RISK MANAGEMENT IN

PROJECT MANAGEMENT

MUHAMMAD HAFIZUDDIN BIN MD KAILANI

G1824745

1
Index
1. DEFINITION
2. RISKS ELEMENTS IN PROJECT MANAGEMENT
3. THE PROCESS OF PROJECT RISK MANAGEMENT
4. RISK CONTINGENCY RESERVE
5. COMMUNICATING PROJECT RISKS
6. CONCLUSION

2
 5. RISK

uncert
2. RISK ELEMENTS 3. PROCESS OF 5. RISK

ain
An
CONTINGENCY
1. DEFINITION IN PROJECT PROJECT RISK CONTINGENCY 7. CONCLUSION
MANAGEMENT MANAGEMENT RESERVE RESERVE

DEFINITION
RISK MANAGEMENT IN PROJECT MANAGEMENT
A process used by project managers to minimize any potential problems that may negatively impact
a project’s timetable.

Because of this uncertainty, project risk requires serious preparation in order to manage them
efficiently.

3
 5. RISK

uncert
2. RISK ELEMENTS 3. PROCESS OF 5. RISK

ain
An
6. CONTINGENCY
COMMUNICATING
1. DEFINITION IN PROJECT PROJECT RISK CONTINGENCY PROJECT RISK
7. CONCLUSION
MANAGEMENT MANAGEMENT RESERVE
RESERVE

DEFINITION
RISK
Any unexpected event that might affect the people, processes, technology and resources involved in a
project.
In other words :Events that could occur and you may not be able to tell when.

PMI define risk as:

An uncertain event or condition that has a positive or negative effect on a project’s objectives.
In other word : Risk can affect your project for better or for worse.

ISSUE ≠ RISK
Issues are the things you know you’ll have to deal with. Risk is an event that has not happened yet but
there is a likelihood that it may happen in future, where as an issue is an event that has already
happened. 4
 uncert
2. RISK ELEMENTS 3. PROCESS OF 5. RISK
2. RISK ELEMENTS IN RISK

ain
1.DEFINITION
DEFINITION

An
6. COMMUNICATING
7. CONCLUSION
1. IN PROJECT PROJECT
PROJECT MANAGEMENT 3.DEFINITION
CONTINGENCY 4.DEFINITION
PROJECT RISK 5. DEFINITION
MANAGEMENT MANAGEMENT RESERVE

RESOURCES PEOPLE

RISK CAN AFFECT

TECHNOLOGY PROCESSES

5
 5. RISK

uncert
2. RISK ELEMENTS 3. PROCESS OF 6. COMMUNICATING
2. RISK ELEMENTS IN RISK

ain
1.DEFINITION
DEFINITION

An
1. IN PROJECT PROJECT
PROJECT MANAGEMENT
CONTINGENCY
3.DEFINITION
RESERVE
4.DEFINITION
PROJECT RISK 5. DEFINITION
7. CONCLUSION
MANAGEMENT MANAGEMENT

• Usually a risk is seen as a bad thing, something that will always have a negative impact. However,
the Project Management Body of Knowledge Guide treats risk as an uncertainty that may have a
positive or negative impact.
• The risks that produce negative outcomes are called “threats,” and risks that produce positive
outcomes are called “opportunities.”
• Example: A project management team controls the risk that a project will go over budget and the
positive risk that the project will be under budget. Being under budget is a good thing because
the company saves money. However, in the context of project management it's considered a
planning error. You didn't really save money — the project manager overestimated the project.

In other words, under budget projects are something project managers try to avoid. However,
when it happens it's an opportunity to reallocate resources.
• Identifying the two types of risks allows project managers and teams to not let opportunities
pass by while managing threats.
6
 5. RISK

uncert
2. RISK ELEMENTS 3. PROCESS OF 5. RISK
2. RISK ELEMENTS IN

ain
1.DEFINITION
DEFINITION

An
6. CONTINGENCY
COMMUNICATING
7. CONCLUSION
1. IN PROJECT PROJECT RISK
PROJECT MANAGEMENT 3.DEFINITION
CONTINGENCY 4.DEFINITION
PROJECT
RESERVERISK 5. DEFINITION
MANAGEMENT MANAGEMENT RESERVE

RISK ELEMENTS IN PROJECT

MANAGEMENT
Factor Risk
-what events
-what events might
might trigger
trigger the
the risk
risk -what might
-what might happen?
happen?

