Risk Management

Monitor and Control Chp 10

Risk
Management
System
(RMS)
Risk Monitoring and Control
 Great!!
 We have identified our risk
 We have an understanding of the likelihood and severity of the impact
 We have a response plan.

 However, are we monitoring the project activities to see if or when a

risk event has occurred and whether the response is being applied?
 We also have to ensure that the response is having the desired
outcome.
Risk Monitoring and Control

 The Monitor and Control Risks process involves

implementing response plans, tracking and monitoring
identified risks, identifying and responding to new risks as
they occur, and improving the risk management processes.
Risk Monitoring and Control
 This process is also concerned with the following:

 Evaluating risk response plans that are put into action as a result of risk events

 Monitoring the project for risk triggers

 Reexamining existing risks to determine if it's changed or should be closed out

 Monitoring residual risks

 Reassessing project assumptions and determining validity

 Ensuring that policies and procedures are followed

 Ensuring that risk response plans and contingency plans are put into action
appropriately and are effective
Project management life cycle
Risk Monitoring and Control
 The project progresses through the different project life cycle stages.
This will force the risk management system to progress as well.

 The project will move from the development stage, planning,

designing now moves toward the actual implementation stage.

 As the timing and characteristics of risk events can be associated with

the different project stages it is logical that risk events will evolve as
well.
 Some risk may expire
 New risk is discovered
Risk Monitoring and Control
 It would be poor project management to ignore the possible risk
events during the implementation (execution stage) of the
project.

 To do so would render previous risk management efforts useless.

Leaving the project team to be reactive to risk events. Dealing
with risk events after they happen.

 The realization of active risk events are closer, now that project
activates are being executed.
Risk Monitoring and Control
 The Project Risk Register (PRR) exists so that the project team can
continuously reference it for solutions.

 However the PRR is a living document. That means it should always

be revisited by the project team.
 To close out risk events that have expired
 To close out risk events that occurred and were addressed
 To add new risk events
Risk Monitor and control
 Each stakeholder must decide how they are going to
monitor and control risk events related to them.

 This includes:
 The assignment of responsibility
 Type and frequency of monitoring
 Suitable control measures
 Reporting methods
 Identification and treatment of new risks
Assigning Responsibility
 There are five considerations when assigning responsibility for monitoring and
controlling risk in a stakeholder organization.

 Let’s explore them

Assigning Responsibility - First
 Different risk may require different monitoring procedures and
control measures at different times by different people.
 It is rare that one person bears responsibility for all risk
management activities in an organization.
 As discussed earlier; risk can take place in different areas in an
organization
 Finance

 Quality management
 Sales

 Safety

 Engineering
Assigning Responsibility - Second
 The people responsible for monitor and control are often
different from those who identified, analysed risk and
created a response / treatment.
 This is due to organization structure influences and
employee churn rates
Assigning Responsibility - Third
 Assigning responsibility may also be influenced by the originations
overall approach to risk management.
 Questions:
 Isthere a separate risk management system for each project and
another for the whole organization?
 Is there a separate safety management system?
 Is there a dedicated systems in place?
Assigning Responsibility – Third cont’d
 If there is a separate PRR for each project, then management
responsibility should be assigned to project staff with the
appropriate decision making authority.

 In a large project driven organization (10 or more projects) it is

common to have several risk management teams established to
include crossover multidisciplinary expertise.

 Examples: different departments for safety, quality,

environment etc…
Assigning Responsibility - Fourth
 The higher the risk the more senior
management is engaged.
 Simple risk events can be handled
by the project team
 Extreme risk events are managed
by the Board
Assigning Responsibility - Fifth
 Quite often the risk management system can be forgotten overtime.
 It becomes an activity that is done if it is convenient to spend time
on. Only if we have time. This is a problem.
 There needs to be a sustained formal effort to revisit the risk
management system.
 Project stakeholders need to be present to reassess existing risks
and work to identify new risk as well address risk events that have
been triggered.
Monitoring procedures
 The nature and frequency of project risk monitoring will
be influenced by the type of project.

 Logic suggests that monitoring intensity should reflect

level of risk severity of the project or event.

