Risk management is essential for any significant project. Certain information about key project cost, performance, and schedule attributes are often unknown until the project is underway.

1. Niwot Ridge LLC, Copyright 2016
MANAGING COST, SCHEDULE, & TECHNICAL PERFORMANCE RISK IS THE BASIS OF GOOD PROJECT MANAGEMENT
Riskmanagement is essential for anysignificant project. Certaininformation about
keyproject cost, performance, andschedule attributes are oftenunknownuntil the
project is underway. The emergingrisks that canbe identifiedearlyinthe project that
impact the project later is often termed“knownunknowns.” These risks canbe mitigated
with a goodriskmanagement process. For risks that are beyondthe visionof the project
team a properlyimplementedriskmanagement process can also rapidlyquantifythe risks
impact and provide soundplans for mitigating its affect.
Riskmanagement is concernedwiththe outcome of future events, whose exact
outcome is unknown, andwith how to deal withthese uncertainties. Outcomes are
categorized as favorable or unfavorable, and riskmanagement is the art andscience of
planning, assessing, handling, andmonitoring future events to ensure favorable
outcomes. A goodriskmanagement process is proactive and fundamentallydifferent
than issue management or problem solving, whichis reactive.
Riskmanagement is animportant skill that can be applied to a wide varietyof projects. In an era of downsizing, consolidation,
shrinkingbudgets, increasing technologicalsophistication, andshorter development times, risk management providesvaluable insights to
helpkeyproject personnel plan for risks, alert themof potential risk issues, analyze these issues, and develop, implement, andmonitor
plans to address risks longbefore theysurface as issuesand adverselyaffect project cost, performance, andschedule.
HOPE IS NOT A STRATEGY
Hoping that the project will proceed as plannedis naïve at best and poor management
at worse. Project Managers constantlyseekways to eliminate or control risk, variance
and uncertainly. Thisis a hopeless pursuit. Managing “in the presence” of risk, variance
and uncertaintyis the keyto success. Some projects have few uncertainties –onlythe
complexityof tasks and relationships is important – but most projects are characterized
byseveral types of uncertainty. Althougheachuncertaintytype is distinct, a single project
mayencounter some combination offour types:
 Variation – comes from manysmall influencesandyields a range of valueson a
particular activity. Attemptingto control these variances outside their natural
boundaries is a waste (Muda)
 Foreseen Uncertainty – are uncertaintiesidentifiable and understoodinfluences
that the teamcannot be sure will occur. There needs to be a mitigationplanfor
these foreseen uncertainties.
 Unforeseen Uncertainty – is uncertaintythat can’t be identified during project
planning. Whenthese occur, a new planis needed.
 Chaos – appears with the presence of “unknownunknowns”
The Planfor the project is the Strategyfor its successful completion ThisPlanneeds to define:
 How the products andservices willbe “matured” as the project progresses
 What are the “units of measure” for this increasing maturity
 At what points inthe project willthis maturitybe assessedbe assessed to confirmprogress is being made
Risk Management in Five Easy
Pieces with apologies to Jack
Managing Risk is how adults manage
projects
 Hope is not a strategy
 No point estimate of cost or schedule
can be correct
 Without integrating cost, schedule,
and technical performance you are
drivinginthe rear viewmirror
 Without a model for riskmanagement,
you are driving in the dark withthe
headlights off
 Riskmanagement means
communicationmanagement
Strategy is the Plan to Successful
Complete the Project
 When General Custer was completely
surrounded, hischief scout asked,
“General what's our strategy?” Custer
replied, “The first thing we needto do
is make a note to ourselves – never
get in this situation again.”
 If the project’s success factors, the
processes that deliver them, the
alternatives whentheyfail, and the
measurement of this success are not
definedinmeaningful ways for both
the customer andmanagers of the
project – Hope is the onlystrategyleft.