PROJECT
MANAGEMENT
RISK ELEMENTS
Risk Time Frame
Impact -when is
-when is itit likely
likely to
to happen
happen
-what’s the
-what’s the expected
expected outcome
outcome

Probability
-what are
-what are chances
chances of
of itit happening
happening

7
 uncert
2. RISK ELEMENTS 3. PROCESS OF 5. RISK

ain
An
6. COMMUNICATING 7. CONCLUSION
1. DEFINITION IN PROJECT PROJECT RISK CONTINGENCY PROJECT RISK
MANAGEMENT MANAGEMENT RESERVE

Process of Project Risk Management

• Practice Standard for Project Risk describes a six-step process to effectively manage project
risks.
• Flow chart shows the entire process along with relationships and dependencies among the
six steps.
• The process starts with developing the risk management plan, followed by identifying risks,
performing qualitative analysis, performing quantitative analysis if required, and planning
8
risk responses.
 uncert
2. RISK ELEMENTS 3. PROCESS OF 5. RISK
2. RISK ELEMENTS IN 6. COMMUNICATING
7. CONCLUSION

ain
1.DEFINITION
DEFINITION

An
1. IN PROJECT PROJECT RISK
PROJECT MANAGEMENT 3.DEFINITION
CONTINGENCY 4.DEFINITION
PROJECT RISK 5. DEFINITION
MANAGEMENT MANAGEMENT RESERVE

• That completes all planning activities related to risk management.

• Risks should be monitored and controlled throughout the duration of the project.
• During the plan risk responses, secondary risks may be identified for which qualitative
and quantitative analysis may be needed, which is shown by arrows going back from plan
risk responses.
• Similarly, monitor and control risks may result in identifying new risks and/or altering the
risk response for one or more risks, which is shown by the arrows going back from
monitor and control risks box.

9
 4. TOOLS FOR 5. RISK

uncert
2. RISK ELEMENTS 3. PROCESS OF 6. COMMUNICATING

ain
An
1. DEFINITION IN PROJECT PROJECT RISK PROJECT RISK CONTINGENCY 7. CONCLUSION
RESERVE PROJECT RISK
MANAGEMENT MANAGEMENT MANAGEMENT

STEP 1: Develop Risk Management Plan

• The first step in project risk management is to develop a tailored risk management plan,
which is used as a guide to manage the project risks.
• Here is where the tailored process is created that will be followed throughout the
project.
• The risk register template is finalized and included in the plan.
• The probability-impact Matrix (P-I matrix) is created and risk thresholds are decided,
which will be used in the later steps to prioritize risks.
• The risk management-related roles and responsibilities are also decided and documented
in the risk management plan.
• The risk management plan is an important document because it is used as a guide to
carry out risk management activities throughout the life of the project.
10
 uncert
2. RISK ELEMENTS 3. PROCESS OF 5. RISK
6. COMMUNICATING

ain
An
1. DEFINITION IN PROJECT PROJECT RISK CONTINGENCY 7. CONCLUSION
PROJECT RISK
MANAGEMENT MANAGEMENT RESERVE

Probability-Impact Matrix (P-I matrix)

• The probability-impact Matrix (P-I matrix) is created and risk thresholds are decided,
which will be used in the later steps to prioritize risks.
• The risk management-related roles and responsibilities are also decided and documented
in the risk management plan.
• The risk management plan is an important document because it is used as a guide to
carry out risk management activities throughout the life of the project.

11
12
 4. TOOLS FOR 5. RISK

uncert
2. RISK ELEMENTS 3. PROCESS OF 6. COMMUNICATING

ain
An
1. DEFINITION IN PROJECT PROJECT RISK PROJECT RISK CONTINGENCY 7. CONCLUSION
RESERVE PROJECT RISK
MANAGEMENT MANAGEMENT MANAGEMENT

