entering the danger zone: the art of risk management cindy margules, pmp pmo director, convio ...

Entering the

Danger Zone:

The Art of Risk

Management

Cindy Margules, PMP

PMO Director, Convio

www.allposters.com

International Project Management Day

November, 2010

Cindy Margules, PMP Entering the Danger Zone November 2010

What is a risk? Risks are things / situations that MAY happenIssues are things / situations that are in progress

What is risk management?The processes involved with identifying, analyzing, and responding to project risk

Little known fact:Risk management is a time waster!

Risk management is proactive – effort not urgently neededIssue management is reactive – firefighting

Every noble acquisition is attended with its risks; he who fears to encounter the one must not expect to obtain the other. - Metastasio -

Risk Terminology


Quietly write on the paper given all the risks you can think of to the following situation. Additionally:

• In the upper left corner estimate the probability of the risk happening (1=low, 2=med, 3=high)

• In the upper right corner estimate the impact if the risk occurred (1=low, 2=med, 3=high)

Your project is to build a zoo. Success is defined as doors open March 1, with 35 different types of animals to view and the infrastructure to support 400 guests / hour average. What are risks that might keep you from being successful?

First Activity


Risk Management Knowledge Area

The objective is to increase the probability and impact of positive events and decrease that of negative events.

Risk Management Planning – deciding how to approach, plan, and execute the risk management activities for a project.

Risk Identification – determining which risks might affect the project and documenting their characteristics.

Quantitative Risk Analysis – numerically analyzing the effect on overall project objectives of identified risks.


Qualitative Risk Analysis – prioritizing risks for subsequent further analysis or action by assessing and combining their probability of occurrence and impact.

Risk Response Planning – developing options and actions to enhance opportunities, and to reduce threats to project objectives.

Risk Monitoring and Control – tracking identified risks, monitoring residual risks, identifying new risks, executing risk response plans, and evaluating their effectiveness throughout the project life cycle.

Risk Management Knowledge Area


SpecificQuantitative

Cause and effect

Typical Risk Example: “The tool recommended may not be approved.”

Good Risk Example: “If the tool recommended is not approved due to

cost, then the schedule will slip by 3 months to reevaluate a different tool.”

Writing a Risk


Typical:PM or other lead evaluates risks based on

experience

Benefits:QuickCovers “most” high risks (assumed)

Disadvantages:

Incomplete - does not utilize vast experience of team

Biased - dependant on one person, his / her take on history

which feeds type / amount / variety of inputs

and impacts, probabilities, mitigations

Skewed actions – less creative mitigations, reactionary and

may not be well thought out

Greater chance of risks becoming issues!!

Greater chance of risks becoming issues!!

Risk Assessments


Entire group in one room

Establish directive parameters charter, schedule, communication, etc may have leading question

Focused response sticky notes group writes as many as possible within 5 minute period

Categorize in silence, first person puts notes on board second person “groups” like notes and adds his continues through group – becomes “categories” one more time through to regroup exception – if same sticky note keeps going back and forth

(3 times) then is reproduced and located in both categories

Clarify, Capture

Formal Risk Assessments


Detailed analysis:

Evaluate probability (L, M, H or 1,3, 9, or 1, 2, 3)o virtual certainty vs. more likely than not

Evaluate impact quantitatively (same) and qualitatively Determine risk total (P x I) - unacceptable, high, medium, low

Determine trigger Determine response plan

o avoid, accept, mitigate, transfero ownero timeframe

Contingency plan

COMMUNICATE – team, stakeholders, etc. … OFTEN!

Formal Risk Assessments - continued

Probability

HIGH 3 6 9

MEDIUM 2 4 6

LOW1 2 3

LOW MEDIUM HIGH

Impact

Add: mitigation

probability of working (L, M, H)


www.cartoonstock.com

avoid, accept, mitigate, or transfer?


Establish directive parameters charter, schedule, communication, etc create web survey with focused leading questions

Establish the time frame (one week to complete)

Focused response: no communication between team members additional inputs requested

Categorize: Review in core team each risk – clarify Group into categories – regroup / re-categorize Evaluate probability; impact; status (uhml) – group buy-in Determine trigger Determine response plan

o Avoid, accept, mitigate, transfero Owner, timeframe

Non Co-located Formal Risk Assessments


ID Risk

Probability Rating(1-3)

Impact Rating (1 - 3)

RiskRating (1 - 9)

Impact Description

Contingency Plan

Mitigation Action

Probability Mitigation Will Work

Action

OwnerDate Last Reviewed

CurrentStatus

1 Rain 2 2 4 slow traffic

leave 30 minutes

early

check weather

night before H me 23Jun09 ok

Excel Formal Risk Logs


Revisit risk analysis often and with different objectives

Assumptions / Requirements


who, what, where, when, why, how

For understanding Risk Management (the process) …

5Ws and the H

and to utilize in the detailed evaluations of individual risks


What are the risksWhat are the best ways to comprehend themWhat are your stakeholders / customers / team

members concerned about

How to find risksHow to run a risk analysisHow to mitigate risksHow to prioritize risksHow to store risk assessments, changes, status

