Project Risk Management Overview Mike Dinnon ( dinnon@fnal.gov ) LBNE Risk Manager Mu2e WGM

Project Risk Management Overview Mike Dinnon (dinnon@fnal.gov) LBNE Risk Manager Mu2e WGM August 18, 2010 LBNE Project Management

Course Objectives 1. Establish the 6 basic principles of Risk Management 2. Identify risk owner’s basic responsibilities 3. Familiarize everyone with tools for identifying risks 4. Recognize that there are threats and opportunities associated with risk 5. Understand that risk management is iterative and must be maintained throughout the project LBNE Project Management

References: • DOE Document DOE O 413.3a • Project Management Institute Body of Knowledge Guide 2004 • Project Management Institute, Project & Program Risk Management, 1992 • Project Management Institute, Practice Standard for Project Risk Management, 2009 LBNE Project Management

Projects will utilize best practices in project risk management. Risk management, when done successfully, helps to ensure both timeliness and cost efficiency on a project and is the right way to manage a project. It involves a more precise plan and strategy that uses proper tools and simulations to better characterize risk. LBNE Project Management

Key Elements of Risk Management • Risk Planning • Risk Identification • Qualitative Risk Analysis • Quantitative Risk Analysis • Risk Handling and Mitigation Strategies • Risk Monitoring LBNE Project Management

What is the definition of a Project Risk? • A definable event with a probability of occurrence and a consequence. • A situation that has the potential to cause an unwanted or undesired change or a desired change (opportunity) in schedule, cost, scope, ES&H or technical success. • Uncertainty in an event having a positive (opportunity) or negative (threat) impact on a project task. • Risk has a definite cause and, if triggered, a resulting effect. • Risk Severity = Probability X Impact LBNE Project Management

Initiation Definition Execution Transition/Closeout Risk Management During CD Phases Iterative process that needs to be continuous throughout the project life cycle CD-0 CD-1 CD-2 CD-3 CD-4 Approve Mission Approve Performance Approve Start of Approve Start of Need Requirements Baseline Construction/ Operation or & Alternative Authorization Project/Transition Selection to Complete Completion And Cost Range Implementation Risk Planning Risk Management Documentation Qualitative Analysis Process Risk Communications Closeout Lessons Learned LBNE Project Management

Goal of Project Risk Management Establish proactiveupfront planning and mitigation strategies to identify events or conditions along with their likelihood of occurrence and impact as to reduce threats (and capitalize on opportunities) before they can impact the project goals. LBNE Project Management

Overall Objectives for Risk Planning • Establish the overall risk nature of the Project • Recognize the importance of the project to the DOE, project stakeholders, and the collaboration • Set the stage and tone for Risk Management • Establish methods for managing risk • Establish a sound communication structure • Create proactive Risk Attitudes to uncover all risks and opportunities • Stabilize poorly defined or ambitious requirements • Develop Risk Management Plan LBNE Project Management

Risk Planning Considerations • Project Scope Statement • Work Breakdown Structure (WBS) • Attitudes and Stakeholder Tolerance • Definitions • Organizational suggested guidelines • Detailed Roles and Responsibilities • Establishment of proper tools and techniques • Establishment of Risk categories (RBS, DOE G 413 3-7 attachment 8, etc.) LBNE Project Management

Risk Breakdown Structure An RBS, like this example, can be used to determine risk categories. Always use an “other” category to solicit information through expert opinions and brainstorming sessions. LBNE Project Management

Common Risk Categories LBNE Project Management

Roles for Risk Planning • Project Manager will establish guidelines for Risk Management. • Risk Manager will be named by the project management team. • A Risk Management Plan will be developed by project management team. • Risk Matrices will be developed for analysis. • Risk Manager will coordinate efforts with sub projects to ensure understanding of plan. LBNE Project Management

Principles of Risk Identification • Determine what risks will have a negative or positive effect on the project and document the findings. • Perform bottoms-up and top-down analysis of risks. • Process is iterative, to be done throughout the project. • Use Risk Breakdown Structure or similar method to group Risks. • Use WBS as a reference to specify and clearly define the risks. LBNE Project Management

Roles and Responsibilities Overview Project Manager – Establish risk guidelines for identification and analysis, schedule project risk meetings, ensure mitigation strategies are implemented properly. Perform top down risk identification. Risk Manager – Bring identified risks together into risk register, work with subprojects to facilitate effective risk identification, analysis, and mitigation, Monte Carlo analysis. L2 Manager – Identify risk owners, manage mitigation strategies for subsystem, schedule periodic risk review, communicate risks with risk manager and Project Manager. L3 + L4 Managers – Identify risks (bottoms-up), assess identified risks and the resulting impacts, develop mitigation strategies, assess post-mitigated risk impact, document basis for impact on cost, schedule, technical, or ES&H, document findings as related to WBS number, continually reassess risks and identify any new risks as they become apparent. Solicit vendor and sub-contractor risk and incorporate into risk planning LBNE Project Management

