Create a risk breakdown structure for John's move shown on Figure 11.5.
Copy and fill in all the text in the Excel Template I have provided for you here: Risk Breakdown Structure.xlsxDownload Risk Breakdown Structure.xlsx
Add your name, and save a copy to your hard or flash drive.
Then upload the file to the assignment.
CHAPTER 11
Project Risk Management
Understanding and managing risk on a project is one of the most important responsibilities of the project manager. Because projects, by definition, are unique, the likelihood of encountering unex- pected events that affect the project performance is higher that in most organizations. Managing risk on projects includes developing the methods, processes, and tools for identifying, assessing, and developing a plan to address every risk appropriately. It also includes managing the risk plan throughout the life of the project.
Typically, there is a correlation between the risk on a project and the complexity level of the project. Project risk increases as the complexity of the project increases. The project risk plan addresses the unique aspects of the project and the complexity level of the project.
11.1 Defining Risk
Learning Objectives
1. Define project risk.
2. Define the difference between known and unknown risks.
3. Describe the difference between overall project risk and individual project risk.
Individual project risk is an uncertain event or condition that, if it occurs, has a positive or negative effect on at least one project objective.[1] Examples of individual project risks include a weather event that delayed the project schedule, a critical team member who resigned, or a computer error that destroyed project data at a critical stage in the project.
The 2017 version of the Project Management Body of Knowledge also identifies overall project risk. This term refers to the “effect of uncertainty on the project as a whole, arising from all sources of uncertainty including individual risks, representing the exposure of the stakeholders to the implications of variations in project outcome, both positive and negative” (p. 397).
Organizational or business purpose risks would be one form of total project risk. For example, a project is chartered to design and construct a copper mine at a cost not to exceed $1.2 billion. If the price of copper drops below the profit threshold for the company, the organizational goals of the project may not be achieved. The price of copper is an organizational or business risk. The cop- per mining company authorized the project based on assumptions about the future price of copper. The price of copper is an overall project risk because 1) the price is uncertain and 2) if the price of copper drops below the threshold, the project could be canceled (variation in outcome) and stake- holders exposed to consequences of the closing of the project.
Risk management focuses on identifying and assessing the risks to the project and managing those risks to minimize the impact on the project. There are no risk-free projects because there is an infinite number of events that can have a negative effect on the project. Risk management is not about eliminating risk but about identifying, assessing, and managing risk.
© 2018 Boston Academic Publishing, Inc., d.b.a. FlatWorld. All rights reserved.
C re
at ed
e xc
lu si
ve ly
fo r
S co
tt B
ro w
n <
sb ro
w n@
ce rr
ito s.
ed u>
known risks
Risks that can be anticipated, such as exceptionally bad weather.
overall project risks
Possible loss that is associated with the business purpose of the project.
Tzvi Raz, Aaron Shenhar, and Dov Dvir[2] studied the risk management practices on one hun- dred projects in a variety of industries. The results of this study suggested the following about risk management practices:
• Risk management is not widely used.
• The projects that were most likely to have a risk management plan were those that were per- ceived to be high risk.
• When risk management practices were applied to projects, they appeared to be positively related to the success of the project.
• The risk management approach influenced the meeting of project schedules and cost goals but exerted less influence on project product quality.
• Good risk management increases the likelihood of a successful project.
Risk deals with the uncertainty of events that could affect the project. Some potential negative project events have a high likelihood of occurring on specific projects. Examples are as follows:
• Safety risks are common on construction projects.
• Changes in the value of local currency during a project affect purchasing power and budgets on projects with large international components.
• Projects that depend on good weather, such as road construction or coastal projects, face risk of delays due to exceptionally wet or windy weather.
• The project deliverables do not meet customer expectations on an IT Project.
These are examples of known risks. Known risks are events that have been identified and ana- lyzed for, which advanced planning is possible. Other risks are unknown or unforeseen.
