The Rules of Project Risk Management

Implementation Guidelines for Major Projects

Robert Chapman

• Editore: Routledge
• Anno: 2019
• ISBN:
  9781000650501
• Edizione: 2
• Argomento: Business
• Categoria: Assicurazioni

The Rules of Project Risk Management, 2nd Edition, provides practical experience-based guidance to support the delivery of effective project risk management. While the discipline is recognised as a major contributor to the successful outcome of projects, its implementation is far from straightforward. Successful delivery requires an in-depth understanding of the "ingredients" of effective risk management practices which impact project performance. The book's value is derived from the description of these ingredients in a manner which will support their practical implementation.

The author describes a series of guidelines (labelled "rules") to support the practical application of project risk management to positively influence project outcomes. The rules are supported by mini case studies of both successful and unsuccessful projects to bring to life the ramifications of effective and poor risk management respectively, and are assembled under seven headings of environment, external stakeholders, organisation and culture, leadership and governance, internal stakeholders, risk resources and system. This second edition contains a new glossary of terms and an overview of the risk management process to enable those new to the subject to understand the core risk management activities. It also contains six more individual guidelines and ten more case studies to support practitioners, researchers and academics alike to gain an even greater appreciation of the drivers of successful project risk management.

Enabling the reader to "get inside" risk management to gain an appreciation of the individual components and "how the engine works", this book is essential reading for project and risk management professionals. While the guidelines are described individually so specific subjects can be examined in detail, they must be considered together, for like a car, specialist carburettors, fuel injection or high-octane fuel on their own do not support improved performance. The guidelines can be considered as the elements that should be taken into account when compiling a risk maturity model to drive incremental improvement in risk management practices.

1

Layout of the book

The book is subdivided into nine sections followed by a number of appendices.

Section 1 describes the layout of the book as a navigational aid.

Section 2 describes an overview of the risk management process to provide those new to the subject with an outline description of the steps involved in its implementation. It is a foundation stone upon which a broader understanding of risk management can be developed.

Sections 3 to 9 describe seven categories of project risk management (PRM) critical to its successful implementation. They are derived from maturity models developed for organisations across multiple industries. The seven categories are illustrated in the cause and effect diagram below. For each category a number of “rules” or PRM guidelines are included. While the “rules” included do not represent an exhaustive list they provide the backbone of effective PRM.

Sections 3 to 9

Section 3, Environment: environment is the term used to describe an organisation’s complete context, not just its natural environment. An environment is characterised by cultural, political, legal, regulatory, financial, technological, economic, developmental, environmental and social aspects. Projects will be exposed to the same aspects of the environment as the organisations which undertake them. The way an organisation undertakes its projects and deals with the uncertainty emanating from the environment will directly affect the health of the organisation in terms of profitability, reputation, stakeholder relations, repeat business, compliance and, in some cases, share price.

Figure 1.1    Cause and effect diagram of the seven selected risk categories and the “rules” of project risk management described for each

Section 4, External stakeholders: an external project stakeholder is a party that may influence or be influenced by a project but is not part of the organisation for which the project is undertaken. External stakeholders are considered here to include regulators, central government departments, government agencies, local authorities, communities, pressure groups, adjacent land owners, highway agencies, utility companies, design consultancies, contractors, sub-contractors and suppliers.

Section 5, Organisation and culture: an organisation is a deliberate arrangement of people with specific roles and responsibilities and arranged in a structure to accomplish some specific purpose. The organisation sits within an environment which influences, for instance, its purpose, structure, people, policies, processes, inputs, outputs, profitability and longevity. There are variety of legal types of organisations which are created in the public and private sector. Culture refers to the “way of doing things” within a project, a set of behaviours and beliefs about how a project should be implemented.

Section 6, Leadership and governance: leadership is the process of leading and influencing a group of individuals to achieve specific pre-determined goals. Leadership can occur at all levels in an organisation from board members down to individual team leaders. The governance function is responsible for overseeing the production of accurate, timely and relevant information, compliance with laws and regulations and establishing the company culture by setting the company’s values and standards. In addition, in the context of risk management, governance entails agreeing the objectives for risk management, establishing a risk management function, ensuring accountability for risk management, supporting the embedding of the process and driving the implementation of improvements in risk management as part of continuous improvement.

