B U D I L U H U R U N I V E R S I T YPOST GRADUATE PROGRAM

MAGISTER ILMU KOMPUTER (M.Kom)

IT PROJECT MANAGEMENT

PROJECT RISK MANAGEMENT

Ruth Drayer

2010

Project risk

An uncertain event or condition that, if it occurs, has a positive or negative effect on at least one project objective (time, cost, scope, quality)

May have one or more causes May have one or more impacts Risk conditions could include aspects of the

project’s or organization’s environment that may contribute to project risk

2010

Known risk Identified & analyzed A risk response generates by the project team

as it is worth

Unknown risk Can not be managed proactively

2010

PROJECT RISK MANAGEMENT PROCESSES

Plan

1. Plan Risk Management

2. Identify Risk

3. Perform Qualitative Risk Analysis

4. Perform Quantitative Risk Analysis

5. Plan Risk Response

Control 6. Monitor and Control Risk

2010

1 PLAN RISK MANAGEMENT

Deciding how to: approach conduct

the risk management activities for a project

The risk management planning process should be completed early during project planning process

The level of detail will vary with the needs of the project

2010

Questions Addressed in a Risk Management Plan (Schwalbe: ITPM Table 11-2).

2010

Terms:

Contingency plans are predefined actions that the project team will take if an identified risk event occurs

Fallback plans are developed for risks that have a high impact on meeting project objectives

Contingency reserves or allowances are provisions held by the project sponsor that can be used to mitigate cost or schedule risk if changes in scope or quality occur

2010

INPUT OUTPUT1. Project scope statement2. Cost management plan3. Schedule management plan4. Communications

management plan5. Enterprise environmental

factors6. Organizational process assets

1. Risk management plan

TOOLS & TECHNIQUES1. Planning meetings & analysis

PLAN RISK MANAGEMENT

2010

PLAN RISK MANAGEMENTINPUT

Project scope statement (see: scope definition)Project management plan (Cost; schedule;

communication)Enterprise environmental factors

• Policy statements express risk attitudes and tolerance

Organizational process assets• Risk categories, risk tolerance• Templates• Roles and responsibilities, and authority

levels of decision making

2010

PLAN RISK MANAGEMENT TOOLS & TECHNIQUES

Planning meetings & analysis• Project manager• Selected team members & stakeholders• Person in the organization with responsibility

to manage the risk planning and execution

2010

PLAN RISK MANAGEMENTOUTPUTS

Risk management plan, includes:• Methodology:

• approaches, tools, data sources to perform risk management

• Roles & responsibility• Defines the lead, support, and risk management

team membership for each type of activity, • Assign people to these roles • Clarifies their responsibilities

2010

PLAN RISK MANAGEMENTOUTPUTS (cont)

Risk management plan, includes (cont 1):• Budgeting:

• Assigns resources• Estimates costs• Included in the project cost baseline

• Timing:• When?• How often?• Establishes risk management acivities to be

included in the project schedule• Risk categories:

• Risk Breakdown Structure• Templates, based on previous projects

2010

PLAN RISK MANAGEMENT OUTPUTS (cont)

Risk management plan, includes (cont 2):• Definitions of risk probability & impact• Probability & impact matrix• Revised stakeholder tolerance• Reporting formats • Tracking (whether & how risk management processes

will be audited)

2010

PLAN RISK MANAGEMENTOUTPUTS: Risk Breakdown Structure

2010

PLAN RISK MANAGEMENT OUTPUTS: Probability & Impact Matrix for 4 Project Objectives

Defined conditions for impact scales of a risk on major project objectivesProject

