8. Risk Management

Risk Management
Best PMP Exam Simulator

Risk is defined as an uncertain event or condition, that if it occurs has a positive or negative effect on
one or more of the project objective(s) – scope, time, cost and quality
11. Project Risk Management
www.testudaan.com 7/24/20172 Best PMP Exam Simulator

Necessity of Risk Management
• Any project is subject to risk
• Risk can be minimized BUT CAN NOT be eliminated
• Risk Management is about “Minimizing negative impacts and Maximizing positive
impacts” on the project objectives
• Risk is required for Growth & Returns
Why Manage Risks ?
1. Helps stakeholders to understand the nature of the project.
2. Helps team members in defining strengths & weaknesses.
3. Helps to integrate project resources.
4. Helps in prioritizing resources & efforts.
Project Risk Management

The ranking of RISK analysis is directly proportional to the‘Tolerance’ of the involved party
WHO MAY HAVE RISK ?
• High Risk for‘A’ may not be High risk for‘B’, since tolerance levels of stakeholders vary !
RISK REFERREDTOWHAT ?
• Priorities of Objectives may be different to different stakeholders !
WHATTIME AREWE EXPECTING RISK ?
• Risk varies withTIME and hence its Impacts can be of different levels at differentTIME !
Basic Risk Analysis

Risk Attitudes
Organizations and stakeholders are willing to accept varying degrees of risk depending on their
risk attitude
The risk attitudes of the organizations and stakeholders may be influenced by factors classified into
three themes such as :
1. Risk Appetite : Degree of uncertainty an entity is willing to take on in anticipation of a reward.
 “We love taking risks, we were able to grow just because of our risk taking
attitude” – HighAppetite for Risks
 “We need to insure that project team takes on all commitments, we do not
want to confront a situation where stakeholder interest is at risk, we want to
play safe” – LowAppetite for Risks

Risk Attitudes
2. RiskTolerance : Degree, amount or volume of risk that an organization or individual will
withstand.
 “I can take risks up to 100, 000 USD or I can manage schedules variance of
10-20%”
Ask the stakeholder “How much is too much for you ?”
3. RiskThreshold : Refers to measures along the “level of uncertainty or the level of
impact” at which a stakeholder may have a specific interest by further quantifying the Risk
Attitude
i.e. Below that risk threshold, the organization will accept the risk and above that risk
threshold, the organization will not tolerate the risk
 Ask the stakeholder “Will you be willing to take risk of 100,000 USD with 50%
probability of occurring ?”

RiskTolerance Levels
Different people & different organizations have different tolerances for risks, which depends on the
organizational strategies, capacity, capabilities, etc.
Based on above features broadly organizations are differentiated into following three categories:
1. Risk Averse : Limited Risk taking capacities.
2. Risk Neutral :Take Risk only if proportionate to opportunities.
3. Risk Seekers:Take risk even if present opportunities are less, keeping in mind future business
prospects.

A. It is a scientific approach to identify, analyze, assign and respond to the risk regularly across the
project life & so as to achieve the maximum towards meeting project objectives.
B. Provides input for realistic planning of-
a. project schedule,
b. cost estimates and
c. resource requirements
to achieve the project objectives‘successfully and efficiently’.

Project Risk Management Processes
Start
Project /
Enter
Phase
Initiating Planning Executing Closing
End
Project /
Exit Phase
Monitoring and Control Process
Process Groups
Initiating Planning Executing Monitoring &
Control
Closing
Plan Risk Management
Identify Risks
Perform Qualitative RiskAnalysis
Perform Quantitative RiskAnalysis
Plan Risk Responses
Control Risks
7/24/20179 www.testudaan.com Best PMP Exam Simulator

The process of defining how to conduct risk management activities for a project.
11.1 Plan Risk Management

The Risk factors include:
• Risk Event
 What might happen?
• Probability
 What is the chance of it happening?
• Impact (or Amount at Stake)
 What is the financial impact?
• Exposure = Probability X Amount at Stake
• Risk proximity
 When it will happen - How soon ?

