Download risk management workshop
-
Upload
bestoutcome -
Category
Business
-
view
147 -
download
1
description
Transcript of Download risk management workshop
Risk & Issue
Management
Workshop
Version 1.0
Prepared by: Iain Aitken
7th July 2009
Workshop objectives
To become familiar with:
• Risk & Issue Management best practices
• The Risk Management Approach, to be incorporated into the
Project Brief/Charter
• Applying Risk & Issue Management to projects
2 © Bestoutcome Limited 2009
Key learning
• The importance of Risk & Issue Management to projects
• The value of a standardised terminology and approach
• Key principles of Risk & Issue Management
3 © Bestoutcome Limited 2009
Scope
In scope
• Risk & Issue Management
Out of scope
• Project Management methods generally
• Systems Development methods generally
• Quality/Control Gates methods generally
4 © Bestoutcome Limited 2009
What do we mean by ‘risks’ & ‘issues’?
• Definitions:
Something which might happen which would
threaten the project’s achievement of its
objectives. A potential issue.RISK
Something which has happened which
threatens the project’s achievement of its
objectives. A risk which has materialised.ISSUE
5 © Bestoutcome Limited 2009
What do we mean by ‘risks’ & ‘issues’?
• Example:
I’m planning a day’s cycling in the New Forest…
I might get a puncture.
(I’ll carry a repair kit – or maybe I’ll just
chance it!)
RISK
I already have a puncture.
(I’ll need to repair it before I can set out.)ISSUE
6 © Bestoutcome Limited 2009
What do we mean by ‘risks’ & ‘issues’?
• Definitions:
• the inverse of a risk – missing an opportunity is like allowing a
risk to materialise
Something which might happen
which would improve the project’s
chances of success.OPPORTUNITY
7 © Bestoutcome Limited 2009
8 © Bestoutcome Limited 2009
Two types of risk/issue
• There are 2 ways in which a project is exposed to potential failure
1. Delivery Risk/Issues: risks/issues that might impact our ability to
deliver the project to scope, budget, schedule targets
2. Value Risk/Issues: risks/issues that might impact our ability to deliver
the promised organisational benefits/outcomes of the project
Why manage risks & issues?
• All projects involve a degree of risk. Most projects will be affected
by issues.
• Proactive management is essential to minimise the damage done
• Visibility is important – the risks/issues faced and the measures
taken to address them should be communicated to stakeholders
• The project manager should not carry the risk alone
• Key project decisions need to be informed regarding risks & issues
9 © Bestoutcome Limited 2009
Risk & Issue Management in context
• Risk & Issue management is a fundamental discipline of
project/programme/portfolio management – it should not be
addressed in isolation
• The ODPM Project Management Framework recognises risk & issue
management as essential to project success, e.g.
• IP3: Define Project Business Case
• PL4: Develop Risk/Issue Logs
• CS1: Manage Change and progress
10 © Bestoutcome Limited 2009
How do we manage risks & issues?
• Definitions:
The repository of all information
regarding risks & issues.
RISK & ISSUE
REGISTERS
The process (within risk & issue
management) of reviewing the
current status of risks (issues).
RISK / ISSUE
REVIEW
The discipline of proactively
addressing risks and issues, in
order to minimise damage to
the project.
RISK & ISSUE
MANAGEMENT
Sub-discipline of risk
management which addresses
the identification &
evaluation of risks.
RISK
ASSESSMENTACTION
PLANNING
11 © Bestoutcome Limited 2009
How do we prioritise risks & issues?
• Definitions:
The probability that a risk will occur –
usually expressed as ‘LIKELY’, ‘POSSIBLE’
or ‘REMOTE’LIKELIHOOD
A combination of severity and likelihood –
reflects the importance we will place on
itPRIORITY
The effect upon the project of an issue or
materialised risk. Could affect delivery to
time, budget or quality. Expressed as
‘CRITICAL’, ‘MAJOR’ or ‘MANAGEABLE’
SEVERITY RISK &
ISSUE
RISK
ONLY
RISK &
ISSUE
12 © Bestoutcome Limited 2009
Evaluating Risks – the priority grid
SEVERITY
CRITICAL
MAJOR
MANAGEABLE
LIKELIHOOD
LIKELYPOSSIBLEREMOTE
MEDIUMLOWLOW
HIGHMEDIUMLOW
HIGHHIGHMEDIUM
13 © Bestoutcome Limited 2009
Policy keynotes
• Approach to managing risks & issues to be documented in the
Project Brief/Charter
• Risk Assessment to be carried out during Project Planning phase
• High priority risks & issues to be communicated to stakeholders
and reported regularly
• Risk & Issue Registers to be maintained throughout
• Risks & Issues to be monitored throughout
14 © Bestoutcome Limited 2009
The Risk & Issue Management Process
Tasks
Establish
Approach
Identify
and Analyze
Action
Plans
Monitor
Review
Report
Improvement
Information
15 © Bestoutcome Limited 2009
The Risk & Issue Management Process
Tasks
Establish
Approach
Identify
and Analyze
Action
Plans
Monitor
Review
Report
Improvement
Information
16 © Bestoutcome Limited 2009
Project/Programme/Portfolio relationships
• Projects define Risk (& Issue) Management Approach
• Projects within programmes are likely to inherit standards from
programme level
• Standards for escalation of risks/issues to programme level should
be defined
• Reporting of risk/issue status to programme/portfolio management
or programme office should be defined
• ‘dashboard’ reports show top priority risks & issues
17 © Bestoutcome Limited 2009
The Risk & Issue Management Process
Tasks
Establish
Approach
Identify
and Analyze
Action
Plans
Monitor
Review
Report
Improvement
Information
18 © Bestoutcome Limited 2009
Risk Assessment
• Covers risk identification and evaluation
• Issues also need to be evaluated – but tend to identify themselves!
