Ethiopian Technical University Wolkite Campus

Department of Information Technology

Chapter Seven
Project Risk Management
Risk Management
• Dictionary definition of risk is the possibility of loss or injury

• Risk can be positive or negative, negative risk involves understanding potential

problems that might occur in the project and how they might impede project
success.

• Positive risks are risks that result in good things happening; sometimes called
opportunities.

• A general definition of project risk is uncertainty that can have negative or positive
effect on meeting the project success.

• The goal of project risk management is to minimize negative risks while maximize
positive risks.
Broad categories of risk
.
Cont…
.
Project Risk Management
• Project Risk Management includes the processes concerned with identifying, analyzing,
and responding to project risk.

• It includes maximizing the results of positive events and minimizing the consequences of
adverse events.

• Risk management has the following process

1. Risk Management Planning :- Systematic process of deciding how to approach, plan,

and execute risk management activities throughout the life of a project.

• It is intended to maximize the beneficial outcome of the opportunities and minimize or

eliminate the consequences of adverse risk events
 Cont…
2. Identify Risk Events :-Risk identification involves determining and documenting which
risks can affect the project. It may be a simple risk assessment organized by the project
team, or an outcome of a formal risk assessment process such as the Cost Estimate
Validation Process.

3. Qualitative Risk Analysis :-involves Project teams assessing identified risks for
probability of occurrence and impact on project objectives.

• Teams may elicit assistance from subject matter experts or functional units to assess the
risks in their respective fields.

• Risks are measured by their “quality” in words rather than quantified in numbers.
 Cont…
4. Quantitative Risk Analysis :-Is a way of numerically estimating the probability that a
project will meet its cost and time objectives. Quantitative analysis is based on a
simultaneous evaluation of the impacts of all identified and quantified risks.

5. Risk Response Risk :-Involves developing options and determining actions to reduce
threats or enhance opportunities to project objectives. Actions are identified and assigned
to parties that take responsibility for the risk response. This process ensures each risk
requiring a response has an “owner.”

6. Risk Monitoring & Control :-tracks identified risks, monitors residual risks, and identifies
new risks—ensuring the execution of risk plans and evaluating their effectiveness in
reducing risk. Risk monitoring and control is an ongoing process for the life of the project .
Cont…
.
 Benefits of Risk Management
• Project risk management delivers a number of values to the project, including:

• Recognizes uncertainty and provides forecasts of possible outcomes.

• Produces better business outcomes through more informed decision making.

• Has a positive influence on creative thinking and innovation.

• Creates opportunities for improved project monitoring and control.

• Can aide in addressing concerns with respect to overhead and time.

• Contributes to project success.

 Cont…
2. General management skills. General management skills (discussed in Section 2.4) are of
particular importance to team development. .

3. Reward and recognition systems. Reward and recognition systems are formal
management actions which promote or reinforce desired behavior. To be effective, such
systems must make the link between performance and reward clear, explicit, and
achievable.

• Projects must often have their own reward and recognition systems since the systems of
the performing organization may not be appropriate. For example, the willingness to
work overtime in order to meet an aggressive schedule objective should be rewarded or
recognized; needing to work overtime as the result of poor planning should not be.
 RISK IDENTIFICATION
• Risk identification consists of determining which risks are likely to affect the project
and documenting the characteristics of each.

• Risk identification is not a onetime event; it should be performed on a regular basis

throughout the project.

• Risk identification should address both internal and external risks.

• Internal risks are things that the project team can control or influence, such as staff
assignments and cost estimates.

• External risks are things beyond the control or influence of the project team, such
as market shifts or government action
Inputs to Risk Identification
• Product description. The nature of the product of the project will have a major effect on
the risks identified. Products that involve proven technology will, all other things being
equal, involve less risk than products which require innovation or invention.

• Risks associated with the product of the project are often described in terms of their cost
and schedule impact.

• Other planning outputs. The outputs of the processes in other knowledge areas should
be reviewed to identify possible risks. For example:
o Work breakdown structure
o Cost estimates and duration estimates
o Staffing plan
o Procurement management plan—
 Cont…
• Historical information. Historical information about what actually happened on previous
projects can be especially helpful in identifying potential risks. Information on historical
results is often available from the following sources:
• Project files:- one or more of the organizations involved in the project may maintain records
of previous project results that are detailed enough to aid in risk identification.
• Commercial database:- —historical information is available commercially in many application
areas.
• Project team knowledge:- the individual members of the project team may remember
previous occurrences or assumptions
Outputs from Risk Identification
• Sources of risk. Sources of risk are categories of possible risk events (e.g., stakeholder
actions, unreliable estimates, team turnover) that may affect the project for better or
worse.

• The list of sources should be comprehensive, i.e., it should generally include all identified
items regardless of frequency, probability of occurrence, or magnitude of gain or loss.

• Common sources of risk include:

• Changes in requirements.

• Design errors, omissions, and misunderstandings.

• Poorly defined or understood roles and responsibilities.

• Poor estimates.

• Insufficiently skilled staff

 Cont…
• Risk symptoms. Risk symptoms, sometimes called triggers, are indirect manifestations of
actual risk events. For example, poor morale may be an early warning signal of an
impending schedule delay or cost overruns on early activities may be indicative of poor
estimating.

• Inputs to other processes. The risk identification process may identify a need for further
activity in another area. For example, the work breakdown structure may not have
sufficient detail to allow adequate identification of risks.

• Risks are often input to the other processes as constraints or assumptions.

RISK QUANTIFICATION
• Risk quantification involves evaluating risks and risk interactions to assess the range of
possible project outcomes.

• It is primarily concerned with determining which risk events warrant response. It is

complicated by a number of factors including, but not limited to:
• A single risk event can cause multiple effects, as when late delivery of a key component
produces cost overruns, schedule delays, penalty payments, and a lower-quality product.
• Opportunities for one stakeholder (reduced cost) may be threats to another (reduced
profits)
• The mathematical techniques used can create a false impression of precision and
reliability
Outputs from Risk Quantification

• Opportunities to pursue, threats to respond to. The major output from risk
quantification is a list of opportunities that should be pursued and threats that
require attention.

• Opportunities to ignore, threats to accept. The risk quantification process should

also document (a) those sources of risk and risk events that the project
management team has consciously decided to accept or ignore and (b) who
made the decision to do so