Making Project Risk Management Work

Transcription

1 Making Project Risk Management Work Dave Maynard 1 Risk is the intentional interaction with uncertainty Risk perception is a judgment made about the severity of a risk, and may vary person to person 2 1

2 Perception may vary from person to person 3 Dave Maynard Nerd Background BSEE using a sliderule MBA using Minitab PMP # 7054 using a dull #2 pencil Experience NASA, Other Government Entities, SMI, IPFW, IUPUI 2

3 5 Please introduce Yourself to the group 6 3

4 Topics 1. The Definition Debate 2. The Risk Paradox 3. Should We Manage Project Risk? 4. Projects Need a Scalable Risk Management Approach 5. PMBOK Guide Chapter Risk Meta Language 7. Why Don t We Do it? 8. Top Excuses For Not Having Project Risk Management 9. Making it Work Rules to Make Risk Management Work 11. The Project Manager s Role 7 The first step in the risk management process is to acknowledge the reality of risk. Denial is a common tactic that substitutes deliberate ignorance for thoughtful planning. Charles Tremper 4

5 The Definition Debate 9 What debate? This word risk can be found in the dictionary! But professionals continue to debate the precise use of the word 10 5

6 Webster s Dictionary 1: possibility of loss or injury; peril 2: someone or something that creates or suggests a hazard 3a: the chance of loss or the perils to the subject matter of an insurance contract; also; the degree of probability of such loss 3b: a person or thing that is a specified hazard to an insurer 3c: an insurance hazard from a specified cause or source 4: the chance that an investment (as a stock or commodity) will lose value

7 Traditionally risk has been perceived as bad The emphasis has been on the potential effects of risk as harmful, adverse, negative, and unwelcome 13 Most people agree that risk arises from uncertainty And it is about the impact that uncertain events could have on the achievement of goals 14 7

8 Some uncertainties could be helpful if they occurred 15 This agreement has led to definitions combining two elements of uncertainty A risk is any uncertainty that, if it occurs, would have an effect on achievement of one or more objectives. 16 8

9 These uncertainties have the same characteristics as threat risks but the potential effects If they occur, would be welcome them 17 Three Camps Resulted 18 9

10 Camp A One group insists that the traditional approach must be upheld, reserving the word risk for bad things that might happen They recognize that opportunities exist, but see them as separate from risks, and should be treated differently using a different process 19 Camp B Believes that there are benefits from treating threats and opportunities together, broadening the definition of risk and the scope of the risk management process to handle both 20 10

11 Camp C Seems unconcerned about definitions, words, and jargon, preferring to focus on doing the job. This group emphasizes the need to deal with all types of uncertainty without worrying about which labels to use 21 The majority of official risk management standards including the PMBOK Guide use the broadened definition of risk, including both upside opportunities and downside threats 22 11

12 Advantages to the Guide s Approach A common process to manage both threats and opportunities has benefits Efficiency: no need to develop, introduce, and maintain a separate opportunity management process 23 Familiar techniques: requiring only minor changes to current techniques for managing threats so organizations can deal with opportunities Minimal additional training: because the common process uses familiar processes, tools, and techniques 24 12

13 Proactive opportunity management: Opportunities that might have been missed can be addressed Improved contingency management: by including potential upside impacts as well as downside 25 Opportunities are identified that might have been overlooked 26 13

14 Further Clarification.. Now that we ve defined what risk is it is also important to clarify what risk is not Effective risk management must focus on risks and not be distracted by other related issues 27 Issues Used in several ways Sometimes it refers to matters of concern that are insufficiently defined to be treated as risks An issue is more vague than a risk, and may describe an area (such as requirement volatility, resource availability, or weather conditions) from which specific risks might arise 28 14

15 Issues 29 Problems A problem is also a risk whose time has come Unlike a risk that is a potential future event, there is no uncertainty about a problem it exists now and must be addressed immediately 30 15

16 Causes Many people confuse causes of risk with risks themselves The cause describes existing conditions that might give rise to risks There is no uncertainty about the statement, We have never done a project like this before, so it cannot be a risk But this statement could result in a number of risks that must be identified and managed 31 Effects Similar confusion exists about effects, which in fact only occur as the result of risks that have happened To say, The project might be late, does not describe a risk, but what would happen if one or more risks occurred The effect might arise in the future but its existence depends on whether the related risk occurs 32 16

