Risk Management

for
Projects

1
 Project Risk Management
Session Logistics

3.5 hour class

We will take several breaks throughout the session
Please put cell phones on mute or turn off
Feel free to send me an email to talk project management
topics: scott-morrison@comcast.net
Ask questions, actively participate, and try to have some
fun!!!

2
 Project Risk Management
Introductions
About the facilitator
Born in Columbus, Ohio, moved to Denver in 1979
Worked at Mountain Bell/US West/ Qwest from 1981 to 2001
Held several positions with Qwest (Call center operations, product management, database development,
technical project manager, business project manager, program manager, director)
Ran own consulting firm providing project management and management consulting services
Worked at WellPoint (Anthem/Blue Cross Blue Shield) as a Business and IT project manager
B.S. at Regis University (CIS major, Business minor)
Program Management certification at US West/University of Denver Center for Program Management
PMP
Developed and delivered the following Saturday Workshop classes for the Mile High PMI Chapter:
Project Risk Management (2010, 2013, and December 2016)
Project Organizational Design (2011)
Program Risk Management (2012)
Leadership for Project Managers (2013)
Communications for Project Managers (2014)
Project Management Tools (2015)
Project Kick Offs and Team Building Tools (2016)
Fun with MS Project (planned for 2017)
3
 Project Risk Management
Session Agenda

Review risk concepts

Risk Management Overview and the Risk Management Plan
Risk Identification
Risk Quantification
Risk Response
Risk Control

Team exercise
Team exercise readout
Closing items

4
Project Risk Management

Risk Management Overview

and the Risk Management Plan

5
 Project Risk Management
Risk Management Overview

What is risk?
Risk: An uncertain event or condition that, if it occurs, has a positive
or negative effect on a projects objectives

VENTURE OUTCOME
(Project) (Products)

FAVORABLE
UNKNOWNS (Opportunity)
(Uncertainty)
UNFAVORABLE
(Risks)

6
 Project Risk Management
Risk Management Overview

Project Lifecycle
Risk vs. Amount at Stake

I
CONCEPT DEVELOPMENT IMPLEMENT CLOSE
N
PHASE PHASE PHASE PHASE
C
R $
OPPORTUNITY AND RISK
E
A V
S A
PERIOD WHEN
I HIGHEST RISKS L
N ARE INCURRED U
G E

PERIOD OF
R HIGHEST
I RISK IMPACT
AMOUNT AT STAKE
S
K
7
 Project Risk Management
Risk Management Overview

What is risk management?

Identifying, analyzing, prioritizing, and
responding to risk events
Integration of risk management activities into
your other project management functions
Developing responses to risk to meet your
project objectives
Project risk management is PROACTIVE
8
 Project Risk Management
Risk Management Overview

INTEGRATING RISK WITH OTHER PROJECT MANAGEMENT FUNCTIONS

PROJECT
MANAGEMENT
INTEGRATION
INFORMATION /
SCOPE
COMMUNICATIONS
Life Cycle and
Expectations Environment Variables
Ideas, Directives, Data
Feasibility
Exchange Accuracy

QUALITY
Requirements PROJECT Availability HUMAN
Standards RISK Productivity
RESOURCE

Services, Plant, Materials:

Time Objectives, Performance
Cost Objectives,
Constraints Restraints

CONTRACT /
TIME
COST PROCUREMENT

9
 Project Risk Management
Risk Management Overview

Components of the Risk Management Plan

Methodology
Roles and responsibilities
Budgeting
Timing
Risk categories
Definitions of risk probability and impact
Probability and impact matrix
Stakeholders tolerances
Reports
Tracking
10
 Project Risk Management
Risk Management Overview

