B U D I L U H U R U N I V E R S I T Y POST GRADUATE PROGRAM MAGISTER ILMU KOMPUTER (M.Kom)

1. B U D I L U H U R U N I V E R S I T Y POST GRADUATE PROGRAM MAGISTER ILMU KOMPUTER (M.Kom) IT PROJECT MANAGEMENT

2. PROJECT RISK MANAGEMENT Ruth Drayer

3. Project risk • An uncertain event or condition that, if it occurs, has a positive or negative effect on at least one projectobjective (time, cost, scope, quality) • May have one or more causes • May have one or more impacts • Risk conditions could include aspects of the project’s or organization’s environment that may contribute to project risk

4. Known risk • Identified & analyzed • A risk response generates by the project team as it is worth Unknown risk • Can not be managed proactively

5. PROJECT RISK MANAGEMENT PROCESSES

6. 1 PLAN RISK MANAGEMENT Deciding how to: • approach • conduct the risk management activities for a project The risk management planning process should be completed early during project planning process The level of detail will vary with the needs of the project

7. Questions Addressed in a Risk Management Plan (Schwalbe: ITPM Table 11-2).

8. Terms: Contingency plans are predefined actions that the project team will take if an identified risk event occurs Fallback plans are developed for risks that have a high impact on meeting project objectives Contingency reserves or allowances are provisions held by the project sponsor that can be used to mitigate cost or schedule risk if changes in scope or quality occur

9. PLAN RISK MANAGEMENT

10. PLAN RISK MANAGEMENTINPUT Project scope statement(see: scope definition) Project management plan(Cost; schedule; communication) Enterprise environmental factors • Policy statements express risk attitudes and tolerance Organizational process assets • Risk categories, risk tolerance • Templates • Roles and responsibilities, and authority levels of decision making

11. PLAN RISK MANAGEMENT TOOLS & TECHNIQUES Planning meetings & analysis • Project manager • Selected team members & stakeholders • Person in the organization with responsibility to manage the risk planning and execution

12. PLAN RISK MANAGEMENTOUTPUTS Risk management plan, includes: • Methodology: • approaches, tools, data sources to perform risk management • Roles & responsibility • Defines the lead, support, and risk management team membership for each type of activity, • Assignpeople to these roles • Clarifiestheir responsibilities

13. PLAN RISK MANAGEMENTOUTPUTS (cont) Risk management plan, includes (cont 1): • Budgeting: • Assigns resources • Estimates costs • Included in the project cost baseline • Timing: • When? • How often? • Establishes risk management acivities to be included in the project schedule • Risk categories: • Risk Breakdown Structure • Templates, based on previous projects

14. PLAN RISK MANAGEMENT OUTPUTS (cont) Risk management plan, includes (cont 2): • Definitions of risk probability & impact • Probability & impact matrix • Revised stakeholder tolerance • Reporting formats • Tracking (whether & how risk management processes will be audited)

15. PLAN RISK MANAGEMENTOUTPUTS: Risk Breakdown Structure

16. PLAN RISK MANAGEMENT OUTPUTS: Probability & Impact Matrix for 4 Project Objectives

17. Project Risk Management Worksheet Risk probability & level of impact: VL=very low; L=low; M=medium; H=high; VH=very high

18. 2 IDENTIFY RISK • Determining which risks might affect the project and documenting their characteristics • An iterative process; new risks may be known as the project progresses through its life cycle

19. IDENTIFY RISK

20. IDENTIFY RISK

21. IDENTIFY RISK INPUT Risk management plan • Assignments of roles & responsibilities • Provision for risk management acrtivities in the budget & schedule • Categories of risk Activity cost estimates Activity duration estimates

22. IDENTIFY RISK INPUT Scope baseline • Uncertainty in project scope statement Stakeholder register Project management plan • Schedule namagement plan • Cost management plan • Quality management plan

23. IDENTIFY RISK INPUT Project documents Enterprise environmental factors • Published information, commercial databases, benchmarking, industry/academic studies Organizational process assets • Lesson learned & actual data from previous project files

24. IDENTIFY RISK TOOLS & TECHNIQUES Documentation reviews Information gathering techniques • Brainstorming • Delphi technique • Root cause analysis • Interviewing: Experienced project participants; stakeholders; experts Checklist analysis Assumptions analysis

25. IDENTIFY RISK TOOLS & TECHNIQUES Diagramming Techniques • Cause & effect diagram • System / process flow diagram SWOT analysis Expert judgment

26. IDENTIFY RISK OUTPUTS Risk register • List of identified risk • List of potential responses

27. 3 PERFORM QUALITATIVE RISK ANALYSIS • Prioritizing risks for subsequent further analysis or action by assessing and combining their probability of occurrence and impact

28. Potential Risk Conditions Associated with Each Knowledge Area (Schwalbe: Table 11-5.)

29. PERFORM QUALITATIVE RISK ANALYSIS

30. PERFORM QUALITATIVE RISK ANALYSISINPUT Risk register List of identified risks Risk management plan • Roles & responsibilities for conducting risk management • Budget; schedule; probability & impacts matrix; • Stakeholders’ risk tolerances Project scope statement • Technology used (common / state of the art) Organizational process assets • Data about risks on past projects • Lessons learned knowledge base