Hurricane Damage
A project to conduct field trials on a new drug that would provide an alternative to opiate pain management depended on supplies of the new drug from the plant in Canovanas, Puerto Rico. Puerto Rico was hit by a hurricane that damaged most of the pharmaceutical plants, and the Canovanas plant will be off line for six months. No alternative supplies of the new drug exist.
Sudden Family Death
Just before a project meeting in Texas, the engineering lead received word that his father had died in the middle of the night. The team delayed making decisions on some critical engineering events without the knowledge and judgment of the engineering manager.
Whole Crew Fails Drug Test
On a project in Texas, the entire twelve-member masonry crew failed the drug screening test even though they had been told that drug screening was required on the project.
These events were unforeseen by the project team, and in all three cases the projects experi- enced schedule delays and additional costs.
Project risks are separate from the overall project risks that are associated with the business purpose of the project.
338 Project Management
© 2018 Boston Academic Publishing, Inc., d.b.a. FlatWorld. All rights reserved.
C re
at ed
e xc
lu si
ve ly
fo r
S co
tt B
ro w
n <
sb ro
w n@
ce rr
ito s.
ed u>
Key Takeaways
• Project risk is the possible outcome that planned events on the project will not occur as planned or that unplanned events will occur that will have a negative impact on the project.
• Known risks can be identified before they occur, while unknown risks are unforeseen.
• Overall project risks are associated with the business purpose of the project and assumed by the client when deciding to do the project.
Exercises
1. According to PMI, project risk is a(n) ___________ event or condition that, if it occurs, has an effect on at least one project objective.
2. A risk such as the future market price of a commodity is an example of a(n) _________ risk.
3. Define risk in your own words.
4. Give an example of a known risk and an unknown risk that are different from those in the text.
5. Describe the difference between overall project risk and individual project risk in your own words and give an example of each that is not used in the text.
Planning for Known and Unknown RisksPlanning for Known and Unknown Risks
Consider a trip that you might be planning. Describe at least five risks that are associated with taking the trip.
11.2 Risk Management Process
Learning Objectives
1. Identify the major elements in managing project risk.
2. Describe the processes for identifying project risk.
3. Describe the processes for assessing project risk.
4. Describe the processes for planning and implementing the risk response.
Managing risks on projects is a process that includes identifying risk, assessing risk, and planning and implementing a risk response. This is a creative process that uses past project experience and knowledge of project environment to imagine possible outcomes. It is also a disciplined process that requires creating and following processes designed to understand and manage the potential risks to the project.
Risk Identification
Identifying risk is a creative process, and project managers often brainstorm potential risks in team meetings designed to address project risks. Subject matter experts are a source of information on potential risks that is valuable in identifying risks on a project.
Chapter 11 Project Risk Management 339
© 2018 Boston Academic Publishing, Inc., d.b.a. FlatWorld. All rights reserved.
C re
at ed
e xc
lu si
ve ly
fo r
S co
tt B
ro w
n <
sb ro
w n@
ce rr
ito s.
ed u>
risk breakdown structure (RBS)
Organization of risks associated with each activity in the work breakdown structure using a similar graphic approach.
A more disciplined process involves using checklists of potential risks and evaluating the like- lihood that those events might happen on the project. Some companies and industries developed risk checklists based on experience from past projects. The Construction Industry Institute[3] devel- oped a detailed checklist of potential risks based on the experience of several large construction companies executing major construction projects. These checklists can be helpful to the project manager and project team in identifying both specific risks on the checklist and expanding the thinking of the team. The past experience of the project team, project experience within the com- pany, and experts in the industry can be valuable sources for identifying potential risk on a project.
Identifying the sources of risk by category is another method for exploring potential risk on a project. Some examples of categories for potential risks include the following:
• Technical
• Cost
• Schedule
• Client
• Contractual
• Weather
• Financial
• Political
• Environmental
• People
The people category can be subdivided. Examples of people risks include the risk of not finding the skills needed to execute the project or the sudden unavailability of key people on the project. David Hillson[4] uses the same framework as the work breakdown structure (WBS) for developing a risk breakdown structure (RBS). A risk breakdown structure organizes the risks that have been identified into categories using a table with increasing levels of detail to the right.
