Project Risk Management Overview Mike Dinnon ([email protected])[email protected] LBNE Risk Manager Mu2e...

LBNE Project Management 1

Project Risk ManagementOverview

Mike Dinnon ([email protected])LBNE Risk Manager

Mu2e WGMAugust 18, 2010

mailto:[email protected]


Course Objectives1. Establish the 6 basic principles of Risk

Management2. Identify risk owner’s basic responsibilities3. Familiarize everyone with tools for identifying

risks4. Recognize that there are threats and

opportunities associated with risk5. Understand that risk management is iterative and

must be maintained throughout the project


References:

• DOE Document DOE O 413.3a• Project Management Institute Body of Knowledge

Guide 2004• Project Management Institute, Project & Program

Risk Management, 1992• Project Management Institute, Practice Standard

for Project Risk Management, 2009


Projects will utilize best practices in project risk management. Risk

management, when done successfully, helps to ensure both timeliness and cost

efficiency on a project and is the right way to manage a project. It involves a more precise plan and strategy that uses proper tools and simulations to

better characterize risk.


Key Elements of Risk Management

1. Risk Planning2. Risk Identification3. Qualitative Risk Analysis4. Quantitative Risk Analysis5. Risk Handling and Mitigation Strategies6. Risk Monitoring


What is the definition of a Project Risk?• A definable event with a probability of occurrence

and a consequence.• A situation that has the potential to cause an

unwanted or undesired change or a desired change (opportunity) in schedule, cost, scope, ES&H or technical success.

• Uncertainty in an event having a positive (opportunity) or negative (threat) impact on a project task.

• Risk has a definite cause and, if triggered, a resulting effect.

• Risk Severity = Probability X Impact


Risk Management During CD Phases

Iterative process that needs to be continuous throughout the project life cycle

Initiation Definition Execution Transition/Closeout

CD-0 CD-1 CD-2 CD-3 CD-4 Approve Mission Approve Performance Approve Start of Approve Start of Need Requirements Baseline Construction/ Operation or & Alternative Authorization Project/Transition Selection to Complete Completion And Cost Range Implementation Risk Planning

Risk Management Documentation

Qualitative Analysis Process

Risk Communications

Lessons Learned

Closeout


Goal of Project Risk Management

Establish proactive upfront planning and mitigation strategies to identify events or conditions along with their likelihood of occurrence and impact as to reduce threats (and capitalize on opportunities) before they can impact the project goals.


Overall Objectives for Risk Planning• Establish the overall risk nature of the Project• Recognize the importance of the project to the DOE,

project stakeholders, and the collaboration• Set the stage and tone for Risk Management• Establish methods for managing risk• Establish a sound communication structure• Create proactive Risk Attitudes to uncover all

risks and opportunities• Stabilize poorly defined or ambitious

requirements• Develop Risk Management Plan


Risk Planning Considerations

• Project Scope Statement• Work Breakdown Structure (WBS)• Attitudes and Stakeholder Tolerance• Definitions• Organizational suggested guidelines • Detailed Roles and Responsibilities• Establishment of proper tools and techniques• Establishment of Risk categories (RBS, DOE G 413

3-7 attachment 8, etc.)


Risk Breakdown Structure

An RBS, like this example, can be used to determine risk categories. Always use an “other” category to solicit information through expert opinions and brainstorming sessions.

PROJECT

TECHNICAL

Requirements

Technology

Complexity & Interfaces

Performances & Reliability

Quality

Safety

Cost

Other

EXTERNAL

Subcontractors & Suppliers

Regulatory / Legal

Markets

Political

Funding

Cost

Other

ORGANIZATIONAL

Organizational Structure

Human Resources

Management

Prioritization

Dependencies

Cost

Other

PROJECT MANAGEMENT

Estimating

Planning

Communications

Controls

Cost

Other

Scope

Schedule


Common Risk Categories

Common Project Risk Areas Significant Risks

Supplier Capabilities Restricted number of available vendors. Restricted production capacity.Cost Realistic cost objectives not established early. Funding profile does not match needs. Fluctuations in exchange rates, space and utility costs, and cost of raw

materials.Technology

Project depends on unproven technology for success with no alternatives. Project success depends on achieving advances in state-of-the-art

technology.

Potential advances in technology will result in less than optimal cost-effective system or make system components obsolete.

Technology has not been demonstrated in required operating environment.

Technology relies on complex hardware, software,or integration design.

