$60 fixed draft due in 6hrs ..final paper in 12hrs 3000 words

PROJECT RISK MANAGEMENT

Information Technology Project Management, Ninth Edition. © 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password

Dr Andrew Levula

COMMONWEALTH OF AUSTRALIA

Copyright Regulations 1969

WARNING

This material has been reproduced and communicated to you by or on behalf of the Australian

Institute of Higher Education pursuant to Part VB of the Copyright Act 1968 (the Act).

The material in this communication may be subject to copyright under the Act. Any further

reproduction or communication of this material by you may be the subject of copyright

protection under the Act.

Do not remove this notice.

Learning Objectives (1 of 2)

• Explain the concept of risk as it relates to project management, and list the

advantages of managing project risks according to best practices

• Discuss the elements of planning risk management and the contents of a

risk management plan

• List common sources of risks on information technology (IT) projects

• Describe the process of identifying risks and create a risk register and risk

report

• Discuss qualitative risk analysis and explain how to calculate risk factors,

create probability/impact matrixes, and apply the Top Ten Risk Item Tracking

technique to rank risks

Learning Objectives (2 of 2)

• Explain quantitative risk analysis and how to apply decision trees,

simulation, and sensitivity analysis to quantify risks

• Provide examples of using different risk response planning strategies to

address both negative and positive risks

• Discuss how to monitor risks

• Describe how software can assist in project risk management

• Discuss considerations for agile/adaptive environments

The Importance of Project Risk Management (1 of 7)

• Project risk management is the art and science of identifying, analyzing, and

responding to risk throughout the life of a project and in the best interests of

meeting project objectives

– Risk management is often overlooked in projects, but it can help improve

project success by helping select good projects, determining project

scope, and developing realistic estimates

The Importance of Project Risk Management (2 of 7)

• Research shows a need to improve project risk management

– Study by Ibbs and Kwak shows risk management has the lowest maturity

rating of all knowledge areas

– A similar survey was completed with software development companies in

Mauritius, South Africa, and risk management also had the lowest

maturity

– KLCI study shows the benefits of following good software risk

management practices

The Importance of Project Risk Management (3 of 7)

Global Issues

• Many people around the world suffered from financial losses as various

financial markets dropped in the fall of 2008, even after the $700 billion

bailout bill was passed by the U.S. Congress

– According to a global survey of 316 financial services executives, over

70 percent of respondents believed that the losses stemming from the

credit crisis were largely due to failures to address risk management

issues

• Worldwide banking and insurance sectors will spend about $78.6 billion on

risk information technologies and services in 2015, growing to $96.3 billion

by 2018

The Importance of Project Risk Management (4 of 7)

• A dictionary definition of risk is “the possibility of loss or injury”

– General definition of a project risk: an uncertainty that can have a

negative or positive effect on meeting project objectives

– Managing negative risks involves a number of possible actions that

project managers can take to avoid, lessen, change, or accept the

potential effects of risks on their projects

– Positive risk management is like investing in opportunities

Best Practice

• Some organizations make the mistake of only addressing tactical and

negative risks when performing project risk management

– David Hillson suggests overcoming this problem by widening the scope

of risk management to encompass both strategic risks and upside

opportunities, which he refers to as integrated risk management

– Hillson described the importance of good working relationships;

especially between the project sponsor and project manager

The Importance of Project Risk Management (5 of 7)

• Risk utility is the amount of satisfaction or pleasure received from a potential

payoff

– Utility rises at a decreasing rate for people who are risk-averse

– Those who are risk-seeking have a higher tolerance for risk and their

satisfaction increases when more payoff is at stake

– Risk-neutral approach achieves a balance between risk and payoff

The Importance of Project Risk Management (6 of 7)

Advice for Young Professionals

• Young project professionals are sometimes more willing to take risks with

unique or untested approaches

– Take the time to find out what other, more experienced people might feel

about the circumstances of a project before making up your mind about

potential risks

• Then, taking other views into account, you can determine how best to

plan for the impacts that might occur while balancing the rewards of a

potential payoff from a unique or untested approach

The Importance of Project Risk Management (7 of 7)

• Project risk management processes

– Planning risk management: deciding how to approach and plan the risk management

activities for the project

– Identifying risks: determining which risks are likely to affect a project and documenting

the characteristics of each

– Performing qualitative risk analysis: prioritizing risks based on their probability and

impact of occurrence

– Performing quantitative risk analysis: numerically estimating the effects of risks on

project objectives

– Planning risk responses: taking steps to enhance opportunities and reduce threats to

meeting project objectives

– Implementing risk responses: implementing the risk response plans

– Monitoring risk: monitoring identified and residual risks, identifying new risks, carrying

out risk response plans, and evaluating the effectiveness of risk strategies throughout

the life of the project

Planning Risk Management (1 of 3)

