5. Chapter Five: Project Risk Management

 

Downloadable file: 

https://drive.google.com/file/d/1QRlRDSc2eCegvOSX5zRRRRcfU0rB9k8p/view?usp=sharing

YouTube Video

Class Day 22:

https://www.youtube.com/watch?v=qEocMnLf64E&list=PLGYMTr4BT9IxTt8jLIGOOzy0mjtXLHeMy&index=25

Class Day 23:

https://www.youtube.com/watch?v=Je1FEBh3rps&list=PLGYMTr4BT9IxTt8jLIGOOzy0mjtXLHeMy&index=26

Class Day 24:

https://www.youtube.com/watch?v=Z_Ztek_XR10&list=PLGYMTr4BT9IxTt8jLIGOOzy0mjtXLHeMy&index=27

CHAPTER 5- PROJECT RISK MANAGEMENT

5.1 Introduction to Project Risk

When our World was created, nobody remembered to include Certainty

- PETTER BERNSTEIN

Every project is risky, meaning there is a chance things won't turn out exactly as planned. Project outcomes are determined by many things, some that are unpredictable and over which project managers have little control. Risk level is associated with the certainty level about technical, schedule and cost outcomes. High certainty outcomes have low-risk; low- certainty outcomes have high risks. Certainty derives from knowledge and experience gained in prior projects, as well as from management's ability to control project outcomes and respond to emerging problems.

In general, risk is a function of uniqueness of a project and the experience of the project team.

Risk = f (uniqueness, experience of project team)

Project Risk

Project risk is an uncertain event or condition that, if it occurs, has a positive or negative effect on a project objective. A risk has a cause and, if it occurs, an impact. For example, the cause may be requiring a permit or having limited personnel assigned to the project. The risk event is that the permit may take longer than planned or the personnel may not be adequate for the task. Project risk includes both threats to the project’s objectives and opportunities to improve on those objectives.

The notion of project risk involves two concepts:

•  The likelihood that some problematical event will occur.
•  The impact of the event if it does occur.

Risk is also the joint function of: Risk – f (likelihood, impact)

A project will be ordinarily considered risky whenever at least one factor – either the likelihood or the impact- is large. For example, a project will be considered risky where the potential impact is human fatality or massive financial loss even when the likelihood of either is small.

 Risk & Reward

·         Risk should be related to reward.

·         Risks accepted should be in balance with the reward that may be gained by taking the risk.

·         For example, a fast-track schedule is a risk taken to achieve the benefit of a shortened schedule.

 5.2 Types of Project Risk

Broadly, there are five main categories of risk types associated with project management.

1.   External Risks

External events are mainly outside the control of the project manager and, in most cases, the organization. Examples include:

·         Marketplace developments—rapid developments can cause an abrupt change of direction

·         Market risks include competition, foreign exchange, commodity markets, and interest rate risk, as well as liquidity and credit risks

·         Government regulatory changes

·         Industry-specific procedures—new standards, issues

·         Legal issues-disputes, lawsuits, and court orders

·         Change-driven factors-new products, services, changes in market

·         Corporate strategy and priority changes

·         Disasters such as fire, flood, earthquake, or other natural disaster

·         Risks associated with labor strikes; and civil unrest

·         Risk Associated with Loss of power, heating, or ventilation; air conditioning failure

·         Communications systems and security sensor failures

·         Emergency destruction of communications

Most of these risks are very difficult to control at the project manager level but can be identified and, therefore, managed. This means that senior management must be involved in the risk management process and have input into risk control issues.

2.   Cost Risks

Many of these types of risks are directly or indirectly under the project manager's control or within his or her area of influence. Cost risk, typically escalation of project costs due to poor cost estimating accuracy and scope creep.

 Examples of cost risks include those arising from:

·         Cost overruns by project teams or subcontractors, vendors, and consultants

·         Scope creep, expansion, and change that has not been managed

·         Poor estimating or errors that result in unforeseen costs

·         Overrun of budget and schedule

 

3.   Schedule Risks

Schedule risks can cause project failure by missing or delaying a market opportunity for a product or service. Schedule risk is the risk that activities will take longer than expected. Slippages in schedule typically increase costs and, also, delay the receipt of project benefits, with a possible loss of competitive advantage. Such risks are caused by:

·         Inaccurate estimating, resulting in errors

·         Increased effort to solve technical, operational, and external problems

·         Resource shortfalls, including staffing delays, insufficient resources, and unrealistic expectations of assigned resources

·         Unplanned resource assignment—loss of staff to other, higher-priority projects

4.   Technology Risks

Technology risks can result from a wide variety of circumstances. The result is failure to meet systems' target functionality or performance expectations. Performance risk is the risk that the project will fail to produce results consistent with project specifications. Typical examples are:

