Identifying and Managing Project Risks

(1)

Top Ten Mistakes Made in

Managing Project Risks

Joe Lukas, PMP, PM, CCE

g g

j

Chapter Dinner / Lunch Meetings March 19 & 20, 2012

• Consultingand Training(online, public and private)

 project management

 business analysis

 Agile projects

 Interpersonal skills

• Free Educational Webinars

 Earn ~10 PDU’s per year

 http://www.pmcentersusa.com

• Webinars on Demand • Webinars on Demand

(2)

Presentation Objectives

• Are you making any of the common errors in risk management?

• This talk will cover the top ten mistakes Project Managers make in dealing with project risks • This presentation will also discuss how to avoid

these mistakes, along with effective risk techniques that should be used on projects

3

©Joe Lukas-March 19 & 20, 2012

techniques that should be used on projects

Top 10 Risk Mistakes

1. Not considering opportunities – just threats

2 C f i i k i k t & i t

4. Understating risk impacts, and not scaling the 2. Confusing risk causes, risk events & impacts 3. Using checklists and not ‘scanning the

horizon’ for other risks

impacts based on project drivers

(3)

7 C lli i k l i ‘ iti ti ’ 6. Not considering sensitivity with Risk Analysis

Top 10 Risk Mistakes

7. Calling risk response planning ‘mitigation’ 8. Not considering contingency plans when

doing risk response planning

9. Not making specific project team members

5

10. Not making risk management an on-going process

g p p j

responsible for specific risk events

• Risk Management is the process of identifying,

Mistake #1

Not Considering Opportunities – Just Threats

analyzing, and responding to all project risks

• Risks typically related to highly “chancy” or hazardous activities, but need to consider the probability and impacts with a goal to:

 maximize for positive events  minimize for adverse events

(4)

Mistake #1

Not Considering Opportunities – Just Threats

• Client example of risk management procedure

b i d t j t

being used to manage projects

7

• Special pricing offered by a supplier

• Competitive market conditions for a specific

Examples of Opportunities

service

• Sudden availability of a key resource for a short time period due to their project being postponed

• Availability of some needed equipment (such as servers or desktop computers) from another company downsizing their operations

• Availability of an government investment tax credit for work done before a specified date

(5)

Mistake #2

Confusing risk causes, risk events & impacts

• Common error during risk identification: failingCommon error during risk identification: failing to distinguish among the causes of risk,

genuine risk events, and the impacts of risks

• Result:

 Dilutes the value of the risk process

 Introduces distractions at early stages

9

 Introduces distractions at early stages

 Can obscure genuine risks

• Causes: Definite events or sets of

circumstances that exist in the project or its

Causes

-Risk Events-Impacts

environment and which give rise to uncertainty

• Examples:

 Doing a project in a developing country

 Using unproven technology

(6)

• Risk Events: Uncertain activities that, if they occur, will effect the project objectives.

Causes-

Risk Events

-Impacts

, p j j

• Examples:

 Exchange rate fluctuations

 Contractor delivery

 Client expectations misunderstood

11

• Impacts: Unplanned variations from project objectives (positive or negative) which are a

Causes-Risk Events-

Impacts

result of risks occurring.

• Examples:

 Milestone date missed

 Budget under-run

(7)

• Risks events have one unique dimension: uncertainty (described as “probability” or

“ ” f ”)

Causes-Risk Events-Impacts

“likelihood” of occurrence”)

• Need to maintain a clear separation between Causes, Risk Events, and Impacts

Format: (1) Due to <cause>,

< i k t> ld

13

<risk event> could occur,

resulting in <impact>

(1)_{Project Risks, Identifying Causes, Risks and Effects, Dave Hillson, PMP, PM} Network, September, 2000

Identified Risk Example

Due to <the many job opportunities for top-notch

th l f k j t l

programmers>, <the loss of key project personnel> could occur, resulting in <higher costs and a longer schedule>

(8)

Identified Risk Example

Due to <other systems projects underway>, <a lack of space to support the new application on lack of space to support the new application on existing servers> could occur, resulting in <the need to purchase a new server>

15

Identified Risk Example

Due to <a lack of training resources>, <system launch without the necessary training materials> launch without the necessary training materials could occur, resulting in <poor data quality because untrained users enter incomplete data>

(9)