Risk Management Process


When should you look for risksWhen should you mitigate the risksWhen should people be informed of, and changes to, the risks

Where should you conduct analysisWhere should you share and store the information

Who should have the informationWho is the owner of the riskWho should you utilize to ensure your risks are thoroughWho should you inform of changes

Why is it a risk - probability and impact

Risk Management Process


cost, schedule, quality

critical resource personnel availability

non-human resources not functioning

different motivations

objectives / business goals

requirements

gossip

mitigation not working / coverage of mitigation

assumptions

unplanned work

process maturity

communication paths

Leading Question Categories


lost information, ignored or misunderstood email

poor documentation

utilize non team members, SMEs, customer

SWOT – strengths, weaknesses, opportunities, threats

positive risks

improvements

organizational barriers

risk of senior management not buying into proposed

solution

non-participation

multitasking

other projects impacting

5ws and the h

Leading Question Categories - continued


Communication!

Risks changewording, probability, impact, status, closure, triggers,

responses, ownership, timeframe, etc.

Less risks become issues

More time for quality work / reasonable workweek

Project efficiency – significant cycle time reduction

Most important business reasons …

Increased Profitability and Customer Satisfaction

Best Reasons for Formal Risk Analysis


Review top risks daily

Escalation

Change management

Resources

It takes a strategic mindset to focus on risks over issues

or other items that take up your time

Control / Governance

NOT the problem!


Skeptical team members

PM did this for client in-depth planning:• Took about 1 – 1.5 hours the first day • Additional time added the second day since the client

found it so valuable• Client talked about how important this activity was

(although they weren’t sure about it at first)• Client requested PM lead this same type of activity

for the Partners• PM actively managing her risk log for this

engagement

Next slides can be cut / paste into presentation for a Risk Analysis

Successes


What is a Risk?

Anything that could potentially happen on a project that would impact its timing, budget, quality or overall success

Risks/Opportunities can either positively or negatively impact your project

Example: Your tire may have a blowout on your upcoming trip.

What is a Mitigation Plan?

A plan to avoid or reduce the impact or probability (or both) of a specific risk or exploit an opportunity

Example: You buy new tires.

(Decreased probability – NOT impact)

Risk Management Overview


What is an Issue?

An issue is a risk or event that has already occurred.

What is a Contingency Plan?

A pre-prepared action plan created if an identified risk turns into an issue anyway (usually for high risks)

Example: You buy a medical emergency kit and put it in your trunk.



Why is Risk Management Important?• Empowers us to think proactively over the lifecycle of the

project

• Allows us to plan for the future success of the project

• Identifies those risks that are the most likely to occur and present the greatest impact to the project

• Gives us an opportunity to develop a mitigation plan to avoid a risk turning into issue

• Gives us an opportunity to develop a contingency plan to act when a risk becomes an issue



SpecificQuantitative

Cause and effect

Typical Risk Example: “The tool recommended may not be approved.”

Good Risk Example: “If the tool recommended is not approved due to

cost, then the schedule will slip by 3 months to reevaluate a different tool.”

Writing a Risk


Description of Risk

Risk Probability Ranking

Risk Impact Ranking

Risk Probability - chance that risk will occur

• 1 – Small (0 – 25%)• 2 – Medium (26 – 74%)• 3 – Large (75 – 100%)

Risk Impact • 1 – Minor Impact • 2 – Significant Impact• 3 – Huge Impact /

Deal Breaker

No talking and write legibly PLEASE!

Possible Owner

Your Name

(you may want to first use an example to discuss with group to determine individual’s different perceptions)

Risk Management – Group Activity


In silence:• First person puts sticky notes on white board

(flip chart paper) their guess as to categories

• Second person adjusts categories, adds their risks (combining if required)

• Third person … until last.

• Re-review and categorize with marker (no miscellaneous / 1 – 2 re-categorize).

Risk Management - Group Activity


Probability

HIGH 3 6 9

MEDIUM 2 4 6

LOW1 2 3

LOW MEDIUM HIGH

Impact

After notes are agreed upon by team in categories, mark the categories on the back of the sticky notes.

Then, take the notes and re-decide as a group their probability and impact and place them in the appropriate boxes.

Risk Management – Group Activity


Next Steps

• The Project Manager enters the risks identified into a risk log and develops plans (with the team) for how to manage those risks

• Risks are reviewed individually and with the team OFTEN: To ensure new ones are captured Identify risks changing wording, impact, probability,

mitigation plans, contingency plans, dates, etc.

Risk Management - Group Activity


Thank you!Cindy Margules, PMP

Project Management Office Director, Convio

[email protected]

www.linkedin.com/in/cindymargules

http://www.convio.com/

entering the danger zone: the art of risk management cindy margules, pmp pmo director, convio ...

Documents

project risk

risk slide

risk monitoring

risk identification

risk management planning

risk management activities

quantitative risk analysis

risk response planning