·         Problems with immature technology

·         Use of the wrong tools

·         Software that is untested or fails to work properly

·         Requirement changes with no change management

·         Failure to understand or account for product complexity

·         Integration problems

·         Poor Software/hardware performance issues—poor response times, bugs, errors

 

5.   Operational Risks

Operational risks are characterized by an inability to implement large-scale change effectively. Such risks can result in failure to realize the intended or expected benefits of the project. Typical causes are:

·         Inadequate resolution of priorities or conflicts

·         Failure to designate authority to key people

·         Insufficient communication or lack of communication plan

·         Size of transaction volumes—too great or too small

·         Rollout and implementation risks—too much, too soon

·         Poor implementation, procurement etc

5.3 Analysis of Major Sources of Risk

Any factor with an uncertain probability of occurring that can influence the outcome of a project is considered as risk source or risk hazard. The most difficult part of risk identification is discovering things we don’t already know! Project risk’s source can be classified as internal risks and external risk

1.   Internal Sources of risk:

Internal risks originate inside the project and project managers and stakeholders usually have a measure of control over these. Two main categories of internal risk source are market risk and technical risk

a.      Market risk

Market risk is the risk of not fulfilling either market needs or the requirements of particular customers. The sources of market risk include

·         Incompletely / in adequately defined market or customer needs

·         Failure to identify changing needs

·         Failure to identify newly introduce products by competitors

 b.      Technical risk

Technical risk is the risk of not meeting time, cost or performance requirements due to technical problems with the end-item or project activities. These risks are high in projects involving activities that are unfamiliar or require new ways of integration and especially high in projects with untried technical applications.

One approach to expressing technical risk is to rate the risk of the project end item or primary process as being high, medium or low according to the following features:

Maturity -                     An end item or process that is pre- existing, installed and operational or based on experience and pre- existing knowledge entails less risk than in the early stage of development or new

Complexity -                   An end item or process with numerous interrelated steps or components is more risky than one with few steps and components having simple relationship

Quality -                     An end-item or process that is known to be completely producible, reliable or testable is less risky than one that has not yet been produced or has low reliability or testability

Concurrency or Dependency -  In general risk increases the more that activities overlap one another. Sequential, dependent activities with no overlap are much less risky than those with much overlap

2.   External Sources of risk:

External risk include only risk that stem from sources outside the project. Project managers and stakeholders usually have little or no control over these. External risk hazards include changes in:

•  Market conditions
• Competitor’s actions
• Government regulations
•  Interest rates
• Decisions made by senior management / customers regarding project priorities, staffing or budgets
• Customer needs and behavior
• Weather (adverse)
• Labor availability (Strikes / Walkouts)
• Material / labor resources (Shortages) etc.

 5.4 Effective Management of project Risk /Risk management Processes

Risk Management

Risk management is the systematic application of the risk management processes on a project. The processes consist of risk management planning, identification, analysis, responding, and monitoring & control.

The objective of risk management is to maximize the probability and impact of positive events and minimize the probability and consequences of events adverse to project objectives.

• Ensure that the risk management effort is proportionate to both the risk and importance of the project to the organization.

• Provide enough resources for risk management activities.

•  Establish basis for evaluating risk.

 The curved line indicates the 'acceptable level of risk', whatever that may be in the individual case. The risk may be reduced to an acceptable level by reducing either or both of uncertainty and constraint. In practice, few people have the opportunity to reduce constraint, so most focus on the reduction of uncertainty. It is also worth noting from the diagram that total elimination of risk is rarely achieved. So we have to consider how to manage that remaining risk most effectively.
 

Risk Management Process/ Cycle

The processes of risk management are updated throughout the project life. It involves following steps:

  

1.Risk Management Planning - Deciding how to approach and plan the risk management activities for a project.

2. Risk Identification - Determining which risks might affect the project and documenting their characteristics.

3.   Qualitative Risk Analysis - Prioritizing risk by their effects on project objectives through assessment of their probability, impact, and the combination of both

4.   Quantitative Risk Analysis - Quantitatively analyzing the effect of identified risks on project objectives

5.   Risk Response Planning - Developing options and ways to enhance opportunities and to reduce threats to the project’s objectives

6.   Risk Monitoring and Control - Monitoring identified and residual risks, identifying new risks, executing risk response plans and evaluating their effectiveness throughout the project life cycle

 1. Risk Management Planning

Risk management planning is the process of deciding how to approach and perform the risk management activities for a project.

 Objectives of Risk Management Planning

•  Ensure that the risk management effort is proportionate to both the risk and importance of the project to the organization.
• Provide enough resources for risk management activities.
• Establish basis for evaluating risk.

