Bronwyn Friday – Group Manager, Risk

Project Risk Management Tools

Introduction

› Bronwyn Friday› Group Manager, Risk

› John Holland Group Pty. Ltd

˃ Education˃ Bachelor Degree – Construction

Management (Building)

˃ RMIT 1994

˃ Master of Business Administration

˃ Deakin 2008

˃ Certified Practising Risk Manager

˃ RMIA 2008

˃ Risk Experience˃ Group Manager, Risk

˃ John Holland 2009 to now

˃ Global Risk Manager

˃ Foster’s 2006 to 2009

˃ Corporate Risk Manager

˃ Powercor / Citipower 2004 to 2006

˃ Risk Consultant

˃ Marsh 2001 to 2004

› Who we are

› 8,000+ people on 80+ projects

› Revenue

› $3.7 billion

› New business (2011)

› Total new work won during the year $4.8 billion

› Work in Hand per business stream

› Infrastructure $3.3 billion (up 21%)› Energy & Resources $1.6 billion (up 102%)› Transport Services $2.8 billion (up 55%)

John Holland - Highlights

Record work in hand

$7.7bn

Group Introduction

› A chance to meet each other

› Three simple questions

› Your name & company

› Your experience with Project Risk Management› e.g. none, some, heaps

› Where are you involved in the Project Lifecycle› Financier, Owner, Consultant or Delivery of project

Overview of Project Risk Management

Best Practice

› Best Practices in Managing Risk› International Standard 31000:2009

› Best Practices in Project Management

› PMBOK

› PRINCE2

› Best Practices in Project Risk Management› Practice Standard for Project Risk

Management [PMBOK]› M_o_R® (Management of Risk) [Prince2]› P3O [Prince2] - effective portfolio, programme and

project management.

Project Lifecycle

Time

Concept Feasibility Tender Delivery Final

Handover

›What part of the Lifecycle are you involved in?

Risk Information vs. Influencing

Time

High

Low

Infl

ue

nci

ng

Sca

le

Ris

k I

nfo

rma

tio

n

0%

100%

Likely Risk

Management process

Concept Feasibility Tender Delivery Final

Handover

Influence Curve

Construction Industry Report

Results

Risk Appetite & Tolerance

› Key to all Risk Management processes is knowing your project / organisation’s:

› Risk Appetite

› Risk Tolerance

› Definitions› Risk Universe / Profile

› All the risks that the project might face

› Risk Tolerance

› If push comes to shove, the project / organisation might just be able to put up with

› Risk Appetite› Those risks that the project / organisation actively wish to engage with.

Risk Appetite & Tolerance (by IRM*)

* The Institute of Risk Management (UK)

Risk Appetite & Tolerance (by IRM*)

* The Institute of Risk Management (UK)

Risk AppetiteThose risks that the project / organisation actively wish to engage with.

Risk ToleranceIf push comes to shove, the project / organisation might just be able to put up with

Risk Universe / ProfileAll the risks that the project might face

Risk Financing Strategies

Diagram by Aon Risk Solution

Overall Project Risk Management Process

Project Price = Estimated Cost* + R&O Allowance** + Mgmt Contingency

Eg. Monte Carlo Simulation

Identification of Risks /

Opportunities

Probability of Outcomes

Cost Point or Range

of OutcomesCost

Range (Modelling)

R&O Provision**

R&O Allowance

Quantitative Assessment

Inherent Risk Cost

Cost Point (Deterministic)

or

Scope Growth Cost

Project Risk & Opportunity Process

EstimateCost*

Inherent Risk

• Quantities• Rates

• Direct• Indirect• Margin

PlanningInherent

Risk

• Days

Date Range

(Modelling)

PlanningMgmt Plans

MethodsDesign

Analysis & Evaluation

Mitigation / Maximisation

Strategies

Qualitative Assessment

Original (BAU) Rating Residual RatingR&O Register

• Risk / Opportunity• Owner• Controls (BAU)

Identification Analysis & Evaluation

Identification of required provision

Risk Contingency

›What quantitative risk assessments can be used for:› Valuation of Risk within your project

› Linked to TIME and COST

› The assessment process may look at:› Uncertainty of estimate and program

› Design Development Scope Growth

› Discrete Risk Events

› Should include both Threats and Opportunities

› Aims to support effective decision making

Contingency vs. Management Reserves

› Is different across the phases and stakeholders of the project:

* Broadleaf Capital International Pty Ltd

› E.g. - Client

› Project Contingency is part of the budget

› Based on known unknowns

› Management Reserve keep separate from the project

› Based on unknown unknowns

› E.g. - Constructors

› Risk & Opportunity Allowance / Contingency is part of the tendered price

› Based on known unknown

› Management Contingency is also part of the tendered price but may be kept away from the project budget

› Based on unknown unknowns

Project Risk Management Tools

Project Risk Management Tools

›What are the tools that you:

› Use?

