neither of them.

So the decision tree graph starts with a decision node on the left hand side. Notice it's a rectangle. Out of that rectangle come four arcs. Each one of the arcs corresponds to one of the available choices. You can only make one of those four choices. (Even if you do nothing, you've made a choice.) At the end of the arc that describes the choice you make, there's a circle, a chance node, and that illustrates uncertainty revealing itself.

Suppose site A costs $6 million to purchase, and site B costs $7 million to purchase. Several things could happen. As you move to the right of the chance nodes, notice what can occur.

If the complex locates near A, then A will increase in value from $6 million to $9 million. If the complex doesn't locate near A, then A will fall in value from $6

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

million to $3 million. If the complex locates near B, then B will increase in value from $7 million to $12 million. If the complex doesn't locate near B, then B will fall in value from $7 million to $4 million. If the complex doesn't locate near either site A or B, then that increased value doesn't come to fruition for either property, and in fact, both properties' value will fall from their purchase price.

So let's examine the first choice: $6 million buys property A. If the entertainment complex locates near site A, that property that you spent $6 million for is now worth $9 million. There's a 64% chance that will occur. There is also, then, a 36% percent chance that the complex won't locate near site A. And your $6 million investment will only be worth $3 million. So that's a 36% chance of a negative return. There's a 64% chance you'll get a positive return, an extra $3 million, and a 36% chance that you'll lose half your investment.

The same logic applies to the interpretation of the path going through the decision to buy B. If you buy B, that $7 million dollar investment is worth considerably more if site B is selected for the entertainment complex. But there's only a 16% chance that will happen. There's an 84% chance that the complex won't be located near B and the $7 million dollar investment will then be worth $4 million.

What we need to do to understand what the best decision is in an expected value sense is to compute the expected value associated with each of the four choices:

Buy A; Buy B; Buy A and B; Buy neither A nor B.

Which is the best decision on expectation? To find out, let's step through each of those and compute the expected value.

Examine the decision of purchasing site A at a cost of $6 million. That represents a 100% chance, if you choose A, to put the $6 million on the

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

table. If the entertainment complex is located near site A, you get $9 million. There is a 64% chance you will get $9 million and a 36% chance the $6 million investment will be worth $3 million.

We can compute the expected value of that choice:

-6M +0.64 x 9M +0.36 x 3M = 0.84M

It's important to notice that you will not actually get $0.84 million. You will get a return of $3 million extra or you will lose $3 million. That's what's meant by expected value. Expected value doesn't map to one of the actual outcomes you will see when you execute this investment; it's the weighted average of what you could see.

You can do the same calculation for the decision of purchasing site B. The relevant number is $7 million paid for 100% of securing site B, and then a 16% chance of walking away with $12 million; an 84% chance of walking away with $4 million. That will leave you in the hole, on expectation, -$1.72 million.

-7M + 0.16 x 12M + 0.84 x 4M = -1.72

Does that mean you will never make money if you buy site B? No. If you buy site B and the entertainment complex locates near B, its value will increase to $12 million; you will have seen an increase of value on your investment of $5 million.

Let's examine the same calculation for the decision to purchase both sites, A and B. In that case, it's a $13 million purchase price for both. There's a 64% chance of walking away with $13 million. Why? Consider the whole: If they locate the entertainment complex near site A, the value of A increases to $9 million; but that also means that the entertainment complex will not be located near site B, so your property at B will no longer be worth $7 million, it will be worth $4 million. So $9 million plus $4 million will be $13 million you will walk away with if, in fact the complex, is located at B.

What if you purchase both sites and the complex does not locate near A or B? You would get decline in value of the $13 million investment; Site A and Site B will no longer be worth the $13 million purchase price;

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

together, they will be worth $7 million. That choice has a fairly substantial expected loss associated with it on expectation.

So when you do that analysis, based on expectation, the best decision is to buy A.

Back to Table of Contents

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

Course Project, Part One: Assessing Risk

As you have seen, it's critical for project managers to develop the ability to assess the risks that may be present in a project. In this part of the course project, you will work on assessing the risks that were present in one of your own projects, and conduct some analysis of them. Completion of this project is a course requirement.

Instructions:

Download the "Assessing, Managing, and Mitigating Project Risk" course project. Complete Part One. Save your work. You will not submit your work now. You will submit your completed project at the end of the course for instructor review and credit.

Before you begin:

Review the grading rubric for this assignment. Please review eCornell's policy regarding plagiarism.

Back to Table of Contents

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

https://s3.amazonaws.com/ecornell/content/CEPM/CEPM503/CEPM503_course_project.docx

https://s3.amazonaws.com/ecornell/global/eCornellPlagiarismPolicy.pdf

Module One Wrap-up: Assess Risk

As individuals, we deal with personal risks every day, and we make decisions on a regular basis to try to manage those risks. We try to mitigate the consequences should an accident occur. We might make decisions about insurance, safety measures, and other precautions in order to reduce the probability of risks coming to fruition and to mitigate their harmful effects should they become reality. In this module, you examined the nature of risks and consequences in the specific context of project management. You examined the strategies that project managers use to assess and predict risks, and the ways that you can begin to both think about risk and try to put precautions and mitigations in place.

Back to Table of Contents

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

Module 2: Examine Risk 1. Module Two Introduction: Examine Risk 2. Watch: Using a Stoplight Chart 3. Read: Illustrated Stoplight Chart Example 4. Tool: Create a Stoplight Chart for Your Project 5. Watch: How Does this Apply to Project Management? 6. Activity: Apply to a Sample Project 7. Read: Analyzing that Risk 8. Watch: Looking at Risk Analysis in Project Scheduling 9. Watch: What are Risk Attitudes? 10. Read: Why People's Risk Attitudes Matter to You 11. Tool: Discussing Risk Attitudes 12. Course Project, Part Two: Examining Risk 13. Module Two Wrap-up: Examine Risk

Back to Table of Contents

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

Module Two Introduction: Examine Risk

Are you typically risk averse? Does ambiguity in project work make you uneasy? Or are you comfortable with great levels of risk and able to envision positive outcomes and opportunities? The way that you think about risk, and the way that other people on your projects (including

funders, stakeholders, and clients) think about risk will be enormously influential as decisions get made. In this module, you will examine risk attitudes. You will use a tool to assess, in qualitative terms, the probabilities and consequences of potential threats. You will also practice applying risk to a sample project network, and observing the changes that may follow.

