Project Theft Management,

Transcription

1 Project Theft Management, by applying best practises of Project Risk Management Philip Rosslee, BEng. PrEng. MBA PMP PMO Projects South Africa PMO Projects Group PMO Projects Group Maputo, MZ 15 November 2011

2 Context - Sources PMI Risk Management Professional Certification Project Management Institute The Practice Standard for Project Risk Management Project Management Institute (

3 Workshop Objectives Understand the nature of risks and their causes Understand the Project Risk Management Process Know how to implement Understand the added value to the organization Know how to implement the core techniques: Risk Register Risk Breakdown Structure Probability-Impact Matrix Sensitivity Analysis Monte Carlo Simulation Expected Value and Risk Reserve Risk Response Strategies Understand the organizational requirements for practical implementation

4 Workshop Agenda Context: exploring uncertainty Overview of the PMBOK Guide Definitions and Basic Concepts The Risk Management Processes Implementing the Risk Management Process Plan Risk Management Identify risks Perform Qualitative Risk Analysis Perform Quantitative Risk Analysis Plan Risk Responses Monitoring & Control Risks Consolidating the Risk Management Process Critical factors for organizational implementation

5 Practical Exercises Development of a Structured Risk Register Development of a Risk Breakdown Structure Development of a Probability-Impact Matrix Sensitivity Analysis based on the Critical Path Analysis Development of Decision Trees based on the Expected Value Monte Carlo Simulation and probabilistic analysis Risk Cost/Time Reserve Calculation and Monitoring Benefit/Cost Calculation of Risk Responses

6 Risk Management: exploring uncertainty Maximize Impact? Minimize Opportunities Response Planning Threats Identify Performance Measurement System (EVM) Data Project Execution & Project Environment Identify

7 PM practices to combat theft Scheduling JIT QA Inspection Timing Procurement Strategies Responsibility for transport Delay handover Technology Material uses Position of services Anti theft devices

8 PM practices to combat theft Communication Local Authorities Off-set areas Human Resources Employment criteria Etc.

9 Agenda Context: exploring uncertainty Overview of the PMBOK Guide Definitions and Basic Concepts The Risk Management Processes Implementing the Risk Management Process Plan Risk Management Identify risks Perform Qualitative Analysis Perform Analysis Plan Risk Responses Monitoring & Control Risks Consolidating the Risk Management Process Critical factors for organizational implementation

10 Overview of the PMBOK Guide sum of knowledge within the profession of Project Management [ ] rests with practitioners and academics that apply and advance it. [ ] includes knowledge of proven traditional practices that are widely applied, as well as knowledge of innovative and advanced practices that have seen more limited use, and it includes both published and unpublished material.

11 Overview of the PMBOK Guide What is a risk? Risk vs. Project Objectives Cost Quality Scope Time

12 Overview of the PMBOK Guide What is a risk? Risk vs. Project Objectives Cost Quality Scope Time

13 Overview of the PMBOK Guide Definitions and Concepts What is a risk? Project risk is an uncertain event or condition that, if occurs, has a positive or a negative effect on a project objective. Cause Risk Impact A risk is not its cause nor its impact!

14 Overview of the PMBOK Guide Definitions and Concepts Risk are often inter-related: Common Cause Waiting for material Material Theft... Delay in elementary tasks or in external work Delay in major milestone or final date Increased cost for material Actual cost above the planned Cost

15 Overview of the PMBOK Guide Definitions and Concepts Risk are often inter-related: Event Interaction Waiting for material Delay in elementary tasks or in external work Delay in major milestone or final date Material Theft Increased cost for material Actual cost above the planned Cost

16 Overview of the PMBOK Guide Definitions and Concepts Risk are often inter-related: Common Impact Waiting for material Delay in elementary tasks or in external work Delay in major milestone or final date Material Theft Increased cost of material Actual cost above the planned Cost