17 The Risk Paradox 33 Project Risk Exposure Available Risk Information WAG SWAG 34 17

18 35 No noble thing can be done without risks Michel de Montaigne (French Philosopher and Writer ) 36 18

19 Should We Manage Project Risk? 37 Study Result Risk management implemented as a fully integral part of the project management process, delivers large benefits

20 There s Proof! Empirical research gathered project performance data from major organizations across a variety of industries, showed that risk management is the single most influential factor in project success 39 Where risk management is well implemented Completed projects averaged 95 percent of plan Where risk management is poor Completed projects averaged 170 percent of plan 40 20

21 41 The same research found that risk management the scores lowest of all project management techniques in effective use Artist Kimber Fiebiger 21

22 A Different Study First question: How important is risk management to project success? Second question: How effective is risk management on your projects? Risk Doctor & Partners in collaboration with KLCI 43? 44 22

23 This Suggests Although many organizations recognize that risk management matters, they are not implementing it effectively Projects still fail, businesses still struggle, foreseeable downside threatrisks turn into real issues or problems, and too many achievable opportunityrisks are missed 45 Yes, risk taking is inherently failure prone. Otherwise, it would be called sure thingtaking. Jim McMahon (American Football Player. b.1959) 46 23

24 Projects Need a Scalable Risk Management Approach 47 You Have to Make a Decision 48 24

25 Risk management is not: One size fits all. Risk management is an essential feature of effective project management But there are different ways of putting it into practice 49 The simplest is a process in which all phases are undertaken, but with a very light touch. It might be implemented as a set of questions What are we trying to achieve? What could hinder or help us? Which of these are most important? What shall we do about it? 50 25

26 The other extreme is a fully detailed risk process using a range of tools to support various phases Stakeholder workshops might be used for the definition phase, followed by multiple risk identification techniques involving a range of project stakeholders 51 Both of these represent extremes, and the typical organization will likely implement a level of risk management somewhere in between them 52 26

27 Each organization must decide what level of implementation is appropriate 53 Different Projects are exposed to different levels of risk Therefore, each step in the Risk Management process must be scalable 54 27

28 Scalable items include Resources Methodology Tools and techniques Update frequency Reporting requirements 55 PMBOK Guide Chapter

29 We re going to review the PMBOK Guide!?! 57 Mind map 58 29

30 59 Risk conditions may include organizational factors that contribute to project risk 11 Immature project management practices Lack of integrated management systems Concurrent multiple projects Dependency on external participants who are outside the project s direct control 60 30

31 11 A risk may have one or more causes and, if it occurs, it may have one or more impacts 61 Risk Influence on Project Funds Known risks are those that have been identified and analyzed Activity Contingency Reserve Known risks that cannot be managed proactively Contingency Reserve Unknown risks cannot be managed proactively Management reserve 62 31

32 Determine Budget Key Output 63 Risk Attitudes 64 32

33 11 Organizations and stakeholders are willing to accept varying degrees of risk depending on their risk attitude 65 Risk Attitudes 11 Risk appetite The degree of uncertainty an organization is willing to accept in anticipation of a reward Risk tolerance The degree of uncertainty that an organization will withstand Risk threshold Below the threshold level the risk is acceptable Above the threshold level the risk is not acceptable 66 33

34 Risk Appetite Plan Risk Management Defining how to conduct risk management activities for a project Planning Process Group 68 34

35 69 Plan Risk Management

36 Organizational Process Assets With a Risk Perspective Risk categories Common definitions of concepts and terms Risk statement formats Standard templates Roles and responsibilities Authority levels for decision making Lessons learned Key Input 71 Plan Risk Management

37 Analytical Techniques Used to understand and define the risk context of the project Stakeholder risk profile analysis Determine project stakeholder risk appetite and tolerance Strategic risk scoring sheets Provide a high level assessment of the project risk exposure Key Tool or Technique 73 Risk Management Plan Key Output 74 37

38 Risk Management Plan Contents Methodology Budgeting Risk categories Stakeholders tolerances Reporting formats Roles and responsibilities Timing Probability and impact definitions Probability and impact matrix How risk activities will be recorded Key Output 75 Risk Management Plan Potential Risk Categories Operational Risk Schedule Risk Budget Risk Business Risk Technical Environment Risk Technology Risk Information Security Risk Programmatic Risks Infrastructure Risk Quality and Process Risk Resource Risk Supplier Risk Key Output 76 38