Risks in John’s Move
In John’s move, John makes a list of things that might go wrong with his project and uses his work breakdown structure as a guide. A partial list for the planning portion of the RBS is shown below.
340 Project Management
© 2018 Boston Academic Publishing, Inc., d.b.a. FlatWorld. All rights reserved.
C re
at ed
e xc
lu si
ve ly
fo r
S co
tt B
ro w
n <
sb ro
w n@
ce rr
ito s.
ed u>
FIGURE 11.1 Risk Breakdown Structure (RBS)
The result is a more obvious understanding of where risks are most concentrated. Hillson’s approach helps the project team identify known risks but can be restrictive and less creative in identifying unknown risks and risks not easily found inside the work breakdown structure.
Risk Assessment
After the potential risks have been identified, the project team then evaluates the risk based on the probability that the risk event will occur and the potential loss associated with the event. Not all risks are equal. Some risk events are more likely to happen than others, and the cost of a risk event can vary greatly. Evaluating the risk for probability of occurrence and the severity or the potential loss to the project is the next step in the risk management process.
The Construction Industry Institute conducted a study of large construction project risk eval- uation and categorized risk according to the potential impact of project costs. High-impact risk consisted of risks that could increase the project costs by 5 percent of the conceptual budget or 2 percent of the detailed budget. Only thirty potential risk events met these criteria. These were the critical few potential risk events that the project management team focused on when developing a project risk mitigation or management plan. Risk evaluation is about developing an understanding of which potential risks have the greatest possibility of occurring and can have the greatest nega- tive impact on the project. These become the critical few.
Chapter 11 Project Risk Management 341
© 2018 Boston Academic Publishing, Inc., d.b.a. FlatWorld. All rights reserved.
C re
at ed
e xc
lu si
ve ly
fo r
S co
tt B
ro w
n <
sb ro
w n@
ce rr
ito s.
ed u>
positive correlation
Two variables that respond in the same way to change in their environment.
FIGURE 11.2 Risk and Impact
There is a positive correlation—both increase or decrease together—between project risk and project complexity. A project with new and emerging technology will have a high-complexity rating and a correspondingly high risk. The project management team will assign the appropriate resources to the technology managers to assure the accomplishment of project goals. The more complex the technology, the more resources the technology manager typically needs to meet pro- ject goals, and each of those resources could face unexpected problems.
Risk evaluation often occurs in a workshop setting. Building on the identification of the risks, each potential risk event is analyzed to determine the likelihood of occurring and the potential cost if it did occur. The likelihood and impact are both rated as high, medium, or low. A risk management plan addresses the items that have high ratings on both factors—likelihood and impact.
342 Project Management
© 2018 Boston Academic Publishing, Inc., d.b.a. FlatWorld. All rights reserved.
C re
at ed
e xc
lu si
ve ly
fo r
S co
tt B
ro w
n <
sb ro
w n@
ce rr
ito s.
ed u>
FIGURE 11.3 Risk Analysis Example
Risk Analysis of Equipment Delivery
For example, a project team analyzed the risk of some important equipment not arriving to the project on time. The team identified three pieces of equipment that were critical to the project and would significantly increase the costs of the project if they were late in arriving. One of the ven- dors, who was selected to deliver an important piece of equipment, had a history of being late on other projects. The vendor was in high demand and often took on more work than it could deliver on time. This risk event (the identified equipment arriving late) was rated as high likelihood with a high impact. The other two pieces of equipment were potentially a high impact on the project but with a low probably of occurring.
Not all project managers conduct a formal risk assessment on the project. There are barriers to identifying risks. David Parker and Alison Mobey[5] found in a phenomenological study of project managers that there was a low understanding of the tools and benefits of a structured analysis of project risks. The lack of formal risk management tools was seen as a barrier to implementing a risk management program. The level of investment in formal risk management was also associated with managerial psychological dimensions.
Chapter 11 Project Risk Management 343
© 2018 Boston Academic Publishing, Inc., d.b.a. FlatWorld. All rights reserved.
