Civil 703: Project Management 1

Project Risk Management

Week 8
Steven Briggs
Learning Objectives

By the end of this lecture on Project Management

you should understand:
1. Chance, uncertainty and risk
2. Common biases
3. Project Risk management framework
(ISO31000, 2009)
Risk: Definitions

• Hazard, chance of bad

consequences, loss, etc., exposure to
mischance
(Oxford English dictionary)

• The chance of something happening

that will have an impact on objectives
(AS/NZS 4360, 2004)
Risk: Definitions

• Uncertainty that can be associated with an

event that can be quantified on the basis
of empirical observations or casual
knowledge. Frequencies and probabilities
are ways to express risks. Unlike in its
everyday use, the term risk need not be
associated with harm; it can refer to a
positive, neutral or negative event.
(Gigerenzer 2002)
Risk Tolerance

• Risk avoider
• Risk neutral Risk Neutral

REWARD
adverse profile
• Risk taker

GO
Risk taker

NO GO

RISK
Consider the following propositions

Scenario 1

a. ) £800 for

sure or

b.) £1000 with

probability
0.8
£0
with
probability
0.2
Consider the following propositions

Scenario 2

c) -£800 for sure (i.e.

loss) or

d) -£1000 with probability

0.8
-£0 with
probability 0.2
The Framing Effect (Kahneman & Tversky 1979)

Decision making in uncertainty is VALU

E
a two stage process: Risk Neutral Line

1. Editing (i.e. building of a

mental model as a reference
frame = perceived neutral
point) GAINS
2. Evaluation (on relative terms
and not absolute terms,
against the perceived neutral LOSSES
point)
Reconsider the propositions:
Scenario 1
£800 for sure
£1000 with probability 0.8
£0 with probability 0.2
Most choose the sure thing,
despite them being formally
identical (EV=800).
The diminishing utility of
money means that the last
£200 of the
£1000 is relatively smaller in
value,
making the gamble of less
subjective value (hence the
preference for the sure
thing).
Scenario 2
-£800 for sure (i.e. loss)
-£1000 with probability 0.8
-£0 with probability 0.2
Most choose the gamble, despite
them being formally identical
(EV=800).
The diminishing utility of
money means that the last
£200 of the
£1000 is relatively smaller in value,
making the gamble of less
subjective value. This time smaller
is more attractive, since we are
talking about losing money!
Implications of Framing Effect

Implications include:
• The way problems are framed matters
• Response in the domain of losses is more extreme
• Leads to systematic biases:
▫ Risk seeking when framed in domain of
losses
▫ Risk averse when framed in domain of gains
• People value things more once they 'own' them.
This presents real problems for risk models for
decision making that try to use monetary value to
make social and environmental decisions.
Heuristics (A rule of thumb)

Availability Heuristic
•Ease of recall
• Retrievability (ease of imagination)
•Presumed associations (illusionary correlation)
Representativeness Heuristic
• Insensitivity to base rates
• Insensitivity to sample size
• Misconceptions of chance
• Regression to mean
•Conjunction fallacy
Anchorage and
Adjustment
• Insufficient adjustment
for anchor
• Conjunctive and
disjunctive events bias
• Over-confidence
How to Prevent Biases (Bazerman 2002)

• Acquire experience and expertise

• De-biasing
▫ Warn about biases
▫ Describe direction of biases
▫ Feedback
▫ Extended programme of training
• Take an outsider’s view
• Use models based on expert judgement
• Audit assessments and adjust intuitive
predictions
Risk Management
Framework:
ISO 31000 (2009)

Establish the context

Identify risks

Analyse risks

Evaluate risks

Risk Treatment Schedule and

Plan Implement Plan

Risk Management According to
PMBoK
11.1 Plan Risk 11.2 Identify 11.3 Perform
Management Risks Qualitative Risk Mgt

Defining how to Determine and Prioritising risks for

conduct risk document risks that further analysis and
management may affect the project action
Planning Planning Planning

11.4 Perform 11.5 Plan Risk 11.6 Monitor and

Quantitative Risk Mgt Response Control Risks

Numerical analysis of Options and actions Tracking, monitoring

risks to address risks etc and responding to
risks
Planning Planning Monitoring and
Control

Source: PMBoK 5th Edition

ISO31000 v PMBOK Ch 11
Comparison

ISO 31000 PMBOK Ch

11
Establish the context Project Risk Management

11.1 11..2 11.3

Identify risks
Plan Risk Risk Qualitative Risk
Managemen Identification Analysis
t
Analyse risks
11.4 11.5 11.6
Quantitative Risk Response Control Risks
Evaluate risks Risk Analysis Planning

