Chapter 10:

Managing Risk in Projects

Project Management for Engineering, Business
and Technology

Adapted from Slides Compiled by:

John Nicholas, Ph.D.
Loyola University Chicago
 Project Risk
Possibility or probability that the project will not turn out
as planned or desired
(Negative) impact on project objectives

Cost

Project
Objectives

2
 Case Study: Sydney Opera House
Open competition for design (1957)
Sketch submitted by Danish architect, Jorn Utzon, was
selected as winner
No plans or even perspective drawings
No prior experience in designing and constructing such a large
building
No bill of quantities
Little to base cost estimate on
Go-ahead given in 1958
Estimated @ $7million
Funded from state lottery
Completion date: 26 Jan 1963 (Australia day) 5 years

3
 Case Study: Sydney Opera House
Roof shells much larger & wider than any shells ever built
Act like sails
Risks were downplayed or ignored and little was done to
mitigate or control them
Final completion date: 1973
More than 10 years late!!
Final cost $102 million
14 times over budget!!

4
 What is at risk?
Cost
Money / Waste
Time / Schedule
Project
Product Quality Objectives

Lives / Safety & Health

Environment
Reputation/good name

5
 p346

Project Risk
Risk involves two concepts:
The likelihood that some event will occur.
The impact of the event if it does occur.

It is a joint function of the two

Risk = f (likelihood, impact)

Note:
Risk is a measure of something a person or object therefore cannot be a risk

6
 Zero Risk?
Likelihood Probability
Zero chance of something happening cannot exist
Zero Harm Zero Risk
Manage the level of risk to achieve the outcome of zero harm

7
Finagles law...

8
 p347

Risk Management Elements and Process

Repeat throughout every
Identify Risks
phase of the project life-
(Unwanted Events)
cycle, from conception to
close-out

Assess Risks
(How much should I
worry?)

Plan Risk Response

(What am I going to
do about it?)

Revise
Assessment Status
Track and Control
New Risks Risks Close-out

Basis of Assignment 1 9Risk Management Portion

 p347

Risk Management Elements and Process

Sources
Methods
Repeat throughout every
Identify Risks
phase of the project life-
(Unwanted Events)
cycle, from conception to
close-out

Assess Risks
(How much should I
worry?)

Plan Risk Response

(What am I going to
do about it?)

Revise
Assessment Status
Track and Control
New Risks Risks Close-out

Basis of Assignment 110Risk Management Portion

 Sources of Risk (Hazards)
Internal (project control) Environment
External
Internal
Project
Market Risk
Failure to correctly identify and define current or changing
customer needs and requirements
Failure to identify/adapt to new products by competitors
Reduced by defining the Scope of Work & working closely with
customer
1973 Motorola Analog Cell Phone
Weight = 2.5 pounds
1991
Talk Time = 30 min
Nokia 1011
Re-charge = 10 hours
GSM

11
 p349

Sources of Risk (Hazards)

Internal (project control) Environment

Project
Technical Risk
Risk of encountering technical problems with end-item
Risk due to nature of the end item or the process to create it:
High complexity
# steps/elements/components in product/process
how tightly interrelated they are
Low maturity
How experienced/knowledgeable project team is in project technology
Leading edge vs bleeding edge?
How producible, reliable and testable the end-item/process is
High concurrency/dependency
Multiple activities overlap or are dependent on each other

12
 Sources of Risk (Hazards)
Internal (project control) Environment

Project
Assumptions Risk
In compiling budget/schedule
Uncertainty at the beginning of the project.
The less defined the project is, the more difficult estimates are.
The ratio that costs is more than the estimate, is called cost
escalation
Normal to occur on projects +- 20%

13
 Cost Escalation on Projects
300

200
Cost overrun %

100

-100

1910 1930 1950 1970 1990

1920 1940 1960 1980 2000

Year of decision to build

Projects versus Percent Cost Overrun (Flyvbjerg, B., Bruzelius, N., & Rothengatter, W., Megaprojects and Risk: An
Anatomy of Ambition. Cambridge:Cambridge University14 Press, 2003, p. 17. With permission.)
 Internal sources of Assumptions Risk

Cost Escalation & Schedule delays

Uncertainty and Lack of Accurate Information

Inefficiency, Poor Communication, and Lack of Control
Changes in Requirements or Design
Ego/Experience of the Estimator
Project Contract type
Fixed price vs Cost Plus

15
 Sources of Risk
External (outside of project control) Environment

Project
Risks in the project environment
Market conditions
Interest & Exchange rates
Competitors actions
Government regulations
Labor and other resource availability
Subcontractor failure
Physical environment (weather, geography, etc.)
Economic & Social Factors

16
 p347

Risk Management Elements and Process

Sources
Methods
Repeat throughout every
Identify Risks
phase of the project life-
(Unwanted Events)
cycle, from conception to
close-out

Assess Risks
(How much should I
worry?)

Plan Risk Response

(What am I going to
do about it?)

