Lecture 3 - Project Risk Management Basics

Lecture 3 – Project Risk Management Basics
Project Risk Management
MS (PM)
Scheme
2
 Scalability and Tailoring Conditions (Coned…)

 Considerations for Agile/Adaptive environments (Coned…)
 Trends and emerging practices in PRM (Coned….)
 Non-event risks (Variability & Ambiguity)

 Project resilience
 Integrated risk management
 Can Risk be evaded completely?
 Where to apply PRM
 Critical success factors for PRM
 PRM and communication
Bilal Atiq PMP & RMP PMI
Scheme
3
 PRM and responsibility

 PRM and role of project manager
 Using RM outputs
 Risk management processes overview
 Plan Risk Management
 Identify Risk
 Perform Qualitative Risk Analysis
 Perform Quantitative Risk Analysis
 Plan Risk Responses
 Implement Risk Responses
 Monitor Risks
Scalability and Tailoring Conditions Agile/Adaptive Considerations
Scalability and Tailoring Conditions

4
 Each project is unique and exposed to

different levels of risk.
 Every step in the PRM processes should be

scalable to meet the varying degrees of risk.
 PRM activities shall be appropriate to project.
 Balance needs to be maintained between the

level of efforts/resources applied in PRM and
expected output gained from these efforts.

5
Project Size
Project Complexity
Project Importance
Development Approach

6
 Tailoring of PRM processes to meet these considerations

is part of Plan Risk Management process.
 Outcomes of tailoring decisions are recorded in risk
management plan.
 Scalable elements of PRM processes include, but not
limited to:
 Methodology and processes used
 Tools and techniques used
 Supporting infrastructure and resources
 Review and update frequency
 Reporting requirements

7
 The main actions to provide the required tailoring

are as follows:
 Define risk threshold, appetite and the

assessment framework.
 Define those objectives against which risks will be

identified.
 Define how the elements of the PRM processes

will be scaled for this project.
Considerations for Agile/Adaptive Environments

8
 High-variability environments, by definition, incur more uncertainty and risk.
 Projects managed using adaptive approaches make use of frequent reviews of

incremental work products and cross-functional project teams to accelerate
knowledge sharing and ensure that risk is understood and managed.
 Risk is considered when selecting the content of each iteration, and risks will
also be identified, analyzed, and managed during each iteration.
 Requirements are kept as a living document that is updated regularly, and work
may be reprioritized as the project progresses, based on an improved
understanding of current risk exposure.

Risk – Start of Iteration Risk – Start of Iteration Risk – Start of Iteration
• Review Product • Review Product • Review Product
Backlog Backlog Backlog
9
• Risk Identification • Risk Identification • Risk Identification
• Risk Analysis • Risk Analysis • Risk Analysis
• Risk Prioritization • Risk Prioritization • Risk Prioritization
Iteration 1 Iteration 2 Iteration 3
Risk Monitoring During Risk Monitoring During Risk Monitoring During

Iteration Iteration Iteration
• Review & Asses Risks • Review & Asses Risks • Review & Asses Risks
• Monitor Risks • Monitor Risks • Monitor Risks
• Update Iteration Risk • Update Iteration Risk • Update Iteration Risk
Register Register Register
10
Trends & Emerging Practices
https://www.pmi.org/learning/library/manage-risks-didnt-know-were-taking-9275
(Hill son, D., 2014; PMI, 2018)

Trends & Emerging Practices: Non-event Risks Resilience Integrated RM
Event and Non-event Risks

11
 Most projects focus only on risks that are uncertain future events that
may or may not occur, i.e. event-based risks, such as:
 A key seller may go out of business during the project

 the customer may change the requirement after design is complete
 The focus of PRM, however, is broadening to ensure that all types of risk
are considered, and that project risks are understood in a wider context.
 There is an increasing recognition that apart from event-based risks, the

non-event risks also need to be identified and managed.
Event and Non-event Risks

12

Variability Risk (Aleatoric Uncertainty)