Section 7, Internal stakeholders: the simple definition of internal stakeholders adopted here is that they are those individuals within a project organisation, who will initiate the project, sanction expenditure, agree the scope, participate in implementation and use the output. In a broader sense, internal stakeholders are those who will influence the project or be affected by it. Who these stakeholders are will vary to some degree between projects in the public and private sector and from industry-to-industry. The internal stakeholders of a project may include the project board, customer, end users, project manager, project team and in-house functions such as finance, legal, information technology, public relations and human resources.

Section 8, Risk Resources: risk management resources include financial, physical, human, hardware and software.

Section 9, System: the term “system” is used here as a global term to encapsulate risk management documents, software and practices. So, for instance, it includes frameworks, policies, plans, procedures, checklists and templates. It includes hardware and software. It includes risk management training, maturity models and risk management techniques.

Relationship between the sections and the “rules”

Sections 3 to 9 inclusive contain a number of “rules” of project risk management which have been selected to support the implementation of effective risk management. It would be foolhardy to claim that the rules cover all aspects of project risk management implementation as the subject is so broad. As mentioned earlier in the preface, the “rules” are not rigid statements that have to be complied with, like those to be observed in a game of chess. They are commonly recognised “veracities” based on experience and underpinned by a combination of guidelines and recommendations included in ISO31000: 2018, the PMI Practice Standard for Project Risk Management, the RAMP guide,¹ PRAM Guide,² Cabinet Office framework,³ HM Treasury orange book,⁴ M_o_R guide,⁵ MSP,⁶ AIRMIC approach⁷ and other notable publications, which if ignored could undermine the successful implementation of project risk management. They are guidelines as projects vary so considerably for instance in their procurement, execution, context, timeframe, complexity and scale. Included in Figure 1.1 is a cause and effect diagram which illustrates the seven subject areas together with the “rules” described for each. It is not intended that the book provide an exhaustive list of “rules” but it strives to identify and describe those that are the most commonly applicable.

Notes

1    ICE and I&FA (2014) Risk Analysis and Management for Projects: A Strategic Framework for Managing Project Risk and Its Financial Implications, third edition, published for the Institute of Civil Engineers. ICE Publishing is a division of Thomas Telford Ltd., London.

2    APM Risk Management Specific Interest Group (2010) Project Risk Analysis and Management Guide, second edition, published by APM.

3    Cabinet Office (2017) Management of Risk in Government. A Framework for Boards and Examples of What has Worked in Practice – A Non-Executives’ Review.

4    HM Treasury (2013) Orange Book: Management of Risk – Principles and Concepts.

5    M_o_R (2010) Management of Risk – Guidance for Practitioners, 3rd Edition. Author: OGC (Office of Government Commerce), published by TSO (The Stationery Office).

6    Rod Sowden (2011) MSP® Managing Successful Programmes, Cabinet Office, published by TSO (The Stationery Office).

7    Following the publication of ISO 31000:2009, the IRM in conjunction with AIRMIC and Alarm published a short document entitled “A Structured Approach to Enterprise Risk Management (ERM) and the Requirements of ISO 31000”.

2

Overview of project risk management

The risk management process should be an integral part of management, embedded in the culture and practices and tailored to the business processes of the organisation.

ISO 31000 (2009)

Risk Management – Principles and Guidelines, International Standards Organisation

The risk management process and its setting

As any professional discipline becomes more sophisticated and refined over time, it becomes more and more difficult for newcomers to the subject to find the foundation stone from which they can build and develop their own knowledge. A logical starting point is the risk management process itself. As a consequence, the aim of this section is to provide a high-level overview of the project risk management (PRM) process to aid orientation prior to embarking on examining what drives effective risk management. Figure 2.1 below provides an overview of the risk management process and its setting. The subjects of “environment”, “organisation”, “leadership and governance”, “internal stakeholders” and “system” are addressed later in the book.

The risk management process

The nucleus of PRM is the risk management process itself, as summarised in Table 2.1 and based on ISO 31000:2009. Within the table is a high-level description of each of the steps in the risk management process.

Figure 2.1 Overview of project risk management

Table 2.1 Steps in the risk management process

Establishing the context:

External – such as the cultural, social, political, legal, regulatory, financial, technological, economic and market conditions. Internal – such as the objectives, governance, organisational s...