THE EARNED RISK MANAGEMENT METHOD

By Andr Toso Arrivabene, MBA, PMP, PgMP, SCPM

1.

Introduction

Risk management is widely seen as an essential factor to successful project management. When overlooked, risk unexpected risks might became the main cause of project failure, potentially affecting the project objectives and viability, and as pointed by Hilson & Simon (2007), will potentially lead the project to unforeseen results. We may define risk as situation when an uncertainty brings consequences (Cooper, 2005). According to Barkley (2004) risk is, in fact, an aspect inseparable from the project life cycle, as opposed to a one single point-in-time of risk identification and assessment. Risk management might be applied as a form of controlling risks that is structured in its form and allows the prevention of possible problems early on (Stam, 2004). Wideman (1992) stated that Risk Management ensures that risks and uncertainties are adequately incorporated into project planning and development. Although widely accepted as much in projects as in general business management, performance measuring techniques are often seen as a separated discipline, usually linked with the Risk Management discipline in terms of what impact risks might have in overall project or business performance. Applying performance measuring techniques as tools for measuring the performance of risk management seems to be an under explored field. This article proposes a method for monitoring the performance of risk response plans, and the overall project risk response plan efficiency. The ability to quantitatively measure performance is an enabler and success factor for several improvement

EARNED RISK MANAGEMENT

endeavors (Harbour, 2009). The Earned Risk method proposed in this article is focused on the analysis and monitoring of two basic elements: the project Risk Variance (RV) and the project Risk Performance Index (RPI), both described in more details in the next sections. The Earned Risk Method proposes the establishment of a Risk Exposure Baseline, that should be agreed upon and approved by the organization sponsoring the project. The risk exposure baseline is a representation of the expected decrease in the project risk exposure level as the risk response plan is implemented. The rationale behind the approach is that the risk exposure is expected to decrease in a pre-determined pace, that is dictated by the pace of the actions from the risk response plan. The proposed method is intended to help the performance measurement of the risk response plan, in terms of project risk exposure. The Earned Risk Method should be used in addition to other methods of risk assessment, such as probability and impact matrix (P-I Matrix), Expected Monetary Value (EMV) and Decision Trees, and was based on other performance measure methods such as the Earned Value Management method.

2.

Definitions

In order to describe the Earned Risk Method proposed in this article, it is necessary to establish the terminology for the elements of analysis we are going to use:

ID 01

Terminology Initial Risk Exposure

Description The initial risk exposure before any actions defined in the risk response plan are completed. Represents the level of risk exposure agreed with the organization at a given point in time. Represents the actual level of risk exposure at a given point in time. Represents the difference between the actual risk exposure and the baseline risk exposure at a given point in time.

Abreviation REini

02

Baseline Risk Exposure

BRE

03

Actual Risk Exposure

ARE

04

Risk Variance

RV

EARNED RISK MANAGEMENT

05

Risk Performance Index

Index that represents the performance of the current risk exposure versus the baseline risk exposure at a given point in time. The level of risk exposure after all actions in the risk response plan are completed.

RPI

06

Residual Risk Exposure

REres

Table 1 - Earned Risk Method Terminology

The earned risk analysis elements that require calculations are described in the next table, which also describes the interpretation for the element values:

Terminology Risk Variance

Abreviation RV

Equation

Interpretation Risk Variance (RV) represents the absolute value of the difference between the baseline risk exposure and the actual risk exposure. RV > 0 indicates that the actual current risk exposure is lower than the baseline risk exposure, which means that the project is less exposed to risk than the level agreed. RV < 0 indicates that the project is currently exposed at a higher level of risk than agreed in the baseline.

Risk Performance Index

RPI

Risk Performance Index (RPI) represents the ratio between the baseline risk exposure and the actual current risk exposure. RPI > 1 indicates that the actual current risk exposure is lower than the baseline risk exposure, which means that the project is less exposed to risk than the level agreed. RPI < 1 indicates that the project is currently exposed at a higher level of risk than

EARNED RISK MANAGEMENT

agreed in the baseline.

Table 2 - Earned Risk Analysis Formulae

3.