13
 Probability of occurrence is 100% but some aspects (duration, cost, productivity

etc) is uncertain.
 Results in a range of possible outcomes including values both higher and lower
than expected.
 Best analyzed using Monte Carlo simulation.
 Responses may be planned to reduce the spread between min and max values
of possible outcomes by:
 reducing /avoiding threats that drive the worst-case values and/or
 exploiting /enhancing opportunities that contribute to best-case outcome.
Ambiguity Risks (Epistemic Uncertainty)

14
 Uncertainties arising from lack of knowledge or understanding.
 Examples of project areas where imperfect knowledge might affect

our ability to achieve project objectives include:
 Elements of the requirement or technical solution

 Use of new technology
 Competitor capability or intentions
 Inherent systemic complexity in the project

Ambiguity Risks (Epistemic Uncertainty)

15
 Addressed through exploration and experimentation, seeking to

identify areas where we lack knowledge or understanding.
 The aim is to transform ambiguity risks into “known-unknowns.”
 After understanding where lack of knowledge might cause a

problem, we can then take action to fill the gap by:
 Obtaining expert external input

 Benchmarking our approach against best-practices
 Incremental development, prototyping or simulation.
Emergent Risks (Ontological Uncertainty)

16
 Risks that emerge from our blind-spots.
 Arise from limitations in our conceptual

frameworks or world-view.
 They are outside our experience or

mindset.
 Other terms used for emergent risks are

“Unknown Unknowns” & “Black-Swans”.
Emergent Risks (Ontological Uncertainty)

17
 “Unknown unknowns” can be divided into two types:
 Unknown-but-knowable Unknowns - These are

uncertainties that we currently do not know, but
which we could find out about. The risk process
can help in their identification, through creative
risk identification, exploration and education.
 Unknown-and-unknowable Unknowns - These

are genuine emergent risks and much more
difficult to deal with, since by definition we can
never discover them unless and until they happen.

Project Resilience
18
 Emergent risks can be tackled

through developing project
resilience.
 Resilience can be defined as “the

capacity to maintain core
purpose and integrity in the face
of external or internal shock and
change”, sometimes known as
“bounce-back-ability”.

Project Resilience
19
 For a project to be resilient against emergent risks, it needs to have:

 Right level of budget and schedule contingency for emergent risks.
 Flexible processes capable of coping with emergent risk while maintaining

direction toward project goals, e.g. strong change management;
 Empowered project team that has clear objectives and that is trusted to
get the job done within agreed upon limits;
 Frequent review of early warning signs to identify emergent risks a.s.a.p.;
 Clear input
Bilal Atiq PMP &from stakeholders to clarify areas where the project scope or
RMP PMI
Integrated Risk Management

20
 Portfolio
Projects existRisk
in an organizational context, and they may form part of
Register
a program or portfolio.
KPRI Escalated Risks
 Risk exists at each of these levels, and risks should be owned and
managed at the
Program Riskappropriate level.
Register
 A KPRI
coordinated Escalated Risks
approach to enterprise-wide risk management
ensures alignment and coherence in the way risk is managed across
Project Risk
all levels.Register
Escalated Risks

Can project risk be evaded completely?
21

Where to Apply Risk Management?
22

Where to Apply PRM Critical Success Factors PRM and Communication
Where to Apply PRM?

23
 PRM should be conducted on all

projects.
 The degree, level of detail,

sophistication of tools and amount of
time and resources applied to PRM
should be in proportion to the
characteristics of the project under
management and the value that they
can add to the outcome (Tailoring).

Critical Success Factors for PRM

24
Recognize the
value of RM
Integrate with Organizational
Project Commitment
Management
Risk
Management
Success
Individual
Scale Risk Effort Commitment /
to Project Responsibility
Open and
Honest
Communication
PRM and Communication