Results from developing the Risk Management Plan

You have a written plan

You know what actions you have to do

You know who is responsible for what

You can track your work

You can learn from your risk activities and help others with
their risk

11
 Project Risk Management
Risk Management Overview

Risks vs Issues
Many projects use risk and issue logs. Sometimes the management of
issues and risks can become confusing.
The PMBOK definition of an Issue:
A point or matter in question or in dispute, or a point or matter that is
not settled and is under discussion or over which there are opposing
views or disagreements.
If you have the freedom to define these items and their logs and the
subsequent management of risks and issues, then great. Handle risks and
issues as you desire. My suggestion is to follow as closely as possible the
PMBOK guidelines.
If you are dictated by the company, organization, or management team to
handle risks and issues in a particular manner, then follow these
guidelines. Document in your Project Management Plan, Risk
Management Plan, and or Issue Management Plan how you will handle
risks and issues. 12
Project Risk Management

Risk Identification

13
 Project Risk Management
Risk Identification

Risk in corporate business is typically divided into 2 basic

types
Business Risk: Chances of profit or loss associated with a business
endeavor
Business employs a staff of qualified workers to increase profit and reduce
chances of loss

Pure or Insurable Risk: Divided into 4 categories

Direct property: Destruction of property by fire, etc.
Indirect property: Extra expenses associated with rental property or loss due
to a business interruption
Liability: Chance of a lawsuit of bodily injury, damages, etc.
Personnel: Injuries to workers (Workers Comp)
14
 Project Risk Management
Risk Identification

Risk in project management

Usually not enough attention is paid to risk on projects
All risks are not independent and frequently the greatest risk on
a project comes from a series of related/integrated events
Ultimate responsibility of risk management resides with the
project sponsor
As the project manager representing the sponsor, risk
management becomes a large responsibility for you

15
 Project Risk Management
Risk Identification

Risk identification is never done

Risk identification is performed throughout the life of the

project

The process for identifying risk

Understand the project

Identify the risk event

Document the results and take appropriate actions

16
 Project Risk Management
Risk Identification

Types of risk
Technical
External
Organizational
Project Management
Note: These are example types of risk and this list can be modified to
meet the needs of your project

Developing a project RBS (Risk Breakdown Structure) is an

excellent tool to help identify risks
17
 Project Risk Management
Risk Identification
PROJECT
RBS

PROJECT
TECHNICAL EXTERNAL ORGANIZATIONAL
MANAGEMENT

SUBCONTRACTORS PROJECT
REQUIREMENTS ESTIMATING
& SUPPLIERS DEPENDENCIES

TECHNOLOGY REGULATORY RESOURCES PLANNING

COMPLEXITY &
MARKET FUNDING CONTROLLING
INTERFACES

PERFORMANCES
& RELIABILITY CUSTOMER PRIORITIZATION COMMUNICATIONS

QUALITY WEATHER

The Risk Breakdown Structure (RBS) lists categories

and sub-categories for project risk. The actual

18
categories will vary across different types of projects.
 Project Risk Management
Risk Identification

What you need to identify risk

Product description
Planning documents
Project scope statement
Cost mgt plan
Schedule mgt plan
Communications mgt plan
Enterprise environmental factors
Stakeholder register
Quality mgt plan
Organizational process assets
Historical Information
Previous project data
Expert knowledge
19
 Project Risk Management
Risk Identification

In your risk identification meeting

Validate RBS with core team

Identify risks by source (RBS)

Identify risks by level of uncertainty:

Known Known / Unknown Unknown / Unknown

Situation with no Situation with an Situation whose
uncertainty identifiable uncertainty existence we cannot
imagine

20
 Project Risk Management
Risk Identification

Conduct a risk identification meeting

Gather all relevant data

Schedule a risk management meeting with your core team members

Use a structured approach: Brainstorming, Nominal Group Technique, Delphi

Technique, Mind Mapping, Project Lessons Learned

Focus on identifying risk only

Schedule risk identification meetings in your project plan

After certain milestones: Requirements complete, design complete, etc.

