IRIS & @RISK

Presentation OverviewThe Challenges (Colin Wheeler, Istria Ltd)

– Background– The Challenge: Aligning Quantitative and

Qualitative Techniques– Our Solution: IRIS Software– Client Benefits

The Implementation

About Istria• Established in 1985• 20 years experience in project risk management• Provides Consultancy, Software and Training

Solutions• IRIS (Istria Risk & Issue Support) Software developed

in 2004-5 to embed the Istria Risk Management Method

• Alignment of Qualitative and Quantitative Risk Management Techniques

• Clients Include:

The Challenge• IRIS Software featured best in class qualitative risk

management techniques– Dynamic risk matrices– Automated email triggers– Link to MS Project– Full suite of customisable reports

• Project Managers frequently use inaccurate or misleading quantitative techniques

– “Finger in the air” estimates of impact– Multiplication of Probability x Impact Assessment

• These lead to problems establishing – Discrete values for probability; and – Precise impact assessments for cost, time or performance

Combining robust statistical analysis with the leading edge qualitative techniques would generate enormous benefits for clients

The software is designed to manage risks across an entire organisation, or specific departments, programmes or projectsThe hierarchy is tailored to the client organisation on implementation of the tool. The front screen allows navigation to any level in the hierarchy.

Our Solution (1) Organisational Hierarchy

In this example, strategic planning (corporate level) and programme level are used, but additional levels can be addedA full help guide is also available

The risk matrix provides an instant snapshot of the high priority risks for the organisation. Separate risk matrices are available for each project, along with an overall enterprise wide risk matrix

Our Solution (2)Dynamic Risk Matrix

Icons illustrate how the status of the risk has changed during the periodClicking on the icon displays the full Risk Action Plan for that risk (see next page)Clicking the Risk ID displays the risk description only

The risk action plan contains the detailed information for each risk. The probability and impact of each risk is assessed, and each risk is allocated a risk owner.

Our Solution (3)Risk Action Plan & Impact

Assessment

The next review date has a default setting (e.g. 28 days) but can be overwritten.Emails are sent to the risk owner when action is required (e.g. 3 days in advance) and to the programme manager if action is overdueParameters for the

impact of risks are tailored for each level of the hierarchy

Palisade’s @Risk statistical analysis package is embedded within the IRIS software. The impact assessments from the Risk Action Plan provide three data points (Best Case, Worst Case, Most Likely Scenarios).

Our Solution (4)Monte Carlo Simulations

Statistical Confidence Level

@Risk generates thousands of iterations in a few seconds to provide statistical confidence on the risk exposure level.The relative cost/benefit of risk mitigating activity can then be ascertained

Costs of Risk Mitigating Activity

Risk Exposure Reduction

High

Medium

Low

50%

20%

0.65

0.75

Creating the Analytical Model

Probability

1st- Iteration Random Number

2nd - Risk Random Number

i.e. no risks will occur with P < 65%

This risk will have occurred in this iteration Monte Carlo

analysis tool generates two random numbers

The simulation consists of 1,000 iterations and the sum of the impacts is shown as a Cumulative Probability Curve showing Risk Exposure

High

Medium

Low

50%

20%

0.65

0.75

Creating the Analytical Model

BC €0 ML €10,000 WC €100,000

Impact Range in Cost (or Time)

Probability

1st- Iteration Random Number

2nd - Risk Random Number

i.e. no risks will occur with P < 65%

This risk will have occurred in this iteration

Step 1: New risk identified and added to the Risk Matrix

Aligning Qualitative & Quantitative Techniques

Step 2: Quantitative Impact Limits standardise assessments of High, Medium, Low

Step 3: Three point estimates are auto-populated. Can over-write Best Case & Worst Case, but Most Likely must be within parameters

Step 4: @RISK engine runs statistical analysis to quantify overall risk exposure. Target values provide a cost benefit analysis of risk mitigating activity. Can prioritise activity based on Risk Reduction Ratio (RRR)

Benefits of the Approach

Istria developed the IRIS software to embed best practice risk management techniques into a single user-friendly application.

Utilise best practice quantitative and qualitative techniques

Instant visibility of high priority risks through Risk Matrix

Quantified cost-benefit analysis of Risk Mitigation Activity

Integration with other Project Management Tools

Automated Email Triggers to help embed Risk Management

Secure Audit Trail for Internal & External Assurance

Project Risks

Strategic Objectives

Success Criteria

Strategic Risks

Risk Mitigating Actions

Programmes

ProjectsProject Objectives

Success Criteria

Actions Risk Mitigating

StrategicStrategic

OperationalOperational

Strategic Alignment

Risk & Issue Risk & Issue IdentificationIdentification

Evaluation & Evaluation & PlanningPlanning

Management & Management & ControlControl

Management Management ReportingReporting

Risk Action Plans

Determine Risk Determine Risk Management Management

StructureStructure

Istria’s Risk Management Approach

Project Scope

• Identify the scope and boundaries of responsibility

• Obtain agreement

Food SuppliersMaintenance

H&S Executive

ACME Catering

Business Agreement

Organisation

Risk Register Scopes

Risk Identification

• Use the cause effect diagram to identify the future and current problems that will prevent the successful completion of the success criteria.– Lack of Staff (numbers, availability, skills)– Technical problems

• Requirements definition problems• Tools• Scoping

– Operational requirements – Operational problems– Contractual problems

• .

•

Cause/Effect Diagrams

People

Equipment

Success criteria

Suppliers

Provides food to an acceptable standard

Process

Cooking Utensils

Storage (Refrigerators)

Plan to prepare food

Timeliness

Food Quality

AvailabilityNumbers

Skills

Risk Index

Risk Matrix

Links to MS Project

Risk Quantification Data

Risk Data sheet

Risk Exposure

Target Risk Exposure

Where Next?

• Need to exploit the functionality of @RISK (RDK)