Revise
Assessment Status
Track and Control
New Risks Risks Close-out

17
 Methods: Individual Review
Analogy
Experience on similar projects
Post-completion summary reports
Checklists
Risk checklists lists of risk sources in projects (Table 10.1, p 350)

18
 p351

Methods: Team Review

WBS and work packages
Process flow charts
Project Network Diagram
Convergence/Merge Points
Brainstorming (Fig 10.2, p352)
Delphi Technique
Cause-Effect analysis

Causes Effect
Risk sources Outcomes,
and hazards Consequences

19
WBS and work packages with assessed level of risk

20
 For Assignment 1
As a team, decide on an appropriate technique to be
used to identify the risks
Identify risks (unwanted events) associated with:
Fictitious product (internal & external)
Sim4Project development project/steps (internal & external)

Internal External
Fictitious Product
Sim4Project project
 p347

Risk Management Elements and Process

Sources
Methods
Repeat throughout every
Identify Risks
phase of the project life-
(Unwanted Events)
cycle, from conception to
close-out
Likelihood
Impacts/Consequence
Assess Risks Priority
(How much should I
worry?)

Plan Risk Response

(What am I going to
do about it?)

Revise
Assessment Status
Track and Control
New Risks Risks Close-out

22
 Assess the Risk
Also called Risk Analysis
Quantitative
.00001 or 1 in 100,000 fatalities per year

Qualitative
high, medium or low risk, basic ranking (5 by 5)

Semi-quantitative
combined objective & subjective risk estimations

23
 Quantitative Risk Analysis Examples
Risk of being killed by lightning 1 in 10 million
Risk of death by fire / explosion at home 1 in 1 million
Risk of death in a 'safe' industry 1 in 100,000
Risk of death in a road traffic accident 1 in 10,000
Risk of death in UK mining 1 in 1,000
mid 1980s UK nuclear industry info based on 1960s & 70s data

You need the data!

24
Qualitative Risk Analysis

Subjective scales and

isotherms

25
Qualitative Risk Analysis Example

Define your own matrix in

assignment 1

26
 Qualitative Risk Analysis Example
25 risk categories, vs. 9 in previous
example easier to prioritise

Impact
VL L M H VH
VH M M H H VH
Probability

H L M M H H
M L L M M H
L VL L L M M
VL VL VL L L M

RC = L x H = M (according to table)

27
Semi-Quantitative Risk Analysis Example

36 risk categories + use of data to help

with selection of impact & likelihood

28
 Warning: Consultant speak
Assess RC (the risk consequence or exposure)
RC = f(Probability, Impact)................Nicholas
or:
Risk = f(Likelihood, Consequence)...Others
Lets stick with Nicholas

Be careful for equations like:

RCR = CLF + CIF CLF(CIF)
Cannot add probability & impact
Like adding meters and grams

29
 p359

Purpose of Risk Analysis

Projects are subject to numerous risks
Only a few might be important enough to merit attention
Risk Analysis is about prioritisation!
Create a risk log or risk register
risks are rank ordered
greatest risk consequence first

30
Probability: 0-100%, Impact: 1-5: Exposure: (Probability) X (Impact), Scale 0-500

Risk: Condition likely Functional Effect: Preventive

Impact

Probability

Exposure
Item No.

to occur; inherent in area Consequences if action to reduce

every project impacted risk occurs risk

11 Progeni solutions cant perform up Application 5 75% 375 Schedule delays. Cost of Analyze pilot results and
to expectations. Development hiring a replacement vendor. create documents that will
standardize the process.
8 Unknowns in migration project will Technical 4 90% 360 Scheduling delays and Build plan and tracking
occurs. Infrastructure possible re-engineering. mechanism to manage
Redundant system costs. schedule and resources
28 Client impact during migration Technical 5 70% 350 Dissatisfaction of client base Solid test process during
phase. Infrastructure with service levels. System and Client Beta
test. Focus from Business
Development staff.
22 Programs/WFL run ineffectively in a Application 4 75% 300 Increased S&P support and WFL training and testing.
muti-Usercode environment on a Development service level issues. Technical support from
single system. S&P.

5 The purpose of Risk

Lift & Merge process wont meet
Application 4 75% 300 Difficulty in establishing Utilize knowledge learned
migration schedule, that calls for the
Analysis is to Prioritise!
Development
moving of remaining clients, during the
remaining first site clients.
Would force a change in
from Purple system Lift &
Merge even scheduled for
migration of the first V/Series site
migration strategy. May of 2000.
27 Excessive manual changes during post- Application 4 70% 280 Schedule delays. After receipt of pilot
syntran process. Development determine extent of
excess work and readjust
resources.
10 Lift & Merge not kept up to date. Application 4 70% 280 Difficulty in establishing Create Plan to keep L&M
Development remaining clients, on first site on track and current.
chosen, on the ClearPath.