Project Risk Management includes TWO management plans:
1. Risk Management Plan (o/p of Plan Risk Management process)
2. Risk Response Plan (o/p of Plan Risk Responses process)
• Risk Management Plan guidelines the identification, analysis, responses and monitoring &
controlling activities
• It does not include the list of actual project risks, but only the approach to risk management
activities
• Risk Response Plan (Risk Register) includes the actual list of risks, with the risk
probabilities, impacts and planned responses

Risk Management Plan
• Methodologies-The approach, tools, techniques, data sources the team plans to use to manage
risk on the project
• Roles and responsibilities- A defined role with clear responsibilities for each team member who
will play a part in the project’s risk activities
• Budgeting - Estimates of the financial resources that will be needed for the implementation of each
risk activity, to be included in the project’s Cost Baseline (CBL). Also included here are the
procedures to be used in applying Contingency and Management Reserves
• Timing -When and how frequently the Risk Management processes will be performed during the
project
• Risk categories- The risk categorization activity is often performed using a Risk Breakdown
Structure (RBS), which shows graphically the areas in which risks may arise. Areas that are broken
down typically include technical, organizational, project management and external
Plan Risk Management - Output

• Tracking - How risk activities will be documented for the current project and how risk management
process will be audited
• Definitions of risk probability and impact -All identified risks are rated in terms of
priority in the Perform Qualitative Risk Analysis process, typically with the use of a Probability
and Impact (P-I) Matrix. However, for the P-I values that populate the matrix to be meaningful,
definitions must be established
• Probability and impact matrix -To be used in the following process, Perform Qualitative Risk
Analysis, but selected in this process from the OPAs and tailored as necessary to fit the needs of the
project
Risk Management Plan .. contd.
• Revised stakeholder’s tolerances - tolerances may need to be revised here
• Reporting formats - How would the results of the risk management process be documented,
analyzed, and communicated with the content and format of the risk register as well as any other risk
reports required

Requirements
Technology
Complexity &
Interfaces
Performance &
Reliability
Quality
TECHNICAL
Subcontractors &
Suppliers
Regulatory
Market
Customer
Weather
EXTERNAL
Project
Dependencies
Resources
Funding
Prioritization
ORGANIZATIONAL
Estimating
Planning
Controlling
Communication
PROJECT
MANAGEMENT
PROJECT
RBS Provide a means for grouping potential causes of risk

Definitions of Risk Probability and Impact

The process of determining which risk may affect the project and documenting their characteristics
11.2 Identify Risks

Information gathering techniques
• Brainstorming
 Here the goal is to obtain a comprehensive list of project risks
 Often performed with a multidisciplinary set of experts who are not part of the team
• Delphi technique
 It is a way to reach a consensus of project risk experts who participate in this technique
anonymously
 Helps reduce bias in the data and having undue influence on the outcome
• Interviewing
 Helps to identify risks after interviewing project participants, stakeholders and subject matter
experts (SMEs)
• Root cause analysis
 It is a specific technique to identify a problem, investigate the underlying causes that lead to it
and develop preventive actions to avoid from happening again
Identify Risks –T &T

• Cause and effect diagrams
 Also known as Ishikawa or fishbone diagrams
 Useful for identifying causes of risks
• System or process flow charts
 Shows how various system elements interrelate and mechanism of causation
• Influence diagrams
 Are graphical representations of situations showing causal influences, time ordering of events
and other relationships among variables and outcomes (refer example shown below)
Project
Estimates
Risk
Condition
Project ActivityDeliverables
Project
Estimates
Risk
Condition
Project ActivityDeliverables
Diagramming techniques
Identify Risks –T &T

Risk Register
1. Identified Risk
2. Root Cause
3. Potential Response
Identify Risks - Output

The process of prioritizing risks for further analysis of action by assessing and combining
their probability of occurrence and impact
11.3 Perform Qualitative Risk Analysis