Risk management planning is the first step of risk management process in a project. The documents related to project environment factors, project scope, project management plan required for the risk management plan are required for the risk management planning. Stakeholder’s risk tolerance is prime matter. After having these documents a risk planning meeting is carried out on the behalf of PM and all other stakeholders to prepare the risk management plan.    

Risk Management Plan (RMP)

It is the document prepared after the risk management planning meetings which shows/describes the way, mechanism and methods of performing risk identification, risk analysis, response planning and risk Monitoring and controlling mechanism. RMP includes:

• Methodology

• Roles and responsibilities

• Timing

• Budgeting

•  Risk categories and Risk Break down structure

• Risk Probability and impact

• Revised stakeholder’s risk tolerances

•  Reporting format

• Tracking

  2. Risk Identification

 The process of identifying the risk with the involvement of various participants of project is known as risk identification. The participants can be project team, risk management team, subject matter experts, customers, end users, outside experts etc. The various sources are analyzed in order to identify the associated risk with the project through risk identification. Risk management plan and risk break down structures are required for the risk identification process.

Objective of risk identification

    ·       To determine the risks that may affect the project

• To document their characteristics

Risk management plan and risk break down structures are required for the risk identification process. Review of documents related to project files, checklists information gathering technique like brainstorming, Delphi technique, interviewing, SWOT analysis, assumption analysis and diagramming techniques are used for risk identification process. Risk register is prepared after completion of the risk identification process.

Risk Register (RR)

Risk register is a record to document the results of the risk management process. It contains the following information.

• ·         List of identified risks with description
• ·         List of potential responses
• ·         Root causes of risk
• ·         Updated risk categories

 3. Qualitative Risk Analysis

Qualitative risk analysis is the application of methods for ranking the identified risks according to their potential effect on project objectives. This process prioritizes risks according to their potential effect on project objectives.

Qualitative risk analysis is one way of determining the importance of addressing specific risks and guides risk response measures. The RMP and RR is required for the qualitative risk analysis process. The risk probability and impact assessment is carried out. The risk probability and impact are rated and presented in matrix known as probability-impact matrix. The risk register will be updated after completing the qualitative risk analysis. Updates of risk categories according to the impact scale and urgency is done.

4. Quantitative Risk Analysis

Quantitative risk analysis analyzes numerically the effect a project risk has on a project objective. The process generally follows qualitative analysis and utilizes techniques such as Monte Carlo simulation and decision analysis to:

 

Source: PMBOOK 2000

 5. Risk Response Planning

Risk response planning addresses the matter of how to deal with risk. Risk response must be proportional to the severity of the risk, cost effective, timely, realistic and accepted as well as owned by all concerned parties of the risk management.

Objective of risk response planning

·             Develop options and determine actions to enhance opportunities and minimize threats to project objectives.

        Assign responsibility to individuals or parties for each risk response

Various data and documents are required for the risk response planning like RMP, RR, Risk thresholds, Risk owners, risk priorities list etc. risk response can be carried out by using following two strategies.

• a.       Strategies for negative risk (threats)
• b.      Strategies for positive risk (opportunity)

Negative risks are response by either of the following techniques

1.   Risk avoidance

Risk avoidance is the process to avoid the risk by changing the project plan to eliminate the risk. It can also be carried out by relaxing the relevant objectives by extending the schedule or increasing the cost in project. All risk cannot be avoided, but some may. Examples of risk avoidance are: add resources, improve communication, avoid unfamiliar sub-contractor, adopt familiar approach etc.

2.   Risk Transfer

Transfer the risk to the third party who will carry the risk impact and ownership of the response. Risk transfer is most effective in dealing with financial risk exposure. The transfer of risk liability to sub-contractor, the use of risk insurance and payment of risk premium, performance bonds, warranties etc. are examples of risk transfer.

3.   Risk Mitigation

Risk mitigation aims at reducing the probability and/or impact of a risk to within an acceptable threshold. The probability/Impact should be mitigated before the risk takes place. Thus avoiding dealing with the consequences after the risk had occurred. Mitigation costs should be appropriate given the likely impact and probability of the risk. Examples of risk mitigation are: adopting less complex process, adding resources to the schedule, conducting more engineering tests and inspections etc.

 4.   Risk Acceptance

Acceptance indicates a decision not to make any changes to the project plan to deal with a risk or that a suitable response strategy cannot be identified. This strategy can be used for both negative and positive risks

There are two types of acceptance:

• Active acceptance: may include developing a contingency plan to execute should a risk occur.
• Passive acceptance: requires no action. The project team will deal with the risk as it occurs.

Contingency Plan

A contingency plan is developed in advance to respond to risks that arise during the project. Planning would reduce the cost of an action the risk occurs. Risk triggers, such as missing intermediate milestones, should be defined and tracked. The most usual risk acceptance response is to establish a contingency allowance, or reserve, including amounts of time, money or resources to account for known risks. The allowance should be determined by the impacts, computed at an acceptable level of risk exposure, for the risks that have been accepted.