Risk Treatment Schedule and Plan

Implement Plan
Step 1: Establish the Context

The Macro
Environmen
PEST Framework t

Industry

Organisation

The Project

“The key is to identify the drivers which might affect

individual organisations” (Johnson and Scholes)
Step 1: Establish the
Context
PEST Analysis
POLITICAL (& LEGAL) ECONOMIC
Government Business cycles
stability Taxation Interest rates / Exchange
policy rates
Foreign trade Money supply
regulations Social Inflation
welfare policies Unemploymen
Legislation (eg H&S) t

PEST

SOCIETAL (& TECHNOLOGICAL

ENVIRONMENTAL)
Demographics New discoveries /
Social mobility development Speed of
Lifestyle technology transfer
changes Obsolescence
Attitudes to work and Government
Industry spending
focus on on R&D
technological
leisure Levels of education effort
Step 2: Identify Risks
Common Sources of Risk

Clients Constraints Other Work Contractors

Change Estimates Related Stakeholders

Tasks

User Temporar
Team Members Contracts
Requirements y
Activities

Roles and
Ineffective Project
Your Appointment Penalties Responsibilities
Manager
Unclear
Step 2: Identify Risks
Risk Identification Methods ISO
31000
• Brain storming
Team • Workshops
Based
• Flow charting
Structured • System design review
• Hazard and Operability (HAZOP) studies

• What if analysis
General • Scenario Analysis

• High level review

Limited Resource • Check-lists

• Initial high level

Multi-level • Detailed review on priority areas
Step 2: Identify Risks
Risk Identification: General
Guidelines
• Do not use questions.
• Do not include action items.
• Use complete sentences.
• Be very specific.
• State the source of risk and area of impact.
• Define risk in terms of both Cause and Effect
Step 2: Identify Risks
Risk Identification: Examples

Poor Good

• Project Delays • Poor project management

• Cost over-runs decisions during the
• Insufficient recourses design phase may cause
• delays to the project.
Ground conditions
• Defects may cause both
schedule and cost
impacts.
• Poorly worded
specifications may lead
to the vendor claiming
variations with cost
implications.
Step 2: Identify Risks
Categorise Risks

For example:
• Threats with Financial Consequences
• Threats with Physical Consequences
• Threats with Intellectual Property Consequences
• Threats with Societal Consequences

and opportunities…..
Step 3: Analyse Risks

• There are three general types:

• Eg High, Medium Low descriptors
Qualitative

Semi- • Eg frequency / probability multiplied

by qualitative scale of consequence
Quantitative
• Full attribution of values (probabilities
Quantitative and $ values for implications)
Step 3: Analyse Risks
Risk Analysis Methodologies
• Qualitative
▫ Very subjective but easy to understand
▫ Fast analysis
▫ Need standard processes and definitions
▫ Based on experience and judgment
• Quantitative
▫ Objective in principle - but often not in practice
▫ Unavailability of good data may be a problem
▫ If lots of data available the analysis can be time
consuming
▫ Debate may occur over the validity of probabilities
▫ Errors can occur if interactions are not understood
 Risk Register
Project Compiled by Date

Date of Risk Reviewed by Revision

Review

Reference The risk What can How can it What can Existing Analysis Evaluation
happen happen? happen Controls
(The Risk) (consequ- Likelihood Consequ- Level of Priority
ence) ence Risk

Step 1: Steps 2-3:

Identify See later
Risks slides
 Risk Register – Example:
A P P E N D IX 2: SAM PLE R IS K R E G IS T
ER
A c t iv it y A n a ly s t s
C o n tr a c t N o . N
Raem ew
v ie ( s )e r s
D a te No
S aumrec (ess) o f In f
o r m a t io n
No. Name D e s c r ip t io n S ta tu s Threat or Cons equenc e L ik e lih o o d Sc ore
E x is t in g D e s c r ip t io n R a t in g ( C ) D e s c r ip t io n R a t in g ( L ) = C x
O p p o r t u n it y L1
e .g C o n t r o ls

Unf ores een ground In s u f f ic ie n t b e a r in g c a p a c it y is a c h ie v e d o n t h e d r iv in g o f t h e

p ile s u n d e r t h e X Y Z p ie r , w h ic h r e q u ir e s le n g t h e n in g o f p ile s 1 L T n /a $2M - Sev ere 70 L ik e ly 5 350
1 c o n d it io n s u n d e r
to 1 6 .
Ap ile
u ns iq u e A s h o r t d e s c r ip t iv e D e t a il t h e s p e c if ic e v e n t t h a t D e t a ils e x is t in g p r o c e s s e s , The outco me of T h e e x t e n t t o w h ic h a n
id e n t if y in g n u m b e r t it le is le a d in g t o u n c e r t a in t y in d e v ic e s , p r a c t ic e s o r the e v e nt. e v e n t is lik e ly t o o c c u r .
a c t iv it y o u t c o m e c o n t r o ls t h a t a c t t o m in im is e
th re a ts or e nh a n ce
o p p o r t u n it ie s , in c lu d in g a n
in d ic a t io n o f h o w t h e y
m ig h t b e o f in f lu e n c e .