Identified Risks Example

IMPACT

E h

CAUSE RISK EVENT

Need to purchase _Exchange

rate fluctuation Equipment held up in customs Need to purchase equipment from foreign supplier Doing a project in a foreign country    17

Problems installing hi-tech manufacturing equipment Lack of skilled equipment mechanics  

Identified Risks Example:

CAUSE RISK EVENT

IMPACT

Sharing senior software programmer

between two projects Using new software technology Work overload Occurs Unanticipated integration errors      

(10)

Risk Identification Tools

Risk Causes 1. 2 Causes Impacts Cost Time Quality

a lawsuit against the Department of Health and/or the Homeowners Association

Category = Legal Risks

1 4 5 Causes Impacts Cost Time Quality

a lawsuit against the Department of Health and/or the Homeowners Association

Category = Legal Risks

1 4 5 2. 3. 4. 5. 6. 7.

Keep Risk Causes on

19

P = 20% I = 10 RF = 2.0 Function P = 20% I = 10 RF = 2.0 Function Use Post-It notes set-up as shown

to capture and analyze risks

Keep Risk Causes on separate sheet

Mistake #3

Using checklists and not ‘scanning the horizon’ for other risks

• Checklists – listings of risk events typically encountered on a specific type of project, but the team doesn’t consider what’s not on the list!

• Use Brainstorming – free flow of ideas used to generate a listing of other

(11)

Mistake #4

Understating risk impacts, and not scaling the impacts based on project drivers

• Four possible consequences to any risk event:

 Cost

 Schedule

 Functionality

 Quality

21

• Need to look at largest impact in the four areas

Prioritize the Project Drivers

Scope: Needs and Expectations of Time Cost Stakeholders

(12)

Impact

Value Cost Schedule Functionality Quality

10 5% 5% Major Issue Major Issue

Sample Project Impact Scale

10 Major Issue Major Issue

8 Medium Issue Medium Issue

6 Minor Issue Minor Issue

4 Very Small Issue Very Small Issue 2% variance _2%_variance 3% variance 3% variance 4% variance 4% variance 5% variance 5% variance 23

2 1% variance 1% variance -

-Need to consider relative importance of project impacts (are all impacts weighted equal?)

Weighted Project Impact Scale

Impact Value

Cost Schedule Functionality Quality

10 Very high - Major Issue Major Issue

10 Very high

Impact

Major Issue Major Issue

8 High Impact - Medium Issue Medium Issue

6 Medium

Impact

Major Impact Minor Issue Minor Issue

4 Low Impact Medium

Impact Very Small Issue Very Small Issue 2 - Low Impact - -0 - - -

(13)

-Mistake #5

Not using 100% probability during planning

Probability Description

Probability

0.9

0.7

0.5

1.0 Description

Almost certain to occur (>90%) Highly likely (>70%)

Likely (>50%)

Certain to occur (100%)

25

0.3

0.1

0.0

Low likelihood (<30%) Very unlikely (<10%) No chance

Mistake #5

• Can have 100% probability during planning

h b t th P j t T d t t k

Not using 100% probability during planning

phase – but the Project Team needs to take actions to reduce it below 100% or somehow incorporate the item into the Project Plan

• Example: due to the very heavy workload in the client area making key personnel unavailable,

k i t b i d lti i

(14)

Mistake #6

Risk Simulation

Not Considering Sensitivity with Risk Analysis

• Improves project risk management by determining the biggest risks for risk response planning

• Education tool for management to help them understand project

27

• Also improves estimate (cost & schedule) accuracy and determine a contingency amount for an acceptable risk level

Risk Simulation Software

• Risk analysis software provides:

Time or $’s  Frequency of probable cost or schedule outcomes C l ti t Time or $’s  Cumulative cost or schedule with overrun probabilities

(15)

Risk Simulation ‘Problem’

• Project team needs to assign most likely, optimistic and pessimistic values to each risk:

 There is a

BIG

tendency to understate risk impact!

 One option: define standards for risk ranges to minimize debate

Low = -5% to +10% Medium = -10% to +50%

29

Medium 10% to +50% High = -20% to +100% Very High = -30% to +300%

Mistake #7

Calling risk response planning ‘mitigation’

• Client example of risk management tool being p g g used to manage projects

This tool mistakes mitigation as being the only risk response action! being the only risk response action!