39 Risk Management Plan Risk Categories as a Risk Breakdown Structure Key Output 77 Risk Management Plan Impact definitions Key Output 78 39

40 11.2 Identify Risks Determining which risks may affect the project and documenting their characteristics Planning Process Group 79 What you don't know can hurt you Sculpture by Kimber Fiebiger 40

41 Identify Risks Information Gathering Techniques Brainstorming 1. Focus on quantity 2. Withhold criticism 3. Welcome unusual ideas 4. Combine and improve ideas Key Tool or Technique 82 41

42 Information Gathering Techniques A formal face to face meeting in which facts, or statements are elicited from another The primary technique for information gathering during the analysis phases of a development project Interviewing Key Tool or Technique 83 Information Gathering Techniques 1. Define the Problem 2. Collect Data 3. Identify Possible Causal Factors Physical causes Human causes Root cause analysis Organizational causes 4. Identify the Root Cause(s) 5. Recommend and Implement Solutions Key Tool or Technique 84 42

43 Checklist Analysis A systematic approach built upon historical knowledge Generates qualitative lists with recommendations These lists of risks can be from previous, similar projects Using the lowest level of the Risk Breakdown Structure or other sources The quality of the evaluation is determined primarily by the experience of the people creating the checklists and the training of the checklist users Key Tool or Technique 85 Assumptions Analysis It is preferable to have the assumptions accurate, complete and consistent; but, in practice, it is not always possible Identifies risks to the project from inaccuracy, instability, inconsistency or incompleteness of assumptions It is important for the project management team to review the justification or strength or support of the assumptions made Key tool or Technique 86 43

44 87 Diagramming Techniques Cause and Effect Diagrams Key tool or Technique 88 44

45 Diagramming Techniques System or Process Flow Charts Key Tool or Technique 89 Diagramming Techniques Influence Diagrams Key Tool or Technique 90 45

46 SWOT Analysis A method to evaluate the strengths, weaknesses, opportunities, and threats involved in a project Specify the objective of the project, then identify the internal and external factors that are favorable and unfavorable to achieving that objective Risk Register A document where the results of risk analysis and risk response planning are recorded Contains the outcomes of the other risk management processes as they are conducted The risk register begins in the Identify Risks process and the information contained in the register increases over time Key Output 92 46

47 93 Three Perspectives of Risk Identification 94 47

48 Risk Meta Language 95 Risk Meta Language 96 48

49 Unambiguous risk descriptions are clearly essential if we are to manage risks effectively 97 One helpful tool for describing risks is risk meta language, which separates the risk from its causes and effects using a threepart sentence 98 49

50 The risk meta language is written like this: Because of <cause(s)>, <risk> might occur, which would lead to <effect(s)>. 99 Cause(s) Because of <cause(s)>, <risk> might occur, which would lead to <effect(s)>. Causes are present facts or conditions which exist now or which are certain to exist in the future

51 Risk Because of <cause(s)>, <risk> might occur, which would lead to <effect(s)>. Why are we concerned about this fact? 101 Effect(s) Because of <cause(s)>, <risk> might occur, which would lead to <effect(s)>. Effects are the consequences which would impact one or more objectives if a risk were to occur

52 Risk Meta Language 103 CAUSE (A fact) RISK (an uncertain event or set of circumstances) EFFECT (a direct impact on aproject objective) As a result of using novel hardware Because our organization has never done a project like this before We have to outsource production unexpected system integration errors may occur we might misunderstand the customer s requirement [so] we may be able to learn new practices from our selected partner which would lead to overspend on the project....which would mean that our solution would not meet the quality acceptance criteria. which would lead to increased productivity and profitability. Because we have no experience using this technology we might not have the necessary skilled staff to carry out the design work which would lead to a delay in the project while we train our existing staff or recruit new skilled staff

53 CAUSE <Humpty Dumpty sat on a wall> RISK <he may fall off> EFFECT <and be broken!> Photo by Frank Wuestefeld by Gerald Thurman 105 o CAUSE <Because there are no fences> RISK <A cow may fall on my car> EFFECT <causing a totaled car & totaled cow>