Ex c e p t io n s S t a t e m e
nt
? ? ? e x a m p le
L EG EN D 1
T h e f o llo w in g c o lo u r s a r e u s e d t o d e t a il r is k
L L iv e c a t e g o r ie s : Ex tr e m e >=350
E E m e r g in g V e r y H ig h 350-200
P Pa r ke d H ig h 200-70
C C lo s e d M o d e r a te 70-30
T Th rea t Low 4-30
O O p p o r t u n it y N e g lig ib le 1-3

Source: Transit (www.transit.govt.nz/technical_information

)
Step 3: Analyse Risks

likelihood of an event
e.g. highly likely project delay of 2 weeks

RISK

the consequence
e.g. liquidated damages of $50,000
Step 3: Analyse Risks
Semi- Quantitative Likelihood Example:
Level Descriptor Example detail description
A Almost Certain Is expected to occur in most circumstances

B Likely Will probably occur in most circumstances

C Possible Might occur at some time

D Unlikely Could occur at some time

E Rare May occur only in exceptional circumstances

Step 3: Analyse Risks
Semi-Quantitative Consequence Example:
Level Descriptor Example detail description
1 Insignificant No injuries, low financial loss

2 Minor First aid treatment, on-site release immediately

contained, medium financial loss

3 Moderate Medical treatment required, on-site release

contained with outside assistance, high
financial loss
4 Major Extensive injuries, loss of production
capability, off-site release with no detrimental
effects, major financial loss
5 Catastrophic Death, toxic release off-site with detrimental
effect, huge financial loss
 Semi- Quantitative Measures
of
Consequence – Example:
Descriptor Health & Image / Environment Stakeholder Technology Cost Time Other Other Ratin
Safety Reputation Interest g

Substantial Several Sustained Permanent Commission Unable to use + $1M Years 100
Fatalities National Ecological of Inquiry
Media Cover Damage

Major Fatality Regional Heavy Ministerial Significant + $100K Months 70

Media Cover Ecological Inquiry shortfall in to $1M
or Short-term Damage, quality or
National Costly functionality
Cover Restoration to whole
project
Medium Serious Sustained Major but Ministerial Significant + $10K to Weeks 40
Injuries Local Media Recoverable Questions or shortfall in $100K
Cover Ecological 3rd Party quality or
Damage Investigation functionality
Threat

to localised
area

Minor Minor Injuries Brief Local Limited but Official Shortfall in + $1K to Days 10
Media Cover Medium-term Information functionality $10K
Negative Request to localised
Effects area
Slight loss in
quality to
whole project

Negligible Slight Injuries Immediate Short-term Minor Slight loss + $0 to Hours 1

Stakeholders Damage Complaint quality to $1K
Only localised area

Source: Transit (www.transit.govt.nz/technical_information) with modifications (additional blank columns added

 Step 4: Evaluate Risks
Semi- Qualitative Risk Analysis
Matrix
Likelihood Consequences
Insignificant Minor Moderate Major Catastrophic
1 2 3 4 5
Almost Certain H H E E E
A
Likely M H H E E
MINIMISE

B
Possible L M H E E
C
Unlikely L L M H E
D
Rare L L M H H
E

MITIGAT
Key
E: Extreme E
risk H: High
risk
M: Moderate
 Step 4: Evaluate Risks
Risk Evaluation using a Risk
Register
Project My project Compiled by G Miller Date xxxx

Date of xxxx Reviewed by Civil 703 class Revision Issue 01

Risk
Review
Reference The risk What can How can What can Existing Analysis Evaluation
happen it happen Controls
(The happen? (consequ Likelihood Consequ Level Priority
Risk) - ence) - ence of Risk
1 Risk 1 xxxx xxxx xxxx xxxx 3 2 6 2