2. Hope Means A Plan Means
I hope we can get done bythe weekend withthe integration
test. We’ll work as hardas we can to get done byMonday
morning. If not we’ll make it upin System Test.
If we don’t get the integration test done byFriday, well
release without features A, B and F
I hope the control bus will be fast enoughfor the command
loop.
If the control bus is not fast enough, we’ll run twoinparallel
until the new versionis complete.
I hope we’llhave enoughmanagement reserve to complete
the project onbudget. We’llwatch the budget expenditures
real close andlet you know if we’ll needmore money
At each 20% budget absorptionlevel, we’ll confirm our
deliverables value (BCWP) matchis investment value (BCWS)
and adjust our forecast for management reserve ona monthly
basis.
Hope must be replaced witha risktolerant plan. Inthis planlarger varaincescanbe tolorated inthe earlyparts of the project. But as the
project proceeds the toleance for riskmust bne reduced. At the endof the project all the risks must have beenretired.
NO POINT ESTIMATE OF COST OR DURATION CAN BE CORRECT
The use of point estimates for durations and costs is the first impulse inan
organizationlowon the project management maturityscale. Understanding cost and
durations are actually“random variables,” drawnfrom an underlyingdistribution of
possible value is the starting point for managing in the presence of uncertainty. In
probabilitytheory, everyrandom variable is attributedto a probabilitydistribution. The
probabilitydistributionassociatedwitha cost or durationdescribes the variance ofthese
randomvariables. A commondistributionof probabilistic estimates for cost andschedule
randomvariables is the Triangle Distribution.
The Triangle Distribution is used as a subjective descriptionof a populationfor which
there is onlylimitedsample data, andespeciallywhere the relationshipbetweenvariables
is knownbut data is scarce. It is basedon the knowledge of the minimumandmaximum
and a “best guess” ofthe modal value (the Most Likely). Using the Triangle Distribution
for the costs anddurations, a Monte Carlosimulationof the network ofactivitiesandtheir costs can be performed. Monte Ca rlo methods
are usedto numericallytransform andintegrate the posterior quantitative risk assessment intoa confidence interval. The result is a
“confidence” modelfor the cost andcompletiontimesfor the project basedon the upper and lower bounds of each distribution assigned
to each durationandcost. This approach to estimatingprovides insight intothe behavior of the plan as wellas sensitivitybetweenthe
individualelements of the plan.
The notionthat project task durations are random variablesis the foundationof programmatic risk management. The numeric va lue
of a durationor a cost is actuallydrawnfrom a probabilitydistribution. This distributionrepresents the range ofallpossible value of the
durationor cost. The shape ofthe probabilitydistributiondescribes howmanyof the possible values willappear whendrawnfrom the
distribution. When a “Point Estimate” is usedfor the duration andcost, this number is onlyone ofallthe possible valuesthat could occur.
Without anunderstanding of the statistical nature of these values, there is no understanding of how “confident” we shouldbe in the
number.
Points Estimates are Always Wrong
 A Single Point Estimate uses sample
data to calculate a single value which
serves as a "best guess" for an
unknown populationparameter.
 A BayesianInference is a statistical
inference inwhich evidence or
observations are usedto infer the
probabilitythat a hypothesis maybe
true.
 Without this statistical information
anystatements about cost, schedule
and completion dates or costs are
simply50/50 guesses

3. Estimatingis a veryvague art inthe absence of a formal process. One place to start is with the statistical definitionof an“estimate.”
But event that definitionhasthree (3) different possibilities:
 The Mode is the most likelyvalue. The value that occurs most oftenwhenstatisticalsamples are drawnfrom the underlying
population.
 The Medianis the “middle” value between the highest andlowest value from the total of all samplesdrawnfrom the underlyi ng
statisticalpopulation.
 The Meanis the “average” of allthe samples drawnfromthe population.
The most important concept is to understandthat the “sum” ofallthe “estimates” is never one ofthese three estimates. The details
of this are beyondthe scope ofthis presentationbut it hasto do with“summing” probability distributions is not actuallya summation
process – it is a convolution process. This means that the probabilitydistribution – representedbyan integral equation – is convolved
with the other integralequations.
When we speakinterms like “Best Estimate” we needto understandwhat that reallymeans. Does the “Best Estimate” mean?
 The Most Likely– this is the Mode
 The 50th percentile – this is the Median
 The expected value – this is the Mean
In all caseswhenthe individualestimatesare “rolledup” theyNEVER mean one of these.
One simple approach to cost and schedule estimating inthe presence of uncertainty
is to use a Triangle Distributionfor the possible valuesof the estimate. A triangle
distribution providesa convenient wayto represent uncertainties where values toward
the middle ofthe range of possible values are consideredmore likelyto occur than
values near either extreme. Although not a traditionaldistribution, the arbitraryshape
and “sharpcorners” of triangle distributionis a convenient wayto state that the details
of the shape ofthe distributionare not preciselyknown. This mayhelpto prevent over
interpretationor false sense of confidence insubtle details ofthe results [Morgan, M.
and Henrion, M., Uncertainty:A Guide to Dealing with Uncertainty in Quantitative Risk
and Policy Analysis, Cambridge UniversityPress, Cambridge, UnitedKingdom, 1990]. A
triangle distributionis a gooddistributionto use earlyin expert elicitationsince it is easy
to obtain judgments for it.
Triangle distributions are useful whenis limitedinformationabout the characteristics ofthe randomvariables are allthat is
available. Since point estimatesare always wronga methodis needed to produce probabilistic estimates. Table 1 describes how to move
from Point Estimatingto Probabilistic Estimating.
Deterministic Estimating Probabilistic Estimating
Simple calculation ofcriticalpath basedinPoint Estimatesof
duration
Requires assessment of variances for eachrisk classanda
Monte Carlomodel using those variance to determine the
confidence interval onthe target durationor cost
Single valued estimatesusedfor cost andschedule duration
are gathered fromhistorical or subject matter experts
Definedprobabilitydistributionfunction(Triangle)with
parametric ranges is produced from historicalor Delphi
processes.
Cannot quantifyriskinanymeaningful wayother that the
“opinion” of the participants.
Riskdefinedin terms of confidence ofcompleting onor
before a date using a 5x5 riskqualification process.
Criticalityof anactivityis either true or not true, but not
assessment of the impact or mitigationof those impacts
Criticalityof anactivityis probabilistic andcorrelated to the
network paths, impacts onthose paths andmitigations.
Suitedof “simple” project management approaches which
are rare inthe modern technologyworld.
Suitedfor realistic project management by“managing under
uncertainty” and“variability” are the norm.
Table 1 – understanding that Point Estimates are always wrong means that probabilistic estimates are neededto produce a
credible cost andschedule.