17 Key Concepts and Definitions What is Risk Management? Proactive Control External Changes Monitoring Planning Threats Risk Management Opportunities Engineering Process Requirements Design Build Testing

18 Key Concepts and Definitions What is Risk Management? What is Risk Management? Risk Management is the systematic process of identifying, analyzing, and responding to project risk. A Guide to the Project Management Body of Knowledge, Fourth Edition (PMBOK Guide) 2008 Project Management Institute, Inc. All Rights Reserved. Risk Management is aimed at: Maximizing the probability and impact of positive events Minimizing the probability and impact of negative events It is implemented through 6 processes

19 Revision of the PMBOK Guide Process Groups The five Process Groups: Initiating Planning Execution Monitoring and Controlling Closing

20 Revision of the PMBOK Guide Knowledge Areas The nine Knowledge Areas : Integration Management Scope Management Time Management Cost Management Quality Management Human Resource Management Communication Management Risk Management Procurement Management Any project issue, problem or requirement can be addressed by one of these knowledge areas

21 Revision of the PMBOK Guide Knowledge Areas and Process Groups Each process in the knowledge areas is mapped to one process group

22 Revision of the PMBOK Guide The Risk Management Knowledge Area

23 The Project Risk Management Process Tools and Techniques Monitoring Planning Risk Management Process Tools and Techniques Engineering Process Reqs. Design Build Test

24 Project Risk Management Process Tools and Techniques Some of the more commonly used tools / techniques: Risk Register Risk Breakdown Structure Meta-language Delphi Method Group Nominal Technique Probability-Impact (PI) matrix Stochastic PERT analysis Stochastic Monte Carlo simulation Decision Trees Expected Monetary Value Sensitivity Analysis Deterministic CPM analysis Qualitative cause-effect diagrams Quantitative System Dynamics simulation Stakeholder Analysis Checklists (risks, impacts, responses) Brainstorming Others...

25 Course Agenda Context: exploring uncertainty Overview of the PMBOK Guide Definitions and Basic Concepts The Risk Management Processes Implementing the Risk Management Process Plan Risk Management Identify risks Perform Qualitative Risk Analysis Perform Quantitative Risk Analysis Plan Risk Responses Monitoring & Control Risks Consolidating the Risk Management Process Critical factors for organizational implementation

26 Implementing the Risk Process Plan Risk Management

27 Implementing the Risk Process Plan Risk Management Aim: to decide about the level of effort that will be dedicated to the Risk Management process and about how this process is to be implemented How to decide about the level of effort? Depends on the following main factors: Size and complexity of the project Uncertainty associated with the project Importance and value of the project to the organization Benchmarking metrics can help (example): Project Management may consume between 5% to 20% of the project budget Risk Management may consume between 10% to 20% of the project management budget Risk Management may be budgeted between 0,5% to about 5% of the project budget It is essential To specify the Scope of the Risk Management Process To consider an explicit Budget for the Risk Management Process as part of the overall project budget

28 Implementing the Risk Process Plan Risk Management Components of the Risk Management Plan: Methodology Roles and Responsibilities Budgeting Timing Risk Categories Definitions of probability and impact Probability-Impact Matrix Stakeholders tolerances Reporting formats Tracking

29 Plan Risk Management Risk Classification What is risk classification? Practical experience shows that risks which generally occur in projects have characteristics that allow us to group them into categories Why classifying risks? Grouping risks into categories makes it easier to understand their causes and impacts, and therefore makes it easier for us to manage them How to classify risks? There is no universal classification system. Risks can (and should) be classified under various different criteria, specially by cause.

