project risk disscuss

Examining risk tolerance in project-driven organization

Young Hoon Kwak a,*, Kenneth Scott LaPlace

b,1

a Project Management Program, Department of Management Science, Monroe Hall 403, The George Washington University,

2115 G Street, Washington, DC 20052, USA b Cambridge Associates, 4100 North Fairfax Drive, 13th Floor, Arlington, VA 22203, USA

Abstract

Risk tolerance is often misunderstood or overlooked by project managers. The levels and perspectives of risk tolerance are dynamic

throughout the life of the project. Risk tolerance has three different perspectives when you are involved in a project: firm, project manager,

and stakeholder. The firm’s risk tolerance varies according to the firm’s financial stability and project diversification. A project manager’s

risk tolerance is affected by job security and corporate culture. The stakeholder’s risk tolerance is influenced by project objective.

Unfortunately, failures in communication between the stakeholder and project manager are quite common because there are few applicable

tools available to support the process. The project success will depend on agreeable level of risk tolerance and support of compensation

policies, corporate culture, performance reviews, and early risk management planning.

q 2004 Elsevier Ltd. All rights reserved.

Keywords: Risk tolerance; Project management; Organizational culture; Technology-driven organization

1. Defining risk and risk tolerance

Issues involving risk are often difficult to distinguish and

misunderstood by those making vital decisions for firms and

projects. Risk is not tangible or visible, therefore, managers’

risk perceptions in a particular project varies by risk

characteristics and project’s internal and external environ-

ment. Therefore, it is important to first define “risk” and

“risk tolerance” as it relates to project management in a

technology-driven organization.

March and Shapira (1987) observe that according to

classical decision theory, risk is generally understood to be

the distribution of possible outcomes, their likelihood, and

their subjective values. In project management, this

definition can be applied to time, cost, performance, and

many other influential factors in any project that impact

these three concerns. However, project managers, firms,

and stakeholders rarely share the very same view or

opinion of what the possible outcomes are for a project,

much less their likelihood. Kahneman and Tversky

(1979) and Tversky and Kahneman (1992) suggest that

the reference points that people use to evaluate risky

prospects affect risk-taking. In this respect, risk tolerance is

a subjective notion in the absence of clear and uniform

communication and tools for risk analysis.

Risk tolerance is still a developing area of research because

of its human dynamics. Pratt (1964), Arrow (1965), and Ross

(1981) possessed a far too simple conception of risk tolerance:

to put it simply, individual decision-makers are risk averse. In

fact, a person does not necessarily choose to be compensated

for variability in outcomes. Many other circumstances shape

attitudes toward risk, and thus risk tolerance is a complex

topic demanding a more complex definition.

Taking big risks can be beneficial to a firm that is able to

accept them because it enables opportunity. For this reason,

risk must be defined as including the probability of both

good and bad outcomes. It is in this context that we analyze

risk tolerance correctly and understand some managers’

inclination for risk-taking.

Wilemon and Cicero (1970) point to two categories of

“risk” which pertain to project managers and concern them

most. These are project risk and professional risk. Project risk

applies to the uncertainties for a project manager in achieving

a project’s goals in terms of time, cost, and performance.

These risks are the main subject of risk management as they

apply to project management. Professional risk deals with a

project manager’s uncertainties with respect to future job

advancement and reward. This type of risk receives less

0166-4972/$ - see front matter q 2004 Elsevier Ltd. All rights reserved.

doi:10.1016/j.technovation.2003.09.003

Technovation 25 (2005) 691–695

www.elsevier.com/locate/technovation

1

Tel.: þ1-703-526-8500.

* Corresponding author. Tel.: þ1-202-994-7115; fax: þ1-202-994-2736.

E-mail addresses: [email protected] (Y.H. Kwak), klaplace@cambridge

associates.com (K.S. LaPlace).

attention, but it can potentially drive a project manager’s

decisions and cause those decisions not to be in line with

defined risk tolerance levels.