Risk probability and impact assessment
• Risk probability (p) assessment investigates the likelihood that each specific risk will occur
• Risk impact (i) assessment investigates the potential effect on a project objective such as
schedule, cost, quality, or performance, including both negative effects for threats and positive
effects for opportunities
 For objective analysis the probability and impact rating scales are used
• Risks with low ratings of probability and impact will be included within the risk register as part of
the watch list for future monitoring
Perform Qualitative Risk Analysis –T &T

Probability and Impact Matrix :
Organization should determine which combinations of probability and impact result in a classification of
high risk (Red condition), moderate risk (Yellow condition) and low risk (Green condition)
0.80
0.60
0.40
0.20
0.10
0.10 0.20 0.45 0.90
0.05
0.04
0.03
0.02
0.01
0.09
0.07
0.05
0.03
0.01
0.18
0.14
0.10
0.06
0.02
0.36
0.28
0.20
0.12
0.04
0.72
0.56
0.40
0.20
0.08
0.05
Probability
Impact
The no of steps in the scale are usually established when defining the risk attitude of the organization

Risk Data Quality Assessment
• It involves examining –
 the degree to which the risk is understood AND
 the accuracy, quality, reliability and integrity of risk data
• If data quality is unacceptable, it may be necessary to gather better data
Risk Urgency Assessment
• Risks requiring near-term responses may be considered more urgent to address
• Indicators of urgency or priority could include :
 Probability of detecting the risk
 Time to implement a risk response
 Symptoms and warnings signs
 Risk Urgency rating (H / M / L)

• List of risks, which you don’t want to forget about, but which you don’t need to track closely
• You will keep a watch on this list from time to time to keep an eye on things
Watch Lists –T &T

Risk Register Updates
4. Identified Risk
5. Root Cause
4. Category
5. Sub-Category
6. Prob. of Occurrence(%)
7. Impact on which of the project objective(s) ?
8. Impact (%)
9. Risk Ranking (H/M/L)
10. Occurring in near term ?
11. Time to implement response for near term risk
12. Risk Urgency/Priority rating (H/M/L)
Perform Qualitative Risk Analysis - Output

The process of numerically analyzing the effect of identified risks on overall project
objectives. If not necessary, this process may be skipped
11.4 Perform Quantitative Risk Analysis

• Process is performed on risks that have been prioritized by the perform qualitative risk analysis
process as potentially and substantially impacting the project’s competing demands
• It analysis the impact of those risks on project objectives
• It is mostly used to evaluate the aggregate effect of risks on projects
• The project manager should use expert judgment to determine the need for the viability of
quantitative risk analysis
• This process should be repeated , as part of, the control risk process to determine if the overall
project risk has been satisfactorily decreased
Perform Quantitative RiskAnalysis - Activities

Data Gathering and RepresentationTechniques
• Interviewing
• Probability Distribution
Quantitative Risk Analysis and ModelingTechniques
• SensitivityAnalysis
• Expected MonetaryValue (EMV)
• Modeling and Simulation (e.g. Monte Carlo Analysis)
Perform Quantitative RiskAnalysis –T &T

Data Gathering and RepresentationTechniques -
Interviewing
The information
needed depends upon
the type of probability
distributions that will
be used

Modeling and Simulation (Monte CarloTechnique): A technique that uses simulation to show
the probability of completing your project on time and within budget
• Overall risk of the project is determined and not the activities
• Probability of completing the project on a specific day and within the specified cost is determined
• All the path convergence in the network diagrams are considered
• Impacts to your schedule and budget is evaluated
• Since the mathematical computations are very complicated, analysis is usually done with a
computer program
• Creates triangular, beta, uniform and lognormal probability distributions

ModelingTechniques - Sensitivity Analysis
* A quantitative risk analysis and modeling technique used
• To help determine which risks have the most potential impact on the project
• To examine the extent to which the uncertainty of each project element affects the
objective being examined when all other uncertain elements are held at their
baseline values
• To display results in the form of aTornado diagram
 is useful for comparing relative importance and impact of variables that have a high
degree of uncertainty to those that are more stable
 is also helpful in analyzing risk-taking scenarios enabled on specific risks whose
quantitative analysis highlights possible benefits greater than corresponding identified negative
impacts