30 Plan Risk Management Risk classification The PMBOK Guide considers four generic main risk categories: Technical, quality or performance directly related to the product and its development process (e.g. material demand) Project management directly related to project management decisions and actions (e.g. poor planning increasing exposure) Organizational directly related to issues that have to do with the organization implementing the project (e.g. negative community relations) External caused by forces totally external to the project (e.g. Socio economic forces) Risk Classification should be based on a Risk Breakdown Structure (RBS) which provides a top-down decomposition of the relevant risk types for a project

31 Plan Risk Management Risk classification: example of a RBS

32 Exercise No. 1: Development of a Risk Breakdown Structure Purpose: to develop a RBS tailored to your specific business and organization environment Guidelines: Use the first level of the RBS presented in the PMBOK Guide Consider the second level of the PMBOK Guide just as an example The criteria to breakdown should oriented towards the cause and/or source of the risks Consider a single criteria for each level of breakdown (e.g. organizational unit) Each level must provide a more detailed and complete definition of the level above

33 Course Agenda Context: exploring uncertainty Overview of the PMBOK Guide Definitions and Basic Concepts The Risk Management Processes Implementing the Risk Management Process Plan Risk Management Identify risks Perform Qualitative Risk Analysis Perform Quantitative Risk Analysis Plan Risk Responses Monitoring & Control Risks Consolidating the Risk Management Process Critical factors for organizational implementation

34 Identify Risks Key Elements

35 Identify Risks Key Elements Input: Risk Breakdown Structure Tools & Techniques: Information Gathering: Root Cause Identification Use of Meta Language Delphi Technique Nominal Group Technique Diagramming Techniques: Influence Diagrams Output: Risk Register

36 Identify Risks Meta-Language (Root Cause Identification) Aim: to allow for risks to be identified with more accuracy from informal language Potential problems are described in informal language Problems are re-written using a defined meta-language that distils: Cause (what leads to uncertainty) Risk (the uncertain event) Effect (impacts on the project objectives) Example: Because < fact >, <event> may happen and the consequences are <impacts> < fact > cause. It is not uncertain. E.g.: Cables must lay open for inspection. <event> risk. It is uncertain. (Possible) Will be stolen at night. <impacts> effect. It is certain if the risk happens. E.g. a 3 month delay.

37 Identify Risks Delphi Method & Nominal Group Technique Aim: to allow for the effective use of expert judgement for risk identification and risk legitimisation through effective consensus building Barriers to use of expert judgement in Identify Risks: Formal power Personality Personal interactions and relationships The Delphi Method Panel of experts is completely anonymous Identify Risks and debate is completely anonymous Consensus is based on continuous feedback and review of risks Time-consuming The Nominal Group Technique Panel of experts is not anonymous The process of proposing risks and voting for its relevance is anonymous Debate on the relevance of the risks is not anonymous Less time-consuming

38 Identify Risks The Risk Register The structure of a Risk Register can be developed as complex and sophisticated, as necessary for the project

39 Identify Risks The Risk Register Identifier must be a unique key Description concise and focused on the uncertainty Probability of occurrence qualitative index or quantitative (%) Impact it can be split into the four objectives (cost, time, scope and quality). Can be defined qualitatively or quantitatively (typically $) Importance based on an index combining probability and impact. Can be defined qualitatively or quantitatively (typically $) Rank position in the list according to its importance Owner person responsible for managing the risk Responses description, triggers and current status

40 Exercise No. 2: Identify Risks and Development of Risk Register Purpose: to develop in MS Excel an appropriate Risk Register structure and identify a number of risks based on meta-language Guidelines: Use the Excel template provided Use the Meta-Language table to identify 5-10 risks Fill-in the following fields: Date, Proposed by, Description (informal) Consider the informal description and fill-in: Cause Event Impact: scope, quality, cost and schedule Review the risks to identify: Redundancy: risks that are the same Risks with common cause Copy the Event description from the Meta-Language table into the Risk Register table in the Risk Description field

41 Course Agenda Context: exploring uncertainty Overview of the PMBOK Guide Definitions and Basic Concepts The Risk Management Processes Implementing the Risk Management Process Plan Risk Management Identify Risks Perform Qualitative Risk Analysis Perform Quantitative Risk Analysis Plan Risk Responses Monitor & Control Risks Consolidating the Risk Management Process Critical factors for organizational implementation