Types of Risk Known-Unknowns – things we know exist but, do not know how they will effect the project. An identifiable uncertainty. (Management Reserve) Examples: Oil prices increase, Budget delayed, Manufacturer has layoffs, safety, Design margins Unknown-Unknown – an item or situation whose existence we cannot anticipate. (Available Contingency) Examples: Natural disasters, Supplier closes doors LBNE Project Management

Tools and Techniques for Risk Identification • Information gathering sessions • Strengths, Weaknesses, Opportunities, Threats(SWOT) analysis • Checklists • Assumptions Analysis • Flow Charts • Cause and Effect Diagrams • Expert Testimonials LBNE Project Management

First Steps • Need to talk about risk as in groups. • Identify what worries us • Document the worries • Identify risks between handoffs of subsystem integration and subproject interfaces. • Everything else will fall into place moving forward. LBNE Project Management

Documentation • Risk Management Plan – Sets the guidelines for dealing with risk in the project and parameters for analyzing risk. (Written by the Project Office) • Risk Forms – Will be filled out by risk owners or identifiers to identify each risk individually. (Form will be distributed by the Risk Manager) • Risk Register – After risks have been properly identified with their triggers they are recorded in one database containing all of the identified risks. LBNE Project Management

Common biases to be aware of when identifying risks • Status quo – strong bias toward alternatives that maintain current direction. • Confirming evidence bias – information that supports existing points of view are championed while avoiding information that contradicts. • Anchoring – disproportionate weight is given to the first information provided. LBNE Project Management

Specific Roles for Risk Identification • L3 + L4 Managers will identify risks bottoms up and risks associated with contractors and vendors, document, communicate with L2 Manager and Risk Manager. • L2 Manager will perform top down risk analysis and identify risk owners. • Project Manager will perform top down analysis on entire project. • Risk Manager will meet with individual groups to communicate plan to move forward. LBNE Project Management

Qualitative Risk Analysis Qualitative analysis is the process of adequately characterizing risk in words so as to initiate the development of an appropriate risk handling strategy. Additionally, qualitative analysis allows for an assigned risk rating for each risk, which enables a risk grouping process to occur. LBNE Project Management

Risk Factors • Risk Event – an event causing negative or positive impacts on the project. • Risk Probability – How likely it is for the event to occur. • Consequence – What ramifications (both positive and negative) the event has on the project. • Time & Frequency – How the timing and occurrence of the event tie to the overall task or project. LBNE Project Management

Project Risk Rating • The average risk rating can determine the overall project risk rating. • Risk ratings are assigned via a matrix to the risk, threat or opportunity, based upon the risk classification. • Typical risk classifications are low, moderate, or high. • The classifications value can be tailored to the project. • If the project’s risk threshold is reached, re-evaluation of risks must be addressed to ensure a successful project. LBNE Project Management

Qualitative Risk Threat Analysis Matrix Example Project Specific Inputs LBNE Project Management

Opportunity Risk Analysis • Risks can be positive and not just negative. • These risks will have a positive impact on the project. • Harder to identify and fewer in definition but must be addressed just the same. Examples: Early procurement will decrease a lag in schedule, Having an existing wafer board upgraded early so that a redesign is not necessary if a company is planning a re-tooling that does not support existing specs (Schedule, Cost). LBNE Project Management

Qualitative Opportunity Risk Analysis Matrix Example Project Specific Inputs LBNE Project Management

Specific Roles for Qualitative Analysis • All owners and identifiers of risk will perform a qualitative analysis on their risks using matrices supplied by the Project. • Risk Manager will coordinate efforts and combine all records of risk for further analysis. • Risk Manager will group risks accordingly and enter into preliminary Risk Register. LBNE Project Management

Quantitative Risk Analysis • Used to estimate the impact of risks on project cost and schedule. • A Monte Carlo analysis of the probability and consequence of individual risks that addresses the overall project risk through the use of simulations and models. • Information necessary for accurate analysis should be provided by the risk identifier such as: worst/likely/best scenarios and logic behind, any historical data, vendor quotes LBNE Project Management

Monte Carlo Analysis • Used by the risk manager and/or Project Controls on data supplied by the risk owners/identifiers from all subprojects to determine probabilities of achieving project objectives while managing risks. • Identifies risks requiring the most attention by the use of simulation (critical path analysis). • Quantify project risk exposure and determine the size of cost & schedule management reserve. • Quantitative risk analysis outputs will determine a realistic contingency plan for higher risks. • Outputs will generate graphs and sensitivity analysis for use in CD review process to justify reserve amounts. • Key tool to forecast risks and eliminate most uncertainty using statistics and expert data. LBNE Project Management

Specific Roles for Quantitative Analysis • Risk owners will communicate with Risk Manager to set up parameters needed for proper analysis. • Risk Manager/Project Controls will, in cooperation with risk owners/identifiers, perform necessary analysis and formulate plan for moving forward and soliciting mitigation strategies. • After analysis, establishment of ownership on analysis will be confirmed between the Risk Manager and risk owner. LBNE Project Management

