Chapter Four
DEMYSTIFYING RISK: USING
PMI PMBOK
The PMBOK is a Guide intended to help practitioners recognize the general process
of project risk management practice and the associated inputs, tools and techniques.
Despite its popular use as a guide to simplify the process it is only a start in regards
to future needs.
Process focused.
Single project oriented.
Emphasis on quantitative.
Focused on methods and procedures, not people.
Not related to cost.
Not related to quality.
Ignores business wide risk.
Does not incorporate contingency into planning.
Ignores risk as opportunity.
Project Risk Management Processes (PMBOK)
PMBOK provides the following complete step-by-step process on managing PRM
Plan risk management:
Identify risks
Perform qualitative risk analysis
Perform quantitative risk analysis
Plan risk responses
Control risks
Plan Risk Management
Risk management Plan is the process of defining how to conduct risk management activities for a
project
The project team should review project charter, project documents as well as
organization’s risk management policies, risk categories, lessons-learned reports from
past projects, and templates for creating a risk management. It is also important to review
the risk tolerances of various stakeholders.
Issues not addressed in PMBOK include
Building a risk-based organizational culture
Program and portfolio management
Interface management
Risk and cost integration
Business plan
Work Breakdown Structure (WBS)
Information and network system
WBS for establishing a Construction site.
WBS for Retail Website
Depending upon the size and complexity of the project the
following elements will be present in a risk management plan.
Methodology
Roles, Responsibilities and Authority.
Budgeting
Timing
Risk categories
Scoring and interpretation
Revised stakeholder risk tolerance
Tracking
Risk documentation
Different individuals and organizations have different tolerances for and
attitudes toward risk. The three types of stakeholder attitudes toward risk
are
risk seeker – a willingness to take risks – and accept the
outcome – in anticipation of positive outcomes.
risk averse – a reluctance to take risks or to expose projects to
the possible adverse consequences of unplanned events or
conditions.
risk neutral – an indifference to risk whereby it does not play a
role in decision making.
Topic Questions to Answer
Methodology How will risk management be performed on this project? What tools and data sources are
available and applicable?
Roles and responsibilities Which people are responsible for implementing specific tasks and providing deliverables
related to risk management?
Budget and schedule What are the estimated costs and schedules for performing risk-related activities?
Risk categories What are the main categories of risks that should be addressed on this project?
Risk probability and impact How will the probabilities and impacts of risk items be assessed? What scoring and
interpretation methods will be used for the qualitative and quantitative analysis of risks?
Revised stakeholders’ Have stakeholders’ tolerances for risk changed? How will those changes affect the project?
tolerances
Tracking How will the team track risk management activities? How will lessons learned be
documented and shared? How will risk management processes be audited?
Risk documentation What reporting formats and processes will be used for risk management activities?
Identify Risks
Identifying risks is the process of determining which risks are
likely to affect a project and documenting the characteristics of each.
Identify risks by sources (risk categories) such as technical, external,
organizational, external etc. that vary across different types of
projects.
A risk breakdown structure (RBS) helps the project team to look at
many sources from which project risk may arise in a risk
identification exercise.
Identifying risks – Input
Project charter
Work breakdowns structure (WBS)
Product description
Schedule and cost estimates
Resource plan
Assumption and constraint lists
Historical information
Project files
Published information
Identifying risks – Tools and techniques
Information gathering techniques
Brainstorming
The Delphi Technique
Interviewing
SWOT analysis
Checklist analysis
Assumptions analysis
Documentation reviews
Diagramming techniques
Cause and effect diagrams.
System or process flow charts.
Influence diagrams
Example : Cause and Effect Diagrams
• Also known as Ishikawa or fishbone
Testing Inadequate Time Project Prioritization
Product
Delivered Late
Personnel Materials Insufficient Bad Specs
Resources
Potential Causes Effect
The primary output of the risk identification process is the ‘Risk Register’.
The preparation of the risk register begins in the identify Risks process with the
following information, and then becomes available to other project management and risk
management processes:
List of identified risks and the root causes of those risks.
Triggers for each risk : indicators of symptoms of actual risk events
Perform Risk Analysis
After identifying and categorizing risks follows risk assessment , to
establish the level of risks in terms of possibility and consequence.
The risk analysis will determine which risk factors would potentially
have a greater impact on the project by analyzing risks in terms of
probability and impact.
There are two methods used for determining the level of risk :
qualitative and quantitative
Qualitative analysis Quantitative analysis
• Uses subjective values: Green, • Relies on a numeric value
Yellow, Red • Uses objective data
• Requires common • Requires understanding of
understanding of ordinal ranking probability theory
system
• Removes some uncertainty
• May be less precise than • Should be based on historical
quantitative analysis data
• Should be defined in terms of
the parameters of the project
Qualitative Risk Analysis Process
Quantitative Risk Analysis-Input
Similar to qualitative risk analysis input plus
Cost management plan
Schedule management plan
Quantitative Risk Analysis-Tools and techniques
Interviewing
Modeling techniques
Sensitivity analysis
Expected value analysis
Simulations
Expert judgement
Quantitative Risk Analysis- Output
Probabilistic analysis of the project
Probability of achieving cost and time objectives
Prioritized list of quantified risks.
Trends in quantitative risk analysis results
Plan Risk Responses
Involves developing options and actions to enhance opportunities and to
reduce threats to project objectives.
Control Risks
Summary of Risk Management Process
1. Plan Risk Management—Defining how to conduct risk management activities for
a project.
2. Identify Risks—Determining which risks may affect the project and documenting
their characteristics.
3. Perform Qualitative Risk Analysis—Prioritizing risks by assessing and
combining their probability of occurrence and impact.
4. Perform Quantitative Risk Analysis—Numerically analyzing the effect of
identified risks on overall project objectives.
5. Plan Risk Responses—Developing options and actions to enhance opportunities
and to reduce threats to project objectives.
6. Control Risks—Implementing risk response plans, tracking identified risks,
monitoring residual risks, identifying new risks, and evaluating risk process
effectiveness throughout the project
