Professional Documents
Culture Documents
MANAGEMENT
A GUIDE BY
Contents Page
1. Introduction -------------------------------------------------------------------------------------------3
2. What Is Project Risk Analysis And Management? ------------------------------------------3
3. What Is Involved -------------------------------------------------------------------------------------3
4. Why Is It Used? ---------------------------------------------------------------------------------------4
5. When Should It Be Used and Who Should Do It?-------------------------------------------5
6. How To Do It - Techniques And Methods ----------------------------------------------------6
7. What Experience Is Available?----------------------------------------------------------------- 10
This Guide may not be reproduced without written permission of The Association of Project Managers.
This ‘mini’ guide has been expanded, updated and rewritten as the Project Risk Analysis and
Management (PRAM) Guide edited by P Simon, D Hillson and K Newland, published by the APM 1997,
ISBN 0953159000.
3
Project Risk Analysis & Management
high/low) in terms of both its impact and its respond to risks may be urgent and the solution
probability of occurrence. fairly obvious. Iteration between the Risk
Analysis and Risk Management stages is likely.
A sound aim is to identify the key risks,
perhaps between five and ten, for each project (or Risk Management can involve:
part-project on large projects) which are then ✧ identifying preventive measures to avoid a
analysed and managed in more detail. risk or to reduce its effect
Quantitative Analysis ✧ establishing contingency plans to deal with
risks if they should occur
A Quantitative Analysis often involves more
sophisticated techniques, usually requiring ✧ initiating further investigations to reduce
computer software. To some people this is the uncertainty through better information
most formal aspect of the whole process ✧ considering risk transfer to insurers
requiring: ✧ considering risk allocation in contracts
✧ measurement of uncertainty in cost and ✧ setting contingencies in cost estimates, float
time estimates in programmes and tolerances or 'space' in
✧ probabilistic combination of individual performance specifications.
uncertainties. Section 6 of this Guide considers some of the
Such techniques can be applied with varying techniques of Project Risk Analysis and
levels of effort ranging from modest to Management in more detail.
extensively thorough. It is recommended that
new users start slowly, perhaps even ignoring
4. Why Is It Used?
this 'sub-stage', until a climate of acceptability has There are many reasons for using Project
been developed for Project Risk Analysis and Risk Analysis and Management, but the main
Management in the organisation. reason is that it can provide significant benefits
far in excess of the cost of performing it.
An initial qualitative analysis is essential. It
brings considerable benefit in terms of Benefits
understanding the project and its problems The benefits gained from using Project Risk
irrespective of whether or not a quantitative Analysis and Management techniques serve not
analysis is carried out. It may also serve to only the project but also other parties such as the
highlight possibilities for risk 'closure' i.e. the organisation and its customers. Some examples of
development of a specific plan to deal with a the main benefits are:
specific risk issue. ✧ an increased understanding of the project,
Experience has shown that qualitative which in turn leads to the formulation of
analysis - Identifying and Assessing Risks - more realistic plans, in terms of both cost
usually leads to an initial, if simple, level of estimates and timescales
quantitative analysis. If, for any reason - such as ✧ an increased understanding of the risks in a
time or resource pressure or cost constraints - project and their possible impact, which
both a qualitative and quantitative analysis are can lead to the minimisation of risks for a
impossible, it is the qualitative analysis that party and/or the allocation of risks to the
should remain. party best able to handle them
It should be noted that procedures for ✧ an understanding of how risks in a project
decision making will need to be modified if risk can lead to the use of a more suitable type
analysis is adopted. An example which illustrates of contract
this point is the sanction decision for clients, ✧ an independent view of the project risks
where estimates of cost and time will be which can help to justify decisions and
produced in the form of ranges and associated enable more efficient and effective
probabilities rather than single value figures. management of the risks
✧ a knowledge of the risks in a project which
Risk Management
allows assessment of contingencies that
This stage of the process involves the actually reflect the risks and which also
formulation of management responses to the tends to discourage the acceptance of
main risks. Risk Management may start during financially unsound projects
the qualitative analysis phase as the need to
4
Project Risk Analysis & Management
✧ a contribution to the build-up of statistical Resources
information of historical risks that will
The minimum resource requirement is
assist in better modelling of future projects
obviously just one person within a organisation
✧ facilitation of greater, but more rational, with experience of using Project Risk Analysis
risk taking, thus increasing the benefits that and Management techniques. However, if
can be gained from risk taking expertise does not exist within the organisation it
✧ assistance in the distinction between good can be readily acquired from outside consultants.