2. Modeling and quantifying risk tolerance

Risk tolerance concerns both the probabilities of inherent

risk occurrences taking place and the resulting impact of

those occurrences. Tools and techniques have been devel-

oped to display these components for each risk and how the

firm’s risk tolerance weighs against them. Fig. 1 depicts one

illustrated by the Office of Government Commerce (OGC,

2001) using probability/impact matrix to summarize risk

profiles.

OGC offers a risk profile generator on its website (www.

ogc.gov.uk) that uses project risk register information to

generate such a profile. The process begins with the firm

determining how much of a negative impact it is willing to

risk enduring given a probability. With this information, the

risk tolerance line is mapped out. Each risk is plotted

according to its perceived likelihood of occurring, as well as

the impact it would have should a worst-case scenario

happen. With this information charted out, the firm can

identify the individual risks that lie above the firm’s

tolerance level and focus resources towards those.

The utility curve is another straightforward tool for

understanding risk tolerance. A concave utility curve shown

in Fig. 2 demonstrates a risk-averse decision-maker while

Fig. 3 shows a risk-taker. Theoretical tools such as this one

can provide some assistance for managers as they define

how much risk is acceptable in their project and make

decisions accordingly.

When measuring risk and determining acceptable levels

for tolerance, it is imperative that projects are viewed as a

whole. By taking on multiple projects with uncorrelated or

negatively correlated outcomes, a firm builds a portfolio of

projects whereby the overall level of risk is lower than what

one would perceive by looking at projects individually.

Project risk is not uncommon to investment portfolio theory

in this regard. As Kahneman and Lovallo (1993) recognize,

managers make fundamental errors in their forecasting and

decision-making by ignoring this important facet of risk

measurement.

3. Why is risk tolerance important?

According to Jarrett (2000), risk is not only a probability

of success, but is also always a probability given a set of

premises. The decision-maker’s risk tolerance must always

be coupled with the established definition of risk. Though

risk tolerance is often a neglected topic of discussion in

many firms, there are numerous reasons why top manage-

ment, project managers, and stakeholders should all have a

unified vision and firm grasp of it in connection with any

project.

Attention to risk tolerance leads to more efficient use of

resources because the project team has a better under-

standing of how much of the project’s risk should be

remedied. Managing risk can be an expensive scheme;

therefore, it is important not only to prioritize risks and

address the most crucial ones, but also to know how much to

reduce them so that the risk is acceptable. The project team

should have a better understanding of how far down the list

of prioritized risks should go. This will result in improved

decision-making that leads to lower costs, better perform-

ance, and a shorter duration of the project.

Minimizing risk as much as a project’s budget is quite

straightforward and is the approach many firms take.

Conversely, recognizing when a higher level of risk is

suitable and accepting that situation to reap the benefits of

innovation is much more difficult. Ahmed (1998) argued that

many companies only pay lip service to the idea of

innovation and that a precious few possess a culture to

promote smart risk-taking. Great financial windfalls and

industry dominance do not come without some measure of

risk. When a firm’s strategy is to be first to market a new

product, it is imperative risks be taken to ensure the product

is not held up in development. In instances such as this,

the project manager should have a detailed understanding of

the firm’s tolerance level for the possible occurrence of

Fig. 1. Probability and impact matrix.

Y.H. Kwak, K.S. LaPlace / Technovation 25 (2005) 691–695692

every sizeable risk. Because defined risk tolerance levels are

rarely communicated effectively throughout the firm, lower

level employees and managers are rarely willing to try to

innovate and engage in activities that depart from traditional

business.

4. Influencing factors specific to the firm

Risk tolerance is such an interesting topic because it is so

dynamic and fluid. A firm’s acceptance of risk changes

throughout the duration of a project. For instance, as Daw

(1999) notes, a company’s commitment and investment in

the project grows and more is at stake through its

progression. Even though the project has fewer risks later,

the ones that still persist can be even more detrimental.

Under this most common scenario, the firm’s risk tolerance

could be graphed over time as shown in Fig. 4.

As touched upon earlier in the discussion of measuring

risk tolerance, firms may lower their overall risk exposure

by taking on multiple projects with uncorrelated or

negatively correlated outcomes. While this is true for the

firm, it is not true for a project manager dedicated to one

project. For this reason, upper management must make it a

point to ensure project managers understand their project’s

role within the context of the aggregate project portfolio.