54 What about this one? CAUSE < > RISK < > EFFECT < > 107 One More CAUSE < > RISK < > EFFECT < >

55 Risk Register After Identify Risks Process A description of the risk The impact should this event actually occur The probability of its occurrence Risk Score (the multiplication of Probability and Impact) A summary of the planned response should the event occur A summary of the actions taken in advance to reduce the probability and/or impact of the event Key Output Perform Qualitative Risk Analysis Prioritizing risks for further analysis or action by assessing and combining their probability of occurrence and impact Planning Process Group

56 Risk Probability and Impact Assessment Qualitative risk analysis supplements information assembled during risk identification and adds new information for each risk about the probability of the risk occurring and the risk impact should it occur This analysis results in a relative priority of each risk The priority is used to focus attention on most significant risks Key Tool or Technique 111 Fundamental Equation

57 Risk Rank = Probability x Impact Risk Probability and Impact Assessment The team rating of the project's risks and opportunities Probability is the likelihood a risk will occur Impact is the potential negative or positive effects It s best to meet with a team of project members, subject matter experts, individuals listed in the risk management plan Then conduct risk interviews Key Tool or Technique

58 Probability x Impact 115 Risk Data Quality Assessment

59 Risk Categorization By Sources Risk Breakdown Structure (RBS) Area of the project Work Breakdown Structure (WBS) Project Phase Milestones Common Root Causes Key Tool or Technique 117 Risk Urgency Assessment Time Available to put a risk response into motion Probability of detecting the risk triggers or warning signs Some risk triggers may allow only a small response window In case of opportunities the opportunities may not exist forever May be combined with risk rank to give a risk severity Key Tool or Technique

60 119 Project Documents Updates Risk Register Updates After Qualitative Risk Analysis Relative ranking of project risks Risks grouped by categories Risks requiring response in the near term Watch list of low priority risks Trends in relative risk analysis results Key Output

61 Project Documents Updates Assumptions log updates The assumptions log is a document which the project manager and team use to capture, document, and track assumptions throughout a project s lifecycle Key Output

62 11.4 Perform Quantitative Risk Analysis Numerically analyzing the effect of identified risks on overall project objectives Planning Process Group The Perform Quantitative Risk Analysis process is used mostly to evaluate the aggregate effect of all risks affecting the project

63 11.4 Perform Quantitative Risk Analysis generally follows the Perform Qualitative Risk Analysis process Perform Quantitative Risk Analysis generally follows the Perform Qualitative Risk Analysis process

64 11.4 The analysis is performed on risks prioritized by the Perform Qualitative Risk Analysis process as being substantial 127 It s expensive to do a quantitative risk analysis 11.4 Time + effort You may not need to do a quantitative risk analysis

65 Data Gathering and Representation Techniques Interviewing One of the most common ways of refining cost and schedule estimates is to do a three point estimate that gives the low, most likely, and high estimate for a particular cost or duration Documenting the rationale of the risk ranges and the assumptions behind them are important considerations Key Tool or Technique 129 Data Gathering and Representation Interview to Gather the Data Key Tool or Technique

66 Modeling Techniques Sensitivity analysis Key Tool or Technique 131 Modeling Techniques Sensitivity analysis Used to determine which risks have the most potential impact on the project Examines the impact on each objective being examined with all other uncertain elements held constant The tornado diagram is a typical method to display the results and is used to compare the relative importance of project risks Key Tool or Technique

67 Modeling Techniques Sensitivity analysis Key Tool or Technique

68

69 Risk Register Updates After Quantitative Risk Analysis Probabilistic Analysis of the project Estimates are made of potential project schedule and cost and their confidence levels Probability of Achieving Cost and Time Objectives Prioritized List of Quantified Risks Trends in Quantitative Risk Analysis Results Trends may become apparent regarding risk responses Key Output

70 11.5 Plan Risk Responses Developing options and actions to enhance opportunities and to reduce threats to project objectives Planning Process Group 139 Plan Risk Responses

71 dam

72 Risk Register Updates after Risk Response Planning Identified risks, descriptions, affect upon project objectives Risk owners and their responsibilities Agreed upon response strategies Warning signs of risk occurrence Budget and schedule required to implement the responses Fallback plan Residual and secondary risks Key Output 143 Project Management Plan Updates Schedule management plan Cost management plan Quality management plan Procurement management plan Human resource management plan Scope baseline Schedule baseline Cost baseline Key Outputs

73 11.6 Control Risks implementing risk response plans, tracking identified risks, monitoring residual risks, identifying new risks and evaluating risk process effectiveness Monitor and Control Process Group The project work should be continuously monitored for new, changing, and outdated risks