Back to Table of Contents

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

Watch: Using a Stoplight Chart

Sometimes you will need to examine risk from a qualitative perspective as opposed to a quantitative perspective. You may not know with certainty whether a risk has a 75% chance of occurring, but you can make a reasonable analysis in terms of it being high risk, medium risk, or low risk. Professor Nozick will discuss a very helpful tool you can use to work with in this regard.

Transcript

So, in the last example, when we did decision trees, that was a very quantitative look at the situation. We had probabilities that a site, that the entertainment complex would be selected, if it located near A or B. We had a probability that it would be selected, would be sited near A if it was going to be sited. We had dollar values for the cost to buy the property, the value of the property if the complex was located near it or not. And then we did a very quantitative calculation to find the expected value of each of the decisions so we could pick the best one, the one with the highest expected value.

Sometimes, you don't have all the numbers to do that kind of a rigorous analysis. And so, you still need to do a risk analysis. The question is still there, and you still need to find a defensible way to analyze it and come to a choice, but you can't use some of those tools that require so much quantitative data. One very useful mechanism is something called a stoplight chart. It's, that chart still has the same dimensions as the risk analysis, all the risk analysis material we've already been discussing, the idea that risk is based on probability and consequence. That notion is still very clearly there. But now it's a qualitative description of what the probabilities are and what the consequences are.

So, for example, for probability, instead of being able to say, there is 80% chance they will locate the entertainment complex at site A or B, you wind up saying is the probability of this thing will happen, very low, low, medium or high. And medium and high don't necessarily relate to specific values of probability, they're relative to each other. They're a frequency

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

that, if it's high, it's quite frequent, in terms of that context. And high is much higher frequency than very low. Okay, and the same logic applies to the consequence dimension of the stoplight chart.

Instead of being able to say this is the dollar value of the consequence, because not everything has a dollar value, you wind up saying, are the consequences low, medium, high or catastrophic? Imagine you're doing, you have an application domain and this has to do with your reputation, or damage to your reputation. There's clearly going to be a financial element to that, but there's also likely to be losses that are beyond the financial. Okay, so consequences of low, medium, high, catastrophic. And those categories are not necessarily the right ones in every single domain. You pick consequence descriptions that match the application you're in. Once you find those categories of probability and those categories of consequence, you then say, well, does this combination of a particular probability category and a particular consequence category concern me a lot? Not much, not at all?

So, if you said not at all, you'd associate that combination with a green light. Like, for example, very low probability, and low consequence in this example. Maybe you're too worried about that, maybe the same is true for low probability, and low consequence. And then you associate a green with that one too. When you start to move up a little bit in consequence, and/or move up a little bit in probability, maybe you start to get a little more nervous, and then you associate a yellow with those. So, in this case we associated a medium consequence and a very low probability with a yellow light. A medium probability and a low consequence with a medium light. Because now that consequence, while it's low, is happening more frequently and now we're a little worried. And you notice, even at low consequence high probability got a red light. Because maybe it's happening so frequently that it is actually becoming a significant issue.

So, it's very subjective which combinations of probability and consequence get a green light, a yellow light or a red light. It's part of the qualitative process of trying to figure out how concerned you are of a particular consequence. One the most important parts of a stoplight chart is that it forces you to go through and think very carefully through the probabilities, through the consequences, and then put your outcomes,

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

the things that can happen, in the context of that green, yellow, red. That makes this process very visible to the people around you, you get input very easily. It makes all the decision-making very visible. It's a very positive and powerful tool. Even though it's not quantitative, it's still extremely valuable.

Back to Table of Contents

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

Read: Illustrated Stoplight Chart Example

• A stoplight chart helps you identify risks in terms of probability and consequence

• Once you identify risks, you look for possible mitigations

In this example, we will use a daycare center serving small children to examine the value of using a stoplight chart. The positive aspect of using a daycare center for an example is that we all have some intuition about a daycare center and the activities that take place there. The negative aspect is everything that could go wrong in a daycare center seems pretty catastrophic, since children's health and safety is at issue.

For the purposes of this example, let's limit our thinking to four possibilities of what could happen in a daycare center, and we'll use a stoplight chart to develop our analysis.

Notice that for this stoplight chart, the probabilities are ranked from very low to high; the consequences are ranked from low to catastrophic. (Catastrophic, again, because in a daycare center, children could be at risk.)

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

Link to full description of stoplight chart

Consider four possible risks:

Someone trips and falls A child falls against sharp/hard objects A child leaves without staff noticing Someone gains unauthorized entry

Where would you place each of these risks on the stoplight chart? Where you place each possible risk that could happen in this chart is clearly up to debate and discussion. For the purposes of illustration here, we'll make a reasonable choice about where to place each risk on the chart, consider whether to undertake some mitigation, and consider what that mitigation might look like.

Risk 1

Start on the low end for the consequences: trips and falls. A daycare center has staff, (people who are carrying babies around), and it has children, including young children who are just learning to walk. Trips and falls will clearly be an issue in a daycare center.

Risk 2

Another risk is that a child who falls could hit himself against a sharp or

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

hard object. That's another kind of trip and fall.

Risk 3

A third possibility is that a child could try to leave the property and the staff might not notice. So this could be a child playing and somehow manages to get off the property or headed toward a place where there would be no adult supervision.

Risk 4

A fourth kind of outcome that we are interested in thinking about is unauthorized entry: People who shouldn't be in the daycare center gain access, and they may be up to no good.

So we've identified four events. We have identified that these events are both possible and have negative consequences. So we place them on the stoplight chart: on the X axis, or horizontal, we can rate them from very low to high for probability, and on the Y axis, or vertical, we can rate them from low to catastrophic for consequences. So you, as the project manager, could make reasonable judgments about where to place each of those risks. (We've placed them on this chart as dots for illustrative purposes, but those risks could reasonably have been placed elsewhere on this chart. A stoplight chart is somewhat subjective as you make assessments and judgments.)

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

Questions

Then you start asking yourself and your team questions:

Who do each of these risks affect? What might we do to mitigate these risks?

And then you will use those questions and answers as a way to make some decisions.