31. PERFORM QUALITATIVE RISK ANALYSISTOOLS & TECHNIQUES Risk probability and impact assessment • Investigate the potential effect (neg or pos) on a project objective • Probability & impact are assessed for each identified risk. The level is evaluated during the interview or meeting. Probability and impact matrix • Ratings are assigned to risks based on their assessed probability and impact. Result: low or moderate or high risks. Risk rating rules can be tailored in the risk management planning

32. Probability & Impact Matrix Impact ( ratio scale) on an objective (e.g. cost, scope, time, quality = high risk = low risk

33. PERFORM QUALITATIVE RISK ANALYSISTOOLS & TECHNIQUES Risk data quality assessment • Require accurate and unbiased data Risk categorization • RBS & others Risk urgency assessment • Risk requiring near-term responses may be considered more urgent to address Expert judgment

34. PERFORM QUALITATIVE RISK ANALYSISOUTPUTS Risk register updates, includes • Relative ranking or priority list of project risk • Risks grouped by categories • List of risks requiring response in the near-term • List of risks for additional analysis and response • Watch lists of low priority risks • Trends in qualitative risk analysis results

35. 4 PERFORM QUANTITATIVE RISK ANALYSIS • Assess the likelihood and impact of identified risks to determine their magnitude and priority • Performed on risks that have been prioritized by the qualitative risk analysis process as potentially and substantially impacting the project competing demands • Large, complex projects involving leading edge technologies often require extensive quantitative risk analysis • Managers often perform quantitative risk analysis right after risk identification process • Should be repeated after risk response planning

36. PERFORM QUANTITATIVE RISK ANALYSIS

37. PERFORM QUANTITATIVE RISK ANALYSISINPUT Risk register • Identified risks • Relative ranking or priority list of project risk • Risks grouped by categories Risk management plan • Roles & responsibilities • Budget; schedule activity for risk management; • Probability & impacts matrix; • Stakeholders’ risk tolerances • Risk categories

38. PERFORM QUANTITATIVE RISK ANALYSISINPUT Project management plan • Schedule management plan • Cost management plan Organizational process assets • Similar completed projects information • Risk databases • Studies of similar projects by risk specialists

39. PERFORM QUANTITATIVE RISK ANALYSISTOOLS & TECHNIQUES Data gathering and representation techniques • Interviewing  probability & impact on project objectives • Probability distribution • Expert judgment Quantitative risk analysis and modeling techniques • Sensitivity analysis • Expected monetary value (EMV) analysis EMV = ∑ pi . Qi p = probability • Decision tree analysis a diagramming method used to help select the best course of action in situations in which future outcomes are uncertain

40. Quantitative risk analysis and modeling techniques • Modeling and simulation : a representation or model of a system to analyze the expected behavior or performance of the system • Monte Carlo analysis simulates a model’s outcome many times to provide a statistical distribution of the calculated results • To use a Monte Carlo simulation, you must have three estimates (most likely, pessimistic, and optimistic) plus an estimate of the likelihood of the estimate being between the optimistic and most likely values

41. Decision Tree Sumber: Schwalbe 2004

42. PERFORM QUANTITATIVE RISK ANALYSISOUTPUTS Risk register updates Updates includes : • Probabilistic analysis of the project • Probability of achieving cost and time objectives • Prioritized list of quantified risks • Trends

43. 5 PLAN RISK RESPONSES • Process of developing options, and determining actions to enhance opportunities and reduce threats to the project objectives • Planned risk response must be: • Appropriate to the significance of the risk • Cost effective in meeting the challenge • Timely • Realistic within the project context • Agreed upon by all parties involved • Owned by a responsible person

44. PLAN RISK RESPONSE

45. PLAN RISK RESPONSE INPUT Risk register • Identified risks • Root causes of risks • List of potential responses • Risk owners • Risk symptoms & warning signs Risk management plan • Roles and responsibilities • Risk analysis definitions • Risk thresholds for low, moderate, and high risk • Time & budget required to conduct project risk management

46. PLAN RISK RESPONSE TECHNIQUES Strategies for negative risk or threat • Avoid: changing the project plan to eliminate the threat posed by an adverse risk ( acquiring expertise, obtaining information, etc) • Transfer: shifting the consequence of a risk and responsibility for its management to a third party (insurance) • Mitigate: taking early action to reduce the probability of its occurrence

47. General riskmitigation strategiesfor technical, cost, and schedule risks Source: Schwalbe, ITPM 3rd ed

48. RISK RESPONSE PLANNINGTOOLS & TECHNIQUES Strategies for positive risks or opportunities • Exploit (ensure ) • Share (allocating ownership to a third party) • Enhance Contingent response strategies • Used only if certain events occur Expert judgment

49. PLAN RISK RESPONSE OUTPUTS Risk register updates Risk related contractual agreements • Agreements for insurance, services, etc Project management plan updates Project document updates

50. 6 MONITOR & CONTROL RISK • Monitoring risks involves knowing their status • Controlling risks involves carrying out the risk management plans as risks occur • Workarounds are unplanned responses to risk events that must be done when there are no contingency plans