2 Risk 2 xxxx xxxx xxxx xxxx 4 1 4 3

3 Risk 3 xxxx xxxx xxxx xxxx 5 4 20 1

Level Descriptor Level Descriptor

1 Rare
2 Unlikely
3 Possible
4 Likely
5 Almost Certain
1 Insignificant
2 Minor
3 Moderate
4 Major
5 Catastrophic
Step 5: Risk Treatment
Risk Treatment
Objective
• “Development of a risk treatment strategy
involves selection of one or more risk
treatment options, which collectively will
reduce the overall risk exposure to the
project or business to an acceptable level”
(Bowden, Lane and Martin)
Step 5: Risk
Options for Treatment of Risks
Treatment
with Negative Outcomes

Avoid the Risk (Threat)

• i.e. conscious decision to not start or discontinue activities

Change the Likelihood

• i.e. reduce likelihood of negative outcomes

Change the Consequence

• i.e. reduce the extent of losses

Share the Risk (Threat)

• e.g. contracts, risk transfer, insurance

Retain the Risk

• Accept and retain the risk
(monitor)
Source: AS/NZS4360 (paraphrase of
Step 5: Risk
Treatment
Options for Treatment of Risks
with Positive Outcomes

Actively seek the Opportunity

• i.e. conscious decision to start or continue activities

Change the Likelihood

• i.e. enhance likelihood of beneficial outcomes

Change the Consequence

• i.e. increase the extent of gains

Share the Opportunity

• e.g. contracts, partnerships, joint ventures, incentive arrangements

Retain the Residual Opportunity

• Retain without immediate action being required
Source: AS/NZS4360 (paraphrase of
Step 5: Risk
Treatment
Decision Flow Chart

Analyse Risk

Evaluat
e Risk

Risks to
Evaluate Options
be treated Identify Options Risk
Do they satisfy
& risk Develop/design Treatmen
treatment objectives?
treatment treatment t Plan
Are they cost beneficial?
objectives options

Residual
Risk

Source: Companion to
 Combined Risk Register /
Risk
Treatment
Project Plan Compiled by Date

Date of Risk Reviewed by Revision

Review

Refer- The risk What How can What Existing Analysis Evaluat- Treatment
ence can it can Controls ion
happen happen? happen
(The (conseq Likeli- Conseq Level of Priority
Risk) u-ence) hood u-ence Risk

Simple Approach:
Add Risk Treatment Column to your Risk
Register
 Separate Risk Treatment Schedule
Project Compiled by Date

Date of Risk Reviewed by Revision

Review

Risk (in priority Possible Preferred Result of Cost- Person Timetable for How will this
order) Treatment Option Benefit Responsible for Implementation risk and the
Options Analysis Implementation treatment be
monitored

Source: Companion to
 Risk Treatment Plan: Example
AP PEND IX 3: S AM PLE RISK T REAT M ENT PLAN
A ctivity A nalys ts Name(s)
Contrac t No. Review ers Name(s)
Date Sources of Inf ormation

No. Name Threat or Treatment Treatment Monitoring & Treatment Risk Reduction
Opportunity Type Progress Treatment A ctions Res ponsibility Timing Resources Reporting Cos t

3 days w ork f or 1
Unf oreseen ground 1.1 Complete additional logged bores boring rig f rom
1 conditions under piles Threat Minimise F Dagg XY Z- 15,000 n/a
Completed at ev er y s ec ond pile loc ation by 30 Mar'04 Tes ting Ltd.

Des ign review & Likelihood of insuf f icient

Meeting to brief report bearing capacity reduced by
1.2 Reass es s piling systems agree design prepared by 50%, but w ith possible
adequacy in consideration of 1.1 change on cons ultant w here increased piling
A B Cee 30 Jun'04 necessary 5,000 base cost. Target net. saving of
Commenced abov e
$300,000
The ty pe of approach that will A brief indication of A list of actions required The individual(s) Deadline for A summary of the The full cost of The estimated reduction in
be taken in treating the risk. current progress on the to complete the responsible for completion of resources required to treatment risk, at the ex pected level,
This may be: A. Accept / P. treatment plan treatment of a risk. completing the treatment complete the treatment (estimated or following completion of the
Accept / Transfer / Maximise / treatment action. actions action. actual). treatment.
Enhance / Avoid / Minimise /
Mitigate.