25
 PRM cannot take place in isolation.
 Success relies heavily on

communication throughout the
process (90% efforts of PM on Comm).
 Risk identified and analysis depend on

comprehensive input from
stakeholders in a project to ensure
that nothing significant is overlooked
and that risks are realistically assessed.
PRM Responsibility Roe of PM Using PRM outputs PRM Processes Overview
PRM Responsibility
26
 Management of project risk shall not be left to a

few risk specialists.
 Since project risks can affect project objectives,

anyone with an interest in achieving those
objectives should play a role in PRM.
 Roles and responsibilities for PRM should be clearly

defined and communicated, and individuals should
be held responsible and accountable for results.
 Responsibility should also be allocated for

recording risk-related lessons.
Risk Management and Role of Project Manager

27
 Promoting the PRM process for the project.
 Determining acceptable levels of risk for project in

consultation with SHs.
 Developing and approving risk management plan.
 Participating in all aspects of the PRM processes.
 Approving risk responses and associated actions

prior to implementation.
 Applying contingency funds to deal with identified

risks that occur.

28
 Monitoring the efficiency and effectiveness of the

PRM processes.
 Auditing risk responses for effectiveness and

documenting lessons learned.
 Overseeing RM by subcontractors and suppliers.
 Facilitating open and honest communication about

risk within the project team and with management
and other stakeholders.


29
 Regularly reporting risk status to key stakeholders,

with recommendations for appropriate strategic
decisions/actions to maintain acceptable risk
exposure.
 Encouraging senior management to support PRM

activities.
 Escalating identified risks to senior management

where appropriate; .e.g. risks which are outside the
authority or control of project manager, risks which
require input or action from outside the project etc.
PRM Responsibility Roe of PM Using PRM Outputs PRM Processes Overview
Using PRM Outputs

30
 Outputs of PRM should be taken into account in

many of the project management steps such as:
 Estimating resource requirements, cost or

duration.
 Assessing impact of proposed scope changes.
 Allocating resources to the tasks.
 Reporting progress to stakeholders.

Project Risk Management Processes
31
Monitor
Risks
PRM Processes Overview

32
Plan Risk Management - Process of defining how to

conduct risk management activities for a project.
Identify Risks - Process of identifying individual project

risks as well as sources of overall project risk, and
documenting their characteristics.
Perform Qualitative Risk Analysis - Process of

prioritizing individual project risks for further analysis
or action by assessing their probability of occurrence
and impact as well as other characteristics.


33
Perform Quantitative Risk Analysis - Process of

numerically analyzing the combined effect of
identified individual project risks and other sources of
uncertainty on overall project objectives.
Plan Risk Responses - Process of developing options,

selecting strategies, and agreeing on actions to
address overall project risk exposure, as well as to
treat individual project risks.


34
Implement Risk Responses – Process of implementing

agreed-upon risk response plans.
Monitor Risks – Process of monitoring the

implementation of agreed-upon risk response plans,
tracking identified risks, identifying and analyzing new
risks, and evaluating risk process effectiveness
throughout the project.

Question 1
35
PMI included a number of concepts discussed in Dr David Hillson’s paper on

Project Risks, but did not include his recommendation of having teams who
should not be requiring approvals for every small deviation from the original
plan. Why, in your opinion, PMI excluded this recommendation?
Because PMI’s Project Management approach/standard demands a strict abidance

of the agreed upon and approved plans and lays a great emphasis on following a
proper procedure (i.e. change management system) to seek approval and
agreement for required change(s).

Question 2
36
Give some examples of potential unknown-unknowns for the project that you are
currently working on?
We cannot give any example of unknown-unknown on the current project, as the

moment we will dig out a risk, it will no longer be an unknown-unknown. However,
we can give examples of unknown-unknowns from the past projects.
However, the questions may not be asked in such a direct way, instead
the same questions may be asked using some practical work scenario.