C re
at ed
e xc
lu si
ve ly
fo r
S co
tt B
ro w
n <
sb ro
w n@
ce rr
ito s.
ed u>
proactive
Making decisions and taking action to anticipate an expected difficulty.
reactive
Making decisions and taking action in response to events.
risk averse
A project manager or decision maker who avoids taking risks.
Monte Carlo simulation
A simulation that uses statistical processes to evaluate risk.
FIGURE 11.4 Risk mitigation.
© 2010 Jupiterimages Corporation
Some project managers are more proactive and will develop elaborate risk management pro- grams for their projects. Other managers are reactive and are more confident in their ability to handle unexpected events without prior planning, while some managers are risk averse and prefer to be optimistic and not consider risks or to avoid taking risks whenever possible.
On projects with a low complexity profile, the project manager may informally track items that may be considered risk items. On more complex projects, the project management team may develop a list of items perceived to be higher risk and track them during project reviews. On pro- jects with greater complexity, the process for evaluating risk is more formal, with a risk assessment meeting or series of meetings during the life of the project to assess risks at different phases of the project. On highly complex projects, an outside expert may be included in the risk assessment process, and the risk assessment plan may take a more prominent place in the project management plan.
On complex projects, statistical models are sometimes used to evaluate risk because there are too many different possible combinations of risks to calculate them one at a time. One example of the statistical model used on projects is the Monte Carlo simulation, which simulates a possible range of outcomes by trying many different combinations of risks based on their likelihood. The output from a Monte Carlo simulation provides the project team with the probability of an event occurring within a range and for combinations of events. For example, the typical output from a Monte Carol simulation may reflect that there is a 10 percent chance that one of the three impor- tant pieces of equipment will be late and that the weather will also be unusually bad after the equipment arrives.
Color-Coded Risks
Some projects use a Red, Yellow, Purple color scheme to highlight risks that need more attention. A project manager on a chemical plant retrofit project required everyone on the project to be updated and know every red risk and would often test team members during project meetings. This was an effective way to increase awareness of risks on the project.
Plan Risk Response
After the project team identifies and analyzes the risks for the project, the project team develops a plan for addressing the risks. The risk response focuses on developing strategies for reducing the probability of occurring if the risk impact is negative and increasing the probability of occurring if the risk presents a positive outcome for the project. Below are approaches to reducing the potential impact of risks to the project:
• Risk avoidance
• Risk mitigation
• Risk transfer
• Risk escalation
• Risk acceptance
344 Project Management
© 2018 Boston Academic Publishing, Inc., d.b.a. FlatWorld. All rights reserved.
C re
at ed
e xc
lu si
ve ly
fo r
S co
tt B
ro w
n <
sb ro
w n@
ce rr
ito s.
ed u>
Risk avoidance
Changing the project plan to eliminate a risk.
Risk sharing
Partnering with others to share responsibility for the risk activities.
Risk reduction
Investment of funds to reduce the risk on a project.
Risk Avoidance
Risk avoidance usually involves developing an alternative strategy that has a higher probability of success but usually at a higher cost associated with accomplishing the project work. A common risk avoidance technique is to use proven and existing technologies rather than adopt new tech- niques, even though the new techniques may show promise of better performance or lower costs. A project team may choose a vendor with a proven track record over a new vendor that is providing significant price incentives to avoid the risk of working with a new vendor. The project team that requires drug testing for team members is practicing risk avoidance by avoiding damage done by someone under the influence of drugs.
Risk Sharing
Risk sharing is a form of risk mitigation that involves partnering with others to share responsibil- ity for the risk activities. Many organizations that work on international projects will reduce political, legal, labor, and others risk types associated with international projects by developing a joint venture with a company located in that country. Partnering with another company to share the risk associated with a portion of the project is advantageous when the other company has expertise and experience that the project team does not have. If the risk event does occur, then the partnering company absorbs some or all of the negative impact of the event. The company will also derive some of the profit or benefit gained by a successful project.
