Reducing Project Risk

Ralph L. Kliem, Irwin S. Ludin

• Publisher: Routledge
• Year: 2019
• Print ISBN: 9781138256118
• eBook ISBN: 9781351905985
• Topic: Business
• Subtopic: Business General
• Index: Business

What are my chances of completing this project successfully? What could prevent me? How can I anticipate potential threats? These are the kinds of questions you are likely to ask yourself when you become responsible for an important project. And these are the kinds of question Reducing Project Risk will help you answer. Drawing on examples from a variety of business activities as well as on their own extensive experience, the authors propose a systematic approach to dealing with risk. They provide both a conceptual framework and the practical techniques for identifying, analysing and controlling risks of any type. Among other things you will learn: ¢ how to carry out an objective review of the factors involved ¢ how to recognize the warning signs so that you can head off trouble before it strikes ¢ how to take care of the 'people side' of project management. Here is a book that will be welcomed not just by professional project managers but by anyone using human and material resources to accomplish a complex task.

Part I
Introduction to Risk Management

1 An Overview

---

A good understanding of risk and what it entails should be our first priority before we examine the subject in more detail.

About risk

Risk is the occurrence of an event that has consequences for, or impacts on, projects. An outcome might be poor timing of product delivery because the market window of opportunity had already closed. Differences in cultures are represented by wealth, health, leisure time, and survival. Affluent nations are considered more sophisticated than poor under-developed nations. The risk of succumbing to disease due to lack of proper medical attention is higher in Amazonia than it is in London. Moral risks may involve fidelity issues with loose morals resulting in divorce for couples who appear to be happily married. Political risks include stepping outside restricted boundaries: an outcome could be not being endorsed by the party you think is supporting you. Not being accepted by your peers for whom you are is a social risk with loneliness being an outcome. In terrifying situations many people ask the question, ‘Why is this happening to me?’ More specifically, in companies and organizations, ill-defined schedules represent an economic risk that can occur on a project (see Figure 1.1 for a summary of generic risks).

Fig 1.1 A summary of generic risks

There are many ways to categorize risks.

● Acceptable vs. non-acceptable risks

● Short-term vs. long-term risks

● Positive vs. negative risks

● Manageable vs. non-manageable risks

● Internal vs. external risks

Acceptable vs. non-acceptable risks

Acceptable risks are tolerable if they occur and will not stop the project. For example, something occurs that impacts on tasks not on the critical path. Non-acceptable risks are ‘show stoppers’ such as something happening that slows or stops tasks on the critical path.

Short-term vs. long-term risks

Short-term risks are risks having an immediate impact and their effect may be decisive. For example, a project participant departs before completing a non-critical task. Long-term risks are risks occurring in the distant future. They, too, may have a decisive impact; for example, the departure of an indispensable employee who has not completed his or her tasks.

Positive vs. negative risks

A risk may help or hinder a project. A positive risk, for example, is where a schedule for a non-critical activity slips in such a way that it actually benefits the completion of a critical activity; the project manager shifts resources to the critical activity without it affecting deliverables.

Manageable vs. non-manageable risks

Project managers may or may not handle a risk, either by design or by some external force. An example of a non-manageable risk is senior management arbitrarily reducing funds for a project.

Internal vs. external risks

Internal risks are unique to a project and not caused by something outside the project boundaries. An example is a task completion date slipping because the person responsible for its completion lacks the necessary skills. External risks are risks over which the project has no control. An example is senior management deciding to scale back the product to build.

Elements of risk

Regardless of how risks are categorized, project managers have five key elements to consider.

1. The probability of the occurrence of a risk. Is the probability low, medium, or high? What are the ‘odds’, or probability, of its occurrence, being anywhere from 0 to 100 per cent? For example, does the probability of poor scheduling occurring have a 60 per cent chance of happening? Or is the figure 75 per cent? And so on.

2. The frequency of occurrence of a risk. How often might the event occur? For example, how many times might a project incur slippage of an important milestone?

3. The impact of an occurrence of a risk. What consequence will it have? For example, will poor scheduling greatly hinder achieving a goal or will it have a minor impact? In other words, will it be a ‘show stopper’? (See Figure 1.2 for potential areas impacted by common risks.)

Fig 1.2 Potential areas impacted by common risks

4. The importance relative to other risks. For example, are inadequate schedules more important than poor accountability for task completion? Not all risks are equal; some have greater importance than others to a project’s outcome. For example, a risk may have a high probability of occurrence and a low impact. The inverse can occur where a risk may have a low probability of occurrence and a high impact.

5. The exposure, or vulnerability, which is the impact of a risk on a product, system, or project. A risk can have different levels of exposures as well as varying probabilities of occurrence based on given circumstances. Therefore, exposure is simply the level of impact times the probability of occurrence.

To demonstrate how these five key elements relate, the following milestone shows slippage on the critical path of a delivery schedule.

1st element is probability of slippage	40 per cent (or 0.40)
2nd element is frequency of slippage	1 time
3rd element is impact of slippage	5 (where 1 is low and 5 is high impact)
4th element is importance relative to other risks	4 (where 1 is low and 5 is high degree of importance)
5th element is vulnerability or exposure (i.e., impact × probability of occurrence)	2 (5 × 0.40 = 2) [where maximum exposure is 5 × 100 per cent = 5; minimum is 1 × 0.40 = 0.10]

This milestone describes slippage in a delivery schedule for a security software application to a third party distributor by a specific date; additional ‘spin-off’ products will result from this package. An analysis indicates that the chance of slippage is 40 per cent and with a single occurrence. However, the impact is very high because the spin-offs in the queue would also slip. The relative importance of the security software versus other products is high due to the usefulness, interest, and practicality of the topic. The vulnerability, however, is that similar products could also enter and saturate the market-place. Thus, the software development firm must decide what risk management action to take.

Risk management steps

Probability, frequency, impact, importance, and exposure are the necessary factors in analysing the four vital steps in risk management. These steps are: risk identification; risk analysis; risk control; and risk reporting.

Risk identification

Considerable effort occurs in identifying and ranking the processes, or components, of a project, its major goals, and its risks.

This identification step is closely allied with the next step, risk analysis. To be effective, risk identification requires considerable up-front planning and research. Project managers need to determine the analysis technique to use; select the primary participants who are to perform the risk identification; allow participants time to perform it; and decide where to conduct it. For research, they must review project plans, interview people, calculate statistics and metrics; and peruse technical documentation.

Risk analysis

Project managers convert data collected during the risk identification step into information using a selected technique. Two categories of risk analysis exist: quantitative and qualitative. Quantitative techniques rely heavily on statistical approaches, such as the Monte Carlo simulation. Qualitative techniques rely more on judgement than on statistical calculations, such as heuristics.

Risk control

Project managers identify the measures, or controls to establish, to lessen or avoid the impact of a ris...

Table of contents

• Cover
• Half Title
• Title Page
• Copyright Page
• Dedication
• Table of Contents
• Lsit of Figures
• Preface
• Part I Introduction to Risk Management
• Part II The Risk Management Process
• Part III Risk Management in Action
• Part IV The Future of Risk Management
• Appendices
• Glossary
• Recommended reading
• Notes
• Index