Management Acquisition strategy does not give adequate consideration to various essential elements (e.g., mission need, test and evaluation, technology, etc.)

Subordinate strategies and plans are not developed in a timely manner or based on the acquisition strategy.

Proper mix of people (in terms of experience, skills, stability) not assigned to the project.

Effective risk assessments not performed or results not understood and acted upon.

Communications with stakeholders lead to misunderstandings and loss of confidence.


Roles for Risk Planning

• Project Manager will establish guidelines for Risk Management.

• Risk Manager will be named by the project management team.

• A Risk Management Plan will be developed by project management team.

• Risk Matrices will be developed for analysis.• Risk Manager will coordinate efforts with sub projects to

ensure understanding of plan.


Principles of Risk Identification• Determine what risks will have a negative or

positive effect on the project and document the findings.

• Perform bottoms-up and top-down analysis of risks.

• Process is iterative, to be done throughout the project.

• Use Risk Breakdown Structure or similar method to group Risks.

• Use WBS as a reference to specify and clearly define the risks.


Roles and Responsibilities OverviewProject Manager – Establish risk guidelines for identification and

analysis, schedule project risk meetings, ensure mitigation strategies are implemented properly. Perform top down risk identification.

Risk Manager – Bring identified risks together into risk register, work with subprojects to facilitate effective risk identification, analysis, and mitigation, Monte Carlo analysis.

L2 Manager – Identify risk owners, manage mitigation strategies for subsystem, schedule periodic risk review, communicate risks with risk manager and Project Manager.

L3 + L4 Managers – Identify risks (bottoms-up), assess identified risks and the resulting impacts, develop mitigation strategies, assess post-mitigated risk impact, document basis for impact on cost, schedule, technical, or ES&H, document findings as related to WBS number, continually reassess risks and identify any new risks as they become apparent. Solicit vendor and sub-contractor risk and incorporate into risk planning


Types of Risk

Known-Unknowns – things we know exist but, do not know how they will effect the project. An identifiable uncertainty. (Management Reserve)

Examples: Oil prices increase, Budget delayed, Manufacturer has layoffs, safety, Design margins

Unknown-Unknown – an item or situation whose existence we cannot anticipate. (Available Contingency)

Examples: Natural disasters, Supplier closes doors


Tools and Techniques for Risk Identification

• Information gathering sessions• Strengths, Weaknesses, Opportunities,

Threats(SWOT) analysis• Checklists• Assumptions Analysis• Flow Charts• Cause and Effect Diagrams• Expert Testimonials


First Steps• Need to talk about risk as in groups.• Identify what worries us• Document the worries• Identify risks between handoffs of

subsystem integration and subproject interfaces.

• Everything else will fall into place moving forward.


Documentation• Risk Management Plan – Sets the guidelines for dealing

with risk in the project and parameters for analyzing risk. (Written by the Project Office)

• Risk Forms – Will be filled out by risk owners or identifiers to identify each risk individually. (Form will be distributed by the Risk Manager)

• Risk Register – After risks have been properly identified with their triggers they are recorded in one database containing all of the identified risks.


Common biases to be aware of when identifying risks

• Status quo – strong bias toward alternatives that maintain current direction.

• Confirming evidence bias – information that supports existing points of view are championed while avoiding information that contradicts.

• Anchoring – disproportionate weight is given to the first information provided.


Specific Roles for Risk Identification

• L3 + L4 Managers will identify risks bottoms up and risks associated with contractors and vendors, document, communicate with L2 Manager and Risk Manager.

• L2 Manager will perform top down risk analysis and identify risk owners.

• Project Manager will perform top down analysis on entire project.

• Risk Manager will meet with individual groups to communicate plan to move forward.


Qualitative Risk Analysis

Qualitative analysis is the process of adequately characterizing risk in words so as to initiate the development of an appropriate risk handling strategy. Additionally, qualitative analysis allows for an assigned risk rating for each risk, which enables a risk grouping process to occur.


Risk Factors

• Risk Event – an event causing negative or positive impacts on the project.

• Risk Probability – How likely it is for the event to occur.

• Consequence – What ramifications (both positive and negative) the event has on the project.

• Time & Frequency – How the timing and occurrence of the event tie to the overall task or project.


Project Risk Rating• The average risk rating can determine the overall

project risk rating. • Risk ratings are assigned via a matrix to the risk,

threat or opportunity, based upon the risk classification.

• Typical risk classifications are low, moderate, or high.

• The classifications value can be tailored to the project.