74 Should be continuously monitored for new, changing, and outdated risks Sculpture by Kimber Fiebiger Control Risks Can Involve Choosing alternative strategies Executing a contingency or fallback plan Taking corrective action Modifying the project management plan Updating the Organizational Process Assets

75 Control Risks Risk Reassessment Risk Reassessment Should be regularly scheduled Identification of new risks Reassessment of current risks Closing of risks Risk reserves returned to the budget Key Tool or Technique

76 Risk Audits The project manager is responsible for ensuring that risk audits are performed as defined in the project s risk management plan The audits examine the risk responses dealing with identified risks and their root causes and the effectiveness of the risk management process Key Tool or Technique 151 Others Variance and trend analysis can reveal deviation from the baseline, which in turn may indicate the potential impact of threats or opportunities Technical performance measurement Compares technical accomplishments that may help forecast the degree of technical risk faced by the project & 4 Key Tool or Technique

77 Reserve analysis When risks occur, they have positive or negative impacts on the budget or schedule These are added to or subtracted from the contingency reserves Reserve analysis compares the amount of the contingency reserves remaining to the amount of risk remaining in order to determine whether the amount of reserves is adequate Key Output 153 Control Risks

78 155 Risk Register Updates After Control Risks Outcomes of risk reassessments, risk audits, and periodic risk reviews Identification of new risks, updates to probability, impact, priority, response plans, ownership Closing risks no longer applicable and releasing their reserves Actual outcomes of the project s risks and of the risk responses Key Output

79 That was a great review of the guide. 157 Leaving the Guide

80 Why Don t We Do it? Risk Management is Difficult Deals with Uncertainty Looks into the future at potential problems Various perspectives Time consuming Value and benefits not clear Contrary to culture We all want to manage risk but we have a hard time doing risk management

81 Management Conditioning* Risk Management Is Proactive, We Are Conditioned For Reactive Management (Putting Out Fires) The Concept Of Risk Management Is To Identify And Manage Risk (Hence Not Problems) Risk Have Uncertainty And Problems Don t *NASA Goddard Space Flight Center 161 Management Conditioning* Risk Management Goes Against If Its Not Broke Don t Fix It Don t Bother Me Unless You Have A Problem Retaining These Thoughts Will Create Weak Risk Solving Behaviors *NASA Goddard Space Flight Center

82 Risk is Managed by People The human aspects of risk management are vital to its success People set risk thresholds, identify risks, assess the degree of uncertainty and extent of possible impact, propose appropriate responses and implement agreed actions 163 Risk conditions may include organizational factors that contribute to project risk 11 Immature project management practices Lack of integrated management systems Concurrent multiple projects Dependency on external participants who are outside the project s direct control

83 History s Lessons In failed projects, people will almost always state the reason for the failure was known to be a distinct possibility in advance but that no actions were taken to prevent it. Harvard Business School 165 The Bad News Psychologists have long known that people do a poor job of judging risk We overestimate the likelihood of rare events (e.g. plane crashes) and underestimate fairly routine hazards Edvard Munch s The Scream (1893) 83

84 So, We re Doomed, Right? 167 The Good News We are able, with a certain degree of effort, to recalibrate our risk assessments to correspond to reality and not our dark imaginations Restored Scream 84

85 Top Excuses For Not Having Project Risk Management 169 Ownership Risks are often thought of as someone else s problem There is often a reluctance to take ownership of a risk because of the fear of blame in case the risk response fails to address the risk

86 Hindsight Most risk management methodologies rely on historical data to calculate probabilities of risk However, many managers feel they cannot rely on such data for their project 171 Expertise Project managers are unaware of risk management techniques Pretty weak excuse!

87 Cost Proper risk management is a timeconsuming, effort laden and expensive process Most projects are run on tight budgets, and risk management is an area that s perceived as being an unnecessary expense 173 Politics Risk management is considering things that can go wrong When informed about risks, stakeholders may get upset Project managers may limit their risk efforts to avoid making stakeholders nervous

88 The Risk Process Takes Time And Money Risk management is not a passive activity, and there is a cost associated with executing the upfront risk process the cost of assessing risk. Risk management requires involvement of the project sponsor, manager, members of the project team, and stakeholders 175 Risk Responses Cost Money A central purpose of the risk process is to identify risks and determine appropriate responses, which results in the need to do new and unplanned things. This introduces a second type of cost to the risk process: the cost of addressing risk

