Risk Management

For Project Management

What is Risk?

• Risk (noun): possibility of loss or injury• (Merriam-Webster Dictionary)

Risk in Project Management

•A risk is something that may happen and if it does, will have an impact on the

project objectives.

May → possibilityImpact → lossObjectives → time, cost, performance,

quality, scope, client satisfaction.

Words in Risk Management

• Possibility → probability, likelihood

• Loss → impact

• Weakness → vulnerability

• Threat

• Control → countermeasure

• Residual Risk → the amount of risk that is left over when appropriate controls are properly applied to lessen or remove weakness

Risk Management Plan

• Risk Identification• Risk Quantification• Risk Response• Risk Monitoring and

Control

Risk Identification

Or Risk Assessment

• Threats to the project

• Weaknesses of the project environment

• The possibility that threat will make use of weakness

• The impact of the exposure (threat to weakness)

• Available controls

Risk Identification and SWOT

Factors affecting an organization (in this case, project) can usually be classified as:

• Internal factors

– Strengths (S)

– Weaknesses (W)

• External factors

– Opportunities (O)

– Threats (T)

Risk Identification Tools and Techniques

• Document Reviews

• Information Gathering

– Brainstorming

– Lessons Learned Database

– Other methods, some common techniques include: questionnaires and surveys, interviewing, checklists, and examination of the Work Breakdown Structure for the project with appropriate specialty groups, asking “what-if’ questions

Risk Identification Output

• Identification # for each risk identified

• Date and phase of project development when risk was identified

• Name of risk (does the risk pose a threat or present an opportunity?)

• Detailed description of risk event

• Risk trigger

• Risk type

• Potential responses to identified risk

• Comments about risk identification

Risk Identification Sheet Example

Risk Quantification

• Set Impact Level of the Project

– Impact Level to Cost

– Impact Level to Schedule

• Set Probability Level of the Project (could be organization standard)

• Set Risk Matrix (should be organizational standard)

Impact Level Example

• Project Value 10M

• Project Schedule 3 Months

Level Value Time

Very High > 5M > 1Mo

High 2M-5M 2W-1Mo

Medium 0.5M-2M 3d-2W

Low 0.1M-0.5M 1d-3d

Very Low <0.1M < 1d

Probability Level Example

Level Probability

Very High >90%

High 70%-90%

Medium 30%-70%

Low 5%-10%

Very Low <5%

Risk Matrix Example

•VH

•H

•M

•L

•VL

•VL •L •M •H •VH

Pro

babi

lity

Impact

Risk Response

Avoid: Do Something to Remove Transfer: Make Someone Else Responsible Reduce: Take Action to Lessen the Impact or

Possibility Accept

Risk Response: Rule

Cost of Risk Response (Avoid, Transfer or Reduce) must be less than the cost of impact.

Reduce Avoid

Accept Transfer

Severity

Pro

bab

ility

Risk Monitoring and Control

• Risk Audit

• Risk Reviews

• Risk Status Meetings and Reports