clamda-im – project management project management 6.the project risk management

CLAMDA-IM – Project Management

Project Management

6. The Project Risk Management


Project Risk Management

• Managing projects means taking risks

• Every decision, every extimation, every plan is potentially a risk driver

• The most common way to manage risks is reaction…. When some unforecasted event happens, we react taking corrective actions…

• But very often, when risks happen, it is too late and we will suffer a lack of efficacy/efficiency

• Someone, to be pro-active, increases the budget…. Based on his experience and common sense…. But this is a “unknown unknown” approach where all the risks are unknown!



• Is it possible overcoming the reactive approach?

• Is it possible increasing the pro-active approach?

• …..

• A Standish Group research tells that on 9.000 IT projects developed in the USA during 2004, only the 18% was on time….

• We need a method to manage all the project risks we meet



• What is the meaning of “Risk”?

• Risk is a event that has a defined probability to happen and can be a damage for the project…

• “Can” and not “For sure”…

• Yes, because the risk is related to uncertainty, but uncertainty could be also an opportunity if its results are good

• “Both threats and opportunities are ‘uncertainties that matter’, so both are type of risks”



Sample:

• I went out home with my new chamois shoes, but the weather forecast says it could rain….

• I am not sure about the rain, so there is a risk…• If the rain doesn’t drop, I will have a light shoes

to walk easier..• If the rain drop, I will destroy my shoes…• If I see dark clouds, I should find a cover, because

it will rain!

• We have all the elemnts to identify and manage the risk!



Sample:

TARGET WEARING MY NEW SHOES

RISK

ADVANTAGE

DAMAGE

TRIGGER (sentinel)

RAIN PROBABILITY

WALKING EASY

DESTROYED SHOES

WATCHING BLACK CLOUDS

IF I SEE DARK CLOUDS, I LOOKING FOR A COVER

STRATEGY



• Risks can mean threats or opportunities…. We have two kind of risks:

– PURE RISKS – if happen, we have only probability to suffer a loss• Managing strategy: avoiding, transfering, mitigating

– SPECULATIVE RISKS – if happen we can suffer a loss or we can have an advantage• Managing strategy: taking advantage, sharing, improving

• Sample: a decrease of a bond in stock exchange could be a threat or an opportunity… depending on if I need to sell or I can buy!



• If I have a planned risk managing system, I am able to know what to do in case of negative event!!

• The Project Team, led by the Project Manager, has to define risks, triggers, threats/opportunities, strategy

• But risks strategies have a cost…

• Who define the cost level vs risks?....

• …. The Sponsor, by set a priority of risks and a budget to manage it!



Risk Management

The risk management method is a four steps process:

1. Risks identification – we define risks could have a project impact. We must define the risk characteristics:

1. Risks impacts (damages/advantages),

2. Risks probability

3. Risks trigger/sentinel

The project team must start this analisys after the project plan and before the economic phase



2. Qualitative and quantitative analisys – we must define a risks priority list based on the probability to happen and the possible impact (see FMEA analisys). This is the phase where we define the risks managing costs and the border between risks (and costs) we want to consider and risks (and costs) we decide to ignore

3. Risks defensive action plan – we must define actions to minimize threats and maximize opportunities. In this phase we will add new activities (and costs) to the project plan, not dirctly related to the project target

4. Risks monitoring and controlling –



Risk identification: the Standard Risk Model (SRM)

• We define three variables:

1. RISK EVENT – the event that forces a loss/gaina. RISK EVENT DRIVER – is the sentinel, who says the risk could happen

b. RISK EVENT PROBABILITY – is the risk event probability

2. IMPACT – potential loss/gain if the risk will happena. IMPACT EVENT DRIVER – is the sentinel, who says the impact could happen

b. IMPACT EVENT PROBABILITY – is the impact event probability

3. TOTAL LOSS – totale loss value (or gain) if the risk will happen



SRM - The three variables are related as following:

IMPACT

RISK EVENT

TOTAL

LOSS

RISK EVENT PROBABILITY

RISK EVENT DRIVERS

IMPACT EVENT DRIVERS

IMPACT EVENT PROBABILITY



SRM

• The Standard Risk Model (SRM) is important because it separes risks from impacts

• We have two level of probabilities: risk probability and impact probability

• So we can operate on two variables…. If I am not able to decrease the probability a risk happen, I can operate to decrease the negative effects (impacts) on our projet!



SRM Sample:

“Human resources working on the project are not enough…. We could delay the end date”

• This phrase is completely un-efficacy because it doesn’t separe the time when I have the risk and time when I have the impact

• But, I can understand better the project activities where I haven’t enough resources….

• …Risk event 1 – from 1st of April two technicians forecasted are not available for the project (risk) for 1wk



SRM Sample:

DESIGN

CONTROL + APPROVAL

WK1 WK2 WK3 WK4

UNAVAILABLE

Marco+Joel

Freddy



SRM Sample:

• Risk event driver – HR wrote: “Starting from 1st of April, the two technicians will attend a course”

• Impact – the “Design” activity, forecasted 3wks (2wk design and 1wk approval) will delay 2wks

• Impact driver – the design approval responsible is unavailable starting from 21th of April for 1wk

• The Risk driver gives a three weeks loss, but the impact driver

define the delay lengh



SRM Sample:

DESIGN

CONTROL + APPROVAL

WK1 WK2 WK3 WK4

UNAVAILABLE

Marco+Joel

Freddy

COURSE

WK5



SRM Sample:

Adopting the SRM, our target is working separately in the two drivers to minimizing the total impact

Risk driver action: I can negotiate with HR a new course date, so I can delete the risk!

Impact driver action: if I cannot delete the risk, I can ask a substitute of design approval responsible. In this way I can reduce the impact only 1wk

Thinking different drivers with SRM allows us to define:– preventive plans working on risks

– reactive plans working on the impacts!



To identify risks, we have to define for each:• Risk (Risk event)• Risk event driver• Risk probability• Impact (impact event)• Impact event driver• Impact probability• Loss/gain • Total risk probability• Expected loss/gain• Priority



Risk management: the Failure Mode & Effect Analysis (FMEA)

RISK (Failure mode)Is the risk modal, or the event. Could be the modal

a component or a process fail

IMPACT (Effect)Is the impact that will happen if the risk was not

correct

REASON (Cause)Is the real reason of the risk




A failure mode means how the risk appears in the process/project, the impact is the conseguence of the risk

For each risk (modal), the project team has to define: • all the possible related impacts (effects), • all the possible related causes, • risk probability (p)• impacts (effects) importance (g)• risk driver “difficult to see” grade (r)

For each risk/impact/cause, we can calculate the

RISK PRIORITY INDEX = p x g x r




•After the FMEA analisys, we have to define responsible and time of corrective/preventive actions

•Verify actions efficacy after they are issued, evaluating the real risk priority index

•Update FMEA related with project modifications

clamda-im – project management project management 6.the project risk management

Documents