STEP 2: Identify Risks

• Risk identification is the most crucial activity in the entire risk management process.
• Identifying all/most project risks is not a trivial task.
• The project manager must have knowledge about all aspects of the project such as
requirements, scope, customer/stakeholders/sponsors, team members, rules and
regulations, contracts etc., since risk can originate from anywhere.
• The most effective way to identify all/most project risks is to collaborate with
customers/stakeholders/sponsors and team members.
• Brainstorming is an excellent technique; document all possible scenarios and then
consolidate to develop the list of potential risks.
• The major output of this step is the “risk register,” which should contain a list of risks, a
description, timeframe, and risk manager for each risk. If a potential risk response is
available it can also be put against the respective risks though it is not necessary that
every risk should have a potential response. 13
 5. RISK

uncert
2. RISK ELEMENTS 3. PROCESS OF 6. COMMUNICATING

ain
An
1. DEFINITION IN PROJECT PROJECT RISK CONTINGENCY 7. CONCLUSION
RESERVE PROJECT RISK
MANAGEMENT MANAGEMENT

STEP 3: Perform Qualitative Analysis

The qualitative risk analysis involves but is not limited to these
• Performing root-cause analysis, which will help figure out the source of the risk and other
the attributes (such as impact and response strategy) of the risk.
• Determining probability of occurrence for the risk event. The probability should range
between 0 and 1. If the probability is zero then this event is not likely to happen. If the
probability is one, then this event has already occurred and there may be a need for an
issue resolution plan rather than a risk response plan.
• Estimating the impact, if the event did occur. The impact can be in terms of time or
money or both. The time impact may most likely result in altering the schedule whereas
cost impact may most likely increase/decrease the project's bottom line (and hence the
profitability or the top line).
14
 4. TOOLS FOR 5. RISK

uncert
2. RISK ELEMENTS 3. PROCESS OF 6. COMMUNICATING

ain
An
1. DEFINITION IN PROJECT PROJECT RISK PROJECT RISK CONTINGENCY 7. CONCLUSION
RESERVE PROJECT RISK
MANAGEMENT MANAGEMENT MANAGEMENT

STEP 4: Perform Quantitative Analysis

• The quantitative analysis provides a better handle on probability and impact of the risk
since it quantifies the two.
• Since such analysis is costly, time consuming, and may require a large amount of data,
only a few selected risks may be subjected to this kind of analysis based on the
prioritized risk register that resulted from perform qualitative analysis.

15
 4. TOOLS FOR 5. RISK

uncert
2. RISK ELEMENTS 3. PROCESS OF 6. COMMUNICATING

ain
An
1. DEFINITION IN PROJECT PROJECT RISK PROJECT RISK CONTINGENCY 7. CONCLUSION
RESERVE PROJECT RISK
MANAGEMENT MANAGEMENT MANAGEMENT

Primary Types of Quantitative Analysis

1. Sensitivity analysis—determines which risks have the most potential impact on the project. A
what-if analysis is performed and a tornado diagram is created to represent most potential
risks on the top.
2. Expected monetary value (EMV) analysis—used to calculate the average outcome of uncertain
scenarios by multiplying probability with impact for each risk and summing them up (EMV =
Σ(probability*impact)). Opportunities produce positive values and threats produce negative
values. This method is the easiest and the least time-consuming quantitative analysis method.
3. Modeling and simulation—translates uncertainties into potential impact on project outcomes
such as cost and/or schedule. Typically performed using Monte Carlo techniques to predict
probabilities for completing project on different dates and/or at different costs.
EMV analysis is recommended for beginners because it is very simple to implement and does not
require a lot of data gathering and analysis, and can be performed using simple mathematics.

16
 4. TOOLS FOR 5. RISK

uncert
2. RISK ELEMENTS 3. PROCESS OF 6. COMMUNICATING

ain
An
1. DEFINITION IN PROJECT PROJECT RISK PROJECT RISK CONTINGENCY 7. CONCLUSION
RESERVE PROJECT RISK
MANAGEMENT MANAGEMENT MANAGEMENT

STEP 5: Developing Risk Response Plans

• Now that risks have been identified, analyzed and prioritized, it's time to start thinking
about developing response plans for risks that have a higher value than the thresholds
defined in the risk management plan.
• The risks below the threshold values are kept on a “watch list”; there is no need to
develop a response plan for them until they cross the threshold values.
• There are seven different strategies that can be used to develop risk response plans.
• Three for negative risks (or threats), three for positive risks (or opportunities), and one
that is applicable to both. Exhibit 3 describes the seven risk response strategies.

17
 4. TOOLS FOR 5. RISK

uncert
2. RISK ELEMENTS 3. PROCESS OF 6. COMMUNICATING

ain
An
1. DEFINITION IN PROJECT PROJECT RISK PROJECT RISK CONTINGENCY 7. CONCLUSION
RESERVE PROJECT RISK
MANAGEMENT MANAGEMENT MANAGEMENT

Seven Risk Response Strategies.