89 Risk Management Doesn t Work For Us Many people have experienced it being applied ineffectively, leading them to believe that risk management doesn t work This often arises when risk management is performed without commitment, perhaps by organizations merely complying with a regulatory or contractual requirement 177 Risk Management Is Just Scaremongering Until recently, risk management was commonly concerned only with threats As a result the risk process focus on examining every possible cause of failure, and listing every potential problem This can demotivate and create a sense of doom for the project team, which believes that the project cannot succeed given the number of identified negative risks

90 Photo by 179 IceSabre Issues Are More Fun And Rewarding Some believe that dealing with issues, problems, or even crises is more interesting and rewarding Individuals gain satisfaction from solving a problem, especially if it s a big one, even if it could have been prevented by proactive risk management Many organizations reward those project managers who successfully resolve a major crisis and then deliver their project

91 I m Too Busy Dealing With Issues When projects are badly planned in the first place, issues and problems will quickly arise that can dominate the project s day to day efforts Project managers become consumed with now problems and find it difficult, if not impossible, to worry about potential future events 181 It s Just Common Sense Everyone looks both ways when they cross the road, don t they? The majority of people can carry out risk management on a day to day basis; it s just common sense. If this is true, then we should expect that risk management will be applied intuitively to all projects, and that project managers will always do it without needing a formal or structured risk process

92 We Can t Prove That Risk Management Works Some risks that are identified never materialize, and as a result some people think that considering things that might not happen is just a waste of time. In addition, it is difficult to prove that risk management is working on a project because there is never an identical project that can be run without risk management as a control. And where the risk process only addresses threats, successful risk management means nothing happens! 183 Making it Work

93 Critical Success Factors What does this mean? 1. Their absence leads to a failure of risk management to deliver the full benefit to the organization 2. Their presence increases the chances of risk management being effective and successful 185 Individual commitment / responsibility CSF Risk management is everyone s responsibility

94 Recognize the value of risk management A valuable discipline that provides a positive potential return on investment 187 Open and honest communication Any attitudes that hinder communication about project risk reduces the effectiveness

95 Organizational commitment Risk management must be aligned with the organization s goals and values 189 Risk effort scaled to the project The activities should be consistent with the value of the project to the organization

96 Integration with Project Management Project Risk Management cannot be isolated from other project management processes 191 Project Risk Management cannot take place in isolation Success relies upon communication throughout the process

97 Project Risk Management cannot take place in isolation Success relies upon communication throughout the process

98 SOD s Law: It will go wrong in the worst possible way. Sculpture by Kimber Fiebiger Findings show that in more than one third of all projects, project risk management is virtually nonexistent because no formal process was applied due to cost justification Elmar Kutsch and Mark Hall: The Rational Choice of Not Applying Project Risk Management in Information Technology Projects

99 Things We Need Rules to Make Risk Management Work

100 Rule 1: Make Risk Management Part of Your Project If you don't embed risk management in your project, you can not reap the full benefits Some projects use no approach whatsoever to risk management. They are either ignorant, running their first project or they are somehow confident that no risks will occur in their project Professional companies make risk management part of their day to day operations and include it in project meetings and the training of staff 199 Rule 2: Identify Risks Early in Your Project This requires an open mind set that focuses on future scenarios that may occur. Two main sources exist to identify risks, people and paper. People are your team members that each bring along their personal experiences and expertise.. Projects tend to generate a significant number of documents that contain project risks. The project plan, business case and resource planning are good starters

101 Risk Identification Tool

102 Rule 3: Communicate About Risks Failed projects show that project were frequently unaware of the big hammer that was about to hit them. The frightening finding was that frequently someone of the project organization actually did see the hammer, but didn't inform the project manager of its existence. Pay attention to risk communication! If you have a team meeting, make project risks part of the default agenda. This shows risks are important to the project manager and gives team members a "natural moment" to discuss them and report new ones. 203 Rule 4: Consider Both Threats and Opportunities Many project teams struggle to finish, being overloaded with work that needs to be done quickly This creates a project where only negative risks matter Create some time to deal with opportunities in your project, even if it is only half an hour. Chances are that you see a couple of opportunities with a high pay off that don't require a big investment in time or resources

