Risk Analysis

The basis of risk analysis is the above explained risk identification. Risk analysis covers a complete and continuous evaluation which should be realized quantitatively as well as qualitatively for all identified risks. The goal is to detect possible interrelationships and enable the project manager to identify a kind of importance order, also called prioritizing. Furthermore, the consequences for the project itself and the organizational goals can be identified. The evaluation of the risks should meet the following demands:

- Objectivity: The reference to the special market should be taken into consideration to make the objectivity practicable. For internal risks a subject evaluation is often necessary.

- Comparability: The evaluation of risks should lead to comparable results. Therefore the organisation should use consistent and standardized methods and data.

- Quantification: By means of quantification the organisation is able to detect deviation from the targeted goal.

Download free books at BookBooN.com 84

- Consideration of interdependencies: In practice this is the hardest part of risk assessment. Effects like compensation and interdependencies can emerge. Not realizing connections between risks and their meaning for the department and possibly for the whole organisation can be a big risk. That is why the project team should consider carefully what a risk and the reaction to it can mean not only for the team but for the whole organisation as a good solution for one department can mean a problem for another department.

The most commonly used technique for risk analyzing is the so-called scenario analysis. This simply consists of the probability of the event and the impact this would have on the project. The scenario analysis is part of many more approaches to the analysis of risks, for example in the matrix, the failure mode and effects analysis (FMEA) or the program evaluation and review technique (PERT).

To do a risk evaluation properly it should be defined first which levels will be used for evaluating the risks. For example, there should be ranges between 1 and 5 to give the impact or the likelihood a certain “size”. If one wants a more detailed evaluation there could also be a range between 1 and 20. If one wants the evaluation to be more exact, there could also be a more exact classification of what a ‘very low impact’ means. This could be described by letters and for probability or affected costs, percentages could be stated for the different evaluation levels (see figure 6.3).

Figure 6-3: Evaluation of Risks

The evaluation form can be filled injointly or with the help of an expert. Common techniques are versatile and range from exact point estimations to workshops. Beside the most probable case, also the worst and the best cases are estimated.

Download free books at BookBooN.com 85

To make the risk analysis more demonstrative the organisation can use the matrix to show the importance of several risks. The matrix shows two aspects of the considered risk: the impact it would have and the probability of its occurrence. A very often used matrix has 5 times 5 fields, each with another value of probability and impact (see Figure 6.4). As each combination has another meaning for the project, according to this the matrix is divided into a green, a yellow and a red zone. As known from traffic lights the red zone, representing the major risks, means nothing good. The yellow colour stands for moderate and the green fields for minor risks. As one can see, the red zone is arranged on the right-hand side and the green zone on the left, where the impact is lower. In between the yellow zone can be found. The red zone goes very deep into the probability menu because the impact is still so high although the probability is low. In general one can say that the impact is more important, as this comparison shows: 10% probability of losing 1 Mio. € is considered to be a more serious risk than a 90% probability of losing 1000 €.

Download free books at BookBooN.com 86

Figure 6-4: Risk Matrix

With the help of this matrix the project manager can prioritize the risks so that he knows which risks should be addressed particularly and at first. Prioritization also helps to adopt the given means reasonably, which is very important as all resources in project management such as material, financial means, human resources and time are limited.

The FMEA (Failure mode and effects analysis) model is similar to the matrix but extends the impact and probability by the detection possibility, meaning how hard it is to actually realise the occurring risk. The equation enlarged with detection is:

Impact x Probability x Detection = Risk Value

To make the equation work each of the dimensions has to be evaluated by a five-point scale. Detection describes the ability of the project team to detect that the risk is threatening. On the 1 to 5 scale, ”1” would mean easy to detect and “5” that the detection would probably only take place when it is considered too late. The product of the data would have a range between 1 and 125. ‘1’ shows the risk has a low

probability, an impact of level 1 and would be easy to detect. At the other extreme the result ‘125’ would show that the team had to handle a high-impact risk whose probability is high and nearly impossible to detect. That would mean consideration has to be given whether to start the project or not if the risk could not be mitigated or transferred. All in all, the range between 1 and 125 can be used to define the hazardous nature of a risk.

PERT (Program evaluation and review technique) was developed within the framework of the U.S. Navy’s Polaris-Project. Nobody knew how long it would take to produce the parts for the rocket. There were many new parts coming from R&D. To solve the problem of planning, the team asked all suppliers to estimate the duration of production. It is assumed that with the help of the program evaluation and review technique the construction of the Polaris rocket was accomplished after two years, which is about 45% earlier than first estimated.

Download free books at BookBooN.com 87

PERT is similar to the critical path method (CPM) known from the scheduling theory. The methods were developed at nearly the same time. The difference is that CPM uses the most frequent duration and is used for standardized projects. In contrast to that, PERT is used for projects with high uncertainty and little experience. PERT is utilized to compute the probability of meeting different project durations.

PERT is useful as it provides the expected project completion time and the probability of the completion before a specified date. Furthermore, it helps in finding out the activities which may have slack time and those that can lend resources to critical activities. Disadvantages are that the estimates can be somewhat subjective and also depend upon the experience of the project members. Furthermore, the beta distribution might not always match the reality. It is said that PERT often underestimates the project completion time because other paths than assumed before can become critical paths if the related activities become late.