› Know of?

› Want to know more about?

Many Types of Risk Assessment Tools

› Being reviewed

› Qualitative Risk Tools› Project Risk Register

› CHAIR

› Bow Tie analysis

› Quantitative Risk Tools› Deterministic Risk Analysis

› 3 Point Estimate Risk Analysis

› Probabilistic Analysis

› Time

› Cost

› Time and Cost

Other Risk Management Tools

›Not being reviewed

› Multi Criteria Decision Analysis

› HAZID or PHA

› RAMBO

› HAZAN, HIRAC, WRAC, etc

› HAZOP, CHAZOP

› HACCP

› FMECA

› SIL Analysis and Determination

› Hazardous Area Classification

› Fault Tree Analysis

› Event Tree Analysis

› Probit Analysis

› Release Modelling

* Tools outlined by SKM

Project Risk Register

›Data collection and reporting ability› Form or data base

› Should suit the needs of project / organisation

› Ability to access data to conduct analysis

Identification methods

Resources HighLow

Level ofDetail

High

LowOne

person review

Checklist

Brainstorming Workshop

Guided Word Workshop

Example of Identification processes

› Matching the identification process with the analysis tool being used.

› Process of collecting risks from a group of people› Post It notes

› Verbal

› Objectives› Identification of a range of risks that could affect the objectives of the project

› Positive› Allows wide range of risks to be collected

› Involves a whole range people

› Ability to narrow down the number of risk by grouping them

› Negative› Require medium level of resource (people and time)

› Better when run by a facilitator

› Where these tools should be used› Start of the risk assessment process

› When guided words are not being used

Brainstorming

› Very structured process of collecting risks from a group of people

› Set list of words that have been developed to match the assessment requirements

› Process risks

› Safety risks

Guided Words

› Objectives› Structured identification of all risks that could affect the objectives

of the project

› Positive› Very detailed

› Drives safety into the design

› Negative› Resource rich (people and time)

› Experience facilitator is needed

› Where these tools could be used.› Start of the risk assessment process

› High risk environment

› Ability to affect design development

Qualitative Risk Tools

Qualitative Rating Matrix

› A subjective priority rating tool.› Ability to rate all types of consequences against each other

› Matrix must be developed to match the scope of project / organisation

› Should used with:

› Consequence table

› Likelihood table

› Action table per rating

› Opinion based not data driven

› Can be used across the whole project lifecycleL

ikel

iho

od

rat

ing

Almost Certain

D C B A A

Likely D D C B A

Possible E D C C B

Unlikely E E D C B

Rare E E D D C

1 2 3 4 5

Consequence rating

John Holland Rating MatricesCorporate Matrix

Lik

elih

oo

d ra

ting

Almost Certain

E D C B B A A

Likely E E D C B A A

Possible F E D D C B A

Unlikely F F E D C B B

Rare F F E E D C B

1 2 3 4 5 6 7

Consequence rating

Project Matrix

Lik

elih

oo

d r

atin

g

Almost Certain

pD pC pB pA pA

Likely pD pD pC pB pA

Possible pE pD pC pC pB

Unlikely pE pE pD pC pB

Rare pE pE pD pD pC

1 2 3 4 5

Consequence rating

›Construction Hazard Assessment Implication Review› Can be used in “Safety in Design”

› Guideword based

› Staged approach

› Concept design

› Detailed design construction

› Detailed design maintenance / repair

› Positive› Very detailed

› Drives safety into the design

› Negative› Resource rich (people and time)

› Experience facilitator is needed

CHAIR

Bow Tie Analysis

›Qualitative – Causes and Impact per incident›Quantitative – Fault and Event Tree analysis› Objectives

› Ability to find controls that can reduce both the likelihood of event occurring and reduction in the impact when the event does occur.