luck and good management and bad luck It is likely that once Project Risk Analysis and
and bad management. Management has been introduced to an
Who benefits from its use? organisation, in-house expertise will develop
✧ an organisation and its senior management rapidly.
for whom a knowledge of the risks As stated in Section 3, Project Risk Analysis
attached to proposed projects is important and Management is relevant to all projects and is
when considering the sanction of capital an integral part of project management. This can
expenditure and capital budgets make it very difficult to separate the costs of
✧ clients, both internal and external, as they performing it. Some organisations treat these
are more likely to get what they want, costs as an overhead to the organisation, and not
when they want it and for a cost they can to the project.
afford
✧ project managers who want to improve the 5. When Should It Be Used and Who
quality of their work i.e. they want to bring Should Do It?
their projects in to cost, on time and to the Project Risk Analysis and Management is a
required performance. continuous process that can be started at almost
What are the costs of using it? any stage in the life-cycle of a project and can be
The costs of using Project Risk Analysis and continued until the costs of using it are greater
Management techniques vary according to the than the potential benefits to be gained. As time
scope of the work and the commitment to the progresses, the effectiveness of using Project Risk
process. Below are some example costs, time- Analysis and Management tends to diminish,
scales and resource requirements for carrying out therefore it is most beneficial to use it in the
the process. earlier stages of project.
5
Project Risk Analysis & Management
✧ Post Tender - The client can make use of it to ✧ projects with sensitive issues
ensure that all risks have been identified by (environment/ relocation)
the contractor and to assess the likelihood ✧ projects with stringent requirements
of tendered programmes being achieved. (regulatory/safety)
✧ At Intervals During Implementation - It can ✧ projects with important
help to improve the likelihood of political/economic/ financial parameters.
completing the project to cost and time-
When should it be done?
scale if all risks are identified and are
correctly managed as they occur. There are a few circumstances when it is
particularly advisable to use Project Risk Analysis
Which projects are suitable?
and Management techniques, these are:
Many experienced users of Project Risk
✧ when there are specific targets that must be
Analysis and Management would say 'any and
met
all' in answer to this question, and experience
does show that this is the case - the reasons were ✧ when there is an unexpected new
stated earlier in the Guide. All projects contain development in a project
risk and risk analysis and management is an ✧ at points of change in the life-cycle of a
integral part of project or business management. project.
6
Project Risk Analysis & Management
process. Some of the techniques and methods that proposed response to an initial risk and might
can be employed are detailed below. therefore lead to the response being unsuccessful.
The necessity of doing this will largely be
Qualitative Risk Analysis
dependent on the size and/or complexity of the
The first phase of the qualitative analysis is project.
identification. This is considered by some as the
most important element of the process since once Quantitative Risk Analysis
a risk has been identified it is possible to do Once all risks have been identified, during
something about it. Identification can be achieved the qualitative analysis, it may be appropriate to
by: enter into a detailed quantitative analysis. This
✧ interviewing key members of the project will enable the impacts of the risks to be
team quantified against the three basic project success
criteria: cost, time and performance. Several
✧ organising brainstorming meetings with all
techniques have been developed for analysing the
interested parties
effect of risks on the final cost and time-scale of
✧ by using the personal experience of the risk projects. However, such techniques do not always
analyst readily apply themselves to the analysis of
✧ reviewing past corporate experience if performance objectives.
appraisal records are kept.
