Risk Management

1. Risk Management Project Management is Risky Business Robin Uba Audit Associate City of Mississauga September 26, 2008 Public Sector Project Management Forum

2. Raise your hand if • you are currently working on a project • you believe that given enough time, money and resources you will successfully complete your project • you believe that you actually have been given enough time, money, and resources to successfully complete your project • you have a documented risk management plan

3. Agenda • Why do risk management • What is risk management • How to identify risks • What to do with risks

4. Why Do Risk Management Something bad will happen soon to wreck my project.

5. Why Do Risk Management • Bad news does not get better with time • early detection allows more time to evaluate options • problems grow bigger with time • the later the problem is detected, the bigger the crisis • crisis reactions are impulse not methodical

6. Why Do Risk Management When you’re up to your ass in alligators it’s hard to focus on draining the swamp.

7. What is Risk Management? What is Risk • an uncertain event or condition that, if it occurs, has a positive or a negative effect on at least one project objective, such as time, cost, scope, or quality (PMI)

8. What is Risk Management? • A plan of actions to take to increase the probability and impact of positive events and decrease the probability and impact of events adverse to the project • Relates primarily to the extent of your ability to predict a particular outcome with certainty.

9. How to Identify Risks What is Uncertainty • An absence of information, knowledge, or understanding regarding the outcome of an action, decision, or event

10. Key Questions • What do I NOT know about project deliverables? • What are the possible outcomes / decisions? • what if the answer is Yes • what if the answer is No • what if the answer is Maybe

11. How to Start • Hold a Black hat meeting once preliminary plan developed • team plays devil advocate, everything delayed, reduced, rejected, opposed • identify options for each decision • identify sources of scope creep

12. Standard Sources of Project Risks Legislative risk: risk of non-compliance risk of legislative or regulatory change Financial risk: the costs have been under-estimated the benefits have been over-estimated Operational risk: implementation is not as planned business benefits are not achieved Technical risk: project depends on new, untried technology very complex infrastructure is required Definitional risk: clients have not defined requirements well complexity of existing processes lack of standards Political risk: stake holders see the project as a threat nay-sayers undermine the project

13. General Public Risks • How many ways can the public interact with your project? • staff visibility / contractor visibility • community assets (roads, parks, rooms) • articles, RFP ads • Are there any special interest groups? • Is the public for or against your project?

14. Council Risks • How many ways can your project come in contact with council? • resident / vendor issues • budget requests / additional funding requests • contract approval / contract extensions • legal issues

15. Council Risks • Other items to consider • mood of council • special interest groups and general public • election timing • lead time to get on agenda • competing agenda items / priorities • At minimum, impacts project schedule and staff resources

16. Legislative Risks Most projects must comply with specific legislative requirements. • Do you know who the expert is? • Do you have an expert for the critical subject legislation on your project? • Is any of the legislation under review?

17. Vendor Risks • Rule #1 – Assume you will be sued • document everything • what if no one responses or too many respond to RFPs • what if vendor runs into difficultly (bankrupt, merger, law suits) • rules to extend / modify signed contract

18. Internal Services • Who do you contact and do you know what process to use for: • purchasing, budgeting, legal, facilities, accounting, printing, legislative services • What does the project need to provide by when, so they can deliver their service efficiently? • Do they know you are coming?

19. Staff Risks • Do team members understand and agree on their role, responsibilities, and time commitments • Are team members over committed • Are you expected to complete employee performance reviews • Do you know the strengths / weaknesses of your team members

20. What To Do • Document risks and actions to be taken • risk register, table, chart • For each risk • classify impact on project (high, medium, low) • classify odds of occurring (high, medium, low) • decide on an action plan and trigger point • do nothing is an acceptable action

21. What To Do • Include actions in project deliverables, schedule, and budget • Outcome is version 2 of the project plan • more robust and conservative plan • shared realistic expectations • Include upcoming risks and planned actions in communications to senior management

22. Warning Some tasks may be viewed as a waste of time, money, and effort, if the potential problem does not occur

23. Develop Risk Mindset • Pay ongoing attention to risks • Risk and uncertainty will always be a threat to your project (first day to last day) • Size and shape of risks continually changes • Always go “looking for trouble” • Be sceptical, aggressive, and relentless in your quest to uncover potential problems

24. Conclusion • Early detection reduces the impact to the project and improves the odds that the project leader will survive • A little paranoia in a project leader is a good thing! • Risk management is less stressful than Crisis management