Let's start with arguably the easiest of the four: trips and falls. Let's assume there are no stairs, so we're not necessarily talking about catastrophic falls down the steps. In doing this risk analysis, you'd ask yourself: Who would this affect? -Children, staff, visitors? In the case of a daycare center, trips and falls could affect everybody.

Mitigation 1

So now we can ask ourselves: What can we do to mitigate trips and falls? One mitigation is just good housekeeping: make sure the rooms are picked up regularly during the day so that there are no toys to trip over. You could implement a policy about how frequently the floor is cleared, for example. And you might use a resource assignment as a mitigation strategy: you could mandate that individuals are assigned specifically to the task of picking up toys, or assign it to teachers to do along with their other tasks.

Mitigation 2

The second type of trip and fall we identified is that someone could fall against a hard or sharp object. Who does this affect? In the case of a daycare, this risk probably mostly affects the children themselves.

And what could you do to mitigate it? You could put protectors over the sharp surfaces. You could put edge protectors on furniture, file off pointy surfaces, install a soft floor covering, and so on.

Mitigation 3

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

If a child leaves the daycare center unattended: Who does this affect? It mainly affects the child, and the results could be disastrous.

What can you do to mitigate the risk of a child leaving the facility? You could have buzzers installed on the exit doors high enough that the children can't reach them. You could think about putting the locks on the exterior doors with keys, and then think carefully about fire safety and emergency exits and planning for an emergency response in that situation. You could choose to assign a staff member to be posted at each exit and monitor them.

Mitigation 4

In terms of the fourth risk of an unauthorized person entering the facility: that risk affects everyone, children and staff.

You could have a buzzer for entry. You could have staff at the door with sign-in sheets. You could require swipe cards so the only people that can get in are authorized parents and staff.

So you have now assessed threats and consequences and identified a list of possible mitigations. Those mitigations have different positives and negatives and they cost different amounts of money. Maybe some of the mitigations you came up with aren't feasible.

In Your Organization

So you can imagine that when you do this exercise within your own organization, you'd start out with that stoplight chart, and you'd go through conversations. You decide where to place each of your "dots," representing risks, on your stoplight chart, and then you'd pose questions about possible mitigations. And based on the mitigations you adopted, you'd expect that those dots would move somewhere on that chart. Hopefully you are able to move those dots to lower probability and lower consequence. We would expect that the amount of movement will be dictated by how big of an investment you're making. It may be a financial investment. It may also be an investment in overhauling processes and procedures. If could be educational: an awareness of risk and response that will cause those risks to shift.

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

Tool: Create a Stoplight Chart for Your Project

• Use the Stoplight Chart whenever you need to identify risks and mitigations

You may find it helpful to download the blank Stoplight Chart on this page and save it to use it for your projects, whenever you need to identify risks, categorize them in terms of consequences and probability, and consider mitigations. You may find that you want to use it for stakeholder discussions or with your project team whenever you are kicking off new work, or when a change request is implemented, or at any point during the project that you find it helpful.

Back to Table of Contents

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

https://s3.amazonaws.com/ecornell/content/CEPM/CEPM503/CEPM503_Tool_Stop_Light_Chart.pdf

Watch: How Does this Apply to Project Management?

Project managers deal with layers of complexity and uncertainty, and as Professor Nozick explains, you will continue to deal with uncertainty and mitigate risks on an ongoing basis as your project evolves over time.

Transcript

So, how do all these ideas apply to project management. Well, after the work breakdown structure is completed, you have a task structure. One illustration of all this fits is now you have uncertainty when you think about that task structure in most the vast majority of projects. For instance there might be uncertainty around how complex a task or tasks will actually be. That might not be fully understood when you do the full work breakdown structure. Or maybe understood will be very uncertain and that goes right the analysis, but certainly there's an evolution of learning as you go through the project. And that will influence how that project evolves over time.

There's also likely to be uncertainty in the ability of team members to handle that complexity. So, you may start with one group of team members, and then find out a particular task is particularly complex, and now have a risk issue. Of who's really going to be able to bring that particular activity to completion. You can have staff turn over. Start your project you think you have person A and B doing it and they're very effective and they have a lot of experience and then they decide to do something different and now you have new people. And then another piece of uncertainty may be the facilities you planned on having available are not actually available. Or the funds available to execute the tasks are lower than you anticipated. So these are just a few dimensions of the uncertainty that you could face as you run your project.

Back to Table of Contents

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

Activity: Apply to a Sample Project

Let's think about this in a little more concrete terms by thinking about a project network through the lens of risk analysis. Let's think about the potential threats that might jeopardize a sample project.

The sample project network shown below relates to building a tree house.

As you can see, the activities are simple:

Pick your trees. Have someone design your tree house. Purchase the tools and materials, and prepare the trees. Build and mount the main supports. Do the layout and build the platform and railing. Complete the interior design and build the structure. Purchase and install the interior items.

Now, imagine you are the project manager who is tasked with adding risk into the project plans. You begin by making a list of possible threats to the success of that project. Try brainstorming your own list of possible risks to this project. Spend five to 10 minutes thinking it through and jot down your ideas. For each risk that you think of, ask yourself: is it high risk or low risk? And for each of those risks, what might be a mitigation?

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

The purpose of this exercise is to practice brainstorming a list of possible risks, assessing their threat level, and considering mitigations. This activity is not graded, but it is highly recommended that you complete it to further your own understanding.

Back to Table of Contents

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

Read: Analyzing that Risk

After you have had a chance to brainstorm a list of possible risks and mitigations to the sample tree house project and you've come up with your ideas about both, read on for Professor Nozick's analysis of the same project. (If you have not yet completed the activity on the previous page, it is highly recommended that you do so now to get the greatest value from this teaching.)

When you have completed your analysis,

click the project network below to reveal Professor Nozick's analysis.

Professor Nozick's Analysis:

I. Possible Risks

For our sample tree house project, a list of risks might look like this:

You lack the necessary skills to build a tree house. You hire someone else to build the tree house for you, but he lacks the right technical skills to do the work. The person building the tree house could get injured on the job. The child might not like the tree house design or the interior design.

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

Your yard may not have the kind of sturdy trees necessary to support a tree house. A hurricane might come and knock down the tree house while you're making it.

II. High Risk or Low Risk?

For each one of the risks identified above, we have to think through how high or low this risk is.