 

 Positive risks are response by either of the following techniques

1.   Exploit the opportunity

Ensure that the risk event happens by eliminating the uncertainty. to take advantage of the opportunity. Examples: assign qualified personnel, select an appropriate project delivery, and provide better quality.

2.   Share the risk

Allocate ownership to a third party who has a better chance of achieving the required results. Examples: joint ventures, partnerships, rewards.

3.   Enhance

Increase the likelihood of occurrence or the impact of the event. Improve chances for the event to happen so the opportunity becomes more certain. Consider how the impact can be increased and choose a course of action that in the increased impact

4.   Accept the risk

Active acceptance: may include developing a contingency plan to execute should a risk occur. Passive acceptance: requires no action. The project team will deal with the risk as it occurs. Risk response planning will update the risk register. The risk register is updated to reflect the results of the response planning process. Level of detail of documenting a risk should be appropriate to the ranking of the risk (high risks in detail, low risks by listing). Items in the risk register are:

• ·         Identified risks
• ·         Risk owners
• ·         Results from risk analysis
• ·         Budget and schedule activities
• ·         Response strategies
• ·         Contingency plans
• ·         Fallback risks
• ·         Residual risks
• ·         Secondary risks

Similarly project management plan will be updated and contractual agreements are set up for the risk response.

 6. Risk Monitoring and Controlling

 Risk monitoring and control is required in order to:

• ·         Ensure the execution of the risk plans and evaluate their effectiveness in reducing risk.
• ·         Keep track of the identified risks, including the watch list.
• ·         Monitor trigger conditions for contingencies
• ·         Monitor residual risks and identify new risks arising during project execution.
• ·         Update the organizational process assets.

 Purpose of risk monitoring

The purpose is to determine if:

• ·         Risk responses have been implemented as planned.
• ·         Risk response actions are as effective as expected or if new responses should be developed.
• ·         Project assumptions are still valid.
• ·         Risk exposure has changed from its prior state, with analysis of trends.
• ·         A risk trigger has occurred.
• ·         Proper policies and procedures are followed.
• ·         New risks have occurred that were not previously identified.

 Risk monitoring needs a data like RMP, updated RR, change request if any from the response and performance indicators. Risk monitoring and control is carried out by following methods:

a.   Risk Reassessment

Project risk reviews at all team meetings. Major reviews at major milestones

Risk ratings and prioritization may change during the life of the project. Changes may require additional qualitative or quantitative risk analysis.

b.   Risk audits

Examine and document the effectiveness of the risk response planning in controlling risk and the effectiveness of the risk owner.

c.    Variance and Trend Analysis

Used for monitoring overall project cost & Schedule performance against a baseline plan. Significant deviations indicate that updated risk identification and analysis should be performed.

d.   Reserve Analysis

As execution progresses, some risk events may happen with positive or negative impact on cost or schedule contingency reserves. Reserve analysis compares available reserves with amount of risk remaining at the time and determines whether reserves are sufficient

e.    Status meetings

Risk management can be addressed regularly by including the subject in project meetings.

Risk M&C helps to update the RR, it suggest the corrective and preventive actions along with change request. More over project management plan will be finally updated.

Table: Comparison of Risk management Guidelines among various agencies

 References

1.   R.Panneerselvam and P. Senthil kumar “ Project Management” Eastern Economy Edition, PHI Learning Private Limited, New-Delhi, India

2.       Monisha Chattopadhya “Project Management”, New Edition, Neeraj Publications Delhi, India

3.       Dr. H.L. Kaila “Organizational Behavior and HRM” Third Edition, AITBS Publishers, India

4.       Dr. Govinda Ram Agrawal “Project Management in Nepal” New Edition, M.K Publishers and Distributors.

5.       A text book of Project Engineering (revised edition) by Santosh Kumar Shrestha & Ishwor Adhikari

6.       Acharya Kedar Prasad “Project Management”, Ashmita Books Publishers & Distributors (P) Ltd.

7.       Acharya Bhawani Shankar “Organizational Behavior”, Ashmita Books Publishers & Distributors (P) Ltd

8.       Dr. Govinda Ram Agrawal “ Dynamics of Human Resource management in Nepal” New Edition, M.K Publishers and Distributors

9.  Subash Kumar Bhattarai, Santosh Kumar Shrestha, & RK Shrestha ''A Text Book of Construction management" Heritage Publishers and Distributors Pvt. Ltd., Bhotahity, Kathmandu.

10.  A manual on fundamentals of project management (by Er. Harimohan Shrestha), manual note for MSc CM Nepal Engineering College

11.    Oxford English Dictionary

12.    Project Management Institute of America (PMI, USA)

13.    Other related websites and freely available materials