ObjectiveRelative or numerical scales are shown

Very low / 0,05

Low / 0,10

Moderate / 0,20

High / 0,40

Very high / 0,80

Cost Insignificant cost increase

< 10% cost increase

10 – 20% cost increase

20 – 40% cost increase

>40% cost increase

Time Insignificant time increase

< 5 % time increase

5 – 10% time increase

10 – 20% time increase

>20% time increase

Scope Scope decrease barely noticeable

Minor areas of scope affected

Major areas of scope affected

Scope reduction unacceptable to sponsor

Project end item is effectively useless

Quality Quality degradation barely noticeable

Only very demanding applications are affected

Quality reduction required sponsor approval

Quality reduction unacceptable to sponsor

Project end item is effectively useless

2010

Project Risk Management WorksheetRISK RISK

PROBA-BILITY

IMPACT DESCRIP

TION

LEVEL OF

IMPACT

DATE OF IMPACT

PRIORITY

LEVEL

RISK MANAGEMENT

PLAN

Risk probability & level of impact:VL=very low; L=low; M=medium; H=high; VH=very high

2010

2 IDENTIFY RISK

Determining which risks might affect the project and documenting their characteristics

An iterative process; new risks may be known as the project progresses through its life cycle

2010

INPUT OUTPUT1. Risk management plan2. Activity cost estimates3. Activity duration estimates4. Scope baseline5. Stakeholder register6. Cost management plan7. Schedule management plan8. Quality management plan9. Project documents10.Enterprise environmental factors11.Organizational process assets

Risk register

TOOLS & TECHNIQUES

IDENTIFY RISK

2010

INPUT OUTPUT

Risk register

TOOLS & TECHNIQUES

1. Documentation reviews2. Information gathering

techniques3. Checklist analysis4. Assumption analysis5. Diagramming techniques6. SWOT analysis7. Expert judgement

IDENTIFY RISK

2010

IDENTIFY RISK INPUT

Risk management plan• Assignments of roles & responsibilities• Provision for risk management acrtivities in

the budget & schedule• Categories of risk

Activity cost estimates

Activity duration estimates

2010

IDENTIFY RISK INPUT

Scope baseline • Uncertainty in project scope statement

Stakeholder register

Project management plan • Schedule namagement plan• Cost management plan• Quality management plan

2010

IDENTIFY RISK INPUT

Project documents

Enterprise environmental factors• Published information, commercial

databases, benchmarking, industry/academic studies

Organizational process assets• Lesson learned & actual data from previous

project files

2010

IDENTIFY RISK TOOLS & TECHNIQUES

Documentation reviews

Information gathering techniques• Brainstorming• Delphi technique• Root cause analysis• Interviewing: Experienced project participants;

stakeholders; expertsChecklist analysisAssumptions analysis

2010

IDENTIFY RISK TOOLS & TECHNIQUES

Diagramming Techniques Cause & effect diagram System / process flow diagram

SWOT analysis

Expert judgment

2010

IDENTIFY RISK OUTPUTS

Risk register• List of identified risk• List of potential responses

2010

3 PERFORM QUALITATIVE RISK ANALYSIS

Prioritizing risks for subsequent further analysis or action by assessing and combining their probability of occurrence and impact

2010

Potential Risk Conditions Associated with Each Knowledge Area (Schwalbe: Table 11-5.)

Knowledge Area Risk Conditions

Integration Inadequate planning; poor resource allocation; poor integrationmanagement; lack of post-project review

Scope Poor definition of scope or work packages; incomplete definitionof quality requirements; inadequate scope control

Time Errors in estimating time or resource availability; poor allocationand management of float; early release of competitive products

Cost Estimating errors; inadequate productivity, cost, change, orcontingency control; poor maintenance, security, purchasing, etc.

Quality Poor attitude toward quality; substandarddesign/materials/workmanship; inadequate quality assuranceprogram

Human Resources Poor conflict management; poor project organization anddefinition of responsibilities; absence of leadership

Communications Carelessness in planning or communicating; lack of consultationwith key stakeholders

Risk Ignoring risk; unclear assignment of risk; poor insurancemanagement

Procurement Unenforceable conditions or contract clauses; adversarial relations

2010

INPUT OUTPUT

1. Risk register2. Risk management plan3. Project scope statement4. Organizational process assets

Risk register updates

TOOLS & TECHNIQUES

1. Risk probability and impact assessment2. Probability and impact matrix3. Risk data quality assessment4. Risk categorization5. Risk urgency assessment6. Expert judgment