First, think about the person who does not have the technical skills to do the work. This could be very low risk. You could be hiring someone qualified to do it, or you yourself may be a carpenter, in which case, maybe building this tree house is pretty easy for you. Alternatively, this could be a high-risk issue, because maybe the person you hired has never built anything like that before. So, depending on who you choose to do the work, this task could be low risk or high risk and anything in between.

Consider the risk that the person might get hurt doing the work. That may depend, in large part, on the skills and experience of the person you choose. So again, this risk can range from a very low risk to a very high risk.

Another risk we identified was that the child might not like the tree house design or the interior design. Let's list that as low risk: assume we know this child's particular taste and we have reason to believe this child would like a tree house.

We might not have good trees for the tree house: we've identified that as a possibility. Well, we can assume that the person in charge has thought about this. And so maybe this has a very low likelihood of being a threat.

Lastly, we've identified that a hurricane might come and knock the tree house down while it's under construction. For simplicity, maybe we'll go ahead and say these people are living in a non-hurricane area, so this is not a risk that is very important to us.

As this example illustrates, this is a brainstorming exercise. Your goal as

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

a project manager thinking about risks to your project is to identify a whole lot of possible risks. Some of them you and your team will be able to decide are not important or not relevant. But a lot will stay on that list. It's important that when you go through this process of trying to identify all the risks, you really don't want to stifle imagination; you want to let people think as inclusively as they can. It's easy to discard a risk off the list later and say, well, this really isn't a big risk. In this example, the risk of a hurricane happening is one such risk: imagine that it's not relevant in this region.

III. Mitigations

So now, you can go back through each one of those possible risks and then ask: What could I do to mitigate it?

For the first risk: the person hired does not have the technical skills to do the work. Our mitigation will be to hire someone who has the skills. So that's a requirement as you staff that project: I need to hire someone who has the skills to build the tree house. That make sense. So some of this risk assessment might actually inform your requirements as you go through the process of staffing.

For the risk that the person might get hurt doing the work: What could you do to mitigate that? Even a skilled person can get hurt. The mitigation could be: Make sure that they carry insurance before they come and build the tree house.

For the risk that the child does not like the tree house design or the interior design. You could mitigate that risk by asking the child to participate in the planning. The mitigation could be: Involve the child in the design and the interior decor decisions.

Consider the risk that you might not have suitably large, sturdy trees. That one might be a show stopper, because it's hard to put it in the very big trees that you would need for a tree house in short order. And consider that a hurricane might knock down the tree house while it's under construction. We've already decided that's unlikely in this region.

These last two risks, suitability of trees and hurricanes, we might

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

reasonably discard off our list of risks. We might say we don't need to plan mitigations for them because they're so unlikely in our scenario. We might say: In fact, we probably wouldn't have planned to put up a tree house if we didn't believe we had suitable trees, and we probably wouldn't have gone down this path if we expected hurricanes.

Back to Table of Contents

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

Watch: Looking at Risk Analysis in Project Scheduling

You can use your project network within the context of risk analysis work to help you identify risks in project scheduling, as Professor Nozick explains.

The word "critical" here is used in the traditional and general sense, not the formal sense as defined by the Project Management Institute.

Transcript Part One

So, risk analysis and project scheduling. In project scheduling, there is a lot of opportunity to quantitative risk analysis. Here's an example of such a situation. So this is a project network and I have six activities. And that if you look at the project network, there are some red arrows and some black ones. The red ones indicate the critical sequence for that project network. The black ones are activities that are not on the critical sequence.

So associated with each activity there's a duration. That's the number on top. And then there's a resource requirement, A or B. And for each one of the activities you're going to need a unit of A or a unit of B. Okay? For each time period that the activity is active. When you look at that project network, it seems quite simple to pass. It's actually quite complicated in that, it's really a combination of the resource and the president's requirements that in the rank of the project. And we have deterministic durations for each one of the activities. And we can see in the chart, over time, what's the use of resource a and resource b over time, and what activities is it assigned to? One of the approximations in this sort of an analysis is that the task durations are known with certainty.

Okay and so we get this tightly packed schedule and there's really a very little breathing room. And if you look at activity A, sorry resource type A, they're busy all the time with a little bit of slack, one period of slack in it and the rest of it is go go go. If any one of those activities runs a little bit longer then you expect, this project is going to run longer than expected.

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

Okay if it's among the critical sequence. If it's not in the critical sequence, it still may be long enough to cause an elongation of the project make span as well. Okay so risk analysis is a very useful idea in the project scheduling context because it gives you a sense of what your exposure might be in terms of project duration.

Okay, I’m going to go talk about risk analysis and project scheduling and I’m going to move towards a non resource constrained one, that’s really focused on uncertainty on the project durations, the activity durations. I want to keep, you to, keep in mind though, resources can also be an issue when you schedule and you have uncertainty in the project, in the activity durations. Okay? You can have, when you have a schedule like this this is going to be very challenging. If anything is late this whole project is going to go slow. Slower than you anticipated. Let's talk about this now and remove the resources from it. In reality the resources are always an issue, basically. Okay but I don't want to make it too complicated to start with.

So let's look at risk analysis and projects scheduling for an activity we'll soon that we have sort of seeing with each activity. Some probability duration. So distribution of duration for each one of the activities. And maybe we got that off of export opinion. So this is an activity I'm going to do The minimum duration is three weeks. The maximum duration is ten weeks. And the most likely is five weeks. So I don't know exactly how long this activity will take.

Transcript Part Two

Let's go back to our treehouse example because we can put probability distributions on durations in that example quite easily. I've associated now with each activity a minimum length of time, a maximum length of time and a most likely length of time. Okay so I can then effectively compute a probability distribution for the duration of the project okay? And I can do that through simulation.

For each one of the activities I can simply pull a random variable that comes from that distribution and then compute the project make span and do that over and over again. Okay and I've done that 10 times in this next table. I have 10 outcomes for that project. The expected length of

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

time of that project, with those durations, those probability distributions for durations is 42 hours. With a minimum of 34.1 and a maximum of 48. So since my activity durations were not known with certainty, my project duration is not known with certainty. It's also described by a probability distribution. Okay, that's well and good, that's my base-level schedule. It's important to notice, though, so in the first project network, we talked about a critical sequence. We talk about this without resources, we think critical path.