(16)

Mistake #7

Calling risk response planning ‘mitigation’

• The ‘product’ of risk management is called the p g Risk Register and it includes:

 List of identified risks

 Risk analysis

 Risk response plans including contingency plans • It’s not…

31

 A Risk Management Plan

 A Mitigation Plan

 A Risk Assessment

Risk Response Techniques

For Threats: E l it For Opportunities: • Avoid • Transfer • Mitigate • Exploit • Share • Enhance For Both: • Acceptance • Contingency Plans For Both:

(17)

• Avoidance: eliminating specific threats, usually by eliminating

Avoidance & Exploit

the cause

• Exploit: Seeks to provide

d fi iti th t ill li i t

33

definitive causes that will eliminate uncertainty and allow the risk realization for an opportunity

• Contractual agreements may be used to transfer negative risks to others

Transfer & Share

• Allocating ownership to a third party who is best able to capture the opportunity for the benefit of the project is a share example

(18)

• Mitigate: reducing the risk factor by reducing the probability of occurrence and/or the risk event

Mitigate & Enhance

impact

• Enhance: make the risk event more likely by increasing the probability of occurrence and/or the risk event impact

35

• Applies to both opportunities and threats since seldom possible to eliminate all threats or take advantage

Acceptance

eliminate all threats or take advantage of all opportunities

• Can be passive acceptance – do nothing

• Can be active acceptance

-developing a contingency plan and/or developing a contingency plan and/or reserve (time, money and/or

(19)

Mistake #8

Not considering contingency plans when doing risk response planning

• Strategies for threats and opportunities are actions taken beforethe risk event occurs

• Contingency plans are actions taken after the risk event occurs

• Risk response planning should deal with both!

37

Risk response planning should deal with both!

Example Risk Response Plan

• Risk Event: Missing key project requirement

• Expected Value: 9.0

• Mitigation Plan: Include in resource plan activities & hours need by key resources; get management commitment to dedicate key personnel to project

(20)

Example Risk Event Plan

• Risk Event: System launch w/o training materials

• Expected Value:Expected Value: 5 65.6

• Mitigation Plan: Get management commitment to dedicate personnel to project (addresses probability)

• Contingency Plan: Get proposal from vendor

39

training companies to prepare materials, issue Purchase Order to vendor if personnel don’t start as promised

Mistake #9

Not making specific project team members responsible for specific risk events

Th P j t M h ld i l th

• The Project Manager should involve the Project Team in owning project risks!

Project ID: B004

Completed By: Project Manager: Mimi Hoke

Date Completed: Status Date: 14-May-04 RF ASSIGNED RISK PLANNING

# RISK EVENT P I P x I TO (RESPONSE & CONTINGENCY PLANS) STATUS

incomplete user functional requirements

Mimi Mitigation: Get commitment from Business Sponsor on making key users available for

Specific dates and times for JAD sessions being planned. Will look

Joe Lukas 14-May-04

Risk Register

Project Title: New Project Portfolio System

1 q

0.9 10 9.0 requirements definition._{Contingency: If users don't show up, send}

absent list to Business Sponsor for follow-up phone calls.

for firm commitments on attendance.

2

contractors being hired who are not familiar with Sunoco

systems 0.7 8 5.6

Mimi Mitigation: Contact preferred supplier and try to reserve Sunoco experienced contractors. Transference: consider using a fixed price contract on this project.

Working with Purchasing and supplier on staffing plan.

3

lack of justification for this project at a 20% return

0.2 10 2.0

Joe Avoidance: Do sensitivity study early in project to ensure this is a viable project. Mitigation: recheck business financials every time the project estimate is updated.

Next project estimate update planned for June, will update business case at same time.

(21)

Mistake #10

Not making risk management an on-going process

41

Mistake #10

• Ask if any new risks on the horizon

At each team meeting….

• Check to see if any risk triggers occurred • Update status on execution of risk plans • Update probability and impact values

(22)

Conclusion

• Watch for the common risk managementg mistakes outlined in this presentation

• Establish a risk management procedure with supporting templates for your company – don’t leave it up to each Project Manager to ‘invent’ a process and/or tools

43

p

Questions???

Name: Joseph A. Lukas, PMP, PE, CCE Email:a [email protected] u as@p ce te susa co Phone:609-575-9306