Event driven
A risk event happens and becomes part of the risk register

21
 Project Risk Management
Risk Identification

Brainstorming

Chose a facilitator (best if other than the project manager)

Chose a scribe to capture the risks

Use a category or categories to start the creativity flowing

Do not judge or analyze during this effort

Focus on getting the universe of risks for your project

22
 Project Risk Management
Risk Identification

Nominal Group

Gather the core team for a risk workshop

Use flip charts or a whiteboard to collect info

Begin by having each person identify potential areas of risk

Then within each area have each person write at least 3-5 risk

events

Repeat until everyone has listed their risks

23
 Project Risk Management
Risk Identification

Delphi technique
Identify a facilitator
The facilitator then identifies qualified experts to participate
The facilitator poses questions to the experts individually
The facilitator then analyzes the results to identify common
themes
The results are then shared with the experts for validation
The list is then refined and again shared with the panel
The facilitator the creates a single results document
24
 Project Risk Management
Risk Identification

Mind mapping
Begin with a category of risk in the center represented by a circle

Major risks for that category are represented by lines connecting

with the circle

For each major risk identify smaller risks that are part of that risk

Do not judge or evaluate at this time

Continue until no more risks can be identified

25
 Bonus Slide
Scotts 3 Rules of Project Management

1. Dont hurt anyone

People, animals, or the environment

2. Do the right thing

Follow all legal, regulatory, and compliance rules

Ethical behavior and honesty are the most important things you
can ever do

Give credit where credit is due

3. Just deliver, baby!

26 26
Project Risk Management

Risk Quantification

27
 Project Risk Management
Risk Identification

Identify your risks in a risk register or a risk log

Functional Area Identify the functional business areas

potentially impacted by the risk

Risk Category Cost; External; Schedule; Technical;

Resources; Operational

Risk Description Description of the risk and the impact of it

Date Identified Date the risk was identified

Raised By Who identified the risk

28
 Project Risk Management
Risk Quantification

What are the right risks to manage

Analyzing risks for probability and impact
Developing a risk profile for your project
Prioritizing your risks
When to quantify risks
Whenever a new risk is created
An existing risk changes
Influential factors change
New information surfaces
A change is proposed by the sponsor
Market conditions change
Significant personnel leave the project

29
 Project Risk Management
Risk Quantification
Quantitative Analysis
Relies on a numeric value
Uses objective data
Requires understanding of
probability theory
Removes some uncertainty
Should be based on
historical data
Some examples are:
sensitivity analysis,
expected monetary
analysis, and modeling and
simulation
Qualitative Analysis
Uses subjective values:
Green, Amber, Red
Requires common
understanding of ordinal
ranking system
May be less precise than
quantitative analysis
Should be defined in terms
of the parameters of the
project
30
Project Risk Management
Risk Quantification

31
 Project Risk Management
Risk Quantification

Probability
Can be done in a basic approach by developing a simple estimate of the probability that an
event will be late in delivery
Ed says it is 50% likely this task will be late
Probability of Event 1 x Probability of Event 2 = Probability
Can be done in a more complex manner by using weighted averages
Joe says 35% chance of being late
Mary says 40% chance of being late
Ed says 50% chance of being late
Joe gets twice as much credit because he knows more about the situation
The probability is: ((2 x 35) + (40) + (50)) / 4 = 40%
Quantifying risk probability can become quite complex, there are many resources to assist
you with more detailed approaches (books, internet research, multi-day training,
consultants).
32
 Project Risk Management
Risk Quantification

Assessing Impact
Schedule Tools:
Network analysis (relationships, durations, critical
path(s), near critical paths, hard constraints)
Resources (availability, competency, productivity)
Estimates (accuracy, source, method)
Cost tools:
WBS
Requirement definition
Estimating methodologies
Expected monetary value
Decision trees
Financial analysis
33
 Project Risk Management
Risk Quantification

Assessing Impact (cont.)