This next picture illustrates the activities that are along the critical path. In this case all the activities that are in brown are always on the critical path. Okay, so pick the trees, design the treehouse, build the main supports, layout and build platform and railing, build the structure, install the interior items. Those are always going to govern the length of your project. Now purchase tools and materials and prepare trees, 65% of the time preparing trees is on the critical path. 35% of the time purchase tools and materials is on the critical path. Okay? So doing this risk analysis we can understand which activities are going to govern the length of time it will take our project to complete. Interior design is never on the critical path. Purchase interior items, never on the critical path, because build structure simply takes so much longer.

So, one thing you can do in trying to understand in your project, which activities to focus on, is you can ask, gee, what's the correlation between each of my individual activities and the duration of the project? Okay in this case design the treehouse turns out to be highly correlated. Look, it takes 16 hours to do most likely as low as 12.8 as high as 22.4. There's a 93% or 0.93 linear correlation between the design the treehouse and the project duration. This gives you a sense of which activities to focus on and which ones are not quite as important.

So, risk analysis associated with project scheduling. It's really important to understand which tasks may become critical through the duration of the project. And you have things like PERT analysis, Program Evaluation Review Technique, to think about this. You have this Monte Carlo simulation exercise we just did. You can look at the resource and schedule critical path to do this. So when you understand which activities or which tasks may become critical to the duration project, that is govern the length of the project, now you know where to focus your attention and

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

look for ways to mitigate those risks.

So what can you do to mitigate those risks? You can hire people or put people in charge of those activities that have a higher level of skill. That skill may be technical. That skill may be personal. The ability to motivate others, the ability to keep track of what's going on. Okay. So, hiring people with a higher level of skills into those roles makes a lot of sense. You might potentially consider more staff in those activities than you might have initially thought. If something wasn't critical you might go, if it goes a little long, it's not such a big deal. I can be a little thinner on that side. You may not want to do that on things that are highly critical in terms of the driving the duration of the project.

So I say potentially more staff because more staff doesn't necessarily make things go faster. It has to be the right staff, and the right numbers. So this is a very complicated question of whether or not it's worth adding more staff to particular activities. And what kind of staff would be available to do that with. Also you might want to invest in processes that make issues that arise more visible, so that they can be addressed more frequently, more quickly. Okay so that this visibility and making things visible, that could be a place where you really focus attention on those activities that are particularly vulnerable.

And then you might also say, gee, you know this activity is really complex, it's likely to drive the duration of the project, do I need all the content in that task? Are they all features that are actually fundamental? Or are they things that are nice to have? And if they're just nice to have maybe you ask yourself hm, customer doesn't care that much, they're very complex, actually the customer may prefer a more reliable due date delivery of your product, than bells and whistles they don't care too much about on this task. So is it the right content? And make sure that that's true before you go down the path of mitigating and spending a lot of money doing that to mitigate something that wasn't so central in the first place.

So these are some suggestions about what to think about when you think about mitigating the risks associated with project scheduling. And of course you're going to assess the options for mitigation against the scope of the risk, the probability and the consequence. So each one of those

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

options against what does that mean for the reduction in risk that you would enjoy?

Back to Table of Contents

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

Watch: What are Risk Attitudes?

Risk attitudes refer to how people feel about uncertainties and outcomes. Not everyone feels the same. A person's attitudes are driven by how they perceive the probabilities and the consequences related to a risk. It's important for project managers to be aware of the ways that risk attitudes influence behavior and project decisions.

Transcript

So let's talk a little bit about risk attitudes. It is probably easiest to think about risk attitudes, again in the context of an example. So let's go back to this example focused on buying property. So if you remember that example, you had really four choices to make. Would you buy a property located at A, buy property located at B, buy the property located at A and B, or purchase nothing? And remember, there was a possibility that an entertainment complex would be located near A, or near B, or near neither of them. And if it was located near a piece of property you bought, you'd make quite a bit of money off of that. Okay?

So, if you purchased site A and the entertainment complex was located near site A, you'd get $9 million for a property that you actually only paid $6 million for, so you'd have a $3 million plus up. Of course if you buy property A and you put 6 million into it and the complex doesn't locate near A, the property is only worth 3 million now and you've effectively lost $3 million. Think about property B. If you purchase property B that'll cost you 7 million. If the entertainment complex is located near B, that property will now be worth 12 million and you've just made $5 million. That's only going to happen with a 16% chance however. There's an 84% chance in fact your $7 million investment will really only be worth $4 million at the end.

So, there's two outcomes if you buy property B. You'll either get $5 million with a 16% chance, or you'll lose $3 million with an 84% chance. If you buy A and B, there's a 64% chance it'll be a wash. That is, you'll buy A and B, that entertainment complex will be located near B, the value of property A will now be worth 9 million, but the value of property B is only

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

worth 4 million. So you get $13 million and it turns out 13 million is actually what you paid to purchase sites A and B in the first place, so there's no, you get nothing, it's a wash. There's a 16% chance you'll make $2 million. And a 20% chance that you'll lose $6 million.

So when we did a decision tree on that example, we then decided, in expectation, the best thing was to buy A because it had the highest expected value of the four choices you could make. Well that's all well and good, but maybe it's a little hard to think of expected value when you think of something you're only going to do once because you're not really going to see the expected value, you're going to see either a $3 million gain or a $3 million loss. And how you feel about that has a lot to do with your risk attitude.

So what are risk attitudes? They're how you feel about uncertainties and outcomes. Not everyone feels the same. It's driven by how someone perceives the probabilities and the consequences. And it's very important to be aware of risk attitudes because it will affect how people make decisions when it comes to risk. So here's an example, simple example. You had a choice, option at one, to get $1,000 with a probability of 100%. Or you could receive $500 with a probability at 50% or $1,500 with a probability of 50%.

Which do you prefer? That says a lot about your risk attitude. The expected value of option one is $1,000 because you're going to get that with 100% chance. The expected value of option two is also $1,000. Right? (0.5 x 500)+(0.5 x 1,500) = $1,000. If you're risk-averse, you might grab option one. I walk away with a $1,000 for sure. I give up the chance, the 50% chance, to walk away with $1,500. If you risk-seeking, risk- tolerant you might pick option two because there's a chance you'll wind up with a lot more money, an extra $500. And if you're risk neutral, you just don't care. To have the same expectation, one or two, it doesn't matter.