PERFORM QUALITATIVE RISK ANALYSIS

2010

PERFORM QUALITATIVE RISK ANALYSISINPUT

Risk registerList of identified risksRisk management plan

• Roles & responsibilities for conducting risk management

• Budget; schedule; probability & impacts matrix;• Stakeholders’ risk tolerances

Project scope statement • Technology used (common / state of the art)

Organizational process assets• Data about risks on past projects• Lessons learned knowledge base

2010

PERFORM QUALITATIVE RISK ANALYSISTOOLS & TECHNIQUES

Risk probability and impact assessment• Investigate the potential effect (neg or pos) on a

project objective• Probability & impact are assessed for each

identified risk. The level is evaluated during the interview or meeting.

Probability and impact matrix• Ratings are assigned to risks based on their

assessed probability and impact. Result: low or moderate or high risks. Risk rating rules can be tailored in the risk management planning

2010

Probability & Impact Matrix

Probability

Threats Opportunities

0,90 0,05 0,09 0,18 0,36 0,72 0,72 0,36 0,18 0,09 0,05

0,70 0,04 0,07 0,14 0,28 0,66 0,66 0,28 0,14 0,07 0,040,50 0,03 0,05 0,10 0,20 0,40 0,40 0,20 0,10 0,05 0,03

0,30 0,02 0,03 0,06 0,12 0,24 0,24 0,12 0,06 0,03 0,02

0,10 0,01 0,01 0,02 0,04 0,08 0,08 0,04 0,02 0,01 0,01

0,05 0,10 0,20 0,40 0,80 0,80 0,40 0,20 0,10 0,05

Impact ( ratio scale) on an objective (e.g. cost, scope, time, quality

= high risk

= low risk

2010

Risk data quality assessment• Require accurate and unbiased data

Risk categorization• RBS & others

Risk urgency assessment• Risk requiring near-term responses may be

considered more urgent to address

Expert judgment

PERFORM QUALITATIVE RISK ANALYSISTOOLS & TECHNIQUES

2010

PERFORM QUALITATIVE RISK ANALYSISOUTPUTS

Risk register updates, includes• Relative ranking or priority list of project risk• Risks grouped by categories• List of risks requiring response in the near-term• List of risks for additional analysis and response• Watch lists of low priority risks• Trends in qualitative risk analysis results

2010

4 PERFORM QUANTITATIVE RISK ANALYSIS

Assess the likelihood and impact of identified risks to determine their magnitude and priority

Performed on risks that have been prioritized by the qualitative risk analysis process as potentially and substantially impacting the project competing demands

Large, complex projects involving leading edge technologies often require extensive quantitative risk analysis

Managers often perform quantitative risk analysis right after risk identification process

Should be repeated after risk response planning

2010

INPUT OUTPUT1. Risk register2. Risk management plan3. Cost management plan4. Schedule management plan5. Organizational process assets

1. Risk register updates

TOOLS & TECHNIQUES1. Data gathering and representation

techniques2. Quantitative risk analysis and modeling

techniques3. Expert judgment

PERFORM QUANTITATIVE RISK ANALYSIS

2010

PERFORM QUANTITATIVE RISK ANALYSISINPUT

Risk register• Identified risks• Relative ranking or priority list of project risk• Risks grouped by categoriesRisk management plan • Roles & responsibilities• Budget; schedule activity for risk management; • Probability & impacts matrix;• Stakeholders’ risk tolerances• Risk categories

2010

PERFORM QUANTITATIVE RISK ANALYSISINPUT

Project management plan• Schedule management plan• Cost management plan

Organizational process assets• Similar completed projects information• Risk databases• Studies of similar projects by risk specialists

2010

PERFORM QUANTITATIVE RISK ANALYSISTOOLS & TECHNIQUES

Data gathering and representation techniques• Interviewing probability & impact on project

objectives• Probability distribution• Expert judgmentQuantitative risk analysis and modeling techniques• Sensitivity analysis• Expected monetary value (EMV) analysis

EMV = ∑ pi . Qi p = probability• Decision tree analysis

a diagramming method used to help select the best course of action in situations in which future outcomes are uncertain

