Project Risk Management

Muhammad Kamran Khalid, PMP, Six Sigma Black Belt

Dilberts Take

Goals and Objectives

Project Risk Risk Management Risk Management Planning Identify, Qualify & Quantify Risks Response Planning Risk Monitoring & Control Tools, Tricks and Helpful Links

What is Project Risk?

An event that, if it occurs, causes either a positive or negative impact on a project Keys attributes of Risk
Uncertainty Positive and Negative Cause and Consequence Known v Unknown Risks Risk Reward Analysis

What is Risk Management?

PMBOK Definition
The systematic process of identifying, analyzing, and responding to project risk

Steps
Risk Management Planning Risk Identification Qualitative/Quantitative Risk Analysis Risk Response Planning Risk Monitoring & Control

Risk Management Planning

Plan for the Planning
Risk planning should be appropriate for the project Question you should ask:
1. How risky is the project? 2. Is it a new technology or something your organization is familiar with? 3. Do you have past projects to reference? 4. What is the visibility of the project? 5. How big is the project? 6. How important is the project?

The Risk Management Plan

What should it include?
How you will identify, quantify or qualify risk
Methods and tools

Budgetyes budget Who is doing what How often When a risk is really a risk Reporting requirements Monitoring, tracking and documenting strategies

Identifying Risk
Continuous, Iterative Process What is it and what does it look like The sooner the better The more the merrier A fact is not a risk Be specific Dont try to do everything at once

Identification Techniques
Brainstorming Checklists Interviewing SWOT Analysis Delphi Technique Diagramming Techniques
Cause & effect Ishikawa or Fishbone Flow Charts

Analyzing Risk - Qualitative

Subjective Educated Guess High, Medium, Low Red, Yellow, Green 1-10 Prioritized/Ranked list of ALL identified risks First step in risk analysis!

Risk Analysis - Quantitative

Numerical/Statistical Analysis Determines probability of occurrence and consequences of risks Should be focused to highest risks as determine by Qualitative Risk Analysis and Risk Threshold

Probability & Impact Analysis

Risk Probability Impact Expected Value

1 2

25% 50%

$45,000 $2,000

$11,250 $1,000

3%

$100,000

$3,000

Probability/Impact Matrix

Probability/Impact Matrix

Chart Showing High-, Medium-, and Low-Risk Technologies

Decision Tree

Decision Tree Analysis

Decision Definition Decision Node Cost of the Decision Chance Node Probability Impact Prob x Impact Net Impact Cost + Total EV Early 10% Develop In House ($20,000) On Time 20% Delayed 70% Develop In House or Contract? Early 10% Contract ($30,000) On Time 70% Delayed 20% $1,500 +$15,000 $0 $0 ($14,000) -$20,000 TOTAL ($12,500) ($32,500)

$1,500 +$15,000 $0 $0 ($3,000) -$15000 TOTAL ($1,500) ($31,500)

Expected Monetary Value (EMV) Example

Decision Tree

Response Strategies for Negative Risks

Risk avoidance Risk mitigation Risk Transfer Risk acceptance

Risk Response Planning

What are we going to do about it? Techniques/Strategies: Avoidance Eliminate it Transference Pawn it off Mitigation Reduce probability or impact of it Acceptance Do nothing Strategy should be commensurate with risk Hint: Dont spend more money preventing the risk than the impact of the risk would be if it occurs The Risk Response Plan/Risk Response Register

Response Strategies for Positive Risks

Risk exploitation Risk sharing Risk enhancement Risk acceptance

Risk Monitoring & Control

Continuous, Iterative Process Done right the risk should NEVER occur
Someone IS responsible Watch for risk triggers CommunicateCommunicateCommunicate Take corrective action - Execute Re-evaluate and look for new risk constantly

Tools:
Risk Reviews Risk Audits

Residual and Secondary Risks

Its also important to identify residual and secondary risks. Residual risks are risks that remain after all of the response strategies have been implemented. Secondary risks are a direct result of implementing a risk response.