Risk Handling • Develop options and determine actions to enhance opportunities and reduce threats to the project. • Must identify and assign individuals to be responsible for each agreed upon risk. • Iterative process that accounts for continuing change in the project. • Assumptions of risk need to be monitored frequently and mitigated properly. LBNE Project Management

Negative Risk Mitigation Strategies Negative risk handling covers a number of risk strategies, including risk acceptance, avoidance, mitigation, and transfer. When weighing these negative risk approaches, the risk identifier should account for the following: • The options’ achievability in terms of the project’s objectives, and baseline funding and schedule. • The expected effectiveness of the risk handling strategy and document it for analysis by the tools used by the project. • Cost and schedule impacts . • The impact on other technical portions of the project. • Changes to cost and schedule will always utilize the proper change control techniques and documentation. LBNE Project Management

Positive Risk Mitigation Strategies Positive risk handling covers a number of risk strategies, including risk exploiting, sharing, and enhancing. When weighing these positive risk approaches, the risk identifier should account for the following: • Actions taken by the organization to ensure that an opportunity is realized. • Actions may include; increasing resources to reduce schedule, early procurement, Forming risk sharing partnerships. • Influence and identify inputs that drive key risk opportunities. • Strengthening opportunity risk by promoting the occurrence of positive risk triggers. • Changes to cost and schedule will always utilize the proper change control techniques and documentation. LBNE Project Management

Contingency Planning • Documented contingency planning (mitigation strategy) addresses specific risk events ahead of their occurrence . • It is executed when an identified condition occurs indicating the risk is evident. • Cost and schedule contingency are assigned through Monte Carlo Analysis on the risk and the mitigation strategy that accompanies it. • The analysis of their effects on the project will lead to a more defined cost and time distribution for the implementation of project Management Reserve. LBNE Project Management

Common Risk Mitigation Strategies (basic matrix example) Note: ES&H strategies should be solicited from ES&H personnel LBNE Project Management

Specific Roles for Risk Handling • Risk Manager will identify risks that need mitigation strategies from analysis on information submitted from risk owners. • Risk owners will develop and document mitigation strategies and give to Risk Manager. • Risk Manager will ensure analysis on mitigation strategies and communicate with risk owners on results. • L2 Managers will be communicated with and mitigation strategies approved. • Project Manager will approve/reject final strategies or recommend discussion with Risk Management Board. LBNE Project Management

Risk Monitoring • Involves a disciplined, continuous monitoring and evaluating of the effectiveness and accuracy of the risk handling strategy. • Monitoring is executed for individual risks by analyzing risk triggers and continually updating the project risk status. • The risk monitoring process should provide both qualitative and quantitative information to decision-makers regarding the status of the risks and what mitigation strategies are being implemented. LBNE Project Management

Risk Monitoring Considerations The risk monitoring process should be more than a risk tracking documentation process (DOE O 413.3a). Things to monitor: • Risk identification is current with the plan of the project and that risk management is a continuous and iterative process within the project. • Risks, including accepted and low risks, have not changed since first identified. • Mitigation strategies are implemented according to schedule, and that risk triggers are showing that the risk is not presenting itself. • Monitoring done on a monthly basis and discussed in PM group meetings. • Review existing risks for change and see if new risks arise. • Evaluate if risks can be retired and Management Reserve moved to Contingency LBNE Project Management

Risk Monitoring Considerations cont. • Review any back-up plans and determine if any others need to be put into place based upon performance of the current handling strategies. • Review the cost and schedule contingency calculations for current mitigation strategies and those that will be implemented in the near future based upon recent performance to gauge their accuracy. • The risk register and other risk-related forms are up-to-date. • Communication of risks and triggers follows guidelines set forth in the Risk Management Plan. • Communicate Effectively so that proper responses to risk triggers can be put into action as to not effect the project adversely. LBNE Project Management

Specific Roles for Risk Monitoring • Risk Monitoring will be done by risk owners in communication with the L2 Managers and Risk Manager • L2 Managers will incorporate risk monitoring updates into meetings • Project Manager will incorporate risk monitoring into Project Management meetings and keep Risk Management Board informed • Risk Manager will keep the risk register updated and status all risks LBNE Project Management

Summary • Risk management process has steps associated with it. • Understanding those 6 basic principles: • Risk Planning • Risk Identification • Qualitative Risk Analysis • Quantitative Risk Analysis • Risk Handling and Mitigation Strategies • Risk Monitoring • Iterative process that must be maintained. • A risk owner will be assigned and be responsible for all aspects of owned risks. LBNE Project Management

Thank You LBNE Project Management

Project Risk Management Overview Mike Dinnon ( dinnon@fnal.gov ) LBNE Risk Manager Mu2e WGM