RISK

MANAGEMENT
A BRIEF EXAMINATION AND OVERVIEW FOR PROJECT
MANAGERS
QUESTIONS TO CONSIDER IN
RISK MANAGEMENT
• What is likely to happen (the probability and impact)?
• What can be done to minimize the probability and / or
impact of these events?
• What cues will signal the need for such action (i.e., what
clues should I actively look for)?
• What are the likely outcomes of these problems and my
anticipated reaction?
THE LANDSCAPE

• Risk defined: uncertainty about future events. Every action a manager

or business takes raises the possibility and potential for positive or
negative outcomes.
• Recent research concluded the most difficult careers to staff are in the
risk and compliance areas of business.
• Project and Risk Managers are in high demand as a result
• Firms are increasing in size; globalization has caused division meltdowns
in many industries.
• Institutional investors are demanding far more detailed attention to risk
oversight before they extend funding.
 RISK MANAGEMENT
Risk management—the art and science of identifying, analyzing,
and responding to risk factors throughout the life of a project and
in the best interest of its objectives.
Project risk—an uncertain event or condition that, if it occurs, has
a positive or negative effect on one or more project objectives
such as scope, schedule, cost, or quality.

Risk = (Probability of Event) * (Consequences of Event)

RISK VERSUS AMOUNT AT STAKE: THE
CHALLENGE IN RISK MANAGEMENT
Risk Clusters (i.e. areas of risk)

• Financial • Execution
• Technical • Contractual or legal risk
• Commercial

Common Types of Risks

• Absenteeism • Skills unavailable

• Resignation • Ineffective training

• Staff pulled away • Specs incomplete

• Time overruns • Change orders

QUESTIONS TO CONSIDER IN
RISK MANAGEMENT
• What is likely to happen (the probability and impact)?
• What can be done to minimize the probability or impact
of these events?
• What cues will signal the need for such action (i.e., what
clues should I actively look for)?
• What are the likely outcomes of these problems and my
anticipated reaction?
 COPING WITH RISK

Businesses constantly face four basic risk types:

1. Speculative - like financial investments that involve the possibility
of gain or loss

2. Pure Risk - which involves only the possibility of total loss or

gain
“this product may fail or succeed”
The chance of warehouse fire is a pure risk.
3. Personal Risk - terrorism, kidnapping, key person
4. Fundamental Risk - risk to community, sometimes based on climate
CAUSES OF RISKS

3 Basic Causes
Physical – brakes stop working on a car

Human – no one checked the cars brakes

Organizational – no procedure for maintaining cars

RISKY BUSINESS

• For companies to survive and prosper they must manage all

types of risk in a cost-effective manner

• We can define risk management as ”conserving the firm’s

earning power and assets by reducing the threat of loss due to
uncontrollable events”.

• There are five steps in managing risk…

 THE FIVE STEPS OF RISK MANAGEMENT

1. Identify risk and potential losses

2. Measure the Frequency and Severity of Losses and
their impact
3. Evaluate alternatives and choose a technique that will
best mitigate the loss
4. Implement Risk Management program
5. Monitor the results
1 – IDENTIFY RISK AND POTENTIAL
LOSSES
Scenario:
A fleet of delivery trucks can expect one of the trucks will eventually
be involved in an accident over a given period of time.
• May cause bodily injury
• Injury to others
• May cause physical damage to the vehicle
• May cause physical damage to other vehicles or property
• May result in higher insurance costs
• May negatively impact the firm’s image
RISK BREAKDOWN STRUCTURE (R B S)
2 - MEASURE THE FREQUENCY AND SEVERITY
OF LOSSES AND THEIR IMPACT

• Managers must consider both history and current activities

• How often can the business expect the loss to occur
• What is the likely size of the loss in terms of dollars (or
other, more indirect, measures)
• The firm had two accidents last year with its delivery
trucks. This year it triples the number of vehicles in the
fleet. Can they reasonably expect the number of accidents to
increase?
 3 - EVALUATE ALTERNATIVES AND CHOOSE A
TECHNIQUE THAT WILL BEST MITIGATE THE LOSS

• We have identified and measured potential losses.

• How do we handle them?

• There are four ways in risk management…

 FOUR OPTIONS TO MITIGATE RISK

1. Risk Avoidance - a business may choose to avoid a risk by

declining to participate or cease participating in a risky activity
2. Risk Control – the use of loss prevention techniques to minimize the
frequency of losses. Three ideas for the delivery business might be:
a) Train their drivers in defensive training techniques
b) Map the quickest and safest routes
c) Maintain rigorous safety checks and maintenance on the fleet
 FOUR OPTIONS TO MITIGATE RISK (CONT’D)

3. Risk Retention – when losses cannot be avoided or controlled the

business must cope with the consequences. When these losses are
manageable and somewhat predictable the business may decide to
cover the losses out of company funds. This is called self-insuring the
risk.
4. Risk Transfer - when the potential for large risks cannot be avoided
or controlled, risk managers often opt for ‘risk transfer’, usually to an
insurance company. The premiums can sometimes be large and can be
shared by several insurance companies. This is called reinsurance.
 4 – IMPLEMENT RISK
MANAGEMENT PROGRAM
Implementing risk management decisions depend on both the techniques chosen
and the activity managed.