42 Implementing the Risk Process Perform Qualitative Risk Analysis

43 Perform Qualitative Risk Analysis Key Elements Input: Risk Register Tools & Techniques: Probability and Impact Assessment Probability-Impact Matrix Output: Classified Risks (RBS) Risk Ranking Overall Project Risk

44 Perform Qualitative Risk Analysis Probability and Impact Assessment

45 Perform Qualitative Risk Analysis Probability and Impact Risk Rating Matrix

46 Perform Qualitative Risk Analysis Considering the Stakeholders Risk Profile Risk Averse Profile Probability Assessment Risk Robust Profile Impact Assessment 1,00 1,00 0,80 0,80 Importance 0,60 0,40 0,20 0, Level Impact Very High High Medium Low Very Low Ass. NIL Importance 0,60 0,40 0,20 0, Level 1,00 0,57 0,35 0,15 0,06 0,00 Probability Assessment Very High 1,00 1,0 0,6 0,3 0,1 0,1 0,0 High 0,95 1,0 0,5 0,3 0,1 0,1 0,0 Medium 0,83 0,8 0,5 0,3 0,1 0,0 0,0 Low 0,69 0,7 0,4 0,2 0,1 0,0 0,0 Very Low 0,43 0,4 0,2 0,1 0,1 0,0 0,0 NIL 0,00 0,0 0,0 0,0 0,0 0,0 0,0

47 Exercise No. 3 Risk Assessment and Ranking using a P-I P I Matrix Purpose: to develop in MS Excel an appropriate PI-Matrix tool considering risk profiles and assessment criteria, and classify, assess and rank risks, and assess the overall project risk against a threshold Guidelines: Use the Excel template provided Validate and adapt the assessment criterion tables For each risk identified in the Risk Register: Classify the risk in the Risk Register using the RBS previously developed For each risk identified in the Risk Register: Assess the Probability using the criterion tables Assess the Impact using the criterion tables Validate the automatic calculation of the Risk Importance score After all risks have been assessed verify the Overall Project Risk score If the score is above the acceptable threshold, consider risk reduction scenarios that decrease the project risk down to an acceptable level Consider classifying the trend of the risks assessed based on objective criteria

48 Course Agenda Context: exploring uncertainty Overview of the PMBOK Guide Definitions and Basic Concepts The Risk Management Processes Implementing the Risk Management Process Plan Risk Management Identify Risks Perform Qualitative Risk Analysis Perform Quantitative Risk Analysis Plan Risk Responses Monitor & Control Risks Consolidating the Risk Management Process Critical factors for organizational implementation

49 Implementing the Risk Process Perform Quantitative Risk Analysis

50 Perform Quantitative Risk Analysis Key Elements Input: Risk Register Tools & Techniques: Sensitivity Analysis Decision Trees and the Expected Monetary Value (EMV) Monte Carlo Simulation Risk Reserve Calculation based on the EMV Output: Expected Monetary Value of Risks Ranking of Risks based on the EMV Tasks Ranking by Schedule Cruciality (Tornado Analysis) Probability of Achieving Time/Cost objectives Project Reserves based on Stakeholders Risk Thresholds Benefit/Cost Evaluation of Risk Responses

51 Perform Quantitative Risk Analysis Sensitivity Analysis Aim: to evaluate how sensitive the project outcome is against a variation in a single factor and to identify scenarios of high threat and high opportunity A quantitative model is needed with the following attributes: Inputs: variables representing project conditions (e.g. available resources) Calculation process: project outcome is calculated (e.g. schedule) Outputs: project objectives to be analyzed (e.g. final schedule/cost) A range of variation for a project condition that is considered uncertain is considered and introduced in the model The outcome is represented as a function of the input project condition and the scenarios of potential threat and opportunity are identified