The main techniques currently in use are:
All of the above methods are greatly
enhanced by the use of check lists which can ✧ Sensitivity Analysis, often considered to
either be generic in nature i.e. applicable to any be the simplest form of risk analysis.
project or specific to the type of project being Essentially, it simply determines the effect
analysed. on the whole project of changing one of its
risk variables such as delays in design or
Once identified, the risks are then subjected the cost of materials. Its importance is that
to an initial assessment that categorises the risks it often highlights how the effect of a single
into high/low probability of occurrence and change in one risk variable can produce a
major/ minor impact on the project should the marked difference in the project outcome.
risk materialise. It is often advisable to prepare
In practice, a sensitivity analysis will be
initial responses to each identified risk, especially
performed for more than one risk, perhaps all
if risks are identified that require urgent
identified risks, in order to establish those which
attention. The analysis may be terminated during
have a potentially high impact on the cost or
this phase if the assessment immediately suggests
time-scale of the project. The technique can also
a way in which many identified risks can be
be used to address the impact of risk on the
mitigated.
economic return of a project. Figure 1 shows an
It may be necessary to revisit the example of a sensitivity diagram.
identification phase after the assessment phase to
see if any consequential 'secondary' risks can be
identified: a secondary risk may result from a
7
Project Risk Analysis & Management
S e n s itivity D ia g ram fo r a m a n u fa ctu rin g P la n t
150
100
% C hange in IRR
50
-50
-100
-40% -20% 0% 20% 40%
% C hange in V ariables
D e m a n d fo r p ro d u ct C o s t o f R a w Ma te ria ls
R e ve n u e fro m P ro d u ct E n e rg y C o s ts
This diagram shows that the project is very often described by using three estimates:
sensitive, as measured against the internal rate of minimum or optimistic, mean or most likely and
return, to any changes in both the demand for the maximum or pessimistic. The overall outcome for
product and the revenue from the product, however, the project is derived by the combination of
changes in energy costs or the cost of raw material values selected for each one of the risks. The
have much less impact. calculation is repeated a number of times,
perhaps between 100 and 1000, to obtain the
probability distribution of the project outcome.
✧ Probabilistic Analysis specifies a It is usual to carry out a probabilistic time
probability distribution for each risk and analysis with the aid of a CPM network to model
then considers the effect of risks in the project schedule. The same method can be
combination. This is perhaps the most used for probabilistic cost analysis especially
common method of performing a when the cost estimate can be broken down into
quantitative risk analysis and is the one the same categories or activities as the schedule
most people consider, incorrectly, to be and when cost risks are related to time risks. If an
synonymous with the whole Project Risk independent cost analysis is undertaken then
Analysis and Management process. In fact,
as this Guide illustrates, it is but one facet It may be appropriate to use a spreadsheet
of that process. method. Figure 2 shows an example of a
histogram and cumulative curve derived from a
The most common form of probabilistic probabilistic time analysis using a model based
analysis uses 'sampling techniques', usually on a CPM network.
referred to as 'Monte Carlo Simulation'. This
method relies on the random calculation of values
that fall within a specified probability distribution
8
Project Risk Analysis & Management
An Oilfield Development
Early Finish Histogram for Activity G44 (First Oil)
6 120
5 100
Based on 1000 trials
Mean = 29 Jun 90
Standard deviation = 25 days
4 Each bar represents 3 days 80
%Cumulative
%Frequency
3 60
2 40
1 20
0 0
31 Mar 90 30 Apr 90 30 May 90 29 Jun 90 29 Jul 90 28 Aug 90
Period Ending
Figure 2 Time Probability Histogram and S-curve for a New Oil Field Development
This diagram shows the distribution of finish Another technique is the Controlled Interval
dates for the achievement of first oil. It is based on and Memory Method for combining probability
1000 iterations using Monte Carlo Sampling. The distributions which provides an alternative to
actual finish date of this particular project was Monte Carlo Simulation. This technique can offer
achieved within 2 days of the mean. greater precision for much less computerised
effort if either complex CPM networks or
'feedback loops' are not involved.
