How well are you managing your project’s risk? For many project managers risk analysis is an addendum. And it’s not even the icing on the cake; it’s the sprinkles. Yes, most project managers do not think of risk management as an area of essential focus on their project. But risk management, never-the-less, is a primary duty of the project manager.
In a sense all project management activities are an exercise in risk management. Some project management efforts reduce the risk of not meeting the schedule deadline. Others minimize the possibility of overspending the budget. Quality assurance, of course, ensures the end product meets the customer’s standard. Risk is inherent in the nature of a project, and risk management is a part of all that the project manager does.
There is, however, a project management risk effort that has specific activities the project manager performs to identify and manage project related risks. Through this risk management process or risk analysis the project manager consciously discovers, organizes, and manages project related risks.
This article discusses the art and practice of risk management to help the project manager implement conscious risk management efforts, and to increase the possibility of project success.
A Risky Situation
Consider this situation: Ford Motor Company designs a truck using a new lightweight high-strength aluminum-alloy body. What is the risk that this aluminum body will not hold up well in crash tests? Failure of the body in crash tests is a risk Ford Motor Company needs to not only note, but manage. Risk management is the medium Ford should employ to systematically manage this uncertainty, and to increase the likelihood of project success, i.e. meeting project objectives.
This risk analysis and management is a process and has a framework. The risk management process essentially has five steps:
- Identify risks
- Analyze and prioritize risks
- Prepare a risk response
- Establish risk funding reserves
- Continuously monitor and address project risks. The continuous nature of step five implies a repeated framework throughout the life of the project.
Identify Project Risks
There are several ways to identify risks. The most common is to gather stakeholders together and hold a brainstorming session. Brainstorming fosters creativity and produces a list of risks. If your project is similar to past projects and you can employ lessons learned you have a significant advantage. Here you may use a risk profile (based on similar past projects) to interview individual stakeholders, which helps to stimulate their thinking and ensure their input includes all aspects of the project.
Additionally, investigate similar historical projects and note the risks encountered. If you are included in the cost and schedule estimating process be sure to highlight those activities that are difficult to estimate. These hard to estimate tasks should be treated as risks.
Analyze & Prioritize Project Risks
Analyzing and prioritizing risks helps to isolate those risks that could jeopardize your project. What you want to determine here is whether your project risk can cause a ripple or a tidal wave, and its probability of occurrence. So list and prioritize each risk according to its negative impact and occurrence probability.
Before you can truly understand and prioritize a risk you must accurately describe it. Therefore, for each risk provide:
- The condition: a short statement describing the situation of concern.
- The consequence: a short statement describing the possible negative outcomes.
The challenge of predicting the possibility of a problem is similar to the difficulty in estimating schedule duration and cost. Historical data input is invaluable for this process. However, assigning probabilities to risk remains as much an art as a science. Use the following expected value equation to assist:
Probability X Impact = Expected Value
If your probability in this equation is a percentage and impact a dollar amount you can compute an expected dollar amount value. In the absence of hard data the project team may employ intuition to assess probability and impact. A probability and impact matrix uses subjective assessments and places risks in one of several possible quadrants, Figure 1.
Figure 1
If your risk has both a high-probability and a high-impact you are in the matrix red warning zone, and you have a real serious potential threat to your project success. Rank and log risks according to their location on the probability-impact matrix.
Develop Response Plans
There are five categories in classic risk response:
- Accept
- Avoid
- Contingency
- Transfer
- Mitigate
When you accept a risk you should understand both the consequences and probability, even though you choose to do nothing about it. This strategy makes sense when the impact is cheaper than the solution. Risk can be avoided by reducing scope or by selecting a lower-risk approach to achieve objectives.
Contingency plans are helpful for risks that have probabilities that cannot be reduced, but when you want to have a ready response prepared in advance. This is the monitor and prepared to act strategy.
A high-probability and high-impact risk that is difficult to detect may inspire mitigation efforts in addition to contingency planning. If you have a contingency plan and you are able to monitor the risk then you will want in addition a defined trigger event to know when to activate the contingency plan. Transferring the risk is most commonly done by the purchase of insurance.
Another example is to hire an operator in addition to equipment from an equipment leasing company, so they must pay any damage to equipment or job site. Cost risks in contracts are transferred through the use of fixed-price contracting. Here the subcontractor agrees to perform the work for an agreed upon price before work commences. The subcontractors assumes the risk for any cost overruns. Last, risk mitigation is the effort to reduce the risk. Reducing risk involves reducing the impact, the probability, or both.
Contingency & Reserve Funds
Good foresighted project managers set aside rainy day funds. Contingency reserve funds are for known unknowns, which are identified risks. They are known because these risks have been identified. They also are unknown because we do not know exactly what will happen. But we know enough to smartly set aside money to fund our contingency plans for their potential occurrence.
Reserve funds are for unknown unknowns. These are risks that have not been identified and, therefore, are not in our risk log. The question is how much to set aside for these potential unknown risks? The answer is it depends. The high-risk software industry may set aside up to 30 percent of their performance budget. Lower risk, perhaps, construction projects may only require 5 percent of the performance budget. Similar historical project data helps provide a precedent for a reserve fund amount.
Continuous Risk Management
As the project progresses more information emerges both favorable and unfavorable. In risk management we need to decipher how our known risks are affected and to spot the emergence of new risks.
Yes, risk management is best practiced throughout the life of the project. Monitor known risk with a regularly updated risk log. Ask team members at regular status meetings if they foresee any new potential risks. Schedule preplanned risk identification activities at key project milestones. Prepare contingency plans and appropriate contingency funds for newly discovered risks. And for risks that do not materialize remove them from the risk log. Again, these risk management efforts are intentional and practiced continuously throughout the life of the project.
Summary
Risk management is the art and science of finding and dealing with potential threats to the success of your project. Whether you brainstorm or research historical data your risk discovery process should be intentional.
Classify and log your risks according to probability and impact. Know and understand the five classic responses to risk. Set aside both contingency funds for known unknowns and management reserve funds for unknown unknowns. Recognize the importance of a continuous risk search and response effort throughout the project life cycle.
On the optimist flip side these risk management techniques also apply to opportunities, the probability of a positive impact. A search for possible good fortune may be a strategic effort well spent.
Recommended reading: “The Fast Forward MBA in Project Management”, Eric Verzuh