• Main output of this process is a risk management plan

– Documents the procedures for managing risk throughout a project

• The project team should review project documents as well as corporate risk

management policies, risk categories, lessons-learned reports from past

projects, and templates for creating a risk management plan

– It is also important to review the risk tolerances of various stakeholders

Planning Risk Management (2 of 3)

• Additional plans

– Contingency plans: predefined actions that the project team will take if

an identified risk event occurs

– Fallback plans: developed for risks that have a high impact on meeting

project objectives, and are put into effect if attempts to reduce the risk

are not effective

– Contingency reserves or allowances: funds included in the cost baseline

that can be used to mitigate cost or schedule overruns if known risks

occur

– Management reserves: funds held for unknown risks that are used for

management control purposes

Planning Risk Management (3 of 3)

Topic Questions to Answer

Methodology How will risk management be performed on this project? What tools and data

sources are available and applicable?

Roles and responsibilities Which people are responsible for implementing specific tasks and providing

deliverables related to risk management?

Budget and schedule What are the estimated costs and schedules for performing risk-related activities?

Risk categories What are the main categories of risks that should be addressed on this project? Is

there a risk breakdown structure for the project? (See the information on risk

breakdown structures later in this chapter.)

Risk probability and impact How will the probabilities and impacts of risk items be assessed? What scoring and

interpretation methods will be used for the qualitative and quantitative analysis of

risks? How will the probability and impact matrix be developed?

Revised stakeholders’

tolerances

Have stakeholders’ tolerances for risk changed? How will those changes affect the

project?

Tracking How will the team track risk management activities? How will lessons learned be

documented and shared? How will risk management processes be audited?

Risk documentation What reporting formats and processes will be used for risk management activities?

Table 11-2 Topics addressed in a risk management plan

Common Sources of Risk on IT Projects (1 of 3)

• Several studies show that IT projects share some common sources of risk

– The Standish Group developed an IT success potential scoring sheet

based on potential risks

• Other broad categories of risk help identify potential risks

– Market risk

– Financial risk

– Technology risk

– People risk

– Structure/process risk

• A risk breakdown structure is a hierarchy of potential risk categories for a

project

Common Sources of Risk on IT Projects (2 of 3)

Common Sources of Risk on IT Projects (3 of 3) Knowledge

Area

Risk Conditions

Integration Inadequate planning; poor resource allocation; poor integration management; lack

of post-project review

Scope Poor definition of scope or work packages; incomplete definition

Time Errors in estimating time or resource availability; errors in determining the critical

path; poor allocation and management of float; early release of competitive

products

Cost Estimating errors; inadequate productivity, cost, change, or contingency

Quality Poor attitude toward quality; substandard design, materials, and workmanship;

inadequate quality assurance program

Human

resource

Poor conflict management; poor project organization and definition of

responsibilities; absence of leadership

Communicatio

ns

Carelessness in planning or communicating

Risk Ignoring risk; unclear analysis of risk; poor insurance management

Procurement Unenforceable conditions or contract clauses; adversarial relations

Stakeholders Lack of consultation with key stakeholder; poor sponsor engagement

Table 11-3 Potential negative risk conditions associated with each knowledge area. *Source: R.M. Wideman

What Went Wrong?

• In a 2013 survey, risk management was a high priority

– However, only 66 percent of companies said they often build it into their

strategy planning decisions

• Airline incidents cause concerns, especially when lives are lot

– The 2015 Germanwings crash resulted in 150 deaths, allegedly due to

the co-pilot’s poor mental state

– They responded immediately by implementing a rule that two people

must be in the cockpit at all times and are considering changes to

medical and psychological tests for pilots

Identifying Risks (1 of 5)

• Understanding what potential events might hurt or enhance a particular

project

– You cannot manage risks if you do not identify them first

• Another consideration is the likelihood of advanced discovery

– Often viewed at a program level rather than a project level

• Suggestions for identifying risks: tools and techniques

– Brainstorming

– The Delphi Technique

– Interviewing

– SWOT analysis

Identifying Risks (2 of 5)

• Brainstorming

– Group attempts to generate ideas or find a solution for a specific problem

by amassing ideas spontaneously and without judgment

– An experienced facilitator should run the brainstorming session

– Be careful not to overuse or misuse brainstorming

• Psychology literature shows that individuals produce a greater

number of ideas working alone than they do through brainstorming in

small, face-to-face groups

• Group effects often inhibit idea generation

Identifying Risks (3 of 5)

• Delphi Technique

– Used to derive a consensus among a panel of experts who make

predictions about future developments

– Provides independent and anonymous input regarding future events

– Uses repeated rounds of questioning and written responses and avoids

the biasing effects possible in oral methods

Identifying Risks (4 of 5)

• Interviewing

– Fact-finding technique for collecting information in face-to-face, phone,

e-mail, or virtual discussions

– Interviewing people with similar project experience is an important tool

for identifying potential risks

Identifying Risks (5 of 5)

• SWOT analysis

– Strengths, weaknesses, opportunities, and threats

– Helps identify the broad negative and positive risks that apply to a

project

The Risk Register (1 of 4)

• Important output of the risk identification process

– List of identified risks and other information needed to begin creating a

risk register

• Contains the results of various risk management processes and that

is often displayed in a table or spreadsheet format

• Tool for documenting potential risk events and related information

– Risk events refer to specific, uncertain events that may occur to the

detriment or enhancement of the project

The Risk Register (2 of 4)

• Risk register contents

– Identification number for each risk event

– Rank for each risk event

– Name of each risk event

– Description of each risk event

– Category under which each risk event falls

– Root cause of each risk

– Triggers for each risk; indicators or symptoms of actual risk events

– Potential responses to each risk

– Risk owner or person who will own or take responsibility for each risk

– Probability and impact of each risk occurring

– Status of each risk

The Risk Register (3 of 4)

No. Rank Risk Description Category Root

Cause

Triggers Potential

Responses

Risk

Owner

Probability Impact Status

R44 1

R21 2

R7 3

Table 11-4 Sample risk register

The Risk Register (4 of 4)

• Risk report contents

– Sources of overall project risk

– Important drivers of overall project risk exposure

– Summary information on risk events

Performing Qualitative Risk Analysis

• Assess the likelihood and impact of identified risks to determine their

magnitude and priority

• Risk quantification tools and techniques

– Probability/impact matrixes

– The Top Ten Risk Item Tracking

– Expert judgment

Using Probability/Impact Matrixes to Calculate Risk Factors (1 of 3)

• Lists relative probability of a risk occurring on one side of a matrix or axis on

a chart and the relative impact of the risk occurring

– List the risks and then label each one as high, medium, or low in terms of

its probability of occurrence and its impact if it did occur

• Calculates risk factors

– Numbers that represent the overall risk of specific events based on their

probability of occurring and the consequences to the project if they do

occur

Using Probability/Impact Matrixes to Calculate Risk Factors (2 of 3)

Using Probability/Impact Matrixes to Calculate Risk Factors (3 of 3)

Top Ten Risk Item Tracking (1 of 2)

• Qualitative risk analysis tool that helps to identify risks and maintain an

awareness of risks throughout the life of a project

– Involves establishing a periodic review of the top ten project risk items

– Includes the current ranking, previous ranking, number of times the risk

appears on the list over a period of time, and a summary of progress

made in resolving the risk item

• A watch list is a list of risks that are low priority, but are still identified as

potential risks

– Qualitative analysis can also identify risks that should be evaluated

quantitatively

Top Ten Risk Item Tracking (2 of 2)

Monthly

Ranking

Monthly

Ranking

Monthly

Ranking

Risk Event Rank This

Month

Rank Last

Month

Number of

Months in

Top Ten

Risk Resolution Progress

Inadequate

planning

1 2 4 Working on revising the entire project

management plan

Poor

definition

2 3 3 Holding meetings with project customer and

sponsor to clarify scope

Absence of

leadership

3 1 2 Assigned a new project manager to lead the

project after the previous one quit

Poor cost

estimates

4 4 3 Revising cost estimates

Poor time

estimates

5 5 3 Revising schedule estimates

Table 11-5 Example of top ten risk item tracking

Media Snapshot

• The story of the Titanic is known throughout the world, and on April 15,

2012, people acknowledged the anniversary of the Titanic’s sinking

– A recent article in PMI’s Virtual Library explains how to avoid “the Titanic

factor” in your projects by analyzing the interdependence of risks

• For example, the probability of one risk event occurring might change

if another one materializes, and the response to one risk event might

affect another

Performing Quantitative Risk Analysis

• Often follows qualitative risk analysis, but both can be done together

– Large, complex projects involving leading edge technologies often

require extensive quantitative risk analysis

• Main techniques

– Decision tree analysis

– Simulation

– Sensitivity analysis

Decision Trees and Expected Monetary Value (EMV) (1 of 2)

• A decision tree is a diagramming analysis technique used to help select the

best course of action in situations in which future outcomes are uncertain

– Estimated monetary value (EMV) is the product of a risk event probability

and the risk event’s monetary value

• You can draw a decision tree to help find the EMV

Decision Trees and Expected Monetary Value (EMV) (2 of 2)

Simulation (1 of 3)

• Uses a representation or model of a system to analyze the expected

behavior or performance of the system

– Monte Carlo analysis simulates a model’s outcome many times to

provide a statistical distribution of the calculated results

• Predict the probability of finishing by a certain date or the probability

that the cost will be equal to or less than a certain value

• You can use several different types of distribution functions when

performing a Monte Carlo analysis

Simulation (2 of 3)

• Steps of a Monte Carlo analysis

– Collect the most likely, optimistic, and pessimistic estimates for the

variables in the model

– Determine the probability distribution of each variable

– Select a random value based on the probability distribution for each

variable

– Run a deterministic analysis or one pass through the model

– Repeat steps three and four many times to obtain the probability

distribution of the model’s results

Simulation (3 of 3)

What Went Right?

• Microsoft Excel is a common tool for performing quantitative risk analysis

– General Motors uses simulation for forecasting its net income, predicting

structural costs and purchasing costs of vehicles, and determining the

company’s susceptibility to different kinds of risk

– Eli Lilly uses simulation to determine the optimal plant capacity that

should be built for developing each drug

– Procter & Gamble uses simulation to model foreign exchange risk

• Monte Carlo simulation can also help reduce schedule risk on agile projects

Sensitivity Analysis (1 of 2)

• Used to show the effects of changing one or more variables on an outcome

– For example, many people use it to determine what the monthly

payments for a loan will be given different interest rates or periods of the

loan

• Spreadsheet software, such as Microsoft Excel, is a common tool for

performing sensitivity analysis

Sensitivity Analysis (2 of 2)

Planning Risk Responses (1 of 3)

• After identifying and quantifying risks, the organization must decide how to respond to them

– Basic response strategies for negative risks

• Risk avoidance

• Risk acceptance

• Risk transference

• Risk mitigation

• Risk escalation

– Basic response strategies for positive risks

• Risk exploitation

• Risk sharing

• Risk enhancement

• Risk acceptance

• Risk escalation

Planning Risk Responses (2 of 3)

Technical Risks Cost Risks Schedule Risks

Emphasize team support

and avoid stand-alone

project structure

Increase the frequency of

project monitoring

Increase the frequency of

project monitoring

Increase project manager

authority

Use WBS and CPM Use WBS and CPM

Improve problem handling

and communication

Improve communication,

understanding of project

goals, and team support

Select the most

experienced

project manager

Increase the frequency of

project monitoring

Increase project manager

authority

Use WBS and CPM

Table 11-6 General risk mitigation strategies for technical, cost, and

schedule risks. *Source: J. Couillard

Planning Risk Responses (3 of 3)

• It’s also important to identify residual and secondary risks

– Residual risks: risks that remain after all of the response strategies have

been implemented

– Secondary risks: direct result of implementing a risk response

Implementing Risk Responses

• Main executing process performed as part of project risk management is

implementing risk responses

– Key outputs

• Change requests

• Project documents updates

Monitoring Risks

• Involves ensuring the appropriate risk responses are performed, tracking

identified risks, identifying and analyzing new risk, and evaluating

effectiveness of risk management throughout the entire project

– Project risk management does not stop with the initial risk analysis

• Carrying out individual risk management plans involves monitoring risks

based on defined milestones and making decisions regarding risks and their

response strategies

– Project teams sometimes use workarounds—unplanned responses to

risk events—when they do not have contingency plans in place

Using Software to Assist in Project Risk Management

• Risk registers can be created in a simple Microsoft Word or Excel file or as

part of a sophisticated database

– More sophisticated risk management software, such as Monte Carlo

simulation tools, help develop models and use simulations to analyze

and respond to various risks

Considerations for Agile/Adaptive Environments

• All types of projects should share knowledge related to risks as quickly as

possible and keep documents up to date

– Risk is considered during each iteration for agile/adaptive projects, which

does elevate its importance

– Changing priorities can be addressed more easily by changing the

product backlog for each iteration

Chapter Summary

• Risk is an uncertainty that can have a negative or positive effect on meeting project

objectives

– Many organizations do a poor job of project risk management, if they do any at all

– Successful organizations realize the value of good project risk management

• Risk management is an investment

– Costs are associated with identifying risks, analyzing those risks, and establishing

plans to address them

• Implementing risk responses involves putting the appropriate risk response plans into

action

– Monitoring risks involves monitoring implementation of risk response plans,

tracking identified risks, identifying and analyzing new risks, and evaluating

effectiveness of risk management throughout the entire project

THE END