Question 3
37
You are working on a technical project as a project manager and using some very latest
technology that has never been used earlier. You and your team have a limited
understanding about the implications this technology may have on project work and
thus are concerned about the risks it may generate during the project. All of the
following may help you in identification of risks associated with use of this new
technology EXCEPT:
A. Consulting the HoD of engineering department who has recently done an advanced
level course on the same technology from abroad.
B. Comparing your risk management approach with relevant standards of “managing
risks in new technologies”.
C. Modeling the use of technology at a smaller scale before going into full fledged
application of the same on actual project.
D. Developing project resilience to address the unanticipated risks.
Question 3
38
You are working on a technical project as a project manager and using some very latest
technology that has never been used earlier. You and your team have a limited
understanding about the implications this technology may have on project work and
thus are concerned about the risks it may generate during the project. All of the
following may help you in identification of risks associated with use of this new
technology EXCEPT:
A. Consulting the HoD of engineering department who has recently done an advanced
level course on the same technology from abroad.
B. Comparing your risk management approach with relevant standards of “managing
risks in new technologies”.
C. Modeling the use of technology at a smaller scale before going into full fledged
application of the same on actual project.
D. Developing project resilience to address the unanticipated risks.
Sample WBS with Major Deliverables (Ref: PMBoK Guide, 6th Edition)
39
Cost Baseline
40
Critical Path Method (CPM)
Activity Description Preceding Activity

Activity Duration
A Approval of application None 5
B Consultation plans A 15
C Traffic study A 10
D Service availability check A 5
E Staff report B, C 15
F Commission approval B, C, D 10
G Wait for consultation F 170
H Occupancy E, G 35
42
Thanks

Lecture 3 - Project Risk Management Basics

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Lecture 3 - Project Risk Management Basics

Uploaded by

Copyright:

Available Formats

Lecture 3 – Project Risk Management Basics

Project Risk Management

 Scalability and Tailoring Conditions (Coned…)

 Non-event risks (Variability & Ambiguity)

 PRM and responsibility

Scalability and Tailoring Conditions

 Each project is unique and exposed to

 Every step in the PRM processes should be

 PRM activities shall be appropriate to project.

 Balance needs to be maintained between the

Scalability and Tailoring Conditions

Scalability and Tailoring Conditions

 Tailoring of PRM processes to meet these considerations

Scalability and Tailoring Conditions

 The main actions to provide the required tailoring

 Define risk threshold, appetite and the

 Define those objectives against which risks will be

 Define how the elements of the PRM processes

Considerations for Agile/Adaptive Environments

 High-variability environments, by definition, incur more uncertainty and risk.

 Projects managed using adaptive approaches make use of frequent reviews of

Bilal Atiq PMP & RMP PMI

Iteration 1 Iteration 2 Iteration 3

Risk Monitoring During Risk Monitoring During Risk Monitoring During

Trends & Emerging Practices

(Hill son, D., 2014; PMI, 2018)

Bilal Atiq PMP & RMP PMI

Event and Non-event Risks

 A key seller may go out of business during the project

 There is an increasing recognition that apart from event-based risks, the

Event and Non-event Risks

Bilal Atiq PMP & RMP PMI

Variability Risk (Aleatoric Uncertainty)

 Probability of occurrence is 100% but some aspects (duration, cost, productivity

 Best analyzed using Monte Carlo simulation.

Ambiguity Risks (Epistemic Uncertainty)

 Uncertainties arising from lack of knowledge or understanding.

 Examples of project areas where imperfect knowledge might affect

 Elements of the requirement or technical solution

Bilal Atiq PMP & RMP PMI

Ambiguity Risks (Epistemic Uncertainty)

 Addressed through exploration and experimentation, seeking to

 The aim is to transform ambiguity risks into “known-unknowns.”

 After understanding where lack of knowledge might cause a

 Obtaining expert external input

Emergent Risks (Ontological Uncertainty)

 Risks that emerge from our blind-spots.

 Arise from limitations in our conceptual

 They are outside our experience or

 Other terms used for emergent risks are

Emergent Risks (Ontological Uncertainty)

 “Unknown unknowns” can be divided into two types:

 Unknown-but-knowable Unknowns - These are

 Unknown-and-unknowable Unknowns - These

Bilal Atiq PMP & RMP PMI

 Emergent risks can be tackled

 Resilience can be defined as “the

Bilal Atiq PMP & RMP PMI

 For a project to be resilient against emergent risks, it needs to have:

 Flexible processes capable of coping with emergent risk while maintaining

 Frequent review of early warning signs to identify emergent risks a.s.a.p.;

Integrated Risk Management

Bilal Atiq PMP & RMP PMI