Risk Sharing on Pipeline in Peru
One example of risk sharing is a large United States construction firm that won a contract to build a pipeline in Peru. The company partnered with a construction company in Peru with a reputation for performing on time. The Peruvian company brought local expertise and the U.S. company contributed the latest construction methods. If the project had not successfully completed on time, both companies would have received less profit, but the project was successful and both companies met profit targets.
Risk Reduction
Risk reduction is a form of risk mitigation that includes an investment of resources to reduce the potential impact of risk events on a project. On international projects, companies will often pur- chase the guarantee of a currency rate to reduce the risk associated with fluctuations in the currency exchange rate. A project manager may hire an expert to review the technical plans or the cost estimate on a project to increase the confidence in that plan and reduce the project risk. Assigning highly skilled project personnel to manage the high-risk activities is another risk reduc- tion method. Experts managing a high-risk activity can often predict problems and find solutions that prevent the activities from having a negative impact on the project. Some companies reduce risk by forbidding key executives or technology experts to ride on the same airplane.
Risk-Reduction Example
On a medical project to vaccinate children after a hurricane, the project team identified accidental punctures of the nursing staff as a medium possibility but high-impact risk. The project adopted procedures and provided extra training to reduce this risk, even though all the nurses were highly qualified.
Chapter 11 Project Risk Management 345
© 2018 Boston Academic Publishing, Inc., d.b.a. FlatWorld. All rights reserved.
C re
at ed
e xc
lu si
ve ly
fo r
S co
tt B
ro w
n <
sb ro
w n@
ce rr
ito s.
ed u>
Risk transfer
Risk transfer is the risk mitigation process of shifting the possible negative impact of an event to a party outside the project.
Contingency Plan
The project risk plan balances the investment of the mitigation against the benefit for the project. The project team often develops an alternative method for accomplishing a project goal when a risk event has been identified that may frustrate the accomplishment of that goal. These plans are called contingency plans. The risk of a truck drivers’ strike may be mitigated with a contingency plan that uses a train to transport the needed equipment for the project. If a critical piece of equip- ment is late, the impact on the schedule can be mitigated by making changes to the schedule to accommodate a late equipment delivery.
Contingency funds are funds set aside by the project team to address unforeseen events that cause the project costs to increase. Projects with a high-risk profile will typically have a large con- tingency budget. Although the amount of contingency allocated in the project budget is a function of the risks identified in the risk analysis process, contingency is typically managed as one line item in the project budget.
Some project managers allocate the contingency budget to the items in the budget that have high risk rather than developing one line item in the budget for contingencies. This approach allows the project team to track the use of contingency funds against the risk plan. This approach also allocates the responsibility to manage the risk budget to the managers responsible for those line items. The availability of contingency funds in the line item budget may also increase the use of contingency funds to solve problems rather than finding alternative, less costly solutions. Most project managers, especially on more complex projects, will manage contingency funds at the pro- ject level, with approval of the project manager required before contingency funds can be used.
Risk Transfer
Risk transfer is a risk reduction method that shifts the risk from the project to another party. The purchase of insurance on certain items is a risk transfer method. The risk is transferred from the project to the insurance company. A construction project in the Caribbean may purchase hurricane insurance that would cover the cost of a hurricane damaging the construction site. The purchase of insurance is usually in areas outside the control of the project team. Weather, political unrest, and labor strikes are examples of events that can significantly affect the project and that are out- side the control of the project team. Purchasing insurance transfers this risk to the insurance company. It also reduces the potential profitability of the project.
Contract provisions is another technique for transferring risk. For example, a construction contract may include a provision for extending the deadline for project completion if significant weather causes the delay. The contract provision transfers the weather delay risk from the contrac- tor to the client.
Risk Escalation
Risk escalation applies to overall project risk that is not specific to the individual project. The pro- ject escalation applies “when the threat is outside the scope of the project” PMI 2017. Risk escalation is a new category added by PMI in 2017.
During the development of a dialysis clinic in a new neighborhhod, the dialysis equipment provider informed the project manager that their major competitor was building a new dialysis clinic in the same neighborhood.