Project Risk Management

A Proactive Approach

Paul S. Royer

• Publisher: Berrett-Koehler Publishers
• Year: 2001
• ISBN:
  9781567264586
• Edition: 1
• Topic: Business
• Subtopic: Project Management
• Index: Business

You don't need sophisticated statistical analysis or software to improve the probability of project success. This book offers a proactive project management process for managing project risk from project initiation through planning, execution, control and closure. In addition, you'll apply a new technique for program risk auditing that lets you explore risk in multiple related projects. You'll learn how to uncover hidden risk during the planning phase and how to track and manage it throughout the project. You'll also learn to enhance project value by building a risk management repository to support ongoing knowledge transfer.

CHAPTER 1

Risk Management As a Project Management Process

It must be remembered that there is nothing more difficult to plan, more doubtful of success, nor more dangerous to manage than the creation of a new system. For the initiator has the enmity of all who would profit by the preservation of the old institution and merely the lukewarm defense in those who would gain by the new ones.

—MACHIAVELLI

The art of project management consists of many processes. As defined by the Project Management Institute in the PMBOK^® Guide, there are five essential project management processes, as shown in Figure 1-1. For reference, we define these processes simply as follows:

• Initiating processes—Obtaining commitment to begin a project

• Planning processes—Establishing a plan to accomplish the business need that the project addresses

• Executing processes—Coordinating the people and other resources assigned to the project

• Controlling processes—Ensuring achievement of project goals through monitoring and measuring progress so that remedial action can take place in a timely fashion

• Closing processes—formalizing completion of the project by acceptance of final deliverables, leading to an orderly project end.

OVERVIEW OF RISK MANAGEMENT PROCESSES

Before discussing how to manage risk, we must agree on a definition for the term. In the context of project management, we define risk as:

The potential events or circumstances that threaten the planned execution of the project.

This definition puts a totally negative context around the word risk. Others, such as the Project Management Institute, include the positive opportunities (impacts) that risks may have on a project. However, in developing a proactive risk management philosophy, it is most important to concentrate on the negative aspects of risk.

FIGURE 1-1 PMBOK^® Guide Project Management Processes

Each project management process has a corresponding risk management process, as shown in Figure 1-2. To establish a common reference framework, we define the risk management process simply as follows:

• Initiation: Project opportunity assessment—Examining the high-level requirements of the project opportunity to define risks versus opportunities in order to make a decision to proceed or not to proceed with the endeavor

• Planning: Risk management planning—Identifying risks and developing mitigation strategies and contingency plans to minimize their impact

• Executing: Project risk audit—Auditing the effectiveness of project management processes

• Controlling: Continuing risk management—Monitoring identified project risks to trigger the implementation of risk mitigation strategies and contingency plans; identifying new risks

• Closure: Risk knowledge transfer—Capturing lessons learned in the mitigation of project risks for use in future projects.

PROJECT OPPORTUNITY ASSESSMENT

As defined earlier, the project opportunity assessment examines the high-level requirements of the project opportunity to define risks, as opposed to opportunities, in order to make a decision to proceed or not to proceed with the endeavor. While particularly important to consulting organizations and subcontractors, this process is finding more and more applicability within enterprises that conduct their own projects. No one’s resources are inexhaustible; therefore, it is critical to apply them to the “right” project. In addition to feasibility studies, return on investment analyses, and other strategies, the opportunity assessment provides additional insight to the decision-making process.

Process

The five steps in the opportunity assessment process are:

1. Assign opportunity assessor

2. Identify risks and opportunities

3. Evaluate risks and opportunities

4. Distribute opportunity assessment

5. Make go/no no decision.

FIGURE 1-2 Risk Management Processes

Risk Categories

The opportunity assessment process looks at nine assessment categories:

• Customer-associated

• Contract

• Project requirements

• Business practice expertise

• Project management

• Work estimates

• Project constraints

• Complexity and scale of deliverables

• Contractors.

Deliverable

The output from the opportunity assessment is a report that contains decision-making insight for management. A risk assessment of each category documents potential risks and assigns a risk rating on a simple low-medium-high scale. Likewise, the assessment documents potential opportunities (benefits) for each category.

RISK MANAGEMENT PLANNING

Following the decision to proceed with a project, detailed project planning begins. During this process, you must assess and mitigate potential risks to the project. Risk management planning is the process of identifying risks and developing mitigation strategies and contingency plans to minimize their impact. It involves all resources concerned in the enterprise (e.g., project manager, project team, stakeholders, technical support).

Project risks come in two types: identifiable risks and unmanaged assumptions:

• Identifiable risks—Risks identified during engagement contracting activities (i.e., project initiation) or during planning. For the most part, they are highly visible and immediately apparent to everyone (or at least someone) involved with the project.

• Unmanaged assumptions—Project assumptions that are not monitored to ensure continued validity. If an assumption fails to remain valid, it becomes a risk.

Process

Risk planning requires two sets of process steps after establishing a risk planning team: identifying risks and instituting assumption management.

These steps are:

1. Establish risk management planning team

2. Design identifiable risk planning

2.1. Identify risks

2.2. Categorize risks

2.3. Prioritize risks

2.4. Develop risk mitigation strategies

2.5. Establish risk contingency plans

3. Begin assumption monitoring planning

3.1. Identify assumptions

3.2. Verify assumption validity

3.3. Establish assumption monitoring metrics.

Risk Classification

To institute a consistent approach to risk management planning, we need a risk classification scheme. Numerous schemes are possi...