Risk Management
description
Transcript of Risk Management
Risk Managem
ent Part 1 – Risk Identification,
Documentation and Classification
byDonald E. Shannon, PMP, CFCM, CPCM, DMLThe Contract Coach, Albuquerque, NM
DisclaimerInformation in this presentation makes reference to various software products. This should not be interpreted as a recommendation or endorsement by any of the sponsors of any one product. Individuals should conduct appropriate research to identify a product that best meets their specific needs. Where appropriate, credit has been given to the software OEM especially where screen shots of their products have been used. A listing of the products commonly used to accomplish the simulation and scheduling functions described herein is included at the end of this presentation
Series OverviewRoadmap to this series of four presentations
Welcome
This will be a 4-part series of presentations concerning risk management June 19 – 9am to 11am July 8 – 9am to 11am July 29 – 9am to noon August 12 – 9am to noon
While primarily focused on risk we will also touch on The Work Breakdown Structure Project Schedules Performance baselines Risk adjusted estimates of cost to complete and
cost at completion.
Where I’m Coming From
Managing projects/programs/contracts requires expertise in many areas
Typical approach is “stove piping” expertise into silos of knowledge Project Management – organizing, scheduling,
directing and monitoring performance Financial Management – accounting, project
control and cash flow Risk Management – identifying potential risks and
planning actions to avoid them or minimize the impact
Contract Management – compliance with laws and contract terms and conditions, reporting, and deliverable management
Where I’m Coming From
The silo approach permits the existence of multiple views of “reality”: where you stand depends on where you sit.
The preferred approach is via an integrated project team comprised of various specialists Each is expert in their own area (PM, Contracts,
Finance etc.) Each understands the overall process and how they fit
into the team Boundaries are blurred; barriers torn down. Improved communication, better decisions, and better
support for team decisions
Part 1:Risk Management Overview
Establishing a firm foundation ….
Types of Risk
• Risk is event related – no event, no consequences.
• Technical (Performance) Risk – the risk that the design or techniques selected will not work satisfactorily or cannot be sufficiently developed or employed to meet requirements.
• Cost Risk – The risk that the cost of successfully completing the project will exceed the budgeted (or allotted) cost.
• Schedule Risk – The risk that the time required to successfully complete the project will exceed the time allotted.
Interrelationship of Risk Factors
• Technical risk influences both project cost and project duration.
• Cost risk can influence technical risk e.g., a less desirable technology or material must be used to stay within budget
• Schedule risk is influenced by both cost and technical risks and can have significant impact on cost.
Managing Risk
Classic (Qualitative Assessment) approach from PMI Identify Document Characterize Prioritize Strategize Monitor & Control
Few travel beyond this point – but we will!
Project
Risks
Identify Risks
Team brainstorming session Focus on eliciting as
many risks as possible No attempt to judge or
narrow list at this point All ideas are good
Record on whiteboard or easel
Stop when no one else can contribute to list.
Filter Risks
Review brainstorming list and: Eliminate or combine
duplicates Revise or restate
questionable risks to make them more definite and actionable
Split complex risks into smaller, more manageable items
Obtain group consensus as to final form of risk
Start Risk Register
# Risk +/- Prob.
Impact
Score
1 Customer requirements may change
1a Customer asserts requirement change does not constitute a “change” and will not pay for “additional work”
1b Requirement change is covered by changes clause and results in a change order
2 Inability to obtain project financing
3 Loss of key staff during project
4 Bad weather closes office
5 Flu epidemic impacts workforce availability
6 Inability to manufacture critical optical assembly chassis to specifications
The Three Dimensions of Risk
Polarity Is risk a positive (opportunity) or a negative (determent) to the
program
Likelihood What is the probability that the risk event will actually occur? Can be stated adjectively (very low, low, medium, high, very likely)
(Qualitative Analysis) Can be stated as a number or probability (Quantitative Analysis)
Impacts If this event happens what will be the consequence
Schedule Delay Cost Injury or death Project failure
Ranked as very minor, minor, medium, serious, very serious (Qualitative Analysis)
Dollar cost and actual number of days/weeks delayed (Quantitative Analysis)
Perform Qualitative Risk AnalysisDefine Risk Polarity
# Risk +/- Prob.
Impact
Score
1 Customer requirements may change
1a Customer asserts requirement change does not constitute a “change” and will not pay for “additional work”
