Chapter 7

MANAGING RISK

Chapter Outline

*Every Project Manager must understand that risks are inherent in all projects.
No amount of planning can overcome risk. Risk is an uncertain event or condition
that, if it occurs, has a positive or negative effect on project objectives. It has a
cause and, if it occurs, a consequence.

Risk management attempts to recognize and manage potential and unforeseen

trouble spots that may occur when the project is implemented. Risk management
identifies as many risk events as possible (what can go wrong), minimizes their
impact (what can be done about the event before the project begins), manages
responses to those events that do materialize (contingency plans), and provides
contingency funds to cover risk events that actually materialize.

1. Risk management process

Risk management is a proactive approach rather than reactive. It is a preventative
process designed to ensure that surprises are reduced and that negative
consequences associated with undesirable events are minimized. It also prepares
the project manager to take a risk when a time, cost, and/or technical advantage is
possible. Note though that the cost impact of a risk event in the project is less if
the event occurs earlier rather than later.

2. Risk Identification
The risk management process begins by trying to generate a list of all possible
risks that could affect the project. Typically, the project manager, during the
planning phase, will pull together a risk management team consisting of team
members and other relevant stakeholders. The team will use brainstorming and
other problem identifying techniques to identify potential problems. Participants
are encouraged to keep an open mind and generate as many probable risks as
possible.

Many organizations use the Risk Breakdown Structure (RBS), to help the
management team identify and eventually analyze risks.

7-1
 A Risk Profile is another useful tool. A risk profile is a list of questions that
address traditional areas of uncertainty on a project. These questions are usually
developed and refined from previous, similar projects.

Although the RBS and Risk Profiles are useful tools, the risk identification
process should not be limited to just the core team. Input from customers,
sponsors, subcontractors, vendors, and other stakeholders should be solicited. Not
only do these players have a valuable perspective, but by involving them in the
risk management process they also become more committed to the projects
success.

3. Risk Assessment
Note: not all risks listed deserve attention. Some are trivial and can be ignored,
while others pose serious threats to the welfare of the project. Project managers
will have to develop methods for sifting through the list of risks and determining
which ones warrant the need for attention.

A. Scenario Analysis / Probability Analysis: is the easiest and most commonly

used technique for analyzing risks. Here, team members assess the
significance of each risk event in terms of:
1. Probability of the event.
2. Impact of the event.
Simply stated, risks need to be evaluated in terms of the likelihood the event is
going to occur and the impact or consequences of its occurrence.

Because impact ultimately needs to be assessed in terms of project priorities,

Impact Scales may be introduced. These are typically used in rank-order
descriptors, such as: low = 1, moderate = 2, high = 3, and very
high = 4. .

When Impact scales are used with a Risk Assessment Form, a project
manager can detect which risk event is more than likely going to occur and
possibly begin taking mitigating actions early.

4. Risk Response Development

When a risk event is identified and assessed, a decision must be made concerning
which response is appropriate for the specific event. Responses to risk can be
classified as mitigating, avoiding, transferring, sharing, and retaining.

A. Mitigating risk
There are two basic strategies for mitigating risk: (1) reduce the likelihood
that the event will occur, and (2) reduce the impact that the adverse event
would have on the project.
Ex. If rain can delay a project, can parts of the project be brought indoors
under a more climate controlled setting in order to mitigate the risk?

7-2
 B. Avoiding
Risk avoidance is changing the project plan to eliminate the risk or condition.
Although impossible to eliminate all risk events, some specific risks may be
avoided before you launch the project.
Ex. If political unrest may delay the delivery of a key component of your
project, maybe changing your source might help avoid the possible delay.

C. Transferring risk
Passing risk to another party is common, however, it almost always results in
paying a premium for the exemption.
Ex. Insurance is a good way to transfer risk; so is Performance bonds,
warranties, guarantees, etc.