Back to Table of Contents

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

Read: Why People's Risk Attitudes Matter to You

• Risk attitudes affect behavior, choices, and decisions

• Project managers need to account for risk attitudes regarding possibilities and mitigations

So why is understanding an individual's risk attitude important? Risk attitudes affect behavior. Risk attitudes affect how individuals approach decision-making situations and how they evaluate different alternatives. That matters to you as a project manager because your stakeholders, customers, team members, and various decision makers will all have influential attitudes when it comes to discussing risks and mitigations.

For example, is your key stakeholder risk-averse? A risk-averse individual is generally not comfortable with uncertainty. That person will find situations with significant ambiguity challenging. He will certainly find it more challenging than someone who is risk-tolerant. The degree to which he's risk-averse will dictate the degree to which he has that sensitivity.

A person who is sensitive toward risk will take a more aggressive stance to try to mitigate against risk, and try to not choose options that have substantial risk. So understanding that a person is a risk-averse personality helps you understand how he will think about a choice.

Relevance to Project Work

Consider how this matters within your organization and within your project team: it doesn't just affect decisions related to risks. It also may color people's ability to look at opportunities and understand the benefits that might be associated with specific opportunities.

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

To generalize a little bit, a risk-averse person might tend to overreact to risks and then underreact to opportunities, because situations with uncertainty tend to make them nervous. This is in contrast to a person that's risk seeking or very risk tolerant. A person who is comfortable with uncertainty may, in fact, underestimate the scale of the risks that are present, which means they may not prepare adequately to address those risks. They may undervalue mitigation efforts to try to control some of the risks, and they may also underestimate the scope of work it might take to capitalize on an opportunity.

One attitude is not better or worse than the other. But for project managers, you need to recognize what people's attitudes about risk are, and then understand how it might tilt their choices. That's the real value. Consider your stakeholders, your project funders, or your team members. A risk-neutral person will be a little more balanced when looking at risks and rewards. They may be able to look a little more realistically at the situation.

All of these patterns are important to understand in an individual: whether that person likes risk or doesn't like risk, is comfortable with it, not comfortable with it, tolerant of it or not tolerant of it. The same comments apply to groups. Groups can be risk-averse, groups can be more risk- tolerant, groups can be more risk-neutral. These ideas will become important when you're working as a group to make decisions about mitigation strategies.

Influences on Risk Attitudes

What can influence a person's risk attitude? Are people always risk averse or risk tolerant forever and ever? The degree to which a person has those characteristics changes based on the situation. If you're in a situation in which you're very comfortable with the domain and you know the project requirements very well, you tend to feel a little bit more comfortable, relatively speaking, with the risks. You might not be quite as risk averse. If you're in an area in which you totally lack experience in the domain, you might have a high sensitivity to the level of risk. It could be that the more familiar you are, generally, the more tolerant you are of the risk; the amount of risk aversion may decline.

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

Another influence on your risk attitude is the probability of the actual occurrence of the risk. If something is very highly probable and you're risk-averse already, you tend to become more risk-averse. And when things have a very low probability of occurring, even if you're risk-averse, you tend to be a tiny bit more tolerant. The same is true with the magnitude of consequences. If you're considering negative consequences, the higher the consequences, the more risk-averse you tend to be. The lower the consequences, the more risk-taking you tend to be. You might still be risk averse, but you moved to a little less risk averse. In terms of positive consequences, the higher the consequences generally the more risk seeking you tend to become.

The degree to which you can exercise control is also significant. If you have some control, you tend to drift towards more risk-tolerant behavior. When you have no control, and you're risk averse, you tend to move away. This sense of control is actually very important to how people process and make decisions associated with their risk attitudes.

Back to Table of Contents

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

Tool: Discussing Risk Attitudes

• Use this helpful Discussing Risk Attitudes tool to facilitate conversations

Are your funders comfortable with the risks on this project? How comfortable? And what about your project stakeholders: are they very concerned about the plans for mitigation strategies? Are your team members worried about the amount of ambiguity there is in the project work? These are questions you will want to discuss as you move forward in project work. People's attitudes about risk will influence their behavior, their decisions, and the choices they make. You can download and save the tool on this page to use when facilitating conversations about risk attitudes when appropriate with your team, stakeholders, funders, or customers.

Back to Table of Contents

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

https://s3.amazonaws.com/ecornell/content/CEPM/CEPM503/CEPM503_Tool_Discussing_Risk_Attitudes.pdf

Course Project, Part Two: Examining Risk

Project managers must be able to examine the risks that are present within a project on an ongoing basis throughout the project life cycle in order to apply appropriate mitigations. In this part of the course project, you will examine risk through the lens of one of your own projects.

Completion of this project is a course requirement.

Instructions:

Download the "Assessing, Managing, and Mitigating Project Risk" course project, if you have not already done so. Complete Part Two. Save your work. You will not submit your work now. You will submit your completed project at the end of the course for instructor review and credit.

Before you begin:

Review the grading rubric for this assignment. Please review eCornell's policy regarding plagiarism.

Back to Table of Contents

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

https://s3.amazonaws.com/ecornell/content/CEPM/CEPM503/CEPM503_course_project.docx

https://s3.amazonaws.com/ecornell/global/eCornellPlagiarismPolicy.pdf

Module Two Wrap-up: Examine Risk

Now you have had a chance to consider your own attitudes toward risk, as well as the attitudes of other influential people whose ideas and opinions will affect your project work. As you have seen, risk attitudes will be enormously influential as decisions get made. In this module, you examined risk attitudes and used a helpful stoplight chart to assess, in qualitative terms, the probabilities and consequences of potential threats. You participated in a discussion with your peers regarding risk, and completed the second part of your project, in which you applied the concepts here to your own project work.