-
1b Requirement change is covered by changes clause and results in a change order
+
2 Inability to obtain project financing -
3 Loss of key staff during project -
4 Bad weather closes office -
5 Flu epidemic impacts workforce availability
-
6 Inability to manufacture critical optical assembly chassis to specifications
-
Perform Qualitative Risk Analysis
Assess each risk for Likelihood of occurring
Use 1 to 5 scale 1 = unlikely to
occur 5 = very likely to
occur Impact of occurrence
1 = low impact 5 = very serious
impact
Perform Qualitative Risk AnalysisRecord Probability and Impact Values
# Risk +/- Prob.
Impact
Score
1 Customer requirements may change
1a Customer asserts requirement change does not constitute a “change” and will not pay for “additional work”
- 4 4
1b Requirement change is covered by changes clause and results in a change order
+ 4 3
2 Inability to obtain project financing - 1 5
3 Loss of key staff during project - 2 4
4 Bad weather closes office - 3 3
5 Flu epidemic impacts workforce availability
- 3 3
6 Inability to manufacture critical optical assembly chassis to specifications
- 3 5
Perform Qualitative Risk AnalysisCalculate Score (Probability x Impact)
# Risk +/- Prob.
Impact
Score
1 Customer requirements may change
1a Customer asserts requirement change does not constitute a “change” and will not pay for “additional work”
- 4 x
4 = 16
1b Requirement change is covered by changes clause and results in a change order
+ 4 3 12
2 Inability to obtain project financing - 1 5 5
3 Loss of key staff during project - 2 4 8
4 Bad weather closes office - 3 3 9
5 Flu epidemic impacts workforce availability
- 3 3 9
6 Inability to manufacture critical optical assembly chassis to specifications
- 3 5 15
Perform Qualitative Risk Analysis
Calculate Risk Score Score = Probability x
Impact Record result in Risk
Register Plot results on Risk
Matrix (optional)
Perform Qualitative Risk AnalysisSort Scores High to Low
# Risk +/- Prob.
Impact
Score
1a Customer asserts requirement change does not constitute a “change” and will not pay for “additional work”
- 4 4 16
6 Inability to manufacture critical optical assembly chassis to specifications
- 3 5 15
1b Requirement change is covered by changes clause and results in a change order
+ 4 3 12
4 Bad weather closes office - 3 3 9
5 Flu epidemic impacts workforce availability
- 3 3 9
3 Loss of key staff during project - 2 4 8
2 Inability to obtain project financing - 1 5 5
Identify Risk Strategy
Strategy will depend on organization’s risk tolerance Many organizations are
‘risk adverse’ and will want to control every risk
Other organizations are less adverse and will only seek to control significant risks
Everything has a cost Most benefit for least
cost
Risk Strategies
AvoidanceAcceptanceTransferenceMitigationExploit
Avoidance
If activity has risk that cannot be Accepted Transferred Mitigated
Risky activity / process is not performed
Substitute another low risk activity in its place if possible
Acceptance
Low impact / low likelihood risks might be acceptable
Cost or effort involved in planning strategy exceeds likely downside
May still have response plan
Transference
Transfer activity or risk to another (third) party Subcontractor
May be experts at the risky activity
Delta between make and buy is cost of mitigation
Insurance policy or bonds Allow surety to
absorb risk Cost is bounded by
premium costs Currency contract
Similar to insurance except protects against exchange rate fluctuations
Mitigation
Identify Risk Analyze risks to
determine likely cause Evaluate process or
procedures to isolate causation factor(s) Insufficient training Lack of inspection Material Quality
Modify process to eliminate cause or reduce likelihood of event
Repeat as necessary
Mitigation Example 1
Risk: Installation team would not be able to meet stringent schedule requirements
Risk: Robot kit as delivered to site could be incomplete
Risk: Install team spare parts kit lacking critical items.
Strategy Simulate shipping and
installation of three systems Accomplish installation and
testing under field conditions Redeploy systems as
production items following test
Estimated cost $200,000 Results: All 100 systems
deployed and accepted per schedule
Robotic Containerization System
Produced by ABB Inc. - 100 Systems (Phase 1)- Contract value $66M + add-ons = $84M- Installed at 65 US Locations- Install, test and accept in 2 weeks
Mitigation Example 2
Risk: Facility infeed conveyor system not ready to connect in time for acceptance testing Site-specific hardware
provided by 3rd party under a separate contract
Multiple controls typologies necessitated custom integration
Strategy: Obtain portable infeed capable of supporting test. Ship to site as needed Remove following acceptance
and redeploy as needed Strategy: Develop and
promulgate 3rd party universal interface standard.
Exploit
Maximize an opportunity to your advantage
New business opportunity Add value to existing
contract Follow-on opportunity
Must analyze upside potential vs. additional risk Don’t put too much on
your plate May compromise
performance on existing project
Exploit Example
Risk: Facility infeed conveyor system not ready to connect in time for acceptance testing
Strategy: Offer temporary infeed as permanent solution Easily integrated into existing
facility conveyor without additional programming
Standardized Modular product Installation and integration
accomplished simultaneously with robot
Result: Up-sales to facility, increased revenue, improved presence in automation market.
