RISK MANAGEMENT MADE EASY. Susan Parente Project Management Symposium.

Transcription

1 RISK MANAGEMENT Susan Parente MADE EASY PMP, PMI-RMP, PMI-ACP, CSM, CSPO, PSM I, CISSP, CRISC, RESILIA, ITIL, MS Eng. Mgmt. Associate Professor, Post University, CT, MBA Program: PM Concentration Adjunct Professor, Montclair State University, NJ, MBA Program: Risk Management 2018 Project Management Symposium

2 Agenda u Definition of Risk Management u Risk Management Overview u Risk Management Process u Identification, Assessment, Response Planning, Execution u Monitoring, Documentation and Communication u Applicability to Projects u Summary 2

3 u u Risk Defined A Risk is an uncertain event or condition, that if it occurs, has a positive or negative effect on at least one objective A Risk is described by the probability that an event will occur and the impact of the consequence of that event should it occur u Probability: The Likelihood of Occurrence That an Objective Will Not Be Met Using the Current Plan Increased Probability Increased Risk Exposure Increased Impact Note the Difference Between a Risk and a Problem or Issue u A Risk is an event that may occur in the future u A Problem or Issue is something that has already occurred and you are dealing with now Both Risks and Issues must be addressed Impact: The Consequence of Occurrence Penalty Incurred If the Objective Is Not Obtained 3

4 Why Manage Risk? Risk Management is what we have been doing for years as successful PMs, but in a structured & rigorous manner. Image from: NPS (n.d.) Climbing Experience Program. Retrieved from 4

5 Risk Management u Risk Management has us inquire in uncertainty uwhat are our project unknowns? u known unknowns? u unknown unknowns? u Risk Management provides a capability to quickly and effectively communicate risk information up and down the management chain 5

6 Benefits of Risk Management u Identifies existing as well as potential problems u Describes and classifies risks u Prioritizes risks so resources may be effectively applied u Identifies strategies to reduce threat risks u Minimizes safety risk to personnel u Provides a structured and systematic review of the processes to manage risk u Provides ongoing structure for project/ product improvements u Provides continuous risk communication 6

7 Benefits of Risk Management Risk Management facilitates communication by offering processes, mechanisms, and a common language for stakeholders to identify, define, evaluate and control risks. Image from: Pixabay (2016) Retrieved from 7

8 Risk Management Processes u u u u Identification u Discovery of a potential risk Assessment u Review, analysis, and prioritization Response Planning u To mitigate, avoid, transfer, accept, escalate threats u To enhance, exploit, share, accept or escalate opportunities Execution u Of response strategies, as determined in response planning Identify Execute Plan Monitor Document Communicate 8 Assess Plan Response Planning, Monitoring, Documentation and Communication Foundational for project mgmt. & essential to all processes Part of continuous process improvement for the RMP

9 Identify Assess Risk Identification u Any and all personnel on a project are responsible for identifying risks it s an everyday part of the job u It is not necessary to resolve the risk at this stage simply capture the potential problem u Identification Methods u Brainstorming u Checklists u Cost/Schedule Analysis u Functional/Failure Analysis u Interviewing u Subject Matter Experts 9 Execute Plan Response

10 Risk Identification If You Haven t Identified Your Risks, You're Already Taking Them. 10

11 Risk Identification u When is it appropriate to identify a risk? u If the risk poses threats to meeting success criteria, mission objectives, critical milestones, etc. u If you need resources to resolve the risk u If broader awareness is needed u If the risk presents threats to completing tasks Identify Execute Assess Plan Response 11

12 Risk Identification u Risk Statements are written in a structured manner u State the risk in the format of a If, then Statements u Condition ( If ) statement - A short, succinct statement that describes the background information and/or description of the problem u Consequence ( Then ) statement - A short, succinct statement that describes the key possible outcome(s) of the current conditions u Consequences should be directly traceable to the event: For example, If I have a flat tire while commuting to work, then I may not get to work on time 12 Identify Execute Assess Plan Response

13 Risk Assessment (Analysis) Identify Execute Assess Plan Response u Risk Assessment/Analysis u What is the probability of the risk occurring? u What is the impact if the risk occurs? u Qualitatively (subjective) Ex.: significant, severe u Quantitatively (days or dollars) Ex.: 2 days or $10,000 u Both Probability and Impact are determined u These are used to evaluate the risk: Qualitative Assessment: Ex. Risk Score or using the Probability and Impact Matrix Quantitative Assessment: Ex. EMV (Expected Monetary Value) = Probability x Impact 13

14 Risk Assessment (Qualitative) Identify Execute Assess Plan Response u Use a Probability and Impact Matrix 14

15 Risk Assessment (Quantitative) u Results in a quantitative value (dollar or day) for the risk, which is based on the probability and impact of the risk. u Methods Include: u Monte Carlo Analysis (and Latin Hypercube) u EMV (Expected Monetary Value) u Decision Analysis Identify Execute Assess Plan Response 15

16 Identify Assess Response Planning Risk Response Strategies (for Threat Risks): u Mitigation: Pre-Event actions to reduce the probability or impact of a risk u Avoidance: Eliminate the risk producing activity entirely by choosing an alternate approach. u Transfer: Take actions that redistribute risk to another area. (This does not relieve the responsibility of tracking and closing the risk) u Accept: Accept the risk as stated with no other action. Execute Plan Response u u Passive: Accept and do nothing Active: Accept and put a plan in place to minimize the impact of the threat, should it occur. 16

