RISK-944: Common Errors in Dealing with Project Risks

1. RISK-944: Common Errors in Dealing with Project Risks Joseph A. Lukas CCE, PE, PMP

2. Joe Lukas Biography Degree: • BS in Chemical Engineering University: • Syracuse University Years of Experience: • >30 years of experience Professional Field: • Project Management with specialties in scheduling, risk management, earned value and interpersonal skills Something you do not know about me: • Enjoy playing Pickleball at our Del Web Orlando community • Had a double by-pass operation in Sept-2010 with no prior risk factors (except hereditary)

3. Presentation Objectives Are you making any of the common errors in dealing with project risks? This talk will cover the top ten mistakes made in dealing with project risks This presentation will also discuss how to avoid these mistakes, along with effective risk techniques that should be used on projects

4. RISK = OPPORTUNITY & THREATS Risk Management Defined • Dictionary definition of Risk:possibility of loss or injury, or someone or something that creates or suggests a hazard • Project management definition of Risk:any uncertain event or condition that, if it occurs, has a positive or negative effect on a project’s objectives • Risk Management:process of identifying, analyzing, and responding to project risks – both positive and adverse events

5. Five Risk Management Processes 1. Prepare Risk Management Plan 2. Identify the Project Risks 3. Analyze the Project Risks 4. Plan Responses for Project Risks 5. Monitor & Control Risks

6. Top 10 Risk Errors Not considering opportunities Confusing risk causes, risk events & impacts Using checklists and not looking for other possible risk events Underestimating risk impacts Not using 100% probability during planning

7. Top 10 Risk Errors Not considering sensitivity with risks Calling risk response planning ‘mitigation’ Not considering contingency plans along with risk response plans Not making project team members responsible for specific risk events Not making risk management an on-going process

8. RISK = OPPORTUNITY & THREATS Mistake #1 Not Considering Opportunities – Just Threats • Risk Management is the process of identifying, analyzing, and responding to all project risks • Risks typically related to highly “chancy” or hazardous activities, but need to consider the probability and impacts with a goal to: • maximize for positive events • minimize for adverse events

9. Mistake #1 Not Considering Opportunities – Just Threats • Client example of risk management procedure being used to manage projects This procedure totally ignores opportunities!

10. Examples of Opportunities • Special pricing offered by a supplier • Competitive market conditions for a specific service • Sudden availability of a key resource due to another project being postponed • Availability of some needed equipment (such as servers or desktop computers) from another company downsizing their operations • Availability of a government investment tax credit for work done before a specified date

11. Mistake #2 Confusing risk causes, risk events & impacts • Common error during risk identification: failing to distinguish among the causes of risk, genuine risk events, and the impacts of risks • Result: • Makes the risk process less effective • Obscures some genuine risks

12. Causes-Risk Events-Impacts • Causes:Definite events or sets of circumstances that exist in the project or its environment and which give rise to uncertainty • Examples: • Doing a project in a developing country • Using unproven technology • Lacking skilled personnel

13. Causes-RiskEvents-Impacts • Risk Events:Uncertain activities that, if they occur, will affect the project objectives • Examples: • Exchange rate fluctuations • Contractor delivery • Client expectations misunderstood

14. Causes-Risk Events-Impacts • Impacts:Unplanned variations from project objectives (positive or negative) when a risk event occurs • Examples: • Milestone date missed • Budget under-run • Failure to meet performance target

15. Format:(1)Due to <cause>, <risk event> could occur, resulting in <impact> Causes-Risk Events-Impacts • Risks events have oneuniquedimension - uncertainty (described as “probability” or “likelihood” of occurrence”) • Need to maintain a clear separation between Causes, Risk Events, and Impacts (1)Project Risks, Identifying Causes, Risks and Effects, Dave Hillson, PMP, PM Network, September, 2000

16. Identified Risk Example Due to<the many job opportunities for top-notch electrical engineers>, <the loss of key project personnel> could occur, resulting in<higher costs and a longer schedule>

17. Identified Risk Example Due to<other systems projects underway>, <a lack of space to support the new process control software on existing servers> could occur, resulting in<the need to purchase a new server>

18. Identified Risk Example Due to<a lack of training resources>, <system start-up without the necessary training materials> could occur, resulting in<poor data quality because untrained users enter incorrect data>

19. Identified Risks Example IMPACTS CAUSE RISK EVENT Cost Func’t Qual Time Need to purchase equipment from foreign supplier Doing a project in a foreign country Lack of skilled equipment mechanics Exchange rate fluctuation Equipment held up in customs Problems installing hi-tech manufacturing equipment     

20. Identified Risks Example: IMPACTS CAUSE RISK EVENT Cost Func’t Qual Time Sharing senior software programmer between two projects Work overload Occurs   Using new software technology Unanticipated integration errors    

21. Risk Causes 1. 2. 3. 4. 5. 6. 7. Risk Identification Tool Keep risk causes on separate sheet Use Post-It notes set-up as shown to capture and analyze risks

22. Mistake #3 Using checklists and not ‘scanning the horizon’ for other risks • Checklists– listings of risk events typically encountered on a specific type of project, but often the team doesn’t consider what’s not on the list! • Brainstorming– free flow of ideas used to generate a listing of other potential risk events that may occur