Back to Table of Contents

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

Module 3: Manage Risk 1. Module Three Introduction: Manage Risk 2. Watch: Heuristics and Biases 3. Watch: Availability Heuristic 4. Watch: Representation Heuristic 5. Watch: Anchoring and Adjustment Heuristic 6. Watch: Confirmation Trap Heuristic 7. Heuristics and You 8. Tool: Working with Heuristics 9. Course Project, Part Three: Managing Risk 10. Module Three Wrap-up: Manage Risk 11. Read: Thank You and Farewell

Back to Table of Contents

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

Module Three Introduction: Manage Risk

Managing risk means, in large part, thinking about risk in a way that helps you offset it; you have to put plans and strategies into place to do so. It means objectively assessing the levels of threats that are present now or that may present themselves, and putting mitigations into

place to reduce their likelihood of occurring and limit the negative repercussions if they do come to fruition. In this module, you will examine a number of mental shortcuts that help people make decisions quickly, but actually get in the way when it comes to risk. They impede our ability to assess risk objectively. You want to be able to apply strategies to overcome them. You will also complete the final part of your course project, in which you lay the groundwork for your own risk-management plans.

Back to Table of Contents

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

Watch: Heuristics and Biases

Human beings have evolved to use mental shortcuts all the time in order to filter the millions of pieces of information coming in and come to quick decisions. Professor Nozick examines how those mental shortcuts help us to be efficient decision makers but they can also how they trick us into making biased decisions.

Transcript

So, a heuristic is a mental shortcut we use to reach a decision or to arrive at an answer quickly. Even for very simple decisions, when you really sit down and think about it, all the information that's relevant to that decision, that can be a very large set of information. So instead of explicitly considering each piece of information and then thinking about all the information together, we subconsciously screen out much of the information and focus on only a small part in order to reach our decisions. This is much quicker, in terms of reaching a decision.

Examples of this that we do everyday are things like, where should I go for lunch? Your mind quickly go to a small subset of places you frequent. I suspect that's true for just about everybody. If you went and looked around you'd find there's a whole lot more restaurants around you than the ones you actually consider for lunch. Car purchase decision is another one. Now that's a fairly expensive decision, but generally you confine your search to the brands you're used to in some way, and the body types you're used to purchasing. It's hard to go out of your way and think more carefully about other types that might now meet your needs better. So both for car purchase decisions, or something as simple as lunch, we use heuristics to try to make that decision more quickly.

So what's the downside of a heuristic? It helps you get someplace a lot quicker. Well, generally, when you reduce the decision space by only considering a subset of the information, you have, the impact of that is to tilt the decision in one direction over another. And that can lead to errors. It could also lead to the use of stereotypes, or falling back on convenient stereotypes. There's no doubt heuristics make life easier at a price. But

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

we have to be aware of the heuristics we're using so we can counter the negative impacts, and take advantage of the benefits of them.

So how does the idea of risk, of heuristics and biases impact risk analysis? Well, risk attitudes have stem from perceptions. They stem from how we feel about things. Perceptions dictate how we feel about uncertainty, and therefore they govern how we respond to that uncertainty. Now it's important to remember perceptions are related to reality, hopefully quite closely, but they're not exactly reality. And your perceptions are then shaped by these heuristics and how you employ them and the biases that they generate.

Back to Table of Contents

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

Watch: Availability Heuristic

When our brains are trying to interpret information, we use mental shortcuts by looking for reference points in the examples that are available to us; we rely on memories of events that were either very meaningful or very recent.

Transcript

The availability heuristic is one of the most common heuristics people use to make decisions. Many times when we address a situation we try to remember if anything like it has happened in the past.

Well it's certainly easier to recall events that are either very memorable or impactful or very recent. Events that are easier to recall somehow feel more relevant to the current situation. So, we put more weight on them. It's when we're looking for events like the one we're in at that moment, when we need to make a decision, we tend to remember recent events and very memorable ones from the past. And we tend to gloss over all of the rest. So in a situation where there is uncertainty, if there's a memorable event that is viewed as similar, the risk of the situations are also viewed as similar. So that means you're going to put more evidence, more weight on recent event and dramatic events. Because you're going to view them as more significant to the current experience.

And also if you think about it we tend to view negative events as more memorable. Okay which tends to increase our perception of risk and the converse is actually also important. When you think something is pretty uncommon you tend to think of it as having less risk. Generally that happens when it's harder to remember examples of it. So when you can't think of an example that's too close to what your current situation is, you tend to perceive that there is no as much risk associated with it that may be there is really is.

Back to Table of Contents

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

Watch: Representation Heuristic

Now Professor Nozick will discuss another mental shortcut: one in which we look to the past to think of other scenarios that seem to be closely representative of what's present in the current situation. Seeing the two situations as more similar than they really are can lead us to make false conclusions about the risks that exist in the new scenario, as Professor Nozick explains.

Transcript

Another common heuristic is the representation heuristic. The representation heuristic is another subconscious filtering process, just like the availability heuristic.

In the availability heuristic we filter out information based on how recent the event was or how memorable it is. That is that things that are easier to recall we focus on when making a choice. Use it when we use the availability heuristic. The representation heuristic is similar in some sense, it's also a filtering process. But this time we filter information based on instances that seem to be more representative to the current situation. We're looking for the reference scenario. One that's as close to the current situation we're in as possible, or at least in our recollection. When we assess the probabilities in the current situation we draw on that event from the past that reference scenario from the past. We use that to effectively estimate our probabilities.

There a couple of examples of the representation heuristic. So when you're estimating the market share for a new product, you might rely on the market share for an existing product that's available, okay. You might assume that these are going to be similar market shares. Another example, when you're estimating the task duration on a project. You might use the duration of a similar task but on a different project for your current project schedule.

Back to Table of Contents

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

Watch: Anchoring and Adjustment Heuristic

The name "anchoring and adjustment heuristic" sounds very complex, but it refers to a mental shortcut you've probably experienced. You try to begin developing a numeric estimate based on a number you've worked with previously, regardless of whether that's the most accurate starting point. An example is when a new employer suggests a starting salary based on the salary you held at your previous position: the new figure is anchored in the previous number and adjusted from there. Professor Nozick explains.

Transcript

So anchoring an adjustment is another important heuristic, a very common one. When people are asked to estimate a value, an individual tends to think of a value and then make adjustments to their estimate from there. So if the initial estimate they make is very far off, it's not very likely that they'll adjust efficiently to get their estimate into the right place. So when you ask the question it's really important to sit back and think, whether or not the initial value given makes a lot of sense. Okay because if it doesn't and you start adjusting from there you're going to be in a poor space in the poor spot.