ModelingTechniques -
Sensitivity Analysis : Example of aTornado diagram
• is a special type of bar chart used in sensitivity analysis for comparing the relative importance of
the variables
• theY-axis contains each type of uncertainty at base values, and the X-axis contains the spread or
correlation of the uncertainty to the studied output
• each uncertainty contains a horizontal bar and is ordered vertically to show uncertainties with a
decreasing spread from the base values

Sensitivity Analysis : Characteristics of aTornado diagram
• The longer the bar the more sensitive the project objective is to the risk
• The risks are presented in descending order, with the largest impact on the top and the least impact
on the bottom
• It allows the team to focus on those risks with the greatest impact on a project objective

What is Expected MonetaryValue (EMV) ?
* Is a statistical concept that calculates the average outcome when the future includes
scenarios that may or may not happen
• EMV of opportunities are generally expressed as positive values (+), whereas of threats are
expressed as negative values (-)
• EMV for a project is calculated by multiplying the value of each possible outcome by its probability
of occurrence and adding the products together
• Most common method of this analysis is by using DecisionTree Analysis

Risk register updates
13. Probabilistic analysis of the project
14. Probability of achieving cost and time
objectives
15. Prioritized list of quantified risks
16. Any trends observed ?
17. Expected MonetaryValue (EMV)
13. Identified Risk
14. Root Cause
16. Category
17. Sub-Category
20. Impact (%)
21. Risk Raking (H/M/L)
Perform Quantitative RiskAnalysis - Output

The process of developing options and actions to enhance
opportunities and to reduce threats to project objectives
11.5 Plan Risk Responses

• It includes the identification and assignment of one person (an owner for risk response) to take
responsibility for each agreed-to and funded risk response
• Risk responses should be
 appropriate for the impact of the risk,
 cost-effective in meeting the challenge,
 realistic within the project context,
 agreed upon by all parties involved and owned by a responsible person
• Selecting the optimum risk response from several options is often required
Plan Risk Responses

Risks
Negative
[Threats]
Positive
[Opportunities]
Risk that may
have positive
impacts on
project
objectives if
they occur
Risk that may
have negative
impacts on
project
objectives if
they occur
Avoid
Mitigate
Transfer
Acceptance
Exploit
Share
Enhance
Plan Risk Responses – Risk Response Strategies

Strategies for Negative Risks
Avoid
• Risk avoidance is to eliminate the threat posed by an adverse risk
e.g. changing the project management plan to eliminate the threat entirely OR to change the
objective that is in jeopardy such as extending the schedule, changing the strategy or reducing
scope OR to shut down the project entirely OR during the initial stages of the project,
clarifying requirements, obtaining information, improving communication or acquiring
expertise
Transfer
• Requires shifting the negative impact of a threat, along with ownership of the response,
to a third party
• Involves payment of a risk premium to the party taking on the risk e.g. insurance, performance
bonds, warranties, guarantees, etc.
Plan Risk Responses –T &T

Mitigate
• It implies a reduction in the probability and / or impact of an adverse risk event to an
acceptable threshold
• ‘Transference’ is a form of mitigation
e.g. adopting less complex processes, conducting more tests, or choosing a more stable supplier
Sr.No. Strategy Example of Risk Risk Response
1 Avoid
Obsoleteness of Product due to delay
in launch
Marketing analysis to ensure latest
desired features in product
2 Transfer
Penalties, expenses due to accidents.
Labor head count increases long term
liability
Insurance
Outsourcing
3 Mitigate Resource failure
Contingency Plans, Backup
resources, Redundancy

Accept
It is a strategy that is adopted because it is seldom possible to eliminate all risk from a project
• It indicates that the project team :
 Has decided not to change the project management plan to deal with risk OR
 Is unable to identify any other suitable response strategy
Active Acceptance most commonly involves establishing a contingency reserve, is to
establish a contingency reserve, including amounts of time, money, or resources to handle the risks
Passive Acceptance requires no action except to document the strategy, leaving the project team
to deal with threats or opportunities as they occur and to periodically review the threat to ensure that
it does not change significantly
7/24/201742 www.testudaan.com

