Project Risk Management

1. Project Risk Management "How to Avoid the Traps of Cultural Thinking" Mr. Darryl Updegrove, MBA, PMP July 25, 2013

2. What is Risk? • Risk is an uncertain event or condition that, if it occurs, has an effect on at least one project objective. • Objectives can include scope, schedule, cost, and quality. • A risk may have one or more causes and, if it occurs, it may have one or more impacts. • Positive risks (events that have a valued impact) are often called opportunities.

3. How Do I Manage It? • Known risks are those that have been identified and analyzed, making it possible to plan responses for those risks. • Specified unknown risks cannot be managed proactively, which suggests that the project team should create a contingency plan. • The PMBOK guide has two approaches to Risk Management: • Quantify Risk • Qualify Risk

4. Risk Approach – Quantify Risk • Determine Cost Impact or Cost Opportunity: • Risk: • How much will I lose if the risk occurs and what is the probability? • What does it cost me to avoid that risk? • Is it worth the cost to avoid the risk? • Risk Opportunity: • How much will I gain if the opportunity occurs and what is the probability? • What does it cost me to take that opportunity? • Is there a net Return On Investment (ROI)?

5. Risk Approach – Qualify Risk • Qualify Risk: • Identify likelihood (probability) and consequence (impact) • Determine risk level (low / medium / high) • Determine risk handling approach (accept, avoid, transfer, mitigate) • Determine mitigation approach, if necessary • Track risk handling strategy • Track risk status

6. Risk Matrix • Typically, we assign linear likelihoods and look for ways to influence likelihood and/or consequence. • The risk matrix is used to assign a risk level of low (green), medium (yellow), or high (red). • Other methods are used, and levels of likelihood and consequence can be more or less than 5. It is rare to see lower than 3 levels. • Often the approach to risk level are as follows: • Low: Monitor risk level for change • Medium: Develop a handling strategy, but do not implement. Monitor risk level for change. • High: Implement the handling strategy

7. Using the Risk Matrix • Typically, we assign linear likelihoods: • 0-20% - Highly Unlikely • 20-40% - Unlikely • 40-60% - Likely • 60-80% - Probable • 80-100% - Highly Probable X • Consequence levels can be related to type of risk: • Cost: $ thresholds • Schedule: Time delays (days, weeks, months, milestones) • Performance: Loss of capability • Quality: Reliability, availability, % returns, warranty impacts • Others: Impacts can be relative (minor, significant, major)

8. Risk Matrix Issues • Linear probabilities may not be appropriate • Logic tells us that extremely high/low consequences should be evaluated very carefully. • The same can apply to extremely high/low likelihoods X Question: What action would you take if you had a 20% chance or less likelihood of a risk with severe consequences occurring? Remember, by playing Russian roulette you have a 17% chance of fatally shooting yourself on just the first shot

9. Opportunity versus Risk • Do we evaluate the possible value of an opportunity, without first considering the consequence of failure? OPPORTUNITY RISK

10. Cultural Influence on Risk • Our perspectives in life influence how we approach risk mitigation and risk handling. • Risk takers may be inclined to accept the potential consequences of risk without full consideration of the impacts • Risk avoiders may rarely take chances, and miss beneficial opportunities • Media can influence our approach to risk • Stories, legends, news all influence our perspective on risk management

11. Risk Strategy Mistakes • “It’s not a risk, it’s just a concern” – Avoiding acknowledging risk • “The risk isn’t really that high” – Minimizing risk • We often assume the highly unlikely cannot happen (i.e. L = 0) , and the unlikely is highly unlikely (L2 = L1) • Solving risks without documenting the approach • Various reasons: laziness, unwillingness to notify stakeholders, too busy, untrained in the process • Although solving the risk seems like a good idea, without thinking through the process, the most expedient approach is often taken • Without documenting the risk, getting funding for risk mitigation strategies is difficult, and there is no oversight/reporting usually until the risk is virtually realized

12. Risk Strategy Mistakes (continued) • Not re-evaluating risk regularly • Low risks can become higher risks over time • Mitigation strategies are not followed or are not as successful as predicted • Evaluating opportunity over risk • Winner-takes-all approaches lead to evaluating the possibilities of opportunities and ignoring the possibilities of failure • Modern cultural perspectives are very anti-risk handling: • “Just Do It” • “Go Big or Go Home”

13. Risk Consequence Analysis • Analyze all the possibilities before deciding on your strategy: False alarm: get labeled a “Chicken Little” You were prepared and may have saved the day Spend the rest of your life knowing you made the wrong choice You got lucky

14. If You Don’t Take Risks, You’ll Never Be a Success • There are multiple stories of those who gambled and won big: • Paul Orfalea- Kinko’s • Donald Trump • Howard Schultz – Starbuck’s • Bill Gates – Microsoft Corporation • Steve Jobs – Apple Computers • John Lasseter - Pixar Rarely do we remember those who gambled big and lost!