120%
100%
Probability of Completing within a Cost
80%
60%
54% - expected cost £17.4m
40%
41% - unadjusted cost £16.1m
0%
Unallocated Provision
£ Million
Accuracy Range
+ve -ve
This diagram shows the distribution around a the expected cost is considered to be an unallocated
cost estimate for the final, out-turn cost for a new provision.
building. It is based on 1000 iterations using Monte
Carlo Sampling. The highlighted figures represent the
unadjusted cost i.e. the sum of all the cost elements
without any risk treatment, the expected cost derived
from the statistical mean and a suggested accuracy
range. The difference between the unadjusted cost and
9
Project Risk Analysis & Management
✧ Influence Diagrams are a relatively new ✧ remove - risks that can be eliminated from
technique for risk analysis. They provide a the project and therefore no longer propose
powerful means of constructing models of a threat
the issues in a project which are subject to ✧ reduce - risks that can be decreased by
risk. As a result influence diagrams are taking certain actions immediately
now used as the user interface to a ✧ avoid - risks that can be mitigated by taking
computer based risk modelling tool thus contingency actions should they occur
allowing the development of very complex
✧ transfer - risks can be passed on to other
risk models that can be used to analyse the
parties, unfortunately this does not
cost, time and economic parameters of
normally eliminate the risk it just makes
projects.
someone else worry about it
✧ Decision Trees are another graphical
✧ acceptance - the benefits that can be gained
method of structuring models. They bring
from taking the risk should be balanced
together the information needed to make
against the penalties.
project decisions and show the present
possible courses of action and all future The risk management phase begins
possible outcomes. Each outcome must be immediately the qualitative analysis is complete
given a probability value indicating its and is then a continuing process through the
likelihood of occurrence. This form of risk complete life-cycle of the project. The information
analysis is often used in the cost risk gained during the quantitative analysis allows the
analysis of projects. project manager to trade off taking actions now
against the likelihood and impact of risk
Risk Management
occurring. The project manager may choose to
Risk management uses the information immediately amend his overall time and cost plan
collected during the risk analysis phase to make in order to increase the probability of achieving
decisions on how to improve the probability of his time and cost objectives.
the project achieving its cost, time and
performance objectives. This is done by reducing 7. What Experience Is Available?
the risk where advantageous to do so and
The majority of the methods, techniques and
monitoring and managing the risk which
processes described in this Guide have been used
remains.
in a number of industries since the early 1970s.
The project manager uses the information Project Risk Analysis and Management has
at his disposal to choose between the feasible historically been associated with very large, high
responses to each risk identified during the capital projects in specific industries such as
qualitative phase. This may involve amending the defence, oil and gas, aerospace and civil
project plans to reduce the risk e.g. moving high engineering. The experience gained in these
risk activities off the critical path, developing industries since the 70s has now begun to
contingency plans to allow rapid response if disseminate through other industries such as
certain risks occur or setting up monitoring information technology and manufacturing.
procedures for critical areas in order to get early
The number of companies practising
warning of risks occurring.
Project Risk Analysis and Management is
There are two types of response to a risk continuing to increase due to the realisation that
immediate and contingency which can be defined the methods, techniques and processes involved
as follows: form an integral part of project and business
✧ immediate response: an alteration to the management. The increase in its use has led not
project plan such that the identified risk is only to expertise being gained by individuals
mitigated or eliminated within companies but the arrival of specialist
consultancies that can train, advise and carry out
✧ contingency response: a provision in the
Project Risk Analysis and Management for their
project plan for a course of action that will
clients. Project Risk Analysis and Management
only be implemented should the adverse
has also established itself as an important element
consequences of the identified risk
in the syllabuses of many universities and higher
materialise.
educational establishments.
Responses to risks can do one or a
combination of five things:
10
Project Risk Analysis & Management
! The Secretary
Further information regarding computer The Association of Project Managers
software available to assist in performing 85 Oxford Road, High Wycombe
quantitative risk analysis and references to Buckinghamshire HP11 2DX
further information, papers and publications can
be obtained from:
11
Project Risk Analysis & Management