• Risk avoidance for certain activities can be implemented by purchasing from

outside providers like hiring delivery services instead of operating your own.
• Training employees and designing new work methods and introducing new
equipment for on-the-job safety help control risk.
• When risk retention is preferred, set up a provision for retention of reserve
funding.
• When risk transfer is the preferred route, select the best insurance to fit the
risk.
 5 – MONITOR THE RESULTS

• Because risk management is fluid and dynamic, follow up is

always essential.
• New types of risks emerge, with changes in customers,
facilities, employees, products.
• Insurance regulations change and new types of insurance
emerge
SAMPLE RISK ASSESSMENT
MATRICES
SAMPLE RISK ASSESSMENT
MATRICES
SAMPLE RISK ASSESSMENT
MATRICES
 RECAP:
WHAT IS RISK MANAGEMENT IN PROJECTS
? (3:58)
IN-CLASS RISK ASSESSMENT
EXERCISE…
OTHER RISK TYPES

Reputation

Project Environmental

Other
risk

Investment Third party

OTHER RISK TYPES

• Reputation risk: the potential for negative publicity, public perception or

uncontrollable events to have an adverse impact on a company’s reputation, thereby
affecting its revenue
• Environmental risk:  the actual or potential threat of adverse effects on living
organisms and the environment by effluents, emissions, wastes, resource depletion,
etc., arising out of an organization’s activities.
• Third-party risk: the potential risk that arises from financial institutions relying on
outside parties to perform services or activities on their behalf
• Investment risk: the probability or likelihood of occurrence of losses relative to the
expected return on any particular investment
• Project risk: an uncertain event or condition that, if it occurs, has an effect on at least
one project objective
MITIGATING RISK:
THE SWOT ANALYSIS

• Internal • Internal
• Positive • Challenge

Strengths Weaknesses

Opportunities Threats

• External • External
• Positive • Challenge
IN-CLASS SWOT ANALYSIS
EXERCISE…
 Not on
ENTERPRISE RISK MANAGEMENT, OR ‘ERM’ exam!

Risk
ERM provides a Identification
framework for risk
management involving
particular events & Evaluation
Risk
Assessment
circumstances relevant
to the business
objectives & assesses
magnitude, likelihood
ERM
and response strategies Framework By identifying
And proactively
Monitoring Risk Analysis addressing risks
& opportunities,
businesses protect and
create value for all
Implementation
stakeholders

A COMPARISON BETWEEN TWO
RISK METHODOLOGIES
Governance Risk Compliance
(GRC)
• …embraces compliance as a
separate activity for each
business unit.
…is this effective given today’s
pace of change and global
challenges?
Not on
exam!
Enterprise Risk Management
(ERM)
• …is concerned with delivering
measurable business value by
tying front line operation
activities to goals across
business units
 Not on
BURDEN OF COMPLIANCE SUPPRESSES RISK
exam!
TAKING ACTIVITIES

Risk activities are

Many businesses Risk has not been not bad if a business
believe that they eradicated by establishes its “risk
must continue to regulation; instead tolerance” and
eliminate risk risk is driven appetite and has
through compliance underground proper controls in
place
 Not on
APPETITE AND TOLERANCE FOR exam!

RISK

• Risk Appetite
…is the manner in which an organization and its stakeholders
collectively perceive, assess and treat risk

• Risk Tolerance
…requires a company to consider in quantitative terms
exactly how much of its capital it is prepared to put at risk
 Not on
ERM FOR RISK OPTIMIZATION exam!

1. Considers both the upside and downside outcomes of risk-taking

activities

2. When threats and opportunities are better understood, risk taking is

optimized and managers, in turn, will make more informed business
decisions

3. Improved decision making enables an organization to quickly meet

emerging marketplace challenges
 Not on
SCOPE OF RISK IDENTIFICATION exam!

Strategic Operational

Risk
Categories

Financial Other
 Not on
exam!
Innovatio
n

R&D customer

Supply Strategic market

chain
Risk

planning investor

brand
 Not on
OPERATIONAL RISKS INCLUDE: exam!

Governance
Regulatory & Financial
legal reporting

Sustainability Fraud

Communication
Emerging
Technology

Human capital
Operational Hazard
Risk
 Not on
FINANCIAL VALUATION exam!

RISKS INCLUDE
Financi
al
market
volatilit
y
Inflationar Credit
y pressure
risk

Financi
Foreign al risks Liquidit
investmen
t risk y risks

Asse Interes
t rate
t risk risk
Not on
exam!