15. Disastrous Product Launches • Coors Rocky Mountain Spring Water – 2 years • HD DVD – 2 years • Cosmopolitan Yogurt – 18 months • Pepsi AM – 1 year • Pepsi Crystal – 1 year • McDonald’s Arch Deluxe – 1 year • Microsoft Bob – 1 year • Orbitz Soda – 1 year • Google Lively – 4 months • New Coke – 77 days • HP Touchpad – 49 days • Qwikster – 23 days

16. It’s Never Happened Before • Every instance where risk is previously avoided builds a belief that it can’t ever happen • Various examples can be given, but probably the most famous is the Challenger Space Shuttle explosion • Because the solid rocket booster O-ring had never fully burned through before, NASA assumed that the O-rings were safe • The shuttle was launched at its coldest temperature ever, with NASA ignoring warnings that proved fatal for all seven passengers

17. It’s Not a Risk if it Can’t Be Quantified • Following the Challenger disaster, NASA followed up with the Columbia disaster • A damage assessment team saw the foam block strike the Columbia during launch • Pleas to request assistance from other organizations in damage assessment were denied because the risk that there was damage which could endanger the shuttle could not be verified (the very reason the request was made) • As a result of ignoring the risk, seven more lives were lost

18. Go Big or Go Home • “Casey at the Bat” is a ballad about a baseball team from the town of Mudville that is losing by two runs with two outs in their last inning. • With two runners now in scoring position, Casey represented the potential winning run. • Casey is so sure of his abilities that he does not swing at the first two pitches, both strikes. • On the last pitch, the overconfident Casey strikes out, ending the game and sending the crowd home unhappy. And now the leather-covered sphere came hurtling through the air, And Casey stood a-watching it in haughty grandeur there. Close by the sturdy batsman the ball unheeded sped— "That ain't my style," said Casey. "Strike one!" the umpire said. … With a smile of Christian charity great Casey's visage shone; He stilled the rising tumult; he bade the game go on; He signaled to the pitcher, and once more the dun sphere flew; But Casey still ignored it and the umpire said, "Strike two!" "Fraud!" cried the maddened thousands, and echo answered "Fraud!" But one scornful look from Casey and the audience was awed. They saw his face grow stern and cold, they saw his muscles strain, And they knew that Casey wouldn't let that ball go by again. The sneer is gone from Casey's lip, his teeth are clenched in hate, He pounds with cruel violence his bat upon the plate; And now the pitcher holds the ball, and now he lets it go, And now the air is shattered by the force of Casey's blow. Oh, somewhere in this favoured land the sun is shining bright, The band is playing somewhere, and somewhere hearts are light; And somewhere men are laughing, and somewhere children shout, But there is no joy in Mudville—mighty Casey has struck out. Although fictional in nature, the moral of the story is to avoid unnecessary risk in project planning

19. Just Do It ! • Jones was issued nine citations for rules infractions in his career, with a total of 145 days suspended. However, in the year prior to his death Jones had not been cited for any rules infractions. Railroaders who worked with Jones liked him but admitted that he was a bit of a chance taker. He was by all accounts an ambitious engineer, eager to move up the seniority ranks and serve on the better-paying, more prestigious passenger trains. • The night of his death, Casey Jones was “high-balling” his train, hitting speeds as high as 115 mph. The opportunity of meeting schedule and the ensuing fame over-rode the risk of death and destruction that actually ensued. • "The Ballad of Casey Jones" is a traditional song about railroad engineer Casey Jones and his death at the controls of the train he was driving. It tells of how Jones and his fireman Sim Webb raced their locomotive to make up for lost time, but discovered another train ahead of them on the line, and how Jones remained on board to try to stop the train as Webb jumped to safety. • On April 30, 1900, Casey Jones was killed when his passenger train, the Cannonball Express, collided with a stalled freight train at on a foggy and rainy night. • According to legend, when they found his body, his hands were still on the whistle and brake. Casey Jones is remembered for his bravery, not his risk-taking mentality that ultimately claimed his life.

20. Superman - I Can Do Anything • The belief in one’s own or team’s ability to accomplish above-average performance on a regular basis • Misrepresentation of actual capability leads to a decrease in assigned likelihood of failure which is a near-automatic risk reduction • Success / past history can further influence the belief in this capability for future events • Ensure one is aware of the difference between surge capability and continued capability X X

21. Misunderstanding of Probability • Not understanding the laws of probability leads to overconfidence in the unlikely possibility of risk occurrence • An easy example to understand is the likelihood of flipping a coin and it landing head side up at least once • Each chance is 50%, but over just a few flips it becomes close to certain it will occur (at least once).

22. Venetian Blind Syndrome • In calculating quantitative opportunity/Return on Investment (ROI), it is easy to show future returns, with little or no near-term return. • The overall ROI or opportunity is high, but there is little to justify the future expectations of value • As the effort is re-evaluated on a regular basis, forecasts are updated • Repeated evaluation of future ROI with no evaluation of actual versus planned performance can lead to the “Venetian Blind” syndrome

23. Venetian Blind Syndrome (cont.) • The initial analysis shows future large returns

24. Venetian Blind Syndrome (cont.) • When the project is re-evaluated and found to be lacking, future growth is shifted to the right, showing value in continuing the project

25. Venetian Blind Syndrome (cont.) • This continues cycle after cycle

26. Venetian Blind Syndrome (cont.) • Actual performance, when evaluated, might show the project is not worth the time/effort

27. What Do We Do? • Determine if we can live with the negative result of risk • Would you risk striking out in an embarrassing way • Would you risk crashing a train and dying • Would you risk killing a space shuttle crew • Notify stakeholders early • Follow PMBOK principles regarding risk notification • Plan risk, execute risk mitigations, monitor and control impacts

28. Project Risk Management Questions & Discussion Thank You !