2010

Quantitative risk analysis and modeling techniques• Modeling and simulation : a representation or model

of a system to analyze the expected behavior or performance of the system Monte Carlo analysis simulates a model’s outcome

many times to provide a statistical distribution of the calculated results

To use a Monte Carlo simulation, you must have three estimates (most likely, pessimistic, and optimistic) plus an estimate of the likelihood of the estimate being between the optimistic and most likely values

2010

Decision Tree

Sumber: Schwalbe 2004

2010

PERFORM QUANTITATIVE RISK ANALYSISOUTPUTS

Risk register updatesUpdates includes : • Probabilistic analysis of the project• Probability of achieving cost and time objectives• Prioritized list of quantified risks• Trends

2010

5 PLAN RISK RESPONSES

Process of developing options, and determining actions to enhance opportunities and reduce threats to the project objectives

Planned risk response must be: Appropriate to the significance of the risk Cost effective in meeting the challenge Timely Realistic within the project context Agreed upon by all parties involved Owned by a responsible person

2010

INPUT OUTPUT

1. Risk register2. Risk

management plan

1. Risk register updates2. Risk related contract decision3. Project management plan

updates4. Project document updates

TOOLS & TECHNIQUES

1. Strategies for negative risk or threat2. Strategies for positive risks or

opportunities3. Contingent response strategies4. Expert judgment

PLAN RISK RESPONSE

2010

PLAN RISK RESPONSE INPUT

Risk register• Identified risks• Root causes of risks• List of potential responses• Risk owners• Risk symptoms & warning signsRisk management plan• Roles and responsibilities• Risk analysis definitions• Risk thresholds for low, moderate, and high risk• Time & budget required to conduct project risk

management

2010

PLAN RISK RESPONSE TECHNIQUES

Strategies for negative risk or threat• Avoid: changing the project plan to eliminate the

threat posed by an adverse risk ( acquiring expertise, obtaining information, etc)

• Transfer: shifting the consequence of a risk and responsibility for its management to a third party (insurance)

• Mitigate: taking early action to reduce the probability of its occurrence

2010

General risk mitigation strategies for

technical, cost, and schedule risks

Source: Schwalbe, ITPM 3rd ed

2010

RISK RESPONSE PLANNINGTOOLS & TECHNIQUES

Strategies for positive risks or opportunities• Exploit (ensure )• Share (allocating ownership to a third party)• Enhance

Contingent response strategies• Used only if certain events occur

Expert judgment

2010

PLAN RISK RESPONSE OUTPUTS

Risk register updates

Risk related contractual agreements• Agreements for insurance, services, etc

Project management plan updates

Project document updates

2010

6 MONITOR & CONTROL RISK

Monitoring risks involves knowing their status

Controlling risks involves carrying out the risk management plans as risks occur

Workarounds are unplanned responses to risk events that must be done when there are no contingency plans

2010

INPUT OUTPUT

1. Risk register2. Project management plan3. Work performance

information4. Performance reports

1. Risk register updates2. Organizational process

assets updates3. Change requests`4. Project management

plan updates5. Project document

updates

TOOLS & TECHNIQUES

MONITOR & CONTROL RISK

2010

MONITOR & CONTROL RISKINPUT

Project management plan • Assignment of people (risk owners), time, other

resources to project risk managementRisk register

Work performance information• Project deliverables status• Corrective actions• Performance reportsPerformance reports• Analysis results

2010

MONITOR & CONTROL RISKTOOLS & TECHNIQUES

Risk reassessment• Identification, analysis, response design of new risksRisk auditsExamine the effectiveness of the risk mgmt processVariance and trend analysis• EV analysis; CPI; SPITechnical performance measurements• Comparing performance vs project management planReserve analysis• Time & budgetStatus meetings• Periodic

2010

MONITOR & CONTROL RISKOUTPUTS

Risk register updates

Organizational process assets updates• Lessons learned

Change requests

Project management plan updates

Project documents updates

2010

TUGAS

Buatlah Risk Management Worksheet untuk proyek anda

PROJECT RISK MANAGEMENT

The End