Exploit
• It seeks to eliminate the uncertainty associated with a particular upside risk by making the
opportunity definitely happen
• It may be selected for opportunities where the organization wishes to ensure that it is
realized
• It is analogous to‘Avoidance’
e.g. assigning more talented resources to the project to reduce time to completion OR to
provide better quality than originally planned OR using new technologies OR technology
upgrades to reduce cost and duration required to realize project objectives
Share
• It involves allocating some or all of the ownership of the opportunity to a third-
party, who is best able to capture the opportunity for the benefit of the project
• It is analogous to‘Transference’ e.g. forming risk-sharing partnerships OR joint ventures
Strategies for Positive Risks

Strategies for Positive Risks
Enhance
• It modifies the size of an opportunity to increase probability and / or positive impacts by
reinforcing it’s trigger conditions
• It is analogous to‘Mitigation’e.g. adding more resources to an activity to finish early
Accept
• Accepting an opportunity is being willing to take advantage of the opportunity if it arises, but not
actively pursuing it .
Sr.No. Strategy Example of Risk Risk Response
1 Exploit
Availability of new technology enhances
performance
AcquireTechnology
2 Share
Large contract needing lots of man-
power, and end-to end responsibility
Outsourcing Activities, Partnering
with others having core competency
3 Enhance
New government policy being formed,
new tender being designed
Make presentation to educate and
influence into your own product
specifications

• Risk owners and assigned responsibilities
• Agreed-upon response strategies
• Specific actions to implement the chosen response strategy
• Trigger conditions, symptoms, and warning signs of a risk occurrence
• Budget and schedule activities required to implement the chosen responses
• Contingency plans and triggers that call for their execution
• Fallback plans for use as a reaction to a risk that has occurred and the primary response proves to be
inadequate
• Contingency reserves that are calculated based on the quantitative risk analysis of the project and the
organization’s risk thresholds
Plan Risk Responses – Output

Residual Risks
• that are expected to remain after planned responses have been taken, as well as those that have been
deliberately accepted
Secondary risks
• that arose as a direct outcome of implementing a risk response

18. Risk triggers
19. Risk symptoms
20. Risk warnings
21. Risk response owners
22. Risk response strategy
23. Any specific actions to implement
response strategy
24. Contingency plans for responses
25. Fall-back plans
26. Residual risk ?
27. Secondary risks ?
28. Contingency Reserves
29. Risk status
30. Remarks
18. Identified Risk
19. Root Cause
21. Category
22. Sub-Category
25. Impact (%)
26. Risk Raking (H/M/L)
30. Probabilistic analysis of the project
31. Probability of achieving cost and time objectives
32. Prioritized list of quantified risks
33. Any trends observed ?
34. Expected MonetaryValue (EMV)

The process of (a) implementing risk response plans, (b) tracking identified risks, (c)
monitoring residual risks, (d) identifying new risks and (e) evaluating risk process
effectiveness throughout the project
11.6 Control Risk

Risk Reassessment
• Determining if project assumptions are still valid
• Determining if contingency reserves of cost or schedule should be modified in line with the
project risks
• Analysis may show that an assessed risk has changed or can be retired
Risk Audits
• Risk management policies and procedures are being followed
• Updating the organizational process assets, including lessons learned databases and risk
management templates for the benefit of future projects
The Risk Response Owner reports periodically to the Project Manager on :
 The effectiveness of the Risk Response Plan
 Any unanticipated effects and
 Any mid-course correction needed to appropriately handle risks
Control Risks –T &T

Change Requests
 Implementing contingency plans or workaround may result in a change request
*Workaround: is a response to a threat that has occurred, for which a prior
response had not been planned or was not effective
Control Risks – Output

Thank you
Saraca Solutions Pvt. Ltd.

8. Risk Management

Recommandé

Recommandé

Contenu connexe

Plus de Sanjay Rajpoot

Plus de Sanjay Rajpoot (13)

Dernier

Dernier (20)

8. Risk Management