103 Back together again Sculpture by Kimber Fiebiger Rule 5: Clarify Ownership Issues Some project managers think they are done once they have created a list with risks. However this is only a starting point. The next step is to make clear who is responsible for what risk! Assign a risk owner for each risk that you have found. The risk owner is the person in your team that has the responsibility to optimize this risk for the project. If a project threat occurs, someone has to pay the bill. Especially if different business units, departments and suppliers are involved in your project, it becomes important who bears the consequences and has to empty his wallet

104 Rule 6: Prioritize Risks Some risks have a higher impact than others. Therefore, you better spend your time on the risks that can cause the biggest losses and gains. Check if you have any showstoppers in your project that could derail your project. If so, these are your number 1 priority. The other risks can be prioritized on gut feeling or, more objectively, on a set of criteria. The criteria most project teams use is to consider the effects of a risk and the likelihood that it will occur. Whatever prioritization measure you use, use it consistently and focus on the big risks. 207 Probability and Impact What is the probability this risk will occur? What is the impact if it does? 104

105 Rule 7: Analyze Risks Risk analysis occurs at different levels. If you want to understand a risk at an individual level think about the effects that it has and the causes that can make it happen. Looking at the effects, you can describe what effects take place immediately after a risk occurs and what effects happen as a result of the primary effects or because time elapses. The information you gather in a risk analysis will provide valuable insights in your project and the necessary input to find effective responses to optimize the risks

106 Rule 8: Plan and Implement Risk Responses The other rules have helped you to map, prioritize and understand risks. This one will help you to make a sound risk response plan that focuses on the big wins. If you deal with threats you basically have three options, risk avoidance, risk minimization and risk acceptance. Avoiding risks means you organize your project in such a way that you don't encounter a risk anymore. The biggest category of responses are the ones to minimize risks. You can try to prevent a risk occurring by influencing the causes or decreasing the negative effects that could result. 211 Rule 9: Register Project Risks Maintaining a risk register enables you to view progress and make sure that you won't forget a risk or two. It is also a perfect communication tool that informs your team members and stakeholders what is going on (rule 3). A good risk register contains risks descriptions, clarifies ownership issues (rule 5) and enables you to carry our some basic analyses with regard to causes and effects (rule 7). If you record project risks and the effective responses you have implemented, you create a track record that no one can deny. Even if a risk happens that derails the project

107 Rule 10: Track Risks and Associated Tasks The risk register you have created as a result of rule 9, will help you to track risks and their associated tasks. Tracking tasks is a day to day job for each project manager. Integrating risk tasks into that daily routine is the easiest solution. Tracking risks differs from tracking tasks. It focuses on the current situation of risks. Which risks are more likely to happen? Has the relative importance of risks changed? Answering this questions will help to pay attention to the risks that matter most for your project value. 213 The Project Manager s Role

108 The Project Manager s Role Encouraging senior management support for risk management Determining acceptable levels of risk Developing the risk management plan Promoting the risk management process in the project Facilitating open and honest communication about risk 215 The Project Manager s Role Participating in all aspects of the process Regularly reporting risk status to key stakeholders Escalating identified risks to senior management where appropriate Monitoring the efficiency and effectiveness of the Risk Management process Auditing risk responses for effectiveness

109 To be alive at all involves some risk. Harold Macmillan quotes (British politician, ) 217 The Project Manager s Role Encouraging senior management support for risk management Determining acceptable levels of risk Developing the risk management plan Promoting the risk management process in the project Facilitating open and honest communication about risk

110 The Project Manager s Role Participating in all aspects of the process Regularly reporting risk status to key stakeholders Escalating identified risks to senior management where appropriate Monitoring the efficiency and effectiveness of the Risk Management process Auditing risk responses for effectiveness

111 Artist Kimber Fiebiger, creates bronze sculptures and unique humpty dumpties

112 The Deviled egg did it. 223 References Project and Program Risk Management A Guide to Managing Project Risks and Opportunities - R. Max Wideman Project Risk Management Study Notes Project Management Institute Project Risk Management Handbook - Caltrans Office of Project Management Project Risk Management Guidelines - Cooper, Grey, Raymond and Walker Project Risk Management Deloitte Touche Tohmatsu On Uncertainty, Ambiguity and Complexity in Project Management Pitch, Loch and De Meyer Modern Project Management Howes Project Management Manual Harvard Business School The New Project Management J. Davidson Frame A Guide to the Project Management body of knowledge Project Management Institute

113 A Well Written Standard 225 Why We Must Do It The Big Y

114