52 Exercise No. 3: Sensitivity Analysis using a CPM model Purpose: to use a project schedule model to analyse the sensitivity of a project schedule and cost to the variation in resource availability Guidelines: Use the MS Project plan provided Consider the resource availability ranges for the two resources considered in the plan For each resource: Change the resource maximum units available from lowest to high in the range Calculate the project final cost and duration using the resource leveling feature in MS Project Record the results achieved in an Excel table and build a graph relating the resource variation with the final cost and schedule Analyze the results and identify the scenarios of threat and opportunity for each resource

53 Perform Quantitative Risk Analysis Decision Tree Analysis Aim: to structure evaluate complex risk scenarios characterized by a sequence of decisions and uncertain events over time, in order to identify the best possible options and quantify the overall risk A tree-branch-model is developed to capture the sequence of management decisions and uncertain events over-time, based on problem analysis. The model leads to a number o possible branches that identify one possible outcome for the complex scenario The probability of the outcome of each uncertainty node is estimated The costs/schedule associated with each possible branch are estimated Based on the Expected Value, the uncertainty nodes are quantified For each decision node, the best decision is selected The final set of decisions is identified together with the overall probability, impact and Expected Value of the overall risk scenario

54 Perform Quantitative Risk Analysis Decision Trees and Expected Value Success 70% No Subcontract? Yes Delays 30% Continue? Yes Success 20% No Success 20% Delay 80% Import Problems 80%

55 Exercise No. 4: Decision-Tree Analysis Purpose: to use a decision-tree model to identify the best possible responses to a complex risk scenario and quantify the final probability, impact an expected value of that risk Guidelines: Consider the decision tree shown in the previous slide Identify the best options in the decision nodes For the overall complex risk scenario calculate: The probability The impact Expected Monetary Value

56 Perform Quantitative Risk Analysis Decision Trees and Expected Value Success 70% EMV = No Subcontract? Yes Delays 30% Continue? Yes EMV = Success 20% No Success 20% Delay 80% EMV = Import Problems 80%

57 Exercise No. 4: Decision-Tree Analysis Solution: The work should be subcontracted and in case there is a delay in the first milestone the contract should be terminated Overall risk quantification: Probability: there is a 30% probability that the contractor does not succeed Impact: if the contractor does not succeed the extra cost is The expected value of the overall risk remaining is:

58 Perform Quantitative Risk Analysis Monte Carlo Simulation Simulation Results Simulation Results 120% 120% 100% 100% Probability (%) Probability (%) 80% 80% 60% 60% 40% 40% Probability Probability Cum. Probability Cum. Probability 20% 20% 0% 0% Duration (Months) Duration (Months)

59 Perform Quantitative Risk Analysis Exercise No. 5: Purpose: to capture a number of uncertainties related to the project schedule, and calculate the probability of achieving cost and time objectives, and rank the project scope elements (i.e. tasks) by importance. Guidelines: Consider the project schedule provided Analyze and validate the uncertainties captures in the model Run the Monte Carlo Simulation and analyze the results: The final S-Curve The final Tornado Graph

60 Perform Quantitative Risk Analysis Risk Reserve Calculation Purpose: to calculate the cost and schedule risk reserves balanced with the project risks and stakeholders risk tolerance thresholds Risks Risks Stakeholders Thresholds Reserves: Reserves: Cost Cost and and Schedule Schedule

61 Earned Value for Performance Measurement Trend Analysis Value $ Dollars Present Risk Trend for the final Project outcome Plan Earned Value Actual Projected EV EV Projected Actual Project Months Months

62 Perform Quantitative Risk Analysis Exercise No. 5: Purpose: to calculate the adequate cost reserve, balancing the risks identified and quantified in the Risk Register against the risk tolerance threshold imposed by the stakeholders Guidelines: Consider the Risk Register developed with the identified and quantified risks Consider a Risk tolerance threshold of 85% Calculate the cost Risk Reserve using the Expected Value and the Normal distribution