D. Sharing risk
Risk sharing allocates proportions of risk to different parties.
Ex. The entertainment industry formed an agreement to define a common
format for (DVD) Digital Video Disc, in order to ensure compatibility across
products.

E. Retaining risk
Some risks are so large that it is not feasible to consider transferring or
reducing the event, such as earthquake of flood. The project owner will
assume the risk because the chance of such an event occurring during the life
of the project is slim. So the risk is retained by developing a contingency plan
to implement if the risk materializes.

5. Contingency Planning
A contingency plan is an alternative plan that will be used if a possible foreseen
risk event becomes a reality. The contingency plan represents actions that will
reduce or mitigate the negative impact of the risk event. Early contingency
planning facilitates a smooth transition to the remedy or work around plan. The
availability of a contingency plan can significantly increase the chances for the
projects success.

A. Technical risks
Technical risks are problematic and can often be the cause for shutting down a
project. As a contingency, the project manager should identify the high-risk
technical areas, then build models or design experiments to resolve the risk as
quickly as possible.

B. Schedule risks

7-3
 Reducing the project duration can be used as a contingency. This is done by
shortening or compressing one or more activities on the critical path. Here
contingency funds are set aside to expedite the project to get it back on track.

C. Cost risks
Projects of long duration need some contingency for price changes. The
important point to remember when reviewing price is to avoid the trap of
using one lump sum to cover price risks. Prices should be evaluated item by
item.

D. Funding risks
What if funding for the project is cut by 25 percent or completion projections
indicate that costs will greatly exceed the available funds? Project managers
must recognize that a complete risk assessment must include an evaluation of
funding supply. Ex. If a homeowner announces to the contractor that they
will not be able to continue the construction of their house because of loss of
employment, the contractor may have a contingency plan to finish the house
and then sell it on the open market in order to recover his losses.

6. Contingency Funding and Time Buffers

Contingency funds are established to cover project risks identified or unknown.
When, where, and how much money will be spent is not known until the risk
event occurs. Project owners are often reluctant to set-up a project contingency
fund that seem to imply that the project may be a bad one. Some perceive it to be
an add-on slush fund. Others say they will face the risk as it materializes. This
reluctance can be minimized with documented risk identification and planning for
when and how the funds will be disbursed.

A. Budget reserves: these reserves are identified for specific work packages or
segments of a project found in the baseline budget or work breakdown
structure.

B. Management reserves: these reserves are needed to cover major unforeseen

risks and are applied to the entire project.

C. Time buffers: just as contingency funds are used to absorb unplanned costs,
project managers use Time Buffers to cushion against potential delays in the
project. And like contingency funds, the amount of time is dependent upon
the inherent uncertainty of the project.

7. Risk Response Control

Project managers need to establish an environment in where the team players feel
comfortable raising concerns and admitting mistakes. The norm should be that
mistakes are acceptable, hiding mistakes are intolerable. Problems should be
embraced not denied.

7-4
8. Change Control Management
No project plan will materialize as expected. Coping with and controlling project
changes present a formidable challenge for most project managers. Changes can
come from many sources and fall into (3) main categories:
1) Scope changes in the form of design or additions.
2) When risk events occur; there will be an implementation of the
contingency plan.
3) Improvement changes.

Change control systems are designed to accomplish the following:

1) Identify proposed changes.
2) List expected effects of proposed changes on the schedule and budget.
3) Review, evaluate, and approve/disapprove changes.
4) Negotiate and resolve conflicts of change.
5) Communicate changes to affected parties.
6) Assign responsibility for implementing changes.
7) Adjust master schedule and budget.
8) Track all changes that are to be implemented.

9. Summary
* Risk management is used to identify and compensate for the uncertainty
inherent in all projects and that things never go according to plan. It reduces the
number of surprises and leads to a better understanding of the most likely
outcomes of negative events.

*Contingency plans provide a sense of insurance that if in fact a risk event does
occur, then there is a plan ready to go in order to mitigate the negative event.

7-5