Foundations

Lets take for instance a hypothetical project P. The project risk analysis resulted in the risk assessment matrix M represented bellow. The risk exposure is determined using the conventional probability vs. impact method: Risk Assessment Probability Risk 1 P1 Impact I1 Initial Risk Exposure RE1 (P1 x I1) Risk Response Plan Action Impact on Risk Action Due Date Exposure A1 A1 M1 A2 M2 A2 A3 M2 A3 A4 M3 A4 A5 A5 M1 A6 M2 A6 A7 M3 A7 A8 M4 A8 A9 M5 A9 A10 A10 M6 A11 M7 A11 A12 M8 A12 A13 A13 M9 A14 A14 M10 A15 M11 A15

Risk 2

P2

I2

RE2 (P2 x I2)

Risk 3 Risk 4

P3 P4

I3 I4

RE3 (P3 x I3) RE4 (P4 x I4)

Table 3 - Risk Assessment Matrix Example

For the example above, the project initial risk exposure is given by:

where REini represents the projects total risk exposure before the actions defined in the risk response plan are completed. Each risk response action has an impact on either the risks probability or the risks impact, thus representing an impact on the risk exposure. For the purpose of this study, we will represent the impact on the risk resulting from the response action as Ai, where i represents the action identification.

EARNED RISK MANAGEMENT

As an example, the risk exposure from risk #1 after Action 1 is completed is given by:

The residual project risk is the overall project risk exposure after all actions in the response plan have been completed. The representation of the residual risk is as follows:

4.

Risk Exposure over Time

In order to determine the risk exposure at a given point in time, let us consider the due dates for the actions from the response plan represented in Table 1: TIME M1 M2 M3 M4 M5 M6 M7 M8 M9 M10 M11 A1 A1 A2 A2 A3 A3 A4 A4 A5 A5 A6 A6 A7 A7 A8 A8 A9 A9 A10 A10 A11 A11 A12 A12 A13 A13 A14 A14 A15 A15

Table 4 - Risk Response Actions versus Time

The gray cells on table 4 represent the impact expected from each response action on the risk assessment matrix (Table 1) in a given point in time. For instance, the value of cell A1 x M1 is A1, indicating that action A1 is expected to be completed in the time period M1, resulting in a risk reduction of A1. In the same way, the value of cell A5 x

RESPONSE ACTIONS

EARNED RISK MANAGEMENT

M1 is A5, indicating that action A5 is expected to be completed in the time period M1, resulting in an additional risk reduction of A5. The level of risk exposure at a given point in time (t) is the initial risk exposure minus the sum of impact of all the response actions completed by time period t:

where AMi represents the actions in the response plan that are expected to be completed by the time period Mi. For instance, in order to determine the project Risk Exposure in time period M1, the representation should be:

According to the response plan represent in matrix M (Table 1), actions A1 and A5 should be completed by time period M1, so the Risk Exposure for M1 is:

For time period M2, actions A2, A3 and A6 should be completed, so the cumulative Risk Exposure is:

As a general rule, once the risk exposure at any given point in time is determined, the risk exposure for the next time period (t) is determined by the exposure of the previous period (t-1) minus the impact of all actions planned for period t:

EARNED RISK MANAGEMENT

From Table 2, we are now able to determine the expected Risk Exposure at any period of time for project P:

Time M0 M1 M2 M3 M4 M5 M6 M7 M8 M9 M10 M11

Risk Exposure REini REM1 REM2 REM3 REM4 REM5 REM6 REM7 REM8 REM9 REM10 REM11

How to determine -

( ( (

) ) )

In this example, the Risk Exposure expected for the last time period (M11) is the Residual Risk Exposure (REres). For the purpose of this study, we will consider that REres is the level of risk exposure accepted by the organization for our project P. Assuming that no new risks occur and no new risks are identified, the risk exposure curve should assume the shape represented on the next chart:

EARNED RISK MANAGEMENT

Risk Exposure
REini

REM1

REM2 REM3 REM4 REM5 REM6 RE M7 REM8 REM9 RE M10 REres

M0

M1

M2

M3

M4

M5

M6

M7

M8

M9

M10

M11

Chart 1 - Risk Exposure versus Time

Scenario 01 Actual Risk Exposure Higher than Baseline Risk Exposure Let us now fast forward the execution of project P until time period M6. We will assume that some of the actions in the risk response plan are either delayed or were completed in time but were not efficient in reducing the risk level. The shape of the risk curve with the actual risk exposure is represented below:

Risk Exposure
BREini

BREM1

BREM2 BREM3

AREM4

AREM5

AREM6

BREM4 BREM5

BREM6

BREM7 BRE M8 BRE M9

BREM10 BRE res

M0

M1

M2

M3

M4

M5

M6

M7

M8

M9

M10

M11

Baseline Risk Exposure

Actual Risk Exposure

Chart 2 - Baseline Risk Exposure versus Actual Risk Exposure

EARNED RISK MANAGEMENT

Earned Risk Management Variables and Indexes

Risk Variance (RV):

From Chart 2, we know that ARE M6 > BREM6, so RVM6 < 0, which indicates that the project is exposed to a risk level higher than the risk exposure accepted by the organization for that particular time period (M6).

Risk Performance Index (RPI):

From Chart 2, we know that ARE M6 > BREM6, so RPIM6 < 1, which also indicates that the project is exposed to a risk level higher than the risk exposure accepted by the organization for that particular time period (M6). The next chart shows the graphic representation of the Risk Variance for period M6:

Risk Exposure
BREini BREM1 AREM4 BREM3 BREM4 BREM5 BREM6

BREM2

AREM5

AREM6

Risk Variance
BREM7 BRE M8 BRE M9

BREM10 BRE res

M0

M1

M2

M3

M4

M5

M6

M7

M8

M9

M10

M11

Baseline Risk Exposure

Actual Risk Exposure

Chart 3 - Graphic Representation of the Risk Variance

Scenario 02 Actual Risk Exposure Lower than Baseline Risk Exposure Let us now fast forward the execution of project P until time period M6. We will assume that the actions in the risk response plan are either completed on time or in

10

EARNED RISK MANAGEMENT

advance, and had the expected or higher efficiency in reducing the risk level. The shape of the risk curve with the actual risk exposure is represented on the next chart:

BREini BREM1 BREM2 BREM3

Risk Exposure

BREM4 AREM4 BREM5 BREM6

BREM7 BRE M8 BRE M9

BREM10 BRE res

AREM5 AREM6

M0

M1

M2

M3

M4

M5

M6

M7

M8

M9

M10

M11

Baseline Risk Exposure

Actual Risk Exposure

Chart 4 - Baseline Risk Exposure versus Actual Risk Exposure

Earned Risk Management Variables and Indexes

Risk Variance (RV):

From Chart 2, we know that ARE M6 < BREM6, so RVM6 > 0, which indicates that the project is exposed to a risk level lower than the risk exposure accepted by the organization for that particular time period (M6).

Risk Performance Index (RPI):

From Chart 2, we know that ARE M6 < BREM6, so RPIM6 > 1, which also indicates that the project is exposed to a risk level lower than the risk exposure accepted by the organization for that particular time period (M6). The chart below shows the graphic representation of the Risk Variance for period M6:

11

EARNED RISK MANAGEMENT

BREini

BREM1 BREM2 BREM3

Risk Exposure

BREM4 BREM5

AREM4

BREM6

BREM7 BRE M8 BRE M9

BREM10 BRE res

AREM5 AREM6

Risk Variance

M0

M1

M2

M3

M4

M5

M6

M7

M8

M9

M10

M11

Baseline Risk Exposure Chart 5 - Graphic Representation of the Risk Variance

Actual Risk Exposure

5.

Method Limitations

The following limitations should be taken into consideration when applying the Earned Risk Management method: For every risk reassessment, a new Risk Exposure Baseline must be adopted and approved; At least a qualitative risk analysis should be performed on the identified risks before applying the method; The risk exposure level (Probability x Impact) for all risks should be mapped into a common metric (e.g. monetary value, an impact scale based on risk points, etc.) The Earned Risk method is good representation of a risk mitigation strategy, but it has limitations when representing the effects of contingency response actions;

6.

Conclusion

12

EARNED RISK MANAGEMENT

The Earned Risk Method allows the translation of lots of major risk management information into a pair of indexes, providing a tool for monitoring the performance of the risk management activities, and also provides a concise and direct communication tool for project and risk managers, in terms of Risk Management. It is suggested that the method is applied in addition to other conventional and well recognized risk management tools and techniques, as mentioned earlier in this article. The Earned Risk Method has the same fundamental principle from the Earned Value Analysis method, and as such, might be a useful analysis tool for risk managers, project managers and project stakeholders. The method allows for a visualization of how the project is in terms of risk exposure, as compared to what it should be.

7.

References
Newtown Square, PA: Project

Project Management Institute (PMI) (2013). A Guide to the Project Management Body of Knowledge (PMBoK Guide) Fifth Edition. Management Institute. Project Management Institute (PMI) (2009). Practice Standard for Project Risk

Management. Newtown Square, PA: Project Management Institute. Project Management Institute (PMI) (2005). Practice Standard for Earned Value Management. Newtown Square, PA: Project Management Institute. Stam, D. (2004). Project risk management : an essential tool for managing and controlling projects. London Sterling, VA: Kogan Page. Barkley, B. (2004). Project risk management. New York: McGraw-Hill. Cooper, D. (2005). Project risk management guidelines : managing risk in large projects and complex procurements. West Sussex, England Hoboken, NJ: J. Wiley. Harbour, J. (2009). The basics of performance measurement. Boca Raton: CRC Press.

13

EARNED RISK MANAGEMENT

Hillson, D., & Simon, P. (2007). Practical project risk management: The ATOM methodology. Vienna, Va: Management Concepts. Wideman, R. M. (1992). Project and program risk management: A guide to managing project risks and opportunities. Drexel Hill, PA: Project Management Institute.