Source: Transit Risk Management

Step 6: Implement Plan
Significant Risk Treatment
PlanRisk Ref

Summary

Action Plan
1. Proposed Actions

2. Resource Requirements

3. Responsibility

4. Timing

5. Reporting and Monitoring Required

Compiled by Date Reviewed by Date

Source: Companion to
 Putting it all together
Typical Risk Schedules /
Documents A P P E N D IX 2 : S A M P L E R IS K R E G I S T E R

A c t iv it y A n a ly s t s N a m e ( s )
C o n tra c t No. R e v ie w e r s N a m e ( s )
Da te S o u r c e s o f I n f o r m a t io n

No. Nam e D e s c r ip t io n S ta tu s Th re at o r Co n s e q u e nc e L i k e l ih o o d
E x is t in g O p p o r t u n it y C o n t r o ls S c o r e D e s c r ip t io n
R a t in g ( C) D e s c r ip t io n R a t in g ( L ) = C x L 1

e .g

Un f ore s ee n g ro un d I n s u f f ic ie n t b e a r in g c a p a c it y i s a c h ie v e d o n t h e
1 d r ivci no gn d it
o io
f nt hs e u np dilee sr p i le s u nd e r th e X Y Z p ie r , w h i c h r e q u ir e s le n g t h e n in g o f L T n/a $2M - S e v e re 70 L i k e ly 5 350
p ile s 1 t o 1 6 .
A u n iq u e A s h o r t d e s c r ip t iv e D e t a il t h e s p e c if ic e v e n t t h a t D e t a ils e x is t in g p r o c e s s e s , T h e ou tco m e of T h e e x t e n t t o w h ic h a n
id e n t if y in g n u m b e r t it le is le a d in g t o u n c e r t a in t y d e v ic e s , p r a c t ic e s o r t hv ee n t .
e e v e n t is l ik e ly t o
in a c t iv it y o u t c o m e c o n t r o ls t h a t a c t t o oc c u r.
m
t h in
r ei m
a tiss e o r e n h a n c e
o p p o r t u n it ie s , in c lu d in g a n
in d ic a t io n o f h o w
t h e y m ig h t b e o f
in f lu e n c e .

APPENDIX 3: SAMPLE RISK T REAT MENT PLAN

Activity Analysts Name(s)
Contract No. Review ers
Date Name(s)
Sources of
Information
No. Name Threat or Treatment Monitoring & Treatment Risk
Treatment
Opportunity Type Progress Treatment Responsibility Resources Reduction Reporting Cost
Actions Timing
3 days w ork for 1
Unforeseen ground 1.1 Complete additional logged boring rig from
bores F Dagg by 30 Mar'04 XYZ-
Testing 15,000 n/a
1 conditions under piles Threat Minimise Completed at every second pile location Ltd.
Design review Likelihood of insufficient
E x c e p tio n s S ta t e m e
Meeting to & brief report bearing capacity reduced by
n ?t ? e x a m p le
? 1.2 Reassess piling systems agree prepared by 50%, but w ith possible
adequacy in consideration of design consultant w increased piling
L EG EN D 1 T h e f o llo w in g c o lo u r s are us ed to d e t a il r is k
L L iv e c a t e g o r ie s : E x tr e m e >=350 Commenced 1.1
above A B Cee change on here necessary 5,000 base cost. Target net. saving
$300,000
E V e r y H ig h 35 0 -2 00 30 Jun'04 of
E
P m e r g in g H ig h 20 0 -7 0
P
Ca rk e d M o d e ra te 7 0-3 0 The type of approach that will A brief indication A list of actions required The Deadline for A summary of the The full cost of The estimated reduction
C lo s e d Lo w 4 -30 be taken in treating the risk.
of current progress on the to complete
individual(s) responsible for completion resources required to treatment
in risk, at the expected
T
O
T hp rpe oa rt t u n it y
O
N e g l ig i b le 1-3
This may be: A. Accept / P. treatment plan
the treatment of a risk. completing the of treatment complete the treatment (estimated level, following
Accept / Transfer / Maximise treatment actions action.
or actual). completion of the
/ Enhance / Avoid / Minimise action. treatment.
/ Mitigate.

Risk Register

Risk Treatment Plan

Significant Risk
Reports
The Risk
Cycle risk management is not 1-off exercise:
Remember

opportunities disturbances
(threats and hazards)

collect signals
respond
filter out noise

develop a risk
control strategy collate information

compare analyse threats,

with needs and costs, and risks
expectations anticipate the future
Risk Management
Reading / References
Core Texts
• Guide to Project Management Body of Knowledge, (5th
Edition), Chapters 11
• ISO 31000 (2009): Risk Management, Standards New
Zealand
• AS/NZS 4360, (2004): Risk Management, Standards New
Zealand

Additional Texts
• Bowden, Lane, Martin, (2001), Triple Bottom Line Risk
Management,
• Bazerman, M. (2002), Judgement in Managerial Decision
Making, 5th Edition, John Wiley & Sons
Questions ?