Quality
Ask yourself the question What if the project fails to
perform as expected during its operational life?
Of all the project objectives, conforming to quality
objectives is the one most remembered
Therefore, this is one of the most important dimensions
impacting your project
You can use financial analysis to identify risk for poor
quality by quantifying long term activities that will
impact the product lifecycle for your analysis
34
Project Risk Management

Risk Response

35
 Project Risk Management
Risk Response

Risk response is:

Defining steps for responses to opportunities and threats
Assigning responsibility
Developing responses for negative risks:
Avoiding: Changing the project mgt plan to eliminate
the risk. Could involve changing the objective,
modifying the schedule, or reduction in scope.
Mitigating: A reduction in the probability or impact to
the project. Taking early action to reduce the
probability, adopting less complex processes, or
conducting more tests.
Transferring: Shifting the risk to a third party for the
management of the risk. Does not eliminate the risk,
could involve insurance, warranties, bonds.
Insurance: Purchase insurance to reduce/eliminate risk
an athlete may purchase insurance against injury to
guarantee their income.
36
 Project Risk Management
Risk Response

Risk response is:

Developing responses for negative risks(cont.):
Accepting: It is possible that the risk cannot be
eliminated or managed. Can be active or passive in
approach a contingency reserve in time, money,
or resources.
Developing responses for positives risks or opportunities
The strategies for managing positive risks are:
Exploit the situation. We will do whatever we can to
make sure the event does happen so we can enjoy the
rewards of the event.
Enhance the probability and positive impacts of the
event.
Share the ownership with a third party who can better
enhance the situation.
Accept the opportunity, take the advantages provided by
the event, but do not actively pursue the event.
37
 Project Risk Management
Risk Response

Approach response development from a project wide

perspective
Consider related risks
Stay within your project scope on your responses
Consider the following for contingency planning:
The management of a contingency budget
The development of schedule alternatives and work-arounds
Complete emergency responses to deal with major areas of risk
An assessment of project shut-down liabilities

38
Project Risk Management

Risk Control

39
 Project Risk Management
Risk Control

Actively work your risk register/log

Update risks as needed (data, new resources,
new/changing requirements)
Review the log in status calls, set and use due dates for
active contingency plans
Hold assigned resources accountable for their action
items
Engage sponsor when invoking contingency plans to
ensure they know a risk has happened and the team is
actively working the response plan
40
 Project Risk Management
Example Log
Risk ID
Functional Area
Risk Category
Risk Description
Date Identified
Raised By
Date Assigned
Assigned To
Probability
Potential Impact
Risk Factor (P*I)
Positive or Negative Impact
Response Category
Status/Comments
Trigger
Proposed/Actual Resolution
Contingency Plan
Risk Control
Sequential number assigned
Identify the functional business areas potentially impacted by the risk
Cost; External; Schedule; Technical; Resources; Operational
Description of the risk and the impact of it
Date the risk was identified
Who identified the risk
Date the risk was assigned
Who the risk was assigned to
1, 2, 3, 4
1, 2, 3, 4
Probability * Impact
Will the potential impact of the risk have a Positive, Negative, Both or Unknown impact if realized?
Acceptance; Mitigation; Transfer; Avoidance
Status of risk and update/comments about it
Preliminary event that will indicate the risk is about to take place
Risk Response plan
Alternate Plan if Risk Response fails
41
Project Risk Management

Small Team Exercise

42
 Project Risk Management
Small Team Exercise

Your task, should you choose to accept it, and you must,
is to develop a risk plan for your project
The group will break into 3-5 person teams to work on
their project
There are 2 projects, a construction project and a new
product development effort
You will develop your risk plan, then the similar project
teams will get together (all the construction teams in one
group and all the product development teams in another)
and develop a summary of what happened, then each
large project group will present to the whole class their
experiences
43
 Project Risk Management
Small Team Exercise

Product Development Project

This is a telecommunications product
The team will develop and deploy a new feature to be used on your
home or work phone called Phone Buzz
There is an estimated customer base of 6M consumer users and 1M
business users across the 50 states
Revenue for the consumer base is estimated to be $720M per year
and revenue for the business segment is estimated at $180M per year.
The base telecommunications technology for the application is proven,
but must be combined with a new technology that has never been
utilized on the current telecommunications system architecture

44
Project Risk Management
Small Team Exercise

Product Development Project (cont.)

The VP of Marketing is planning on announcing the new
product at the industrys largest trade show in 6 months
The budget for the project is currently set at:
$ 25M for technology
$ 1M for business project costs
$ 5M for marketing
Initial estimates are 12 18 months to complete the project
The project has been approved to start, and the following
assets have been developed
High level business requirements
A preliminary technical feasibility assessment
Secondary market research has been performed
The sponsor and initial core team have been identified
45
 Project Risk Management
Small Team Exercise

Product Development Project (cont.)

Core team members
Required
Business Project Manager
Technical Project Manager
Project Sponsor
Optional
Operations Manager
Training Project Manager

46
 Project Risk Management
Small Team Exercise
Construction Project
This project will develop a combined residential and commercial
community in southern Louisiana, the community will be called
Southern Comfort
Planned activities are:
300 Residential Condos (Targeted sales price $100K to $150K each)
100 Residential Homes (Targeted sales price $350K to $500K each)
A small office complex (50,000 sq. ft.)
2 convenience stores, each with a gas station
4 recreational areas:
2 open space areas: Also used for youth soccer and football
1 area with tennis courts and basketball courts
1 area with 6-8 baseball/softball fields

47
 Project Risk Management
Small Team Exercise

Construction Project (cont.)

The current project budget is $47M, targeting 3 years to
complete the entire effort
Unit Type Quantity Sq. Ft (tot) Cost Cost per Unit
Condos 300 360,000 21,600,000 72,000
Houses 100 200,000 18,000,000 180,000
Commercial 1 50,000 6,500,000 6,500,000
Stores 2 8,000 1,040,000 520,000

Fields 4 100,000 25,000

47,240,000

48
 Project Risk Management
Small Team Exercise

Construction Project (cont.)

So far the following has happened:

The land has been purchased

The property is located next to a protected wildlife area and had wonderful views

and access to good shopping and restaurants

35 condos have been built or are in progress

10 homes have been built or are in progress

The zoning for the commercial lots has not yet been completed

49
 Project Risk Management
Small Team Exercise

Construction Project (cont.)

Core team members
Required
Business Project Manager
Construction Project Manager
Project Sponsor
Optional
Sales Manager
Supplier/Materials Project Manager

50
 Project Risk Management
Small Team Exercise

Your assignment, as the new Business Project Manager is to:

Develop a Risk Management Plan
Develop an RBS
Conduct a Risk Identification meeting
After the identification meeting is complete, quantify your risks
Develop risk responses for your significant risks
Prepare a summary sheet on your findings to share with the other small
teams in your project type
Develop a summary sheet with the similar projects to present to the
entire class
Notes:
Each small team will call for 2 reviews, one for their Risk Management Plan
and one for their Risk Register once they complete their risk responses from
the facilitator
Updates to the project information will be provided during the exercise

51
 Project Risk Management
Small Team Exercise

Conclusions
What worked well?
What did not work so well?
What happened during the process that you found
interesting?
How well were you able to manage your risk?
What would you do differently?
Is there anything you would now do differently on
your project based on this experience?
52
Project Risk Management
Conclusion

Conclusion

53
 Project Risk Management
Conclusion

Risk management requires:

Planning

Structure

Analysis

Creativity

Constant attention

Flexibility

Communications, communications, communications!!

54
 Project Risk Management
Conclusion (cont.)

The PMBOK has a lot of great reference materials to assist you

with your Risk Management planning activities
Whatever you do, just do SOMETHING to address risk on your
projects and do it in a structured manner
If your company/organization does not have templates or a
process in place, develop your own tools.
Use the PMBOK for ideas on the approach and build a risk register in
Excel.
A tab in Excel identifying your plan and another tab with the Risk
Register will work much better than nothing.

55
 Project Risk Management
Conclusion (cont.)

Program Risk Management

Project risk management principles can be applied
to programs
Use of an RBS will be helpful for programs
Project risks will roll up to the program
Program risks will take on a more global nature in
addition to the project risks within the program
External events, company profits, legal/compliance
issues, political issues, company strategies
Communication with your sponsors is even more
critical on programs than on projects

56
Project Risk Management

References

57
 Project Risk Management
References

PMBOK Fifth Edition

Book Project and Program Risk
Management, R. Max Wideman
PMI Seminar Managing Risk on Projects,
Jimmie West

58