63 Course Agenda Context: exploring uncertainty Overview of the PMBOK Guide Definitions and Basic Concepts The Risk Management Processes Implementing the Risk Management Process Plan Risk Management Identify Risks Perform Qualitative Risk Analysis Perform Quantitative Risk Analysis Plan Risk Responses Monitor & Control Risks Consolidating the Risk Management Process Critical factors for organizational implementation

64 Implementing the Risk Process Plan Risk Responses

65 Plan Risk Responses Benefit/Cost Evaluation of Risk Responses Purpose: to evaluate the Benefit/Cost ratio of a risk response by considering the cost of implementation against the value of the reduced uncertainty Cost: Cost: Implement Implement Response Response Benefit: Benefit: Reserve Reserve Reduction Reduction

66 Exercise No. 7: Benefit/Cost Evaluation of Risk Responses Purpose: to evaluate whether a risk response is worth implementing, by comparing the cost of implementation against the value of the reduced uncertainty Guidelines: Consider a Risk Response for a risk identified in the Risk Register: Cost of implementing the response Impact on the probability and impact on the risk Secondary risks generated Evaluate the value of the reduced uncertainty by quantifying the new project risk cost reserve required Calculate the Benefit/Cost ratio of this response

67 Course Agenda Context: exploring uncertainty Overview of the PMBOK Guide Definitions and Basic Concepts The Risk Management Processes Implementing the Risk Management Process Plan Risk Management Identify Risks Perform Qualitative Risk Analysis Perform Quantitative Risk Analysis Plan Risk Responses Monitor & Control Risks Consolidating the Risk Management Process Critical factors for organizational implementation

68 Implementing the Risk Process Monitoring and Control Risks

69 Implementing the Risk Process Monitoring and Control Risks

70 Implementing the Risk Process Monitoring and Control Risks Purpose: to update the adequate value for the cost reserve in face of risks occurring or not throughout the life-cycle Guidelines: Consider the Risk Register developed with the identified and quantified risks Consider a risk tolerance threshold of 85% Consider that a given risk occurs and that another one does not. Recalculate: the new risk exposure (probability of not meeting the budget) the new value for the risk reserve needed

71 Course Agenda Context: exploring uncertainty Overview of the PMBOK Guide Definitions and Basic Concepts The Risk Management Processes Implementing the Risk Management Process Plan Risk Management Identify Risks Perform Qualitative Risk Analysis Perform Quantitative Risk Analysis Plan Risk Responses Monitor & Control Risks Consolidating the Risk Management Process Critical factors for organizational implementation

72 Implementing the Risk Process Consolidation

73 Implementing the Risk Process Consolidation Project Scope Statement Project Management Plan Risk Management Plan Risk Register List of identified risks Risk Register updates Ranking of risks Risks Grouped Trends Risk requiring further analysis Risk Register updates Assigned owners Responses Reserves Contingency Plans Fall back plans Risk Related Contract Decisions Risk Register updates Probabilistic Analysis Probability of achieving cost/time Trends Ranking

74 Course Agenda Context: exploring uncertainty Overview of the PMBOK Guide Definitions and Basic Concepts The Risk Management Processes Implementing the Risk Management Process Plan Risk Management Identify Risks Perform Qualitative Risk Analysis Perform Quantitative Risk Analysis Plan Risk Responses Monitor & Control Risks Consolidating the Risk Management Process Critical factors for organizational implementation

75 Implementing the Risk Process Critical Factors Converting Risks into Opportunities Balancing the Risk Process with the Project needs Identifying possible threats to the risk process Managing behavioral factors Developing technical expertise Attaining top management support and staff buy-in Data collection and knowledge management Software tools

76 Course Agenda Context: exploring uncertainty Overview of the PMBOK Guide Definitions and Basic Concepts The Risk Management Processes Implementing the Risk Management Process Plan Risk Management Identify Risks Perform Qualitative Risk Analysis Perform Quantitative Risk Analysis Plan Risk Responses Monitor & Control Risks Consolidating the Risk Management Process Critical factors for organizational implementation