1 Conversion process of Jobflows to Application 4 65% 260 If not handled properly, major Training early in the
WFL and applicational re-design Development impact on quality of product project. Extensive quality
delivered to client base. assurance of process.
Dedicate proper staffing.
 For Assignment 1
As a team, design a Risk Assessment (Risk Analysis)
technique
Discuss/orientate the reader
Assess the level of risk for each identified risk (unwanted
event).
Document in Priortised Risk Register
 p347

Risk Management Elements and Process

Sources
Methods
Repeat throughout every
Identify Risks
phase of the project life-
(Unwanted Events)
cycle, from conception to
close-out
Likelihood
Impacts/Consequence
Assess Risks Priority
(How much should I
worry?) Strategy: Transfer
Avoid
Reduce
Contingency
Plan Risk Response Accept
(What am I going to
do about it?)

Revise
Assessment Status
Track and Control
New Risks Risks Close-out

33
 Risk Response Planning
Is the process that identifies, evaluates, selects and
implements one or more strategies in order to get risk to
an acceptable level.
Just knowing the risk, gives you ulcers what are you
going to do about it?
Includes:
What should be done?
Who is responsible?
By when?
The cost/resource involved?

34
 p360

Risk Response Strategies

1. Risk avoidance: I will NOT choose this alternative, the
risk is too high (e.g. change the design, walk the stairs)
2. Risk transfer: Its not my problem, its yours (e.g.
contracting) or Its our problem (e.g. sharing the risk
through insurance)

Level of Risk
3. Risk reduction or control: I will take measures to
reduce the risk and take control of it (e.g. plan B,C&D;
throw money at it; design a control system).
4. Contingency plan: When it happens, this is what I will
do (e.g. disaster management)
5. Accepting the risk: I know the risk and consequences
but I will wait and see and do nothing. (e.g. an old car;
if it rains it rains)

35
 1. Risk Avoidance
Eliminate sources of risk
In order to advance, you have to take risks
No such thing as zero risk
Micromanage

36
 2. Risk Transfer
Insurance
Property damage or personal injury suffered as a
consequence of the project
Damage to materials while in transit or in storage
Breakdown or damage of equipment
Theft of equipment and materials
Sickness or injury of workers, managers, and staff
Forward cover: insure against exchange rate fluctuations.
Contracts
Fixed-price versus cost-plus

37
 p363

3. Reduce/Control Risk
Employ best team (and contractors)
Employ strong team incentives
Use known and mature technology and tools
Use parallel development on high risk tasks
Increase frequency and severity of reviews and tests
Reduce system complexity
Cost
De-couple activities All about Project
Priorities & Trade-offs
Use design margins Project
Objectives
Be careful to increase costs

38
 4. Contingency Plan
Study possible what-if scenarios and develop a plan for
each
Usually dealing with impact mitigation, rather than
prevention.

39
 p364

Contingency Plan: Schedule

Baseline the master project schedule & track against
Progress
Resource loading
Focus on critical- & near-critical path
Best resources on time critical tasks
Schedule task with highest risk early in project
Recovery time
Shift high-risk tasks from series to parallel
Incentives for milestones
Overtime?
Project & feeding buffers/slack time

40
 p364

Contingency Plan: Budget/Cost

Identify & monitor key cost drivers
Remember priority matrix
Design reviews & assessments using modeling
Low-cost
Verify system design
Proven technology & commercial off-the-shelf equipment
Contingency reserves in budget
Perform early prototyping/testing on risky components

41
5. Accepting the Risk?

42
 For Assignment 1
Plan a Risk Response Strategy (controls) for each
identified risk (unwanted event).
Classify each response strategy
Document in Risk Register
 p347

Risk Management Elements and Process

Sources
Methods
Repeat throughout every
Identify Risks
phase of the project life-
(Unwanted Events)
cycle, from conception to
close-out
Likelihood
Impacts/Consequence
Assess Risks Priority
(How much should I
worry?) Strategy: Transfer
Avoid
Reduce
Contingency
Plan Risk Response Accept
(What am I going to
do about it?) Responsibility
Measures
Trigger Events
Revise
Assessment Status
Track and Control
New Risks Risks Close-out

44
 Risk Tracking and Response
Risk Management Plan
Specifies methods to identify, profile, assess, monitor, and
handle risks
Names the risk officer
Contains a budget and schedule reserve
Risk Profile
The likelihood, impact, trigger symptoms, monitoring methods,
and response strategy for each identified risk
Example in Fig 10.5

45
 For Assignment 1
Create a risk log or risk register; risks are rank ordered,
greatest risk consequence first
Look at your project through the risk register
Use in each project meeting
Continuously monitor project for:
trigger symptoms of previously identified risks
symptoms of risks newly emerging and not previously identified.

46
 Terminology (do not get confused!)

Nicholas Common Term Description

Impact Consequence If the event happen, what will be the
end result.
Risks Unwanted Events What I should be worried about...
Risk Assessment Risk Analysis Determining how much I should
worry (likelihood & consequence)
Risk Consequence Risk/Risk Rating/ The number used to set priorities
Risk Number
Risk Identification Risk Assessment Technique to identify unwanted
events.
Risk Response Control What I am doing to prevent the
event or deal with consequences

47
Chapter 10:
Managing Risk in Projects