Professional Education

Risk Mitigation and Management

AdvancedProgram Management

2

ObjectivesDefine risk mitigation Identify components of risk mitigationLearn how to manage large-scale program risks

3

Risk Management Definition

Definition:Development, evaluation and monitoring of risk factors. Prioritization of risks and identification of contingency plans to address significant risks.

Activities: Survey management and

project/team for projects risks

Identify approach to minimizing risks by developing mitigation strategies

Reassign risks which can be eliminated as issues

Identify contingency plans for high impact risks

Participants: Project/team leads Program Management Office

Outputs: Updated program risks log

available for program wide viewing

Update as risk become outdated or new risks appear

Objectives: To develop an effective

process for identifying and minimizing project risks

To achieve optimum balance between minimization of risks, quality of deliverables, and ability to meet completion dates (i.e. do not “over minimize” risks at the expense of quality or the schedule)

4

Risk Mitigation is not issue resolution

Risk is the potential danger of harm or loss– by definition it is outside the control of the program being managed

Mitigation means to make something less harmful, unpleasant or badThus, there are both anticipation and planning elements to Risk MitigationIssue resolution is about information collection and decision makingRisk mitigation involves evaluation, probabilities and alternatives– Examples

• Business plans generally state market forces may move unfavorably• Insurance policies generally state that they don’t cover nuclear

incidents or civil unrest

5

There are four major areas that need to be addressed when managing risk

Assumptions and critical success factorsIdentification of potential or real risksTracking mechanismsContingency plans

6

Risk vs Business Value Management

Risk Management is the dimension of the framework that Identifies and manages risks at all levels of the program Manages development of mitigating strategies Builds contingency plans relative to development and deployment

– Assigns and monitors the implementation of contingency plans and risk mitigation strategies

Business Value Management is the dimension of the framework that – Identifies the program’s anticipated benefits/revenue– Develops metrics and frequency to gauge realization of

assumptions and critical success factors– Manages the tradeoff between benefit capture and cost of

delivery during program life cycle– Risks should be captured in the business value as much as

possible

7

Risk Management - Proactively discover and mitigate risks

Risk Management – Provides risk analysis, including identification, categorization,

and root cause assessment– Develops risk response strategy covering avoidance,

prevention, deflection, and mitigation – Scenario evaluation– Solidifies risk control and risk monitoring– Builds contingency plans for development and deployment

8

Sources of Risk/Uncertainty

ExternalChange

OrganizationalChange

IndividualChange

Competitive PressuresDeregulationTechnology

New LeadershipNew Strategy

Re-engineeringRe-organization

Re-anything

ExpectationsMotivation

Skills

9

Defining Assumptions or Critical Success Factors

Assumptions or Critical Success Factors are usually identified early in the project planning stageThey need to be explicitly stated Utilizing the sources of uncertainty and risk will ensure that the process is comprehensive

10

Risk Identification and Quantification

All key risks need to be identified and reported via the use of a risk memorandum/reportThe risks arise out of the assumptions made and potential changes in either the internal or external identified sources of riskEach risk needs to be reviewed in terms of – Potential Impact on strategy, program resources and schedule– Likelihood of occurrence– Need for tracking/monitoring of factors affecting risk– Need for a contingency plan– Identification of trigger points

Risks and contingency plans need signoff by the client– These need to be “living and breathing” documents

Discussion Idea: How thoroughly have you captured and documented risks and contingency plans in the past?

11

Contingency Plans

Contingency plans are alternative plans that can be put into effect if certain critical success factors or assumptions do not occur as expectedOnly high impact and high priority areas require contingency plansContingency plans should be as simple as possible, since there is little advanced warning when implementation is necessaryThe event or point “trigger” at which the contingency plan will be executed needs to be defined as part of the risk memorandum

12

Tracking Mechanisms

Depending upon the type and number of risks identified, the variety of sources tracked and monitored can be largeSources range from government reports, speeches, internal business reports, financial market analysis, news sources, weather reports, or even reading online / offline pop culture “rags”The key event, value, or trigger point should be well defined and the target of the tracking, both to limit time spent and to minimize disagreements about whether or not the contingency plans need to be deployed

13

Sequence of Activities in Risk Management

Identify positive and negative events or uncertainties that could derail the programSpecify trigger points and timing of the eventsCreate mitigation strategies that could reduce the probability of the risk becoming a realityAssess level of impact and probability of the events that readily impact assumptions / critical success factorsDevelop contingency plans only for high-impact or high-probability eventsImplement monitoring effortReport and track events against assumptions and critical success factorsDevelop and implement contingency plans as needed

14

Remember — Issues are not Risks

Issues– are under the program’s control– information can be gathered to make informed decisions– can be resolved– may have major budget, scope or schedule impacts to the

planRisks– are external to the program– cannot be resolved, only monitored– cause alternative plans to be executed– have various probabilities and impacts associated with them

15

Risk Management Key Considerations

Invest in building real contingency plans where appropriate instead of just talking about the needUse the risk reports to manage risks on an ongoing basis (remove risks, add risks, determine contingency planning is required)Resist the tendency to stop managing the risks because the program itself is so overwhelming