17 Identify Assess Response Planning Risk Response Strategies (for Opportunity Risks): Execute Plan Response u u u u Enhance: Increase the likelihood of the risk event occurring and/or increase the magnitude of its impact. Exploit: Pre-Event actions to increase the probability and/or impact of an opportunity risk, to ensure it occurs and is full realized. Share: Optimize probability and/or impact of an opportunity risk occurring. Accept: Accept the risk as stated with no other action. u u Passive: Accept and do nothing Active: Accept and put a plan in place to take advantage of the opportunity, should it occur. 17

18 Identify Assess Execution Execute Plan Response u PMI s PMBOK Guide 6 th Edition calls this Implement Risk Response u Implement response strategies, as determined during response planning. u This includes the risk responses of: u For Threats: Mitigate, Avoid, Transfer, Accept u For Opportunities: Enhance, Exploit, Share, Accept 18

19 More Risk Terms u Secondary Risk: Often the Consequence of one risk statement becomes the hazard or What can go wrong? for another risk. u Residual Risks: Risks that remain after implementing the Risk response. u Risk Trigger: Is an event which when it occurs is a warning that the risk event will soon occur. u Record & Track risks in a Risk Register Identify Execute Assess Plan Response 19

20 Risk Planning, Monitoring, Documentation & Communication umonitor, Track and Communicate Risk utrack the progress of mitigating the risk. ucommunicate this information to management and internal and external stakeholders. Identify Execute Assess Plan Response uintegration of Risk Management with Cost and Schedule Processes 20

21 Risk Planning, Monitoring, Documentation & Communication ueffective Understanding and Prioritization of Risks ufacilitate Early Mitigation, Minimize Project or Program Issues Identify Execute Assess Plan Response uescalation uescalate Risks to the management level where they can be resolved. uexpedite Elevation of Critical Risks to Upper Management 21

22 Applicability to Projects Potential areas for implementation of Risk Management: uproject Objectives uproject Management Processes uinformation Security udevelopment 22

23 Applicability to Projects Risk Categories: Integration (hardware/software) Logistics Support Manufacturing Schedule Technology Budget (funding) Capability of Developer Management Strategies Requirements Test/Evaluation Environment Systems Engineering Maintenance/ Supportability Portfolio Management Marketing Other 23

24 Summary ü Risk Management is an organized, systematic decision-making process that efficiently plans, assesses, handles, monitors, and documents risk to increase the likelihood of achieving project goals and decrease the likelihood that a risk would become a future problem ü Risk Management adds structure and rigor to a fundamental process ü Risk Management is everyone s job! That means you! 24

25 Risk Management Everyone wants to be doing it. Every thinks everyone else is doing it. Not many people are actually doing it, and no one is doing it particularly well 25

26 Risk Management QUESTIONS? Please join us on LinkedIn in the Group Risk Management Implementation lar=&gid= For discussion and resources on Risk Management and Implementing Risk Management S 3 Technologies, LLC Susan Parente Parente@s3-tec.com O:

27 Additional Information 27

28 Risk Identification u Sample Risk Register: <Project> Risk Register- Threats Last Update: <date> Priority (Rank Order) Probability Impact Exposure (Prob x Risk Impact) ID # Very Low, Minimal, (see key) Ex: 1 Technical, Cost, Low, Med, Moderate, HIGH Schedule, High, Very Significant, 4-5 Security High Extensive, Severe Risk Type Status Owner POC Risk Statement Ex: D, DO, DOC, DOCN First and Last Name Risk defined in "if then " statement. Risk Triggers Risk Strategies Residual Risks or Secondary Risks Mitigation, Avoidance, Transfer, Assume (include both short Residual Risk is the risk and long term) remaining after employing the response. Secondary Risks are a direct result of the risk response. Status Notes History of Risk Status Date Identified Date Risk was identified 28

29 Risk Identification u Risk Register Fields: Priority Probability Impact Exposure Risk ID # Risk Type Status Owner POC Risk Statement Risk Triggers Status Date of Identification 29

30 Response Planning Determining Risk Response Strategies: Risk Source Potential Strategies <Priority 1> Avoid Mitigate Minimize Probability Minimize Impact Transfer Defer Assume Estimated Benefit from Strategy Estimated Drawbacks of Strategy (including $/ resources) Selected Strategy (check) 30

31 Additional Information PMI-RMP Certification 31

32 PMI-RMP Certification PMI Risk Management Professional (PMI-RMP) u PMI s Risk Management Professional (PMI- RMP) credential is a response to project management s increasing growth, complexity and diversity. Globally recognized and demanded, the PMI-RMP fills the need for a specialist role in project risk management. u It recognizes your unique expertise and competency in assessing and identifying project risks, mitigating threats and capitalizing on opportunities, while still possessing a baseline knowledge and practical application in all areas of project management. Reference: PMI, PMI Risk Management Professional (PMI-RMP) Retrieved from: 32

33 PMI-RMP Certification Who should apply: u Risk management specialists and Project Risk Managers u To increase your skills in project management u To highlight your specialized expertise to employers PMI-RMP Requirements: u A 4 year degree (bachelor s or the global equivalent), with at least 3,000 hours of project RM experience and 30 hours of project RM education. OR u A secondary diploma (high school or the global equivalent) with at least 4,500 hours of project RM experience and 40 hours of project RM education. Reference: PMI, PMI Risk Management Professional (PMI-RMP) Retrieved from: 33

34 PMI-RMP Certification How to Apply: u Online at u More Info: u PMI-RMP Handbook u PMI-RMP Exam Preparation Maintain Your PMI-RMP: u Earn 30 PDUs/ 3 year cycle in project risk management u Learn more at: Management-Professional-PMI-RMP.aspx Reference: PMI, PMI Risk Management Professional (PMI-RMP) Retrieved from: 34