18
 4. TOOLS FOR 5. RISK

uncert
2. RISK ELEMENTS 3. PROCESS OF 6. COMMUNICATING

ain
An
1. DEFINITION IN PROJECT PROJECT RISK PROJECT RISK CONTINGENCY 7. CONCLUSION
RESERVE PROJECT RISK
MANAGEMENT MANAGEMENT MANAGEMENT

STEP 6: Monitor and Control Risks

• Monitor and control risks is the last risk management process and the only one that is not part of
the planning process group of the PMBOK® Guide. This process is exercised during the project
execution.
• On regular intervals (weekly, monthly, etc.), the project situation is reviewed and new risks are
identified.
• For new risks, the entire risk management process is carried through the development of risk
response plans. The updated risk register and the watch list are reviewed.
• Each risk's timeframe, probability, and impact are re-evaluated. The risk register is updated with
re-prioritized risks, including the watch list. Some risks may move between the risk register and
the watch list.

19
Risk Register

20
21
 4. RISK 5. RISK

uncert
2. RISK ELEMENTS 3. PROCESS OF

ain
An
1. DEFINITION IN PROJECT PROJECT RISK CONTINGENCY CONTINGENCY 7. CONCLUSION
MANAGEMENT MANAGEMENT RESERVE
RESERVE

Risk Contingency Reserve

• Developing Risk Reserve
• Using Risk Reserve

22
Developing Risk Reserve
• It is important to develop risk reserve and apply it carefully to a refined schedule and cost to
achieve greater predictability in meeting project deadlines and/or staying within the budgeted
cost. At the same time, it is very difficult to accurately determine the probability and impact for
each of the risks. This exercise requires an enormous amount of time to be executed properly.
Some form of quantitative analysis is required before an estimate of risk reserve can be
determined.
• For most business/commercial projects where the impact is mainly monetary, an 80/20 rule-
based approach can be implemented. This approach may need about 20 percent of the effort to
achieve about 80 percent of the result or about 80 percent accuracy, which may be good enough
for a commercial project. Much more sophisticated and costly techniques may be needed for
better accuracy for other types of projects where a lot more could be at stake (such as
environment, culture, animals, or human life).
• For most commercial projects, the EMV technique is the most cost effective and easy to
implement to determine an estimate for risk reserve that is almost 80 percent accurate. The first
step would be to estimate the probability and impact for each of the risks using “expert
judgment” or the Delphi technique. This should be done after taking into account the risk
response plan, which may have a significant impact on these numbers. The total project EMV is
simply the sum of the individual EMVs. The total project EMV is then used as the estimate for the
risk reserve needed for the project.
23
Using Risk Reserve
• Like other contingency reserves, risk reserve can be used when a risk event occurs. Normally
once the risk reserve has been approved, a project manager is authorized to use the risk reserve.
• In case of a schedule reserve, the project manager will update the schedule and re-baseline it.
• Since a part of the total risk reserve has been used to deal with the impact caused by a particular
risk event, the total risk reserve is reduced by that amount. This process is followed every time a
risk event occurred.
• It is interesting to note that total risk reserve was based on impact multiplied by probability, but
when risk occurs, it may use 100 percent of the impact amount, not what was calculated by
multiplying it by probability. For example if a risk event has a probability of 30 percent and an
impact of 10 days schedule delay, the EMV for this risk event will be 3 days, which goes as part of
developing the total risk reserve (not 10 days).
• If this risk event occurred, the schedule may have to be delayed by 10 days (not 3 days), and total
risk reserve reduced by 10 days to arrive at remaining risk reserve for the rest of the risks.
• At the surface level, it seems like a problem, but in the real world, it is not. If there were 10 risks
that were used to create the total risk reserve, it is highly unlikely that all 10 will occur. The
portion of risk reserve for non-occurring risks will generally cover the impact for the risks that
occur.

24
 4. RISK

uncert
2. RISK ELEMENTS 3. PROCESS OF 5. COMMUNICATING

ain
An
1. DEFINITION IN PROJECT PROJECT RISK CONTINGENCY PROJECT RISK 7. CONCLUSION
MANAGEMENT MANAGEMENT RESERVE

Communicating Project Risks

Who ? How ?
What ? When ?