• An ongoing project activity – risks (& issues) can arise at any time
• Too many projects only carry out risk assessment at the beginning,
and fail to follow through with actions
19 © Bestoutcome Limited 2009
Risk Assessment
• Risks may be identified at any time during the life of a project
• Typically a major exercise in identifying and evaluating risks is carried out during Project Planning phase
• Similar exercises may be valuable later in the life cycle
• Risks could also be identified during project meetings or informal conversations
• Project Manager’s responsibility to ensure risks recorded and assessments conducted
20 © Bestoutcome Limited 2009
Risk Assessment workshops
• Facilitate workshops across the business
• Identifying risks & issues
• Evaluating severity & likelihood
• Assigning responsibilities
• Initiating action planning
• Various tools & supporting material available
• ODPM Project Management Framework
• PM3 tool (Risk/Issue Management tabs)
• Other risk assessments, e.g. IT security, testing
21 © Bestoutcome Limited 2009
When to carry out Risk Assessment?
• Must be carried out during Project Planning phase
• Further workshops may be held at key review points
(Quality/Control Gates)
• Usually more limited in scope
• Ensure these are included in plan
• All risks need to be evaluated (and the evaluation agreed) as they
arise
22 © Bestoutcome Limited 2009
The Risk & Issue Management Process
Tasks
Establish
Approach
Identify
and Analyze
Action
Plans
Monitor
Review
Report
Improvement
Information
23 © Bestoutcome Limited 2009
Managing Risks & Issues
• Ongoing identification and evaluation
• New risks & issues
• Re-evaluation of known risks/issues
• Developing action plans to address
• Monitoring actions taken
• Recording details and status in the register
• Reporting
• Periodic reviews
• Escalating to higher authority
• Closure
24 © Bestoutcome Limited 2009
Action planning – what can we do?
• Reduce the likelihood (risks)
• Reduce the severity (risks and issues)
• Transfer the risk (e.g. insurance)
• Refer or escalate to higher authority
• Accept (risks) – do nothing
• Countermeasures (preventive)
• Contingencies (recovery)
25 © Bestoutcome Limited 2009
Action planning – mitigating risk
SEVERITY
CRITICAL
MAJOR
MANAGEABLE
LIKELIHOOD
LIKELYPOSSIBLEREMOTE
RISK
RISK
RISK
26 © Bestoutcome Limited 2009
Planning and taking action
• Define and agree actions
– Allocate responsibility
– Assign due dates
– Is the risk worth the cost?
• Update project plans
– Cross-refer to Risk & Issue Registers
• Monitor
– Check that actions are taken
– How effective were the actions?
27 © Bestoutcome Limited 2009
Reviews
• Structured
– As part of Quality/Control Gate review
– Regular, scheduled sessions
– Extraordinary sessions at Project Manager’s discretion
• Ad hoc
– Typically held to address a limited subset of risks or issues
• Risks & issues sometimes reviewed separately
• Reviews policy & process guidance available
28 © Bestoutcome Limited 2009
Reviews
• Review sessions should
– Follow the Approach defined in the Project
Brief/Charter
– Work from the Risk & Issue Registers
• Check for anomalies (missing or inconsistent information)
• Look for outstanding actions
• Review prioritisation (has anything changed?)
• Agree closure, transfer or escalation
– Update the Registers
– Consider possible risks (maybe issues) not yet addressed
– Produce minutes as necessary
29 © Bestoutcome Limited 2009
Closure
• A risk is closed when:
– The likelihood has reduced to (near) zero
– It no longer affects the project
– It has materialised, and become an issue
– It is transferred to some other responsibilit,y e.g. programme management
• An issue is closed when:
– It has been resolved
– It is transferred to some other responsibility
30 © Bestoutcome Limited 2009
Reporting
• Project/Programme/Portfolio reporting standards
• Project reporting, e.g.
– PM3 Issues & Risks ‘traffic light’ delivery status indicators
– PM3 top 5 issues/risks in Dashboard
• Programme reporting, e.g.
– PM3 risks/issues promoted to programme level
31 © Bestoutcome Limited 2009
Other considerations
• Confidentiality
– Do some risks or issues need to be addressed in a confidential fashion?
(commercial issues, personal issues)
• Opportunities vs. risks
– An opportunity is the inverse of a risk
– Should we try to avoid missing an opportunity via risk management?
32 © Bestoutcome Limited 2009
The Risk & Issue Management Process
Tasks
Establish
Approach
Identify
and Analyze
Action
Plans
Monitor
Review
Report
Improvement
Information
33 © Bestoutcome Limited 2009
Using PM3 Risk & Issue Registers
• Advantages for project, programme & portfolio managers
• Standardised format
• ‘Top five’ risks & ‘Top five’ issues generated automatically
• Can be tailored/adapted if necessary
34 © Bestoutcome Limited 2009
The Risk & Issue Management Process
Tasks
Establish
Approach
Identify
and Analyze
Action
Plans
Monitor
Review
Report
Improvement
Information
35 © Bestoutcome Limited 2009
What happens at the end of the project?
• Formal closure
• Post Implementation Review (PIR)
• Then manage Value Risks/Issues of live/delivered project
• Residual risks?
• Outstanding issues?
• Should be transferred to …
36 © Bestoutcome Limited 2009
Capturing knowledge & lessons learned
• How successful were we at managing risks & issues?
• Statistics?
• Qualitative judgements?
• What have we learned?
• New types of risk to look out for?
• New countermeasure/contingency tactics?
• Improvements to the process?
• Have key project deliverables been stored on SharePoint?
37 © Bestoutcome Limited 2009
38 © Bestoutcome Limited 2009
www.bestoutcome.com