 The riskier project require more monitoring and control

than a simple non complex project
Monitoring procedures
 A general rule, there should be monthly risk monitoring meetings for
projects for projects of 12 months or more.

 Shorter project can be every 2 weeks.

 Monitoring and control can be difficult for event type projects

(concerts). That is because the project execution may only be two
hours long. As a result monitoring needs to be very intense leading up
and during the event.
Monitoring procedures
1. Negligible risks
2. Low risks
3. Medium risks
4. High risks
5. Extreme risks
Monitoring procedures / Control measures
Monitoring Control
Negligible Negligible

  Are usually ad hoc and the

Minimum resources and staffing
responsibility of operational or line
 Combined with other project staff
activities
 Training may be required
 Little data gathered
 Minimum communication
Monitoring procedures / Control measures
Monitoring Control
Low Low

 Monitoring and control activity will  Mix of ad hoc and pre planned
increase slightly in intensity. activities
 Communication will be more  Management oversight will match
formal with performance related that of risk monitoring
data
 Management oversight will
increase in frequency and
importance
Monitoring procedures / Control measures
Monitoring Control
Medium Medium

  Requires control measures that are

Monitoring procedures should take
on distinctive and systematic preplanned.
approach  There is a chain of responsibility
 Clear frequency is defined for the ending with senior management
different areas of the organization
 Formal procedure and policies are
developed
 More staff are involved with the
process.
 Higher level of management
oversight (planned / frequent)
Monitoring procedures / Control measures
Monitoring Control
High High

 Usually requires an appointed,  Appropriate emergency response

dedicated and trained staff. and recovery and procedures
 should be in place and rehearsed
Procedures are consistent,
repeatable and auditable  Especially for risk related to
 serious health and safety
Significant senior management
continuous oversight  Escalating levels of responsibility
 for controlling such risk must be
Fast communication channels,
known and clearly understood
detailed data analysis
across all stakeholders.
 Information and responsibilities
should include the executive board
Monitoring procedures / Control measures
Monitoring
Extreme
 Monitoring is continuous
 Senior management is directly and
continuously informed and involved
 High level data collection and analysis
are in place and secure
 Resilience and redundancy are often
applied.
 Communication is flexible, extensive
and able to by pass damaged
communication channels
Control
Extreme
 Involves everyone
 Emergency response and recover
plans and procedures are pre-
planned, agreed to by all,
formalised, rehearsed, practised
(randomly) and stress tested.
 Backup personnel and other
resources should be readily available
 Public relations plan should be in
place and tested
Monitor and control examples
Monitor and control examples
Monitor and control examples
Reporting processes
 Like other important project activities that get recorded,
it is important to record the monitor and control activities
that reflect the decisions and actions that were made.

 We do so that the process is proactive not reactive.

 It also provide a formal record to satisfy any compliance

requirement whether internal or external.

 Reporting can be continuous, intermittent or periodic.

Reporting processes
 Verbal risk reporting is the most direct and realistic method but
it is also the most unreliable and least consistent. Given the
barriers on this form of communication.

 Written reports can be formal or informal from notes to meeting

minutes, project documentation.

 Audiovisual provides a reliable record and means of sharing

information.
Dealing with new risks
 The monitor and control process may reveal new risk for the project
stakeholders.

 New risk tend to emerge during the project implementation

(execution) stage because decision making tends to increase as scope
changes are contemplated and introduced into the project.
Dealing with new risks
 New scope of work means new potential sources for identifying
risk. That is why it is important to have reiterative reviews of
the risk process.

 As time passes stakeholders are more risk aware and averse.

 Risk is easier to manage overtime. As the project progresses

more information is revealed which should better prepare the
stakeholders ability to manage the risk.
Disaster Planning and recovery
Severe risks can be called disastrous and requires a plan of
action which can include;
 Assignment or reassignment of
responsibilities.
 Recruitment and training of
emergency teams
 Obtaining sufficient resources and
equipment
 Defining key system control points
 Alerting of emergency services
 Having adequate communication
facilities
 Supplies, equipment, spare parts
 Psychological counselling for staff
 Public relations
 Collection of evidence
 Design of resilience and
redundancy measures into the
project
The end