25
 4. RISK

uncert
2. RISK ELEMENTS 3. PROCESS OF 5. COMMUNICATING 6. COMMUNICATING

ain
An
1. DEFINITION IN PROJECT PROJECT RISK CONTINGENCY PROJECT RISK PROJECT RISK 7. CONCLUSION
MANAGEMENT MANAGEMENT RESERVE

Who Should Be Informed About Project Risks?

• It is important that everyone be informed about project risks on a regular basis. The
frequency and level of detail may depend on the nature of the risk, its impact, and the
role that a person or group is playing on the project.
• The communication plan developed during the planning process should clearly identify
all stakeholders who should receive risk communication, and the content and frequency
of communication.
• Normally, project managers have the primary responsibility of communicating risks and
all information related to risks to all the stakeholders.

26
 4. RISK

uncert
2. RISK ELEMENTS 3. PROCESS OF 5. COMMUNICATING 6. COMMUNICATING

ain
An
1. DEFINITION IN PROJECT PROJECT RISK CONTINGENCY PROJECT RISK PROJECT RISK 7. CONCLUSION
MANAGEMENT MANAGEMENT RESERVE

What Should Be Communicated About Project Risks, and When?

At minimum, the status of all risks should be communicated to all stakeholders. For every
risk, the current status should include
a) timeframe of occurrence;
b) probability of occurrence;
c) the impact if the risk does occur;
d) the response plan to manage the risk if it does occur.

In addition, the remaining risk reserve, need for additional risk reserve (if any) and current baselines for
schedule and cost may be very valuable information for the sponsors or stakeholders who approve the budget.
The status and additional risk information should be communicated on a regular basis.
The frequency of communication will depend on the nature and size of the project. For projects that are
small but critical, a weekly risk update may be needed. For projects extending beyond six months, a monthly
risk update may be sufficient. The project manager and stakeholders should make this decision and the project
manager should document it in the communication plan.
27
 4. RISK

uncert
2. RISK ELEMENTS 3. PROCESS OF 5. COMMUNICATING 6. COMMUNICATING

ain
An
1. DEFINITION IN PROJECT PROJECT RISK CONTINGENCY PROJECT RISK PROJECT RISK 7. CONCLUSION
MANAGEMENT MANAGEMENT RESERVE

How Should the Project Risk Information Be Communicated?

• Graphs and charts are the best ways to communicate project risk information.
• In addition, the risk register maintained in a spreadsheet and the current version
of schedule in MS Project format may be more than sufficient for the purpose.

28
 4. RISK

uncert
2. RISK ELEMENTS 3. PROCESS OF 5. COMMUNICATING 6. COMMUNICATING

ain
An
1. DEFINITION IN PROJECT PROJECT RISK CONTINGENCY PROJECT RISK PROJECT RISK 7. CONCLUSION
MANAGEMENT MANAGEMENT RESERVE

A graph that shows the total EMV and # of risks

at different points of time may prove very
valuable, and an example of such a graph is
provided in

RISK BEHAVIOUR OVER TIME

29
 4. RISK

uncert
2. RISK ELEMENTS 3. PROCESS OF 5. COMMUNICATING 6. COMMUNICATING

ain
An
1. DEFINITION IN PROJECT PROJECT RISK CONTINGENCY PROJECT RISK PROJECT RISK 7. CONCLUSION
MANAGEMENT MANAGEMENT RESERVE

• This type of graph is very helpful for sponsors and senior executives to
understand the risk impact and its behavior over time.
• As the project progresses if the two lines show a downward trend that would be
an indication the project risks are being managed effectively and project is likely
to meet milestones of time and cost.
• If the two lines, especially the blue total EMV line, show unstable trends with
several ups and downs or an upward trend, it would indicate ineffective risk
management, which may lead to the project getting off the rails at some point of
time.
• The power of the graph lies in the advance warnings that it provides about
possible delays, overruns, and failures.

30
 4. RISK

uncert
2. RISK ELEMENTS 3. PROCESS OF 5. COMMUNICATING

ain
An
1. DEFINITION IN PROJECT PROJECT RISK CONTINGENCY PROJECT RISK 7. CONCLUSION
MANAGEMENT MANAGEMENT RESERVE

CONCLUSION
• Project risk management is one of the tools in a project manager's toolkit.
• A project manager can utilize this tool to improve the predictability of completing the
project on time and within budget.
• This predictability will help project managers develop stronger relationships with
sponsors, stakeholders, and team members as he or she regularly communicates risks
information using graphs and charts, a language well understood by senior management
or executives in a company.

31