23. Mistake #4 Understating risk impacts (and not scaling the impacts based on project drivers) • Four possible consequences to any risk event: • Cost • Schedule • Functionality • Quality • Need to look at largest impact in the four areas

24. Tools Knowledge Cost Time Scope: Needs and Expectations of Stakeholders Quality Skills Techniques Prioritize the Project Drivers

25. Cost Schedule Functionality Quality Very Small Very Small Issue Issue Sample Project Impact Scale Impact Value Major Issue Major Issue 10 5% variance 5% variance Medium Issue Medium Issue 8 4% variance 4% variance Minor Issue Minor Issue 6 3% variance 3% variance 4 2% variance 2% variance - - 2 1% variance 1% variance Need to consider relative importance of project impacts (are all impacts weighted equal?)

26. Weighted Project Impact Scale

27. Probability Description 1.0 Certain to occur (100%) 0.9 Almost certain to occur (>90%) 0.7 Highly likely (>70%) 0.5 Likely (>50%) 0.3 Low likelihood (<30%) 0.1 Very unlikely (<10%) 0.0 No chance Mistake #5 Not using 100% probability during planning

28. Mistake #5 Not using 100% probability during planning • Can have 100% probability during planning phase – but the Project Team needs to take actions to reduce it below 100% or somehow incorporate the item into the Project Plan • Example: due to the very heavy workload in the client area making key personnel unavailable, key requirements may be missed, resulting in… • What actions can be taken to reduce this risk event to <100% probability?

29. Mistake #6 Not Considering Sensitivity with Risk Analysis Risk Simulation • Improves project risk management by determining the biggest risks for risk response planning • Education tool for management to help them understand project • Also improves estimate (cost & schedule) accuracy and determine a contingency amount for an acceptable risk level

30. Time or $’s Time or $’s Risk Simulation Software • Risk analysis software provides: • Frequency of probable cost or schedule outcomes • Cumulative cost orschedule with overrun probabilities

31. Risk Simulation ‘Problem’ • Project team needs to assign most likely, optimistic and pessimistic values to each risk: • There is a BIGtendency to understate risk impact! • One option: define standards for risk ranges to minimize debate • Low = -5% to +10% • Medium = -10% to +50% • High = -20% to +100% • Very High = -30% to +300%

32. Mistake #7 Calling risk response planning ‘mitigation’ • Client example of risk management tool being used to manage projects This tool mistakes mitigation as being the only risk response action!

33. For Opportunities: • Exploit • Share • Enhance For Both: • Acceptance • Contingency Plans Risk Response Techniques For Threats: • Avoid • Transfer • Mitigate

34. Avoidance & Exploit • Avoidance: eliminating specific threats, usually by eliminating the cause • Exploit: Seeks to provide definitive causes that will eliminate uncertainty and allow the risk realization for an opportunity

35. Transfer & Share • Contractual agreements may be used to transfernegative risks to others • Allocating ownership to a third party who is best able to capture the opportunity for the benefit of the project is a shareexample

36. Mitigate & Enhance • Mitigate: reducing the risk factor by reducing the probability of occurrence and/or the risk event impact • Enhance: make the risk event more likely by increasing the probability of occurrence and/or the risk event impact

37. Acceptance • Applies to both opportunities and threats since seldom possible to eliminate all threats or take advantage of all opportunities • Can be passive acceptance– do nothing • Can be active acceptance- developing a contingency plan and/or reserve (time, money and/or resources)

38. Mistake #8 Not considering contingency plans along with risk response plans • Risk Actions for threats and opportunities are things done before the risk event occurs • Contingency plans are actions taken after the risk event occurs • Risk response planning should deal with both!

39. Example Risk Response Plan • Risk Event:Missing key project requirement • Expected Value:9.0 • Mitigation Plan:Include in resource plan activities & hours need by key resources; get management commitment to dedicate key personnel to project • Contingency Plan:If key resources not available, elevate issue to project sponsor

40. Example Risk Event Plan • Risk Event:System launch w/o training materials • Expected Value:5.6 • Mitigation Plan:Get management commitment to dedicate personnel to project (addresses probability) • Contingency Plan:Get proposal from vendor training companies to prepare materials, issue Purchase Order to vendor if personnel don’t start as promised

41. Mistake #9 Not making project team members responsible for specific risks • The Project Manager should involve the Project Team in owning project risks!

42. Mistake #10 Not making risk management an on-going process Not a one-time event!

43. Mistake #10 At each team meeting…. • Ask if any new risks on the horizon • Check to see if any risk triggers occurred • Update status on execution of risk plans • Update probability and impact values based on actions taken • Evaluate effectiveness of actions taken in managing risks

44. Conclusion • Watch for the common risk management mistakes outlined in this presentation • Establish a risk management procedure with supporting templates for your company – don’t leave it up to each Project Manager to ‘invent’ a process and/or tools

45. Questions? RISK-944: Common Errors in Dealing with Project Risks PMP, PE, CCE 863-583-5493 Joe.Lukas@PMcentersUSA.com Joseph A. Lukas