Risk Assessment and Mitigation

1. Risk Assessmentand Mitigation Don Cole Project Management for ARA Engineers and Scientists

2. Total Lifetime Costs U = Ui+ (1 - Ps) Uf Cost (U) {min U} Ui = Initial System Cost (1 – Ps) Uf = Expected Cost of System Failure Reliability (Ps) Ps* Overview Economics of Risk • What types of risks are of concern to Project Manager? • How do you identify the risks? • What are the potential impacts? • To the project • To the company • How are risks eliminated or mitigated? • Where do you first assess risks? What are some Quality Implications?

3. Desired Learning Objectives • Risk Assessment and mitigation/elimination is a management function • Why include Risk Assessment in proposal response? • How to identify and assess risks • How to monitor risks as the project proceeds • How failure to address risks can have serious impacts beyond the quality of the project performance NO! Your OTHER left … Roswell 250 miles

4. Risk Mitigation is a Management Function • Planning • Identify risk elements • Characterize impact (failure to mitigate) • Eliminate where possible by adjusting approach • Mitigate where elimination is impossible • Evaluation and Reassessment during execution • Plan revision • Staff supervision See Handout Risk Assessment Plan

5. Understanding Risk • What can go wrong? • How likely is it? • What are the consequences? • How can the risk be eliminated or mitigated? Four Principal Questions:

6. Risk Defined Example Types of Risks: • Low probability and high consequence • Frequent events and low consequences • Moderate probability and moderate consequences • Very low probability and very high consequences What type of risks get the most publicity? What types of risks most often affect project performance? What types of risks are the most demanding to identify for experimental programs?

7. Two Categories of Risk • Project Risks • Technical • Financial • Schedule • Company Risks • Safety • Security • Small Business Requirements

8. Assessing and Mitigating Project Risk • Performance Risk • Is desired outcome clear? • Does customer recognize risk? • What confidence objective can be met? • Cost Risk • Is the approach in each task clear enough to price with confidence? • Does our approach allow an adequate management reserve? • Schedule Risk • Does PM control all elements effecting the schedule? • Is there adequate lag time before each milestone?

9. Characterizing and Tracking Risks • Identified risks should be assessed in two dimensions • Likelihood of Occurrence • How likely is it that this risk will actually happen? • Impact of Occurrence • How drastically will project be affected if the risk does occur? • Both dimensions typically assessed using high/medium/low categories • Overall assessment determined by combining the two dimensions • Risk with an overall assessment of medium or high should have a risk mitigation plan

10. Elements of a Risk Mitigation Plan • Risk Name & Description • Briefly describe the risk and identify it as one or more types (e.g. cost, schedule, technical, safety, security, etc.) • Assessment • Identify likelihood of occurrence as high, medium or low • Defend assessment with 1-2 sentences/bullets • Identify likelihood of occurrence as high, medium or low • Defend assessment with 1-2 sentences/bullets • Mitigation Plan • Describe the steps to be taken now that will reduce the likelihood of the risk occurring • Describe the steps to be taken now that will reduce the impact if the risk does occur • Indicator/Observation Plan • Describe key triggers that will indicate the identified risk has occurred or is about to occur • Contingency Plan • Describe the work around to be performed after the risk does occur

11. Example: Cost Overrun Risk • Risk name: cost overrun on CPFF effort • Assessment: high • Effort divided between three divisions and a subcontractor • Customer has only vaguely defined expectations • Impact: high • Customer will have to seek additional funds or reduce requirements • Will reduce fee percentage • Mitigation Plan • Work with customer to establish expectations within budget • Provide clear requirements, budget and schedule to each division and subcontractor • Track cost/performance monthly • Assure separate phase in BST for each performer/task • Establish milestones and associated costs with Task Leaders • Indicator/Observation Plan • Look for significant cost or schedule variance by task • Contingency Plan • Reserve a portion of the budget for contingencies (Management Reserve)

12. Who is Responsible for Risk Reduction Activities? • What process will you use to periodically assess the status of your proposed risk reduction action plans? • How and how often will you communicate the progress to the customer? Communicate in your proposal how your management approach addresses the cost, schedule and performance risks

13. What are Some Things that Can Go Wrong? • Communication • Large staff, including multiple divisions • Solve the wrong problem (generally task and subtask level) • Staff Changes • New project absorbs your key staff, staff turnover • Staff preoccupied with other “higher priority” short-term projects • Underestimate effort needed to develop/use computer models • Using new models • New bugs found in current models • Model needs to be adapted – new code written, integrated and tested

14. What are Some Things that Can Go Wrong? (cont.) • Equipment breakdowns • Accessibility to site, data, other models • Takes longer than expected to get clearances • Customer • CTR is replaced by new person • On VERTEC’s ARTS program, 4 CTRs and 5 COs in five years and numerous logistics and engineering POCs changes – increased risk • Requirements change • Customer is non-responsive to needed decisions

15. Assessing and Mitigating Company Risk • Safety Risk • Are personnel or property exposed to hazards? • Can these hazards be avoided by revising approach? • Can remaining hazards be successfully mitigated? • Security Risk • Are we physically equipped to meet security requirements? • Are our personnel adequately trained? • Do we have a plan for comprehensive review? • Subcontractor Risk • Geographical separation, lack of adequate cost/schedule/performance feedback, lack of timely billing, etc. • Is our approach compatible with contract SB requirements and with company SB plan requirements?

16. Costs to Recover from Major Quality Problems ARA Milestones Project Plan 35% Review 65% Review Deliverables Review 4 3 Costs to Fix Major Quality Problems 2 Project Team Meetings, Reviews 1 “Kickoff” Meeting     0 20 40 60 80 100% Time Error Detected/Project Period of Performance “Project staff must identify and fix errors, oversights and poor design problems early.”

17. Why Include Risk Assessment in Proposal Response? • Often required in large procurements • Demonstrates and understanding of processes necessary to meet procurement requirements • Associated uncertainties that can impact quality, cost and schedule • Allows incorporation of risk mitigation in technical and management approach • Structure approach to eliminate or minimize significant risks • Include contingencies for conditions beyond control • Allows client recognition of risks and acknowledgement of potential outcomes

18. Summary • Risk assessment/mitigation is a management function • Risks can have impact well beyond the life of a project • Risk assessment and development of mitigation plan at proposal stage provides client confidence you can meet requirements on schedule and within budget • Allows client recognition of factors beyond control • Affects likely quality of final product • Early risk mitigation provides lowest cost • Importance of milestones