Response Planning
• Not an actual “strategy” Adjunct to mitigation
• Trigger event detection What event or situation
will initiate plan Who has decision
authority• “What do we do if?”
Preplanned response may reduce impact
May include materials or equipment
Response Example
Risk: Facility closed due to inclement weather
Strategy: Enable telecommuting for project team Replace desktop computers
with laptops and docking stations at next replacement cycle
Enable secure log-in from off site using VPN
Enable video conferencing via FaceTime or Skype
Enable call forwarding from desk phone to company cell phones as required.
Document and Implement Your Strategy
Document Update risk register Produce, edit, and
publish formal response plans
Implement Obtain official review
and approval Obtain or authorize
program funds Promulgate guidance
to the team via program directives
Update the Risk Register(Excel Example)
Update the Risk Register(Risk Software Example)
Quantitative Assessment
Using mathematic or statistical techniques to: Quantify the likelihood of
risk events (Probability) Quantify the impact of risk
events Expected Value $$$ Schedule delay
Perform sensitivity analysis Risk impact(s) on entire
project Risks considered apart
from other risks for their unique contribution to overall risk
Image from Careercast.com
Assign Values to Risks
Historical Data Preferred method Extract impact data
from historical data Cost Schedule delay Litigation Injury
Identify frequency of occurrence (i.e., probability)
Identify trigger events or precursors
Separating Wheat from the Chaff
Historical data often combines inputs from multiple sources The true cost / duration of the
work Cost of the various risk events
Separating these data is necessary to identify the true cost of the work and the impact of the risk
The cost of the work, if repetitive, can be easily approximated and subtracted to leave the risk cost behind.
If necessary some approximation may be done to segregate the two cost sources
Assign Values to Risks
Expert Opinion to identify likelihood and impact Acceptable method but
may be less precise than historical data
Must control optimism bias Use Delphi
technique if possible (next slide)
Obtain consensus Express estimate as
value plus/minus a range
Delphi Technique
Named for the Oracle of Delphi
Relies on a group of experts
Iteratively come to a consensus through following process Facilitator asks each
expert to estimate some parameter or value
Results are anonymized and then shared with the group for a second round of estimates
Process continues until some consensus is reached
Assign Values to Risks
Use pre-established values to translate words to values Least Preferred (also
least precise) Method Values based on
organization’s risk tolerance
May be subjective and skew results
Only use if no other data available
Determine Cost of Mitigation Strategy
Gross cost of mitigation strategy estimated using normal procedures Labor Hours Material Costs Other direct costs
May still have some residual risk If less than cost of
additional mitigation efforts the best strategy may be to accept
Compare Mitigation Cost to Risk Impacts
Estimate the cost for each risk First determine the full value of labor
and material associated with the risk
Then calculate the weighted value = full value x probability of risk…. This is the likely impact to the program.
Compute weighted cost of risk if mitigated (reduced likelihood, reduced impact, or both) … this is the likely cost to the program post mitigation
Compare net reduction to cost of mitigation effort Is cost reduction more than the
estimated cost of the mitigation effort?
Is there a social or other reason for mitigating beyond this point?
Conduct Sensitivity Analysis
Identifies cost factors that will pay biggest rewards for controlling
Recompute cost model Vary each factor through its
possible range Monitor the total value for
change Note which factor(s) induce
the largest change in the total cost
Display results in ‘tornado’ diagram Rank order results with
largest contributor at top
Sensitivity Analysis of Cost Risk Factors – Tornado Diagram
Document and Implement Your Revised Strategy
Document Update risk register Produce, edit, and
publish formal response plans
Implement Obtain official review
and approval Obtain or authorize
program funds Promulgate guidance
to the team via program directives
Periodically Review and Update
Schedule periodic reviews of risks and strategies Recommend monthly for
initial reviews Quarterly once program is
established During review look for
New or emerging risks Risks that have passed
and may be dropped Currency of plans or
strategies Update risk register and
plans as required.
Summary
Risk effects both cost and schedule Increased performance
time uses more labor and increases the lease period for rented equipment
Risk events can have associated costs (material, equipment, etc.)
Delays may incur liquidated damages
Cost overruns damaging to the company
Risks can be managed using appropriate strategies
Produced by: The Contract Coach
The Contract Coach5338 La Colonia Dr NWAlbuquerque, NM 87120(505) 259-8485http://www.contract-coach.com
Monte Carlo Simulation Software
MS Excel Add-in @Risk Oracle Crystal Ball Risk Solver
General Purpose Products Analytica GoldSim Reno Oracle Crystal Ball SPSS
MS Project Add-in Full Monty Risky Project (also
supports Primavera P6) Enterprise Systems
Risk+ (Deltek) Primavera EPPM &
Primavera Risk (Oracle)