› Positive› Gain a full understanding of controls

needed to manage a risk event

› Negative› Very resource rich for assessment of all

risks but can be focused on key risks

› Where these tools could be used.› On key risk items

› High risk environment

* Diagram from SKM

Quantitative Risk Tools

Quantitative Risk Management Tools

› Data driven assessment tools› Resulting in dollars or days (or both)

› Looking at:

› Deterministic cost

› 3 point estimate cost

› Probabilistic

> Cost

> Time

> Cost & Time

Cost Risk Analysis - Deterministic

›Cost “point” for each line item – both risk & opportunity› Results in one $ value

› Objectives› Get a specific value for Risk

value

› Positive› Very easy to enter data

› One number to look at

› Negative› No information on worst or best

results

› No information of likelihood of any outcome

› Where these tools chould be used.

› Selection of the Risk Contingency value

Cost Risk Analysis – 3 Point Range

› The cost point has three point estimate› Best case, Most Likely, Worst Case

› Results in Nine Square matrix

› Objectives› Give more information about worst and

best outcomes

› Positive› Easy to enter data

› Negative› No information of likelihood of any

outcome

› Users focus on the middle box result

› Extra time is needed to enter data

› Where these tools should be used.› Review of estimate uncertainty

› Review of any design development scope growth

› Selection of the Risk Contingency value

Cost Risk Analysis – Probabilistic› Each cost point now has a cost range and distribution profile

› Results are a range of outcome with their likelihood of occurring› Objectives

› Ability to show the expected uncertainty around the possible outcome

› Positive› Can give the user most confidence about

the selected value

› Negative› Needs experienced user to run and

assess the model

› Assumptions can be lost within the “black box”

› Results can confuse management

› Where these tools could be used.› Review of estimate uncertainty

› Review of any design development scope growth

› Selection of the Risk Contingency value

* Diagram from SKM

Scheduling Risk Analysis› Probabilistic date range analysis is conducted on

› Date range of the program (Uncertainty)

› Discrete Risk Event throughout the program

› The expected delivery dates have the likelihood of occurring

› Objectives› Likelihood of delivery dates

› Positive› Can give the user most confidence about the

selected delivery date

› Negative› Need robust base program

› Needs experienced user to run and assess the model

› Assumptions can be lost within the “black box”

› Results can confuse management

› Where these tools could be used.› Determine delivery date

› Important when there is tight timeline, large penalties or high overheads

* Diagram from SKM

Scheduling & Cost Risk Analysis

› Cost are linked to the “Work Breakdown” of the program

› Probabilistic analysis of both time and costs together› Objectives

› To gain understanding of Cost and Time risk profile across the project lifecycle

› Positive› Ability to see the critical time and cost sections of the projects, with regards to uncertainty and risk

events

› Negative› Needs estimate to be fully based on program work breakdown structure

› Need robust base programme

› Needs experienced user to run and assess the model

› Needs systems that allows changes to schedule and risk information to be able to up-date each other

› Assumptions can be lost within the “black box”

› Results can confuse management

› Where these tools could be used.› Projects that are complex and / or tight timeframes

› Projects that need to get back on track and management need to know where to focus extra resources

Selecting the tools

How to select tools

› There is no “Right” answer› Questions to ask:

› What is your company’s policies regarding risk management?

› What does your client require?

› What is the project delivering?

› How is the project planning to be delivered?

› What decisions need to be made from this information?

› Time available to conduct the risk assessment process?› Concept may have a year in development

› Tender may have two months

› Resources available to conduct the assessment?

› Management ability to use the assessment results?

Review and Reporting

› What information needs to be reported?

› What decisions are going to be made on the information?

› What risk data can be collected?

› Are there Key Risk Indicators to be reported against?

› How to make the information:

› Understandable› Interesting› Able to influence decision and change behaviour

Reporting Requirements

Communicating Uncertainty

› A way of giving management a sense of “uncertainty” of the what can happen in the future

› Graph used by Bank of England to show expected economic outcomes

Example Manual Risk Dashboard

Dashboard – Page 2.

Use of Risk Management System

* Example of Leighton Contractor’s Risk Management system

LinkedIn - Networking

›Recommending staying in touch› LinkedIn – building networks

› There is Project Risk Management Groups