• If the project’s risk threshold is reached, re-evaluation of risks must be addressed to ensure a successful project.


Qualitative Risk Threat Analysis Matrix Example

Consequence

Matrix Negligible(<.2) Marginal(.3<.4) Significant (.5<.7) Critical (.8<.9) Crisis (.9<)

Cost

Schedule

Scope

ES&H and Quality

Negligible or No Impact

Some Applications Affected

Significant Applications Affected

Concerns That May Jeopardize Project

Key Deliverables Cannot Be Met

Probability

Very Likely >90% Low Moderate High High High

Likely 75% to 90% Low Moderate Moderate High High

Somewhat Likely 26% to 74%

Low Low Moderate High High

Unlikely 10% to 25% Low Low Moderate Moderate High

Very Unlikely <10% Low Low Low Low Moderate

Project Specific Inputs


Opportunity Risk Analysis

• Risks can be positive and not just negative.• These risks will have a positive impact on the

project.• Harder to identify and fewer in definition but

must be addressed just the same.Examples:Early procurement will decrease a lag in schedule, Having an existing

wafer board upgraded early so that a redesign is not necessary if a company is planning a re-tooling that does not support existing specs (Schedule, Cost).


Qualitative Opportunity Risk Analysis Matrix Example

Consequence

Matrix Negligible(<.2) Marginal (.3<.4)

Significant (.5<.7)

High Impact (.8<.9)

Very High Impact (.9<)

Cost

Schedule

Scope

ES&H and Quality

Minimal or No Improvement

Minor ImprovementNoticeable Improvement

Substantial Improvement

Significant Improvement

Probability

Very Likely >90% Low Moderate High High High

Likely 75% to 90% Low Moderate Moderate High High

Somewhat Likely 26% to 74%

Low Low Moderate Moderate High

Unlikely 10% to 25%

Low Low Low Moderate Moderate

Very Unlikely <10% Low Low Low Low Moderate

Project Specific Inputs


Specific Roles for Qualitative Analysis• All owners and identifiers of risk will perform a

qualitative analysis on their risks using matrices supplied by the Project.

• Risk Manager will coordinate efforts and combine all records of risk for further analysis.

• Risk Manager will group risks accordingly and enter into preliminary Risk Register.


Quantitative Risk Analysis• Used to estimate the impact of risks on project

cost and schedule.• A Monte Carlo analysis of the probability and

consequence of individual risks that addresses the overall project risk through the use of simulations and models.

• Information necessary for accurate analysis should be provided by the risk identifier such as: worst/likely/best scenarios and logic behind, any historical data, vendor quotes


Monte Carlo Analysis• Used by the risk manager and/or Project Controls on data

supplied by the risk owners/identifiers from all subprojects to determine probabilities of achieving project objectives while managing risks.

• Identifies risks requiring the most attention by the use of simulation (critical path analysis).

• Quantify project risk exposure and determine the size of cost & schedule management reserve.

• Quantitative risk analysis outputs will determine a realistic contingency plan for higher risks.

• Outputs will generate graphs and sensitivity analysis for use in CD review process to justify reserve amounts.

• Key tool to forecast risks and eliminate most uncertainty using statistics and expert data.


Specific Roles for Quantitative Analysis

• Risk owners will communicate with Risk Manager to set up parameters needed for proper analysis.

• Risk Manager/Project Controls will, in cooperation with risk owners/identifiers, perform necessary analysis and formulate plan for moving forward and soliciting mitigation strategies.

• After analysis, establishment of ownership on analysis will be confirmed between the Risk Manager and risk owner.


Risk Handling • Develop options and determine actions to

enhance opportunities and reduce threats to the project.

• Must identify and assign individuals to be responsible for each agreed upon risk.

• Iterative process that accounts for continuing change in the project.

• Assumptions of risk need to be monitored frequently and mitigated properly.


Negative Risk Mitigation Strategies Negative risk handling covers a number of risk

strategies, including risk acceptance, avoidance, mitigation, and transfer. When weighing these negative risk approaches, the risk identifier should account for the following:

• The options’ achievability in terms of the project’s objectives, and baseline funding and schedule.

• The expected effectiveness of the risk handling strategy and document it for analysis by the tools used by the project.

• Cost and schedule impacts .• The impact on other technical portions of the project.• Changes to cost and schedule will always utilize the proper change

control techniques and documentation.