So here's a couple of examples of that. One of the most common ones we're all very familiar with is salary negotiations. When you think about changing jobs and they ask you what's your current salary that negotiation is then really based on what generally is based on that value. And then there's an adjustment from there. That doesn't, that value will have a lot of historical context to it about the old place you worked and the old job you did. You're now moving into a new situation. Does it make sense to be hinging your salary negotiation on your previous employment? Another good example of that is the sale price for a home. When you think about a home, when you go look at a house and you see a price for it, people think about taking some amount of money off of it, off that initial value to make an offer As opposed to backing up and saying, what is this house really worth?

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

Project scheduling is another situation where anchoring and adjustment can be a real issue. So you need to be on the lookout for this when you think about task durations, okay? And asking people what they think is the right value for the time it will take to do a project. Think or a particular activity and a lot of times when you think about a task duration for an activity, you think about the task duration and then some variability in that duration. If your task duration estimate is way off likely that variability is going to be way off.

Back to Table of Contents

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

Watch: Confirmation Trap Heuristic

"I knew the answer right away." Have you ever heard that? That sentence sums up the confirmation trap heuristic. This is a common mental shortcut in which we focus only on the evidence that confirms what we already thought was true, and we tend to discount new information that might contradict our assumptions.

Transcript

Another very important heuristic is the confirming evidence trap. It's hard when you're in a decision-making situation not to identify an initial decision fairly quickly. Once there is an initial decision in your head, it's often, there's often a very strong tendency to only look for information that proves that that's the correct choice, and to generally discount information that would suggest in fact we're in the wrong place, that our initial decision is wrong. Now, the confirming evidence track has the same benefit as all of the other heuristics we've talked about. It streamlines the process of reaching a decision by narrowing the amount of data you have to process. Right? In the situation of the confirming evidence trap, we really only focus on things that prove our point and tend to ignore, or shuffle aside stuff that would disprove our point.

Interestingly, fear of flying is an example of the confirmation trap. It's not only of the availability trap but also of the confirming evidence trap. Because the accidents are so vivid in the air, when an air accident happens is a very vivid experience, we tend to focus on those as confirming evidence about the risk associating with flying, and we tend to ignore the many, many, many automobile accidents that unfortunately happen everyday. So what's the impact of the confirming evidence trap? Well one of the big impacts is it leads to overconfidence. You've collected all of this information that says this is the right thing to do and that's where you spent all your mental brain power. So we tend to not see as much risk in the decision we're about to make than is likely to be there, which may mean we're engaging in more risk-seeking behavior than we would otherwise. So how do we overcome this trap? It's the same as the other heuristics, in many ways. It is to make sure you're considering all

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

the information and not selectively excluding some of the information. It's also really important to ask why you like your initial first choice.

So, this happened to me just a little while ago when I purchased a new car. I knew what car I wanted, and I did a really good job of finding the evidence about why that was the correct car. It was not a broad look at vehicles that I could possibly purchase. Confirming evidence trap. It made me feel good, and I got the car, but it was clearly an illustration of this sort of a way of thinking. One of the other things you can do to try to make yourself less vulnerable to this heuristic, and actually all of the heuristics, is if you look for people to talk to that think differently than you. It's very easy to surround yourself with yes people, people who think the same way you do. It's not nearly as challenging. But, when people all think the same, you're less likely to get a really good picture of what's going on. And you're more likely to fall into some of these traps.

Back to Table of Contents

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

Heuristics and You

Instructions:

You are required to participate in both of the discussions in this course.

Discussion topic:

How do you think that an understanding of heuristics will help people manage risk more effectively?

Create a post in which you offer one idea of what you could do better on the job with this teaching about heuristics in mind.

To participate in this discussion:

Back to Table of Contents

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

https://s3.amazonaws.com/ecornell/global/eCornellPlagiarismPolicy.pdf

Tool: Working with Heuristics

The Working with Heuristics worksheet

Now that you have an understanding of the different types of heuristics and how they might affect your decision-making processes and your thinking about the probabilities and consequences of risks, you may find it helpful to download the tool on this page. It's a worksheet that you can save and use at any point during the project life cycle that you find it helpful.

Back to Table of Contents

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

https://s3.amazonaws.com/ecornell/content/CEPM/CEPM503/CEPM503_Tool_Heuristics.docx

Course Project, Part Three: Managing Risk

A critical component of managing project risk is applying effective mitigations. Which mitigations will be most appropriate? How will applying mitigations affect the project network? These are questions you will now answer within the context of your own project work.

Completion of this project is a course requirement.

Instructions:

Download the "Assessing, Managing, and Mitigating Project Risk" course project, if you have not already done so. Complete Part Three. Save your work. Click the Submit Assignment button on this page to attach your completed course project document and send it to your instructor for evaluation and credit.

Before you begin:

Review the grading rubric for this assignment. Please review eCornell's policy regarding plagiarism.

Back to Table of Contents

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

https://s3.amazonaws.com/ecornell/content/CEPM/CEPM503/CEPM503_course_project.docx

https://s3.amazonaws.com/ecornell/global/eCornellPlagiarismPolicy.pdf

Module Three Wrap-up: Manage Risk

As you have now seen, there are a number of heuristics that impede people's ability to assess threats objectively. Managing risk means, in large part, overcoming those commonplace mental shortcuts and making sure that you are monitoring and controlling your projects with an objective eye. In this module, you examined heuristics and strategies for managing risk. You participated in a discussion about how heuristics can be overcome, and you completed the final part of your course project, in which you laid the groundwork for your own risk management plans. This effort should position you effectively to monitor and control risks on your projects now and in the future.

Back to Table of Contents

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

Linda K. Nozick Professor and Director

Civil and Environmental Engineering Cornell University

Congratulations on completing "Assessing, Managing, and Mitigating Project Risk." I hope you now feel more comfortable in discussing, assessing, and evaluating the risks that may be present in your projects. I hope you feel better prepared to come up with strategies for objectively assessing risk and putting mitigations into place that will reduce any negative repercussions.

I hope you now feel you are in a better position to use effective risk- management strategies to serve your projects and your organization.

From all of us at Cornell University and eCornell, thank you for participating in this course.

Sincerely,

Linda K. Nozick

Read: Thank You and Farewell

Back to Table of Contents

CEPM503: Assessing, Managing, and Mitigating Project Risk Cornell University

Table Of Contents
Module 1: Assess Risk
Module 2: Examine Risk
Module 3: Manage Risk