4. WITHOUT INTEGRATING COST, SCHEDULE & TECHNICAL PERFORMANCE YOU’RE DRIVING IN THE REARVIEW MIRROR
Addressing customer satisfactionmeans incorporating products requirements and
planned qualityintothe Performance Measurement Baseline to assure the true
performance of the project is made visible.
Connecting Cost, Schedule, andTechnical Performance Measurescloses the loopon
how well a project is achieving its technical performance requirements while maintaining
its cost andschedule goals. IEEE 1220, EIA 632 and"A Guide to the Project Management
Bodyof Knowledge“allprovide guidance for TPMplanning andmeasurement andfor
integratingTPMwith cost and schedule performance measures (Earned Value).
Integrating these three attributesresults ina Performance Measurement Baseline
processes which is distinguishedfrom traditional cost andschedule management in
several ways. The Performance Measurement Baseline:
 Is a plandriven byproduct quality requirements, not work requirements?
 Focuses ontechnical maturityand quality, inaddition to cost and schedule.
 Focuses onprogress toward meeting success criteria of technical reviews.
 Enables insightful variance analysis.
 Ensures a leanandcost-effective approach to project planningandcontrols.
 Enables scalable scope and complexitydependingon risk.
 Integrates riskmanagement activities withthe performance measurement baseline.
 Integrates riskmanagement outcomes intothe Estimate at Completion.
WITHOUT A MODEL FOR RISK MANAGEMENT, YOU’RE DRIVING IN THE DARK WITH THE HEADLIGHTS OFF
Technical performance is a concept absent from the traditional
approaches to risk management. Yet it is the primarydriver of riskin
manytechnologyintensive projects. Cost growthandschedule slippage
often occur whenunrealisticallyhigh levels of performance are required
and little flexibilityis providedto degrade performance during the course
of the program. Qualityis often a cause rather thanan impact to the
program andcangenerallybe broken downintoCost, Performance, and
Schedule components.
The framework shown here provides:
 Riskmanagement policy
 Riskmanagement structure
 RiskManagement Process Model
 Organizational andbehavioralconsiderations for implementingrisk
management
 The performance dimensionof consequence ofoccurrence
 The performance dimensionof Monte Carlosimulationmodeling
 A structured approachfor developing a riskhandling strategy
RISK MANAGEMENT MEANS RISK COMMUNICATIONS
An interactive process of exchange of informationandopinionamong individuals, groups, and institutions;often involves multiple
messages about the nature ofriskor expressing concerns, opinions, or reactions to riskmessages or to legal or institutionalarrangements
for risk management. Risk communication is the basis of riskmitigation. It serves no purpose to have a riskplanandthe defined
mitigations inthe absence of a riskcommunicationplan.
The RiskManagement Communications Planmust address:
 Identifyrisks for project cost andschedule
 Model the behavior of these risks andtheir impact on the project
Cost, Schedule, and Technical
Performance are the basis of risk adjust
performance measurement
Risk Management means using a proven risk
management process, adapting this to the project
environment, and using this process for everyday
decision making

5.  Development RiskHandlingprocesses tailored to the businessdomain
 Provide oversight, advice, guidance andcontrol systems associated withProgrammatic Riskmanagement
SUMMARY
Riskmanagement is a continuous process applied throughout the project life cycle. It is anorganizedmethodologyfor continuously
identifying andmeasuring unknowns;developing mitigationoptions;selecting, planning, andimplementing appropriate riskmitigations;
and trackingthe implementationto assure successful risk reduction. Effective risk management depends onrisk management planning;
earlyidentification and analysis ofrisk;earlyimplementationof corrective actions;continuous monitoring and reassessment;and
communication, documentationandcoordination.
ABOUT THE AUTHOR
Glen B. Alleman is a principle of Niwot Ridge LLC, Niwot Colorado. Glen’s primaryrole is the development of Program Planning and
Controls processes for his aerospace anddefenseclients. These practices start with the Integrated Master PlanandIntegratedMaster
Schedule (IMP/IMS)paradigm. Using Glen’s bookPerformance-BasedProject Management® a riskadjustedplanis developedthat
assures the Program Management Office that both programmatic and technicalrisks are identifiedandmitigated. Glenalsofocuses on
BalancedScorecard performance management processes for large, complex andriskyprograms. Bycombining IMP/IMS, PBEV, and
BalancedScorecard a performedbasedstrategyfor successful project deliverycanbe constructedandexecuted.