Positive Risk Mitigation Strategies Positive risk handling covers a number of risk

strategies, including risk exploiting, sharing, and enhancing. When weighing these positive risk approaches, the risk identifier should account for the following:

• Actions taken by the organization to ensure that an opportunity is realized.

• Actions may include; increasing resources to reduce schedule, early procurement, Forming risk sharing partnerships.

• Influence and identify inputs that drive key risk opportunities.• Strengthening opportunity risk by promoting the occurrence of

positive risk triggers.• Changes to cost and schedule will always utilize the proper change

control techniques and documentation.


Contingency Planning • Documented contingency planning (mitigation

strategy) addresses specific risk events ahead of their occurrence .

• It is executed when an identified condition occurs indicating the risk is evident.

• Cost and schedule contingency are assigned through Monte Carlo Analysis on the risk and the mitigation strategy that accompanies it.

• The analysis of their effects on the project will lead to a more defined cost and time distribution for the implementation of project Management Reserve.


Common Risk Mitigation Strategies(basic matrix example)

Note: ES&H strategies should be solicited from ES&H personnel

Project Impact High Moderate LowCost

Closely monitor cost and spendingClosely monitor cost and spending

Monitor cost,schedule, and spending

Consider implementing phased procurements

Obtain at least two bottoms up independent cost estimates

Obtain multiple bottoms up independent cost estimates

Perform value management vendor visits

Schedule Increase lead time substantially by initiating procurements 6-8 weeks early

Increase lead time by initiating procurements 2-4 weeks early

Monitor cost,schedule, and spending

Vendor visits and oversight Vendor visits and oversight Add additional vendors

Performance Perform major redesign Moderate redesign as requiredQA/acceptance testing

Increase prototype cycles Define QA/acceptance testing Evaluate alternate technology Increase prototype tests

Request additional process control steps during fabrication

Define extensive QA/acceptance testing

Increase lead time/increase testing cycles


Specific Roles for Risk Handling• Risk Manager will identify risks that need mitigation

strategies from analysis on information submitted from risk owners.

• Risk owners will develop and document mitigation strategies and give to Risk Manager.

• Risk Manager will ensure analysis on mitigation strategies and communicate with risk owners on results.

• L2 Managers will be communicated with and mitigation strategies approved.

• Project Manager will approve/reject final strategies or recommend discussion with Risk Management Board.


Risk Monitoring• Involves a disciplined, continuous monitoring and

evaluating of the effectiveness and accuracy of the risk handling strategy.

• Monitoring is executed for individual risks by analyzing risk triggers and continually updating the project risk status.

• The risk monitoring process should provide both qualitative and quantitative information to decision-makers regarding the status of the risks and what mitigation strategies are being implemented.


Risk Monitoring Considerations The risk monitoring process should be more than a risk

tracking documentation process (DOE O 413.3a). Things to monitor:

• Risk identification is current with the plan of the project and that risk management is a continuous and iterative process within the project.

• Risks, including accepted and low risks, have not changed since first identified.

• Mitigation strategies are implemented according to schedule, and that risk triggers are showing that the risk is not presenting itself.

• Monitoring done on a monthly basis and discussed in PM group meetings.

• Review existing risks for change and see if new risks arise.• Evaluate if risks can be retired and Management Reserve moved to

Contingency


Risk Monitoring Considerations cont.

• Review any back-up plans and determine if any others need to be put into place based upon performance of the current handling strategies.

• Review the cost and schedule contingency calculations for current mitigation strategies and those that will be implemented in the near future based upon recent performance to gauge their accuracy.

• The risk register and other risk-related forms are up-to-date.• Communication of risks and triggers follows guidelines set forth in

the Risk Management Plan.• Communicate Effectively so that proper responses to risk triggers

can be put into action as to not effect the project adversely.


Specific Roles for Risk Monitoring

• Risk Monitoring will be done by risk owners in communication with the L2 Managers and Risk Manager

• L2 Managers will incorporate risk monitoring updates into meetings

• Project Manager will incorporate risk monitoring into Project Management meetings and keep Risk Management Board informed

• Risk Manager will keep the risk register updated and status all risks


Summary• Risk management process has steps associated with it.• Understanding those 6 basic principles:


• Iterative process that must be maintained.• A risk owner will be assigned and be responsible for all

aspects of owned risks.


Thank You

Project Risk Management Overview Mike Dinnon ([email protected])[email protected] LBNE Risk Manager Mu2e...

Documents

Transcript of Project Risk Management Overview Mike Dinnon ([email protected])[email protected] LBNE Risk Manager Mu2e...