Both a firm’s financial status and industry status impact

its risk tolerance. A firm in financial distress, with mounting

debt and dried up cash flow, is generally very willing to

gamble in hopes of hitting it big. Likewise, a firm watching

its market share deteriorate and its competitors passing it by

is more likely to push new projects through as quickly as

possible, ignoring dangerous risks, in hopes of recapturing

business. Firms faced with severely adverse conditions are

apt to choose high-risk gambles in place of sure losses

(Kahneman and Lovallo, 1993).

Kahneman and Lovallo (1993) also argue that because

firms have limited resources and various project proposals

competing for them, there is an embedded incentive for

overly optimistic estimates and forecasts. Combined with

this, any expression of pessimism is often construed as

disloyalty to the firm or the project team. These factors lead

to serious concerns over whether well-informed decisions

are made in line with established risk tolerance levels. It is

no wonder most projects finish late, over budget, out of

scope, and without meeting all the initial goals.

A project management study, cited by Wilemon and

Cicero (1970), of the Apollo space program revealed

projects could be plagued with conflicting viewpoints and

tolerances of risks. While the project manager accepted a

reliability index of “x” for a particular component, the R&D

project participants outside of the project manager’s

immediate work unit insisted on a higher reliability. It is

extremely difficult for all project participants to agree on

risk tolerance levels of various components throughout

the life of the project. Over time, this tends to be very costly

to the firm.

Fig. 4. Firm’s risk tolerance.

Fig. 3. Convex utility curve (risk-taking decision maker).

Fig. 2. Concave utility curve (risk-averse decision maker).

Y.H. Kwak, K.S. LaPlace / Technovation 25 (2005) 691–695 693

5. Influencing factors specific to the project manager

A lack of understanding on management’s part of risk, or

even a perceived lack of management’s understanding on

the part of the project manager, can lead to misconceptions

of risk tolerance. Daw (1999) recognizes how project

managers many times feel that by simply identifying risk,

they expose themselves to questions of whether or not they

are good at their job. Their thought is that management will

suggest risks should already be under control and that all

risks are bad. As discussed earlier, risks are not all bad, but

this scenario stresses the importance of open dialogue

between the project manager and upper management.

Project managers are extremely susceptible to unjustified

optimism and unreasonable risk aversion (Kahneman and

Lovallo, 1993). There is rarely time or readily available

information to engage in Bayesian forecasts and detailed

probability analysis for every problem that confronts a

project manager. So, project managers develop views of

themselves of being prudent risk-takers even though many

decisions are necessarily based on a given portion of the

facts and plenty of intuition. What transpires in most

managers’ minds is an “optimistic denial of uncontrollable

uncertainty” (Kahneman and Lovallo, 1993). Without

proper recognition of inherent risks, any previous establish-

ment of risk tolerance levels is nullified.

Naturally, a project manager, or any employee for that

matter, weighs credit and blame when making decisions. A

project’s visibility and impact heavily influence a project

manager’s personal risk tolerance. If the manager possesses

a strong drive to climb the corporate ladder, he or she may

accept more risk in a highly visible project in an effort to

gain accolades should the project come through. In a less

visible project, there is less incentive for risk-taking. This

can be in contrast with the firm’s risk tolerance profile of a

willingness to accept greater risk on smaller projects than

larger visible projects.

March and Shapira (1987) argue that most managers fail

to recognize the uncertainty about positive outcomes as a

critical component of risk. Risk is too often associated with

only negative outcomes. Most firms lack an adequate

understanding of risk tolerance as a component to

innovation. Project managers must be trained to dissect

project risk absent of the myopic view that all risk is bad. It

is important to note that risk and opportunities are related

and opportunities cannot be realized by taking risks. Risk is

essential to making progress and the key is to balance the

two (Kirkpatrick et al., 1992).

Further, managers exhibit a reluctance to quantify risk

once its existence is confirmed. While some managers pay

lip service to what they think should be done to quantify

risk, only a very few actually put it into action because,

the quantification of risk requires heavy involvement from

functional managers particularly in a matrix organization

(Globerson and Zwikael, 2002). However, as evidenced by

Ibbs and Kwak (2000), functional managers tend to be of

very little assistance in carrying out risk management

processes, so the project manager is left to take care of him

or herself. Risk quantification however is an important

component of a risk management process, and without it, risk

tolerance is easily exceeded and projects are jeopardized.

6. Influencing factors specific to the stakeholder

The stakeholder is the customer or client for which a

project is being carried out. For example, NASA was a

stakeholder of Thiokol’s project to build solid rocket boosters.

In this project, millions of dollars were at stake, and more

importantly, lives were on the line. Risk tolerance levels must

be examined by the stakeholder and conveyed to the project

team, regardless of whether the tolerance level is low because

of safety concerns. The purposes behind a project and the

project’s ultimate goals are generally laid out very early in the

relationship between a contractor and client, and risk

tolerance levels should be set and defined at the same time.

A clear communication strategy is paramount and the

OGC (2001) proposes two main steps. First, the firm

handling the project should identify who it is they need to

establish channels of communication with, through which

good and bad news can be delivered. This is very

fundamental, but yet often missing, thus resulting in

miscommunications of risk tolerance levels. The second

step is to identify whose opinion, positions, and interests the

firm should be aware of. This enables the firm to manage

issues accordingly and more readily exploit opportunities. If

the project manager does not receive input from the

appropriate representatives of the stakeholder, or the

messages are not cohesive, the project performance will

suffer and accepted risk levels will not be met.

As expressed by Globerson and Zwikael (2002), the

difficult reality is that very few formal tools and techniques

exist to support the project manager in the communications

area. Some unstructured tools do exist, but they are vague

and fail to offer project managers with an easy ability to

relate with stakeholders. As a result, projects all too often

fail to meet all the stakeholder’s criteria and finish late, over

the budget and not meeting the project’s objectives.

7. Recommendations and conclusion

The risk tolerance has been defined and modeled, the

importance of its assessment has been put forth, and its

influences have been put into context with relation to the

firm, project manager, and stakeholder. What can be done to

ensure that the hazards of deficient risk tolerance analysis

are avoided? Followings are the possible steps.

First, a specific risk management plan should be put in

place that pays very detailed attention to risk tolerance

levels. It should address risk tolerance not only specific to

the firm, but also with regard to the key participants and

stakeholders of project. Very early assessment often seems

Y.H. Kwak, K.S. LaPlace / Technovation 25 (2005) 691–695694

tedious and burdensome, but can pay huge dividends later as

the project’s issues become more large and complex.

Second, a firm should review its compensation policies

for project managers and other employees. People weigh the

possible rewards in making decisions that impact projects.

By initiating a compensation structure whereby a portion of

a person’s salary is at risk and based on performance, a firm

influences that person’s likelihood of taking risks. This is a

tool that firms can use to either increase decision-makers’

risk-taking or increase their risk aversion.

Third, it is vital for companies to possess an organiz-

ational culture that supports proper risk-taking and inno-

vation. Infusing a firm with a culture of innovation and

calculated risk-taking is not an easy task. There are

numerous factors that influence corporate culture and

avenues to take to change culture (Ahmed, 1998). Risk-

taking should be well thought out and measured. Project

managers must be trained and prodded to quantify

whichever risks it makes sense to do so since it is not

uncommon to find managers failing in this regard. It is

difficult to gather the necessary data; so upper management

should lend a hand in getting functional managers involved

in the risk management process.

Daw (1999) recommends as part of risk training for

project managers to ask four questions:

† Am I a risk-taker or avoider?

† What about my project sponsor?

† How much will the project benefit my organization?

† What is the project team’s experience and expertise?

By going through the process of addressing these issues,

a project manager will go a long way in understanding his or

her risk tolerance level as well as that for the project team

and firm as a whole.

Fourth, comprehensive performance reviews of project

managers are another important component for maintaining

a shared understanding and vision of risk tolerance. In

reviewing the project manager’s performance, the upper

management should critique the project manager’s apparent

level of risk aversion. By doing so, the project manager

receives formal guidance for future decisions.

Finally, in performing risk assessment, Kahneman and

Lovallo (1993) point out that a decision-maker should

adopt an outside view. This means a project manager

should make forecasts not only on historical figures and

facts pertaining to the project at hand but more on what

has happened with similar scenarios outside of the

project and even outside of the firm. By doing so,

there is less chance the project manager will make overly

optimistic forecasts naturally leading to failed projects.

Project risk tolerance is a crucial part of any risk

management plan. While it is at the heart of decision-

making, it is all too often overlooked. Risk tolerance cannot

be analyzed at the beginning of a project and later ignored,

because it is ever changing with numerous influential

factors. Fortunately, this complex issue is coming to grips,

thereby ensuring the integrity of valuable and potentially

innovative projects.

References

Ahmed, P.K., 1998. Culture and climate for innovation. European Journal

of Innovation Management 1(1), 30 – 43.

Arrow, K.J., 1965. Aspects of the Theory of Risk Bearing, Yrjo Jahnssonis

Saatio, Helsinki.

Daw, C., 1999. Risk training—the neglected part of project management.

The Training Report. Crownhill Publishing. Available from www.trai-

ningreport.ca

Globerson, S., Zwikael, O., 2002. The impact of the project manager on

project management planning processes. Project Management Journal

33(3), 58 – 64.

Ibbs, C.W., Kwak, Y.H., 2000. Assessing project management maturity.

Project Management Journal 31(1), 32 – 43.

Jarrett, E.L., 2000. The role of risk in business decision-making, or how to

stop worrying and love the bombs. Research—Technology Manage-

ment. Industrial Research Institute, pp. 44 – 46.

Kahneman, D., Tversky, A., 1979. Prospect theory: an analysis of decision

under risk. Econometrica 47(2), 263 – 297.

Kahneman, D., Lovallo, D., 1993. Timid choices and bold forecasts: a

cognitive perspective on risk taking. Management Science 39(1), 17 – 31.

Kirkpatrick, R.J., Walker, J.A., Firth, R., 1992. Software Development Risk

Management: an SEI Appraisal. Software Engineering Institute

Technical Review ’92 (CMU/SEI-92-REV). Software Engineering

Institute, Carnegie Mellon University, Pittsburgh, PA, 1992.

March, J.G., Shapira, Z., 1987. Managerial perspectives on risk and risk

taking. Management Science 33(11), 1404 – 1418.

Office of Government Commerce, 2001. A8: Managing Risk. Crown.

Available from www.ogc.gov.uk

Pratt, J.W., 1964. Risk aversion in the small and in the large. Econometrica

32, 122 – 136.

Ross, S.A., 1981. Some stronger measures of risk aversion in the small and

in the large with applications. Econometrica 49, 621 – 638.

Tversky, A., Kahneman, D., 1992. Advances in prospect theory: cumulative

representation of uncertainty. Journal of Risk and Uncertainty 5, 297 – 323.

Wilemon, D.L., Cicero, J.P., 1970. The project manager—anomalies and

ambiguities. The Academy of Management Journal 13(3), 269 – 282.

Dr. Young Hoon Kwak is a faculty member of the project management

program at the management science department at The George Washington

University (GWU) in Washington, DC. He received his M.S. (1992) and

Ph.D. (1997) in engineering and project management from the University of

California at Berkeley. Before joining GWU, he was a post-doctoral scholar

at Massachusetts Institute of Technology. He has years of experiences

consulting for Fortune 500 companies and various federal governmental

agencies. Dr. Kwak’s main research interests include project management

and control, risk management, and technology management. For more

information visit his homepage at http://home.gwu.edu/~kwak.

Kenneth Scott LaPlace is a senior research associate at Cambridge

Associates, an investment advisory firm to endowed nonprofit institutions,

international organizations, private clients, and corporations. Kenneth

overseas the development of marketable alternative asset manager cover-

age, including long/short hedge funds, distressed securities, and arbitrage

managers, within the firm’s investment manager database group. Kenneth

received his B.S. in Finance from Virginia Tech (1996) and M.B.A. (Magna

Cum Laude) from The George Washington University 2002).

Y